---
title: "Recent threat signatures"
method: GET
path: "/v1/threats"
---

# Recent threat signatures

`GET /v1/threats`

## Request

- Base URL: `https://nullcone.ai/api`
- URL: `https://nullcone.ai/api/v1/threats`
- Auth: none declared

Return the most recently seen threats, optionally filtered by type, severity and confidence.

`ioc_type` was silently ignored before 2026-09-15, so `?ioc_type=prompt` returned
IPs and hashes — the Claude Code plugin's search_by_type depended on it.

**Confidence tiers:**
- `unverified` (< 0.50): raw single-source IOCs
- `community`  (0.50–0.69): community-sourced, reasonable signal
- `validated`  (0.70–0.84): Pro tier — curated, low noise
- `enterprise` (≥ 0.85): multi-confirmed authoritative feed IOCs

## Query parameters

- `limit` integer
- `min_severity` integer
- `min_confidence` number: Minimum confidence_score (0.0–1.0). 0.7+ = validated tier (Pro). 0.85+ = enterprise.
- `ioc_type` string, nullable: Only this IOC type, newest first (e.g. prompt, skill, domain, ip, url, hash_sha256).

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/nullcone/apis/nullcone-api.md) · [All operations](https://skmtc.dev/nullcone/apis/nullcone-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nullcone/apis/nullcone-api/revisions/c00983c87271?raw)