---
title: "Submit a single IOC"
method: POST
path: "/v1/ioc"
---

# Submit a single IOC

`POST /v1/ioc`

## Request

- Base URL: `https://nullcone.ai/api`
- URL: `https://nullcone.ai/api/v1/ioc`
- Auth: none declared

Submit an IOC to the shared threat intelligence database.

The gateway classifies the IOC into a malware family, compresses metadata,
and deduplicates atomically. All subscribed agents receive the new/updated
IOC instantly via WebSocket.

Include `X-Agent-Id` header to track per-agent contribution stats and apply
per-agent daily quota (default: 5,000 IOCs/day).

Rate limit: 60 requests/minute per IP.

## Request body

- IOCSubmit
  - `ioc_type` string, required
  - `value` string, required
  - `severity` integer
  - `confidence` integer
  - `family_hint` string, nullable
  - `context` string
  - `tags` string[]
  - `source` string

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/nullcone/apis/nullcone-api.md) · [All operations](https://skmtc.dev/nullcone/apis/nullcone-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nullcone/apis/nullcone-api/revisions/c00983c87271?raw)