---
title: "Get Threat Feed Items (Deprecated)"
method: GET
path: "/threat-feed"
tags: ["deprecated"]
deprecated: true
---

# Get Threat Feed Items (Deprecated)

`GET /threat-feed`

> **Deprecated.**

**This endpoint is deprecated.** Use the [successor version](https://docs.socket.dev/reference/getorgthreatfeeditems) instead.

Paginated list of threat feed items.

This endpoint requires an Enterprise Plan with Threat Feed add-on. [Contact](https://socket.dev/demo?utm_source=api-docs&utm_medium=referral&utm_campaign=tracking) our sales team for more details.

This endpoint consumes 1 unit of your quota.

This endpoint requires the following org token scopes:
- threat-feed:list

## Query parameters

- `per_page` integer
- `page` string
- `sort` 'id' | 'created_at'
- `discovery_period` '1h' | '6h' | '1d' | '7d' | '30d' | '90d' | '365d'
- `direction` 'desc' | 'asc'
- `filter` 'u' | 'c' | 'fp' | 'tp' | 'mal' | 'vuln' | 'anom' | 'joke' | 'spy' | 'typo' | 'obf' | 'dual'
- `name` string
- `version` string
- `is_human_reviewed` boolean
- `ecosystem` 'github' | 'cargo' | 'clawhub' | 'composer' | 'chrome' | 'golang' | 'huggingface' | 'maven' | 'npm' | 'nuget' | 'vscode' | 'pypi' | 'gem' | 'swift'

## Response `200`

The paginated list of threats in the feed and the next page querystring token.

- object
  - `results` object[], required
    - `createdAt` string, date-time — ISO 8601 timestamp of when the threat in the package artifact was first discovered
    - `updatedAt` string, date-time — ISO 8601 timestamp of when the threat record for the package artifact was last updated (e.g., classification changed, package removed from registry, etc.)
    - `publishedAt` string, date-time, nullable — ISO 8601 timestamp of when the package artifact was published to the respective registry
    - `description` string — Detailed description of the underlying threat
    - `fileSha256` string, nullable — Hex-encoded SHA-256 hash of the malicious file content, usable as an indicator of compromise (IOC). Null when no file content hash is available for the threat.
    - `id` integer — Unique identifier of the threat feed entry
    - `locationHtmlUrl` string, uri — URL to the threat details page on Socket
    - `packageHtmlUrl` string, uri — URL to the affected package page on Socket
    - `purl` string — Package URL (PURL) of the affected package artifact
    - `removedAt` string, date-time, nullable — ISO 8601 timestamp of when the package artifact was removed from the respective registry, or null if the package is still available on the registry
    - `threatType` string — Threat classification. Possible values: `malware` (known malware), `possible_malware` (AI-detected potential malware), `vulnerability` (potential vulnerability), `typosquat` (human-reviewed typosquat), `possible_typosquat` (AI-detected potential typosquat), `anomaly` (anomalous behavior), `telemetry` (telemetry), `obfuscated` (obfuscated code), `dual_use` (dual-use tool), `troll` (protestware or joke package), `unreviewed` (not yet reviewed), `false_positive` (confirmed false positive).
    - `needsHumanReview` boolean — Whether the threat still is in need of human review by the threat research team
    - `threatInstanceId` integer — Unique threat instance identifier across artifacts
  - `nextPage` string, nullable, required

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `403` — Insufficient max_quota for API method
- `404` — Resource not found
- `429` — Insufficient quota for API route

---

[API](https://skmtc.dev/socket-dev/apis/socket.md) · [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/socket-dev/socket/revisions/bf994b75d33f/schema)