All bundles Security bundle · 7 endpoints

Security

7 endpoints for threat intelligence and malware scanning — URL, file-hash, and indicator reputation plus in-memory YARA file scanning.

For security teams, SOC analysts, and AI agents triaging URLs, files, and indicators against free, abuse-resistant threat data.

Endpoints in this bundle

Each endpoint is independently callable. Bundle membership is for discovery only — you do not need to opt in.

Method	Path	Credits	Summary
POST	/v1/intel/url-reputation	1	Is a URL (or its host) a known phishing/malware URL? Matched against a free feed; we never fetch the URL.
POST	/v1/intel/hash-reputation	1	Look a SHA-256/SHA-1/MD5 up against a known-malware corpus. Only the hash is sent — never a file.
POST	/v1/intel/threat	1	One indicator (IP, domain, URL, or hash) returns a combined threat verdict across the free sources.
POST	/v1/scan/file	2	Scan an uploaded file with YARA, in-memory and never stored; built-in rules plus your own.
POST	/v1/intel/blacklist	1	Check an IP or domain against major DNSBL blocklists.
POST	/v1/intel/ip-reputation	1	Classify an IP — datacenter, cloud range, or Tor exit.
POST	/v1/intel/ssl	1	Inspect a host live TLS certificate — issuer, SANs, expiry.

Recipe

Triage an unknown indicator

Send the indicator (IP, domain, URL, or file hash) to /v1/intel/threat for a one-call combined verdict across the free threat sources.
For a URL specifically, call /v1/intel/url-reputation to see the phishing/malware feed match and host-level context.
For a file in hand, hash it and call /v1/intel/hash-reputation; if it is unknown, upload the bytes to /v1/scan/file for an in-memory YARA scan.
Enrich an IP with /v1/intel/ip-reputation (datacenter/Tor) and /v1/intel/blacklist (DNSBL) before allow/deny decisions.

Sample code

Try a request

Pick a language. Click to expand the snippet.

curl

curl -X POST https://api.ollagraph.com/v1/intel/threat \
  -H "Authorization: Bearer $OLLAGRAPH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"indicator":"185.39.181.103"}'

python

import httpx, os

r = httpx.post(
    "https://api.ollagraph.com/v1/intel/threat",
    headers={"Authorization": f"Bearer {os.environ['OLLAGRAPH_API_KEY']}"},
    json={"indicator": "185.39.181.103"},
    timeout=30.0,
)
print(r.json())

node

const res = await fetch("https://api.ollagraph.com/v1/intel/threat", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.OLLAGRAPH_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ indicator: "185.39.181.103" }),
});
console.log(await res.json());

FAQ

Security bundle FAQ

Where does the threat data come from?

Free, reputable open threat feeds, refreshed on a schedule — no paid intel subscriptions, consistent with our free-data-only model, so there are no surprise per-lookup vendor costs.

Do you store files I scan?

No. /v1/scan/file decodes and scans the bytes in memory and discards them — nothing is written to disk or retained. Hash lookups send only the hash, never the file.

Is this an abuse vector?

No. These are defensive, read-only lookups — no port scanning, no mass enumeration, no breach data. URL reputation never fetches the URL, and file scanning is size-capped and rate-limited.

Ship with the Security bundle.

1,000 credits on signup. No card. Every endpoint in this bundle is live from minute one.

Try this bundle View on docs