IOC feeds

Export the indicators your workspace has confirmed — as JSON for SOAR pipelines, STIX 2.1 for threat-intel platforms, or plain-text EDL lists your firewall can consume directly.

All feed endpoints require a key with the IocExport scope.

JSON / STIX

# JSON (default)
curl "https://api.urlyze.io/api/feed/iocs" -H "X-Api-Key: YOUR_API_KEY"

# STIX 2.1 bundle
curl "https://api.urlyze.io/api/feed/iocs?format=stix" -H "X-Api-Key: YOUR_API_KEY"

EDL text lists

One indicator per line, ready to be polled as an External Dynamic List by Palo Alto, Fortinet and friends:

curl "https://api.urlyze.io/api/feed/edl/domains" -H "X-Api-Key: YOUR_API_KEY"
curl "https://api.urlyze.io/api/feed/edl/urls"    -H "X-Api-Key: YOUR_API_KEY"
curl "https://api.urlyze.io/api/feed/edl/ips"     -H "X-Api-Key: YOUR_API_KEY"

Point your firewall at the EDL URL with the X-Api-Key header configured and a refresh interval of 5–15 minutes. Full parameters (age window, severity filter, pagination) are in the API Reference.