Skip to main content
GET
ListCyberThreats

Authorizations

X-WorldMonitor-Key
string
header
required

User-issued WorldMonitor API key.

Query Parameters

start
string<int64>

Start of time range (inclusive), Unix epoch milliseconds. Accepted but currently ignored; no-op until this handler supports the parameter.

end
string<int64>

End of time range (inclusive), Unix epoch milliseconds. Accepted but currently ignored; no-op until this handler supports the parameter.

page_size
integer<int32>

Maximum items per page (1-100).

cursor
string

Cursor for next page.

type
enum<string>

Optional threat type filter.

Available options:
CYBER_THREAT_TYPE_C2_SERVER,
CYBER_THREAT_TYPE_MALWARE_HOST,
CYBER_THREAT_TYPE_PHISHING,
CYBER_THREAT_TYPE_MALICIOUS_URL
source
enum<string>

Optional source filter.

Available options:
CYBER_THREAT_SOURCE_FEODO,
CYBER_THREAT_SOURCE_URLHAUS,
CYBER_THREAT_SOURCE_C2INTEL,
CYBER_THREAT_SOURCE_OTX,
CYBER_THREAT_SOURCE_ABUSEIPDB
min_severity
enum<string>

Optional minimum criticality filter.

Available options:
CRITICALITY_LEVEL_LOW,
CRITICALITY_LEVEL_MEDIUM,
CRITICALITY_LEVEL_HIGH,
CRITICALITY_LEVEL_CRITICAL
jmespath
string

Optional JMESPath expression applied server-side to project or reduce the JSON response before it is returned (mirrors the MCP jmespath argument). Invalid expressions, expressions larger than 1024 UTF-8 bytes, or projections that exceed the 256 KB output cap return HTTP 400 with a {_jmespath_error, original_keys} envelope. Grammar and worked examples: https://www.worldmonitor.app/docs/mcp-jmespath.

Response

Successful response

ListCyberThreatsResponse contains cyber threats matching the request.

threats
object[]
pagination
object

PaginationResponse contains pagination metadata returned alongside list results.