Skip to main content
Panguard AI provides the Threat Cloud API for community-driven threat intelligence. No accounts or login required — Panguard is 100% free and open source.

​
API Service

Threat Cloud API

Configurable port — IoC management, threat feeds, campaign tracking, MITRE heatmaps, geographic queries, and audit logs.

​
Base URL

ServiceDefault Base URLTLS
Threat Cloudhttps://tc.panguard.ai or http://localhost:PORTOptional

​
Authentication

Threat Cloud endpoints that require authentication use an API key in the Authorization header. 
curl -X GET https://tc.panguard.ai/api/iocs \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

​
Common Response Format

Every API endpoint returns a consistent JSON envelope: 
{
  "ok": true,
  "data": {
    "id": "agent-001",
    "hostname": "web-server-1"
  }
}

​
Rate Limiting

The API enforces rate limiting to protect against abuse.
ServiceDefault LimitScope
Threat CloudVaries by endpointPer API key
When rate-limited, the API returns a 429 status code with a Retry-After header indicating when to retry.

​
Error Codes

Status CodeMeaningDescription
200OKRequest succeeded
201CreatedResource created successfully
400Bad RequestInvalid request body or missing required fields
401UnauthorizedMissing or invalid authentication token
403ForbiddenValid token but insufficient permissions
404Not FoundRequested resource does not exist
429Too Many RequestsRate limit exceeded, check Retry-After header
500Internal Server ErrorUnexpected server error, retry with backoff

​
Content Type

All request and response bodies use application/json unless otherwise noted. Feed endpoints may return text/plain for blocklist formats.

​
Pagination

Endpoints that return collections support pagination via query parameters:
​
page
number
default:"1"
Page number (1-indexed).
​
limit
number
default:"50"
Number of items per page. Maximum 200.
Paginated responses include metadata: 
{
  "ok": true,
  "data": [...],
  "pagination": {
    "total": 342,
    "page": 1,
    "limit": 50,
    "pages": 7
  }
}

​
Next Steps

Threat Cloud API

Query and submit threat intelligence.

Configuration

Configure API ports, tokens, and settings.