SOsocket-dev
threat-campaigns

List threat campaigns

Returns a paginated list of supply chain attack campaigns. Supports filtering by status, ecosystem, and an incremental sync parameter (updated_after).

Package PURLs are not inlined on the campaign object — they are their own paginated resource. Fetch them per campaign from /threat-campaigns/:campaign_id/packages.

Authentication: Organization API token, OAuth2, or NextAuth session. Required token scope: threat-campaigns:list.

This endpoint requires an Enterprise Plan with the Threat Feed add-on.

get/v1/orgs/{org_slug}/threat-campaigns/

Request

  • The document declares no server URL.
  • Auth
    HTTP bearer

Path parameters

org_slugstring required

Organization slug

Query parameters

status'ongoing' | 'past'

Filter by campaign status. Defaults to ongoing.

ecosystemstring

Filter by ecosystem (e.g. npm, pypi, maven).

updated_afterstring

Unix timestamp in seconds. Only return campaigns updated after this time. Omit to return all matching campaigns.

per_pageinteger

Number of campaigns per page. Default 30, max 100.

cursorstring

Opaque cursor for pagination. Use the endCursor value from the previous response.

Response

Default Response

endCursorstring nullable

Changes

No recorded changes to this operation across all 1 revision of this API.