---
title: "Delta sync since a high-water mark ID"
method: GET
path: "/v1/threats/since/{last_id}"
---

# Delta sync since a high-water mark ID

`GET /v1/threats/since/{last_id}`

## Request

- Base URL: `https://nullcone.ai/api`
- URL: `https://nullcone.ai/api/v1/threats/since/{last_id}`
- Auth: none declared

Fetch threat signatures added since `last_id` (exclusive).

Recommended sync pattern for EDR sensors, honeypots, and agents that
don't need sub-second latency:
1. Call with `last_id=0` on first run
2. Persist the returned `next_id`
3. On subsequent calls pass `next_id` as `last_id`
4. If `count == batch_size`, call again immediately to drain backlog

`next_id` always advances to the highest fetched id, even for rows
filtered out by `min_confidence` — the cursor is positional, not content-based.

Rate limit: 200 requests/minute per IP.

## Path parameters

- `last_id` integer, required

## Query parameters

- `batch_size` integer
- `min_severity` integer
- `min_confidence` number: Filter to confidence_score ≥ this value. next_id still advances past filtered-out rows.

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/nullcone/apis/nullcone-api.md) · [All operations](https://skmtc.dev/nullcone/apis/nullcone-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nullcone/apis/nullcone-api/revisions/c00983c87271?raw)