---
title: "List flattened threat-intel indicators (IOCs)"
method: GET
path: "/api/intel/iocs"
tags: ["Intel"]
---

# List flattened threat-intel indicators (IOCs)

`GET /api/intel/iocs`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/intel/iocs`
- Auth: HTTP bearer

Flattens indicators from all in-scope intel items, resolves per-indicator hunt status, and supports server-side search, status, and type filtering with pagination.

## Query parameters

- `page` number
- `perPage` number
- `search` string
- `status` 'found' | 'clean' | 'unchecked' | 'unknown'
- `type` string

## Response `200`

Successful response

- object
  - `rows` object[], required
    - `id` string, required
    - `value` string, required
    - `type` string, required
    - `intelItemId` string, required
    - `intelTitle` string, required
    - `sourceLabel` string, required
    - `lastCheckedAt` string, nullable, required
    - `status` 'found' | 'clean' | 'unchecked' | 'unknown', required
  - `total` number, required
  - `page` number, required
  - `perPage` number, required
  - `hasNext` boolean, required
  - `statusCounts` object, required
    - `found` number, required
    - `clean` number, required
    - `unchecked` number, required
    - `unknown` number, required
  - `availableTypes` string[], required

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)