---
title: "POST /indicator-context"
method: POST
path: "/indicator-context"
tags: ["check"]
---

# POST /indicator-context

`POST /indicator-context`

## Request body

- IndicatorTarget
  - `type` 'ip' | 'domain' | 'url' | 'hash', required
  - `value` string, required

## Response `200`

Existing evidence with optional, separately metered context qualification

- IndicatorContextResponse
  - `analysis` ContextAnalysis, required
    - `mode` 'jev' | 'deterministic', required
    - `modelVersion` string, nullable
    - `questionnaireVersion` string, required
    - `reason` string, nullable
  - `contexts` ContextItem[], required
    - `description` string, nullable
    - `descriptionTruncated` boolean, required
    - `exactMention` boolean, required
    - `fetchedAt` string, nullable
    - `id` string, required
    - `modifiedAt` string, nullable
    - `qualification` 'jev' | 'deterministic', required
    - `references` string[], required
    - `role` 'attack_infrastructure' | 'victim' | 'analysis_reference' | 'indeterminate', required
    - `sourceUrl` string, required
    - `tags` string[], required
    - `title` string, required
    - `topic` 'phishing' | 'malware_distribution' | 'c2' | 'scanning' | 'spam' | 'other' | 'indeterminate', required
    - `utility` 'indicator_specific' | 'campaign_context' | 'uninformative' | 'insufficient', required
  - `facts` ContextFact[], required
    - `id` string, required
    - `kind` string, required
    - `references` string[], required
    - `scope` 'ip' | 'domain' | 'url' | 'hash', required
    - `source` string, required
    - `subject` string, required
    - `value` string, required
  - `limitations` string[], required
  - `status` 'available' | 'insufficient' | 'unavailable', required
  - `target` IndicatorTarget, required
    - `type` 'ip' | 'domain' | 'url' | 'hash', required
    - `value` string, required

## Other responses

- `400` — Invalid indicator
- `401` — Invalid credentials
- `429` — Report access rate limit

## Changes

- **2026-09-23** `edb544398108` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/indicator-context/post.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/edb544398108?raw)