Skip to main content
POST
Bounded relationship retrieval for canonical entities

Scope and credits

IOC relationship behavior

/v2/relationships accepts IOC subjects with concrete entity_type values: ip, domain, url, hash, or email. For IOC subjects, request relationship_types: ["ioc"] to retrieve related indicators from event-correlation context. You may also request actor, campaign, or malware relationships for attribution-style context, sector relationships for targeted industries, and country relationships for targeted countries when available. Do not use ioc as a subject entity_type; use the concrete observable type.

Authorizations

Authorization
string
header
required

ApiKey <key_id>:

Body

application/json
agent_context
AgentContext · object | null
context
ClaimEvidenceContext · object | null
cursor
string | null
Maximum string length: 512
expected_types
string[] | null
max_results
integer
default:10
Required range: 1 <= x <= 50
query
string | null
Maximum string length: 1024
relationship_types
enum<string>[] | null
Available options:
actor,
campaign,
malware,
sector,
country,
ioc,
technique
resolution
ResolutionOptions · object | null
subject
AssessmentSubject · object | null

Response

Successful Response

input_mode
enum<string>
required
Available options:
subject,
query
items
RelationshipItem · object[]
required
max_results
integer
required
metadata
Metadata · object
required
relationship_types
enum<string>[]
required
Available options:
actor,
campaign,
malware,
sector,
country,
ioc,
technique
resolution
ResolutionResult · object
required
status
enum<string>
required
Available options:
ok,
no_relationships
next_cursor
string | null
subject
AssessmentSubject · object | null