API Overview

Panguard AI provides the Threat Cloud API for community-driven threat intelligence. No accounts or login required for Community tier — MIT licensed and open source. For production deployments at F500 scale, Enterprise (

150K-500K / year)](https://panguard.ai/pricing), [Migrator Pro (

500K-2M / year), and Sovereign ($5-20M / nation) tiers add signed, continuously re-scanned compliance evidence, airgap deployment, and SLA.

API Service

Threat Cloud API

Configurable port — IoC management, threat feeds, campaign tracking, MITRE heatmaps, geographic queries, and audit logs.

Base URL

Service	Default Base URL	TLS
Threat Cloud	`https://tc.panguard.ai` or `http://localhost:PORT`	Optional

Authentication

Threat Cloud endpoints that require authentication use an API key in the Authorization header.

curl -X GET https://tc.panguard.ai/api/iocs \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Common Response Format

Every API endpoint returns a consistent JSON envelope:

Success
Error

{
  "ok": true,
  "data": {
    "id": "agent-001",
    "hostname": "web-server-1"
  }
}

{
  "ok": false,
  "error": "Agent not found"
}

Rate Limiting

The API enforces rate limiting to protect against abuse.

Service	Default Limit	Scope
Threat Cloud	Varies by endpoint	Per API key

When rate-limited, the API returns a 429 status code with a Retry-After header indicating when to retry.

Error Codes

Status Code	Meaning	Description
`200`	OK	Request succeeded
`201`	Created	Resource created successfully
`400`	Bad Request	Invalid request body or missing required fields
`401`	Unauthorized	Missing or invalid authentication token
`403`	Forbidden	Valid token but insufficient permissions
`404`	Not Found	Requested resource does not exist
`429`	Too Many Requests	Rate limit exceeded, check `Retry-After` header
`500`	Internal Server Error	Unexpected server error, retry with backoff

Content Type

All request and response bodies use application/json unless otherwise noted. Feed endpoints may return text/plain for blocklist formats.

Pagination

Endpoints that return collections support pagination via query parameters:

page

number

default:"1"

Page number (1-indexed).

limit

number

default:"50"

Number of items per page. Maximum 200.

Paginated responses include metadata:

{
  "ok": true,
  "data": [...],
  "pagination": {
    "total": 342,
    "page": 1,
    "limit": 50,
    "pages": 7
  }
}

API Reference

Threat Cloud API

API Service

Threat Cloud API

Base URL

Authentication

Common Response Format

Rate Limiting

Error Codes

Content Type

Next Steps

Threat Cloud API

Configuration

​API Service

Threat Cloud API

​Base URL

​Authentication

​Common Response Format

​Rate Limiting

​Error Codes

​Content Type

​Pagination

​Next Steps

Threat Cloud API

Configuration

API Service

Base URL

Authentication

Common Response Format

Rate Limiting

Error Codes

Content Type

Pagination

Next Steps