> ## Documentation Index
> Fetch the complete documentation index at: https://docs.panguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Overview

> Panguard AI exposes the Threat Cloud REST API for threat intelligence.

Panguard AI provides the Threat Cloud API for community-driven threat intelligence. No accounts or login required for Community tier -- MIT licensed and open source. For production deployments at F500 scale, [Enterprise ($150K-500K / year)](https://panguard.ai/pricing), [Migrator Pro ($500K-2M / year)](https://panguard.ai/pricing), and [Sovereign (\$5-20M / nation)](https://panguard.ai/pricing) tiers add signed, continuously re-scanned compliance evidence, airgap deployment, and SLA.

## API Service

<CardGroup cols={1}>
  <Card title="Threat Cloud API" icon="cloud">
    **Configurable port** -- IoC management, threat feeds, campaign tracking, MITRE heatmaps,
    geographic queries, and audit logs.
  </Card>
</CardGroup>

## Base URL

| Service      | Default Base URL                                    | TLS      |
| ------------ | --------------------------------------------------- | -------- |
| Threat Cloud | `https://tc.panguard.ai` or `http://localhost:PORT` | Optional |

## Authentication

Threat Cloud endpoints that require authentication use an **API key** in the `Authorization` header.

```bash theme={null}
curl -X GET https://tc.panguard.ai/api/iocs \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"
```

## Common Response Format

Every API endpoint returns a consistent JSON envelope:

<Tabs>
  <Tab title="Success">
    ```json theme={null}
    {
      "ok": true,
      "data": {
        "id": "agent-001",
        "hostname": "web-server-1"
      }
    }
    ```
  </Tab>

  <Tab title="Error">
    ```json theme={null}
    {
      "ok": false,
      "error": "Agent not found"
    }
    ```
  </Tab>
</Tabs>

## Rate Limiting

The API enforces rate limiting to protect against abuse.

| Service      | Default Limit      | Scope       |
| ------------ | ------------------ | ----------- |
| Threat Cloud | Varies by endpoint | Per API key |

When rate-limited, the API returns a `429` status code with a `Retry-After` header indicating when to retry.

## Error Codes

| Status Code | Meaning               | Description                                     |
| ----------- | --------------------- | ----------------------------------------------- |
| `200`       | OK                    | Request succeeded                               |
| `201`       | Created               | Resource created successfully                   |
| `400`       | Bad Request           | Invalid request body or missing required fields |
| `401`       | Unauthorized          | Missing or invalid authentication token         |
| `403`       | Forbidden             | Valid token but insufficient permissions        |
| `404`       | Not Found             | Requested resource does not exist               |
| `429`       | Too Many Requests     | Rate limit exceeded, check `Retry-After` header |
| `500`       | Internal Server Error | Unexpected server error, retry with backoff     |

## Content Type

All request and response bodies use `application/json` unless otherwise noted. Feed endpoints may return `text/plain` for blocklist formats.

## Pagination

Endpoints that return collections support pagination via query parameters:

<ParamField query="page" type="number" default="1">
  Page number (1-indexed).
</ParamField>

<ParamField query="limit" type="number" default="50">
  Number of items per page. Maximum 200.
</ParamField>

Paginated responses include metadata:

```json theme={null}
{
  "ok": true,
  "data": [...],
  "pagination": {
    "total": 342,
    "page": 1,
    "limit": 50,
    "pages": 7
  }
}
```

## Next Steps

<CardGroup cols={2}>
  <Card title="Threat Cloud API" icon="crosshairs" href="/api-reference/threat-cloud/ioc">
    Query and submit threat intelligence.
  </Card>

  <Card title="Configuration" icon="gear" href="/configuration/environment-variables">
    Configure API ports, tokens, and settings.
  </Card>
</CardGroup>