Delta sync since a high-water mark ID
Fetch threat signatures added since last_id (exclusive).
Recommended sync pattern for EDR sensors, honeypots, and agents that don't need sub-second latency:
- Call with last_id=0 on first run
- Persist the returned next_id
- On subsequent calls pass next_id as last_id
- If count == batch_size, call again immediately to drain backlog
next_id always advances to the highest fetched id, even for rows filtered out by min_confidence — the cursor is positional, not content-based.
Rate limit: 200 requests/minute per IP.
get/v1/threats/since/{last_id}
Request
- Base URL: https://nullcone.ai/api
- URL: https://nullcone.ai/api/v1/threats/since/{last_id}
- Auth: none declared
Path parameters
last_idinteger required
Query parameters
batch_sizeinteger
min_severityinteger
min_confidencenumber
Filter to confidence_score ≥ this value. next_id still advances past filtered-out rows.
Response
Successful Response
unknown required
Changes
No recorded changes to this operation across all 1 revision of this API.