Index onlineMerchant portal
Api Endpoint

threat-ioc-enrichment

Type-agnostic threat-intelligence enrichment for a SOC or DFIR agent. Give one indicator of compromise of any kind — a file hash, IP, domain, URL or CVE id — and get one normalized, cited verdict. Auto-detects the type, dispatches to the right grain, fuses the sources and returns a verdict, an is_malicious flag, a confidence, malware family when known, per-source citations and reasons. Not a guarantee.

Open interactive test console

Offering

Provider
payai.agentstools.dev
Method
GET
Offering type
Api Endpoint
Transport type
http
Category
Security
Delivery
Not provided
Pricing model
Not provided
x402 version
2

Endpoint context

URL
https://payai.agentstools.dev/threat/ioc
MIME type
application/json
First seen
2026-10-16T02:01:07.550Z
Last seen
Tags
threat-intelligence, ioc, soc, dfir, malware, reputation, hash, IP, domain, url, cve, enrichment, triage, Security

Website

Payment pricing

x402 payment terms are the authoritative price for calling this endpoint.

Payment option 1
0.01 USDC
Atomic price: 10000 · Network: eip155:8453 · Asset: USDC · Scheme: exact
Payment option 2
0.01 USDC
Atomic price: 10000 · Network: solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp · Asset: USDC · Scheme: exact
Raw x402 terms
[
  {
    "scheme": "exact",
    "network": "eip155:8453",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "amount": "10000",
    "payTo": "0xF22e558a00D91Ee12A1F50C52186FecB8dDFf493"
  },
  {
    "scheme": "exact",
    "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
    "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
    "amount": "10000",
    "payTo": "AytHnvc6bZx1ALTy7b5Px7hcavoSYszG9aeKvDcZ8R1u"
  }
]

Observed health

Status
Healthy
Latest latency
400 ms
Average latency
1020 ms
HTTP status
402
Last checked
Reachability
100% over 11 checks

Latency is measured to the first response headers. A reachable result does not verify response accuracy or merchant identity.

Input schema

{
  "type": "object",
  "properties": {
    "type": {
      "type": "string",
      "const": "http"
    },
    "method": {
      "type": "string",
      "enum": [
        "GET",
        "HEAD",
        "DELETE"
      ]
    },
    "queryParams": {
      "type": "object",
      "properties": {
        "indicator": {
          "type": "string",
          "description": "The indicator of compromise: a file hash (md5/sha1/sha256), IP, domain, URL or CVE id"
        },
        "type": {
          "type": "string",
          "description": "Optional type override; auto-detected if omitted",
          "enum": [
            "md5",
            "sha1",
            "sha256",
            "hash",
            "ip",
            "ipv4",
            "ipv6",
            "domain",
            "url",
            "cve"
          ]
        }
      },
      "required": [
        "indicator"
      ]
    }
  },
  "required": [
    "type",
    "method"
  ],
  "additionalProperties": false
}

Output schema

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "input"
  ],
  "properties": {
    "input": {
      "type": "object",
      "required": [
        "type",
        "method"
      ],
      "properties": {
        "type": {
          "type": "string",
          "const": "http"
        },
        "method": {
          "enum": [
            "GET",
            "HEAD",
            "DELETE"
          ],
          "type": "string"
        },
        "queryParams": {
          "type": "object",
          "required": [
            "indicator"
          ],
          "properties": {
            "type": {
              "enum": [
                "md5",
                "sha1",
                "sha256",
                "hash",
                "ip",
                "ipv4",
                "ipv6",
                "domain",
                "url",
                "cve"
              ],
              "type": "string",
              "description": "Optional type override; auto-detected if omitted"
            },
            "indicator": {
              "type": "string",
              "description": "The indicator of compromise: a file hash (md5/sha1/sha256), IP, domain, URL or CVE id"
            }
          }
        }
      },
      "additionalProperties": false
    },
    "output": {
      "type": "object",
      "required": [
        "type"
      ],
      "properties": {
        "type": {
          "type": "string"
        },
        "example": {
          "type": "object"
        }
      }
    }
  }
}