Security Bundle
7 endpoints for threat intelligence and malware scanning — URL, file-hash, and indicator reputation plus in-memory YARA file scanning.
For security teams, SOC analysts, and AI agents triaging URLs, files, and indicators against free, abuse-resistant threat data.
Endpoints in this bundle
Each endpoint is independently callable. Bundle membership is for discovery only — you do not need to opt in.
| Method | Endpoint Path | Credits | Operation Summary |
|---|---|---|---|
| POST | /v1/intel/url-reputation | 1 cr | Is a URL (or its host) a known phishing/malware URL? Matched against a free feed; we never fetch the URL. |
| POST | /v1/intel/hash-reputation | 1 cr | Look a SHA-256/SHA-1/MD5 up against a known-malware corpus. Only the hash is sent — never a file. |
| POST | /v1/intel/threat | 1 cr | One indicator (IP, domain, URL, or hash) returns a combined threat verdict across the free sources. |
| POST | /v1/scan/file | 2 cr | Scan an uploaded file with YARA, in-memory and never stored; built-in rules plus your own. |
| POST | /v1/intel/blacklist | 1 cr | Check an IP or domain against major DNSBL blocklists. |
| POST | /v1/intel/ip-reputation | 1 cr | Classify an IP — datacenter, cloud range, or Tor exit. |
| POST | /v1/intel/ssl | 1 cr | Inspect a host live TLS certificate — issuer, SANs, expiry. |
Triage an unknown indicator
Recommended step-by-step workflow sequence for composing these endpoints in production:
Send the indicator (IP, domain, URL, or file hash) to /v1/intel/threat for a one-call combined verdict across the free threat sources.
For a URL specifically, call /v1/intel/url-reputation to see the phishing/malware feed match and host-level context.
For a file in hand, hash it and call /v1/intel/hash-reputation; if it is unknown, upload the bytes to /v1/scan/file for an in-memory YARA scan.
Enrich an IP with /v1/intel/ip-reputation (datacenter/Tor) and /v1/intel/blacklist (DNSBL) before allow/deny decisions.
Try a request
Pick a language. Copy-pasteable code snippet configured with your standard Bearer token header.
curl -X POST https://api.ollagraph.com/v1/intel/threat \
-H "Authorization: Bearer $OLLAGRAPH_API_KEY" \
-H "Content-Type: application/json" \
-d '{"indicator":"185.39.181.103"}'import httpx, os
r = httpx.post(
"https://api.ollagraph.com/v1/intel/threat",
headers={"Authorization": f"Bearer {os.environ['OLLAGRAPH_API_KEY']}"},
json={"indicator": "185.39.181.103"},
timeout=30.0,
)
print(r.json())const res = await fetch("https://api.ollagraph.com/v1/intel/threat", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.OLLAGRAPH_API_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({ indicator: "185.39.181.103" }),
});
console.log(await res.json());Security bundle FAQ
Common questions about rate limits, execution behavior, and parameters for this workflow.
Where does the threat data come from?
Free, reputable open threat feeds, refreshed on a schedule — no paid intel subscriptions, consistent with our free-data-only model, so there are no surprise per-lookup vendor costs.
Do you store files I scan?
No. /v1/scan/file decodes and scans the bytes in memory and discards them — nothing is written to disk or retained. Hash lookups send only the hash, never the file.
Is this an abuse vector?
No. These are defensive, read-only lookups — no port scanning, no mass enumeration, no breach data. URL reputation never fetches the URL, and file scanning is size-capped and rate-limited.
Ship with the Security bundle.
1,000 credits on signup. No card. Every endpoint in this bundle is live from minute one.