Skip to main content
POST
Structured IOC assessment (LLM-free)

Scope and credits

IOC assessment behavior

/v2/ioc-assessments assesses the submitted IOC itself. It may enrich the assessment with intelligence about the exact IP, domain, URL, hash, or email subject, including targeted industries, targeted countries, and targeted campaigns when available. It does not expand event-correlated or co-occurring IOCs inline. Use /v2/relationships with relationship_types: ["ioc"] when you need related indicators or event-correlation pivots for an IOC subject. Use relationship_types: ["sector"] or relationship_types: ["country"] when you need TIE-derived industry or geography pivots.

Authorizations

Authorization
string
header
required

ApiKey <key_id>:

Body

application/json
agent_context
AgentContext · object | null
context
AssessmentContext · object | null
expected_types
string[] | null
options
Options · object | null
query
string | null
Maximum string length: 1024
resolution
ResolutionOptions · object | null
subject
AssessmentSubject · object | null
time_range
Time Range · object | null

Response

Successful Response

assessment_type
string
required
caveats
string[]
required
confidence
number
required
evidence_refs
Evidence Refs · object[]
required
input
Input · object
required
metadata
Metadata · object
required
priority
Priority · object
required
rationale_codes
string[]
required
resolution
ResolutionResult · object
required
signals
Signals · object
required
timestamp
number
required
trace_id
string
required
debug
Debug · object | null