---
title: "STIX 2.1 Indicator-of-Compromise feed"
method: GET
path: "/trust/iocs"
tags: ["Trust"]
---

# STIX 2.1 Indicator-of-Compromise feed

`GET /trust/iocs`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/trust/iocs`
- Auth: none required

Public IoC feed returned as a STIX 2.1 Bundle. Per-indicator SDOs carry a Mnemom `extensions` block with internal type/TLP labelling. Rate-limited at the gateway and best-effort in-handler (1 req/min/IP). Pagination via `after=<ISO8601>` (resume from the last seen `last_seen_at`).

## Query parameters

- `type` 'substrate_fingerprint' | 'sha256' | 'domain' | 'url' | 'technique_id'
- `after` string, date-time
- `limit` integer

## Response `200`

STIX 2.1 Bundle (possibly empty at GA — see calm-at-GA contract).

- object
  - `type` 'bundle', required
  - `id` string, required: STIX 2.1 bundle identifier (UUID-suffixed).
  - `objects` object[], required: STIX 2.1 indicator SDOs. Each carries a Mnemom extension with the internal indicator type + TLP + linkage to a related advisory.
  - `next_after` string, date-time: Mnemom-extension pagination cursor. Present iff the response was capped at `limit`. Pass as `?after=` to fetch the next page.

## Other responses

- `400`: Bad request
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)