---
title: "Discover infrastructure related to one indicator"
method: POST
path: "/v1/metered/ioc-pivot"
tags: ["Threat intelligence"]
---

# Discover infrastructure related to one indicator

`POST /v1/metered/ioc-pivot`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/ioc-pivot`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

Given one known-malicious indicator, returns every related indicator sharing the same malware family -- surfacing a full C2 network from a single starting point.

**Billing.** $0.20 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

## Request body

- object: At least one of: `ioc`, `ioc_value`.
  - `ioc` string: The indicator to pivot from.
  - `ioc_value` string: Accepted as an alias for `ioc`. Use `ioc` for new integrations.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `ioc_value` string: The normalised pivot indicator.
    - `matched` boolean: False when the pivot indicator is not in the corpus. `related` is then empty.
    - `pivot_on` 'malware_family' | 'source_feed': What the pivot was performed on. Falls back to source feed when the seed carries no malware family.
    - `pivot_value` string: The family or feed name pivoted on.
    - `seed_ioc_type` string: Indicator type of the seed.
    - `seed_source` string: Feed or channel the seed came from.
    - `seed_malware` string: Malware family of the seed. Empty when unattributed.
    - `related_count` integer: Total related indicators found.
    - `related` object[]: Up to 50 related indicators.
      - `ioc_value` string: The indicator itself.
      - `ioc_type` string: Indicator type: ip, domain, url, hash, email, wallet, image_text.
      - `source` string: Feed or criminal channel it was observed in.
      - `malware` string: Malware family it was observed alongside, lowercase. Empty when unattributed.
      - `last_seen` string: Most recent sighting timestamp.

## Other responses

- `400`: `ioc` (or `ioc_value`) is missing or empty, or the corpus lookup failed.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)