---
title: "Enrich up to 100 indicators in one call"
method: POST
path: "/v1/metered/bulk-ioc"
tags: ["Threat intelligence"]
---

# Enrich up to 100 indicators in one call

`POST /v1/metered/bulk-ioc`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/bulk-ioc`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

Built for SIEM log-enrichment pipelines. Submit up to 100 indicators of any type and get malware family, threat actor, confidence and first/last seen for each. Priced per batch, not per indicator.

**Billing.** $0.50 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

**Note.** A single indicator whose lookup fails is returned with `matched: false` and `error: query_failed` rather than failing the batch.

## Request body

- object
  - `iocs` string[], required: 1 to 100 indicators. Values are lowercased and trimmed; empty entries are dropped.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `queried` integer: Indicators actually processed after dropping empties.
    - `matched` integer: Indicators found in the corpus.
    - `results` object[]: One entry per indicator, in the order supplied.
      - `ioc_value` string: The normalised indicator.
      - `matched` boolean: True when found in the corpus.
      - `ioc_type` string: Indicator type. Present only on a match.
      - `source` string: Feed or channel it was seen in. Present only on a match.
      - `malware` string: Malware family. Present only on a match.
      - `threat_actor` string: Attributed actor. Present only on a match.
      - `confidence_score` number: 0.0 to 1.0. Present only on a match.
      - `first_seen` string: Earliest sighting. Present only on a match.
      - `last_seen` string: Most recent sighting. Present only on a match.
      - `hit_count` integer: Distinct sightings, capped at 5. Present only on a match.
      - `error` string: `query_failed` when this one indicator's lookup errored. Present only on failure.

## Other responses

- `400`: `iocs` is missing, not a list, empty, or holds more than 100 entries.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)