Developer docs

Documentation

Guides and API reference for running AntiBait analysis from the web app or from your own code.

API reference

IOC threat graph

Business

Build relationship graphs for threat actor mapping and infrastructure visualization. Returns nodes and edges ready for graph visualization libraries.

API endpoint

GET

GET/api/iocs/graph

Query parameters

iocValue: string (required)
  // The IOC value to center the graph on

iocType?: string
  // Filter by specific IOC type

depth?: number (default: 2, max: 3)
  // Graph traversal depth

Response

{
  "success": true,
  "data": {
    "nodes": [...],
    "edges": [...]
  },
  "metadata": {
    "totalNodes": number,
    "totalEdges": number,
    "depth": number
  }
}

Example request

Request

GET /api/iocs/graph?iocValue=attacker@evil.com&iocType=email&depth=2
Authorization: Bearer YOUR_API_KEY

Response

{
  "success": true,
  "data": {
    "nodes": [
      {
        "id": "email:attacker@evil.com",
        "type": "email",
        "value": "attacker@evil.com",
        "isMalicious": true,
        "threatScore": 95,
        "occurrenceCount": 47,
        "firstSeen": "2025-10-15T08:20:00Z",
        "lastSeen": "2025-11-03T10:30:00Z"
      },
      {
        "id": "domain:evil.com",
        "type": "domain",
        "value": "evil.com",
        "isMalicious": true,
        "threatScore": 92,
        "occurrenceCount": 52,
        "firstSeen": "2025-10-15T08:20:00Z",
        "lastSeen": "2025-11-03T10:30:00Z"
      },
      {
        "id": "ip:203.0.113.1",
        "type": "ip",
        "value": "203.0.113.1",
        "isMalicious": true,
        "threatScore": 88,
        "occurrenceCount": 38,
        "firstSeen": "2025-10-20T12:00:00Z",
        "lastSeen": "2025-11-02T18:45:00Z"
      },
      {
        "id": "url:https://evil.com/phishing",
        "type": "url",
        "value": "https://evil.com/phishing",
        "isMalicious": true,
        "threatScore": 90,
        "occurrenceCount": 31,
        "firstSeen": "2025-10-18T14:30:00Z",
        "lastSeen": "2025-11-01T16:20:00Z"
      }
    ],
    "edges": [
      {
        "id": "email:attacker@evil.com-email_uses_domain-domain:evil.com",
        "source": "email:attacker@evil.com",
        "target": "domain:evil.com",
        "relationshipType": "email_uses_domain"
      },
      {
        "id": "email:attacker@evil.com-sent_from_ip-ip:203.0.113.1",
        "source": "email:attacker@evil.com",
        "target": "ip:203.0.113.1",
        "relationshipType": "sent_from_ip"
      },
      {
        "id": "url:https://evil.com/phishing-url_contains_domain-domain:evil.com",
        "source": "url:https://evil.com/phishing",
        "target": "domain:evil.com",
        "relationshipType": "url_contains_domain"
      }
    ]
  },
  "metadata": {
    "totalNodes": 4,
    "totalEdges": 3,
    "depth": 2
  }
}

Node structure

idstring

Unique node identifier in format "type:value"

typestring

IOC type (email, domain, ip, url, etc.)

valuestring

The actual IOC value

isMaliciousboolean

Whether the IOC is marked as malicious

threatScorenumber

Threat score (0-100)

occurrenceCountnumber

Number of times this IOC has been observed

firstSeendatetime

Timestamp when IOC was first observed

lastSeendatetime

Timestamp when IOC was last observed

Edge structure

idstring

Unique edge identifier

sourcestring

Source node ID (in format "type:value")

targetstring

Target node ID (in format "type:value")

relationshipTypestring

Type of relationship (e.g., "email_uses_domain", "sent_from_ip", "url_contains_domain")

Compatible visualization libraries

D3.js

Force-directed graphs and custom visualizations

Cytoscape.js

Network analysis and visualization

vis.js

Interactive network graphs

Sigma.js

Large-scale graph rendering

Use cases

Threat actor mapping

Visualize connections between attacker infrastructure and identify threat actor networks

Infrastructure analysis

Map malicious infrastructure to understand attack patterns and shared resources

Incident investigation

Trace relationships during security incidents to discover related IOCs

Proactive blocking

Identify and block entire malicious infrastructure networks before they attack

Need help integrating the API? The support team replies within 24 hours on business days.

Contact View FAQ Manage API keys