> ## Documentation Index
> Fetch the complete documentation index at: https://docs.panguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Feed Endpoints

> Consume threat intelligence feeds in blocklist and structured JSON formats.

Feed endpoints provide threat intelligence in formats optimized for consumption by firewalls, DNS resolvers, and Panguard agents. Blocklist feeds return plain text; structured feeds return JSON.

## GET /api/feeds/ip-blocklist

Returns a plain-text list of malicious IP addresses, one per line. Designed for direct ingestion by firewalls (iptables, pf, Windows Firewall) and network appliances.

<ParamField query="minReputation" type="number" default="30">
  Maximum reputation score to include (0 = most malicious). Lower values produce a more conservative list.
</ParamField>

<ParamField query="category" type="string">
  Filter by threat category: `malware`, `botnet`, `bruteforce`, `scanner`, `c2`.
</ParamField>

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET "https://tc.panguard.ai/api/feeds/ip-blocklist?minReputation=20" \
    -H "Authorization: Bearer YOUR_API_KEY"
  ```

  ```bash Direct to iptables theme={null}
  curl -s "https://tc.panguard.ai/api/feeds/ip-blocklist" \
    -H "Authorization: Bearer YOUR_API_KEY" | \
    while read ip; do
      iptables -A INPUT -s "$ip" -j DROP
    done
  ```
</CodeGroup>

### Response

```text theme={null}
# Panguard AI IP Blocklist
# Generated: 2026-03-07T12:00:00Z
# Total: 1423 IPs
198.51.100.42
198.51.100.78
203.0.113.15
203.0.113.99
192.0.2.50
...
```

<Info>
  The response content type is `text/plain`. Lines starting with `#` are comments containing metadata. The list is sorted by reputation score (most malicious first).
</Info>

***

## GET /api/feeds/domain-blocklist

Returns a plain-text list of malicious domains, one per line. Suitable for DNS sinkhole configurations (Pi-hole, dnsmasq, Unbound).

<ParamField query="minReputation" type="number" default="30">
  Maximum reputation score to include.
</ParamField>

<ParamField query="category" type="string">
  Filter by threat category: `malware`, `phishing`, `c2`, `exploit`.
</ParamField>

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET "https://tc.panguard.ai/api/feeds/domain-blocklist" \
    -H "Authorization: Bearer YOUR_API_KEY"
  ```

  ```bash Pi-hole format theme={null}
  curl -s "https://tc.panguard.ai/api/feeds/domain-blocklist" \
    -H "Authorization: Bearer YOUR_API_KEY" | \
    sed 's/^/0.0.0.0 /' > /etc/pihole/panguard-blocklist.txt
  ```
</CodeGroup>

### Response

```text theme={null}
# Panguard AI Domain Blocklist
# Generated: 2026-03-07T12:00:00Z
# Total: 892 domains
malware-c2.example.net
phishing-bank.example.org
dropper.example.com
evil-redirect.example.io
...
```

***

## GET /api/feeds/iocs

Returns the full IoC feed in structured JSON format with metadata, suitable for SIEM integrations and automated processing.

<ParamField query="since" type="string">
  ISO 8601 timestamp. Returns only IoCs updated after this time (for incremental sync).
</ParamField>

<ParamField query="type" type="string">
  Filter by IoC type: `ip`, `domain`, `hash`, `url`.
</ParamField>

<ParamField query="limit" type="number" default="1000">
  Maximum number of IoCs to return (max 5000).
</ParamField>

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET "https://tc.panguard.ai/api/feeds/iocs?since=2026-03-06T00:00:00Z&type=ip" \
    -H "Authorization: Bearer YOUR_API_KEY"
  ```
</CodeGroup>

<ResponseExample>
  ```json 200 theme={null}
  {
    "ok": true,
    "data": {
      "generatedAt": "2026-03-07T12:00:00.000Z",
      "count": 156,
      "iocs": [
        {
          "value": "198.51.100.42",
          "type": "ip",
          "reputation": 12,
          "category": "bruteforce",
          "sightings": 47,
          "firstSeen": "2026-02-15T10:00:00.000Z",
          "lastSeen": "2026-03-07T08:15:00.000Z",
          "metadata": {
            "asn": "AS64496",
            "country": "CN",
            "mitreIds": ["T1110"]
          }
        }
      ]
    }
  }
  ```
</ResponseExample>

***

## GET /api/feeds/agent-update

Returns a bundled update package for Panguard Guard agents containing the latest detection rules and IoC data. This endpoint is called automatically by agents during their update cycle.

<ParamField query="currentVersion" type="string">
  The agent's current rule version. Only returns changes since this version.
</ParamField>

<ParamField query="agentId" type="string">
  The requesting agent's ID for access control.
</ParamField>

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET "https://tc.panguard.ai/api/feeds/agent-update?currentVersion=v20260306" \
    -H "Authorization: Bearer YOUR_API_KEY"
  ```
</CodeGroup>

<ResponseExample>
  ```json 200 theme={null}
  {
    "ok": true,
    "data": {
      "version": "v20260307",
      "rules": {
        "atr": {
          "added": 12,
          "updated": 3,
          "removed": 1,
          "files": [
            {
              "id": "ATR-2025-0125",
              "name": "Detect Cryptominer via Agent Action",
              "content": "..."
            }
          ]
        }
      },
      "iocs": {
        "ipBlocklist": ["198.51.100.42", "203.0.113.99"],
        "domainBlocklist": ["malware-c2.example.net"],
        "hashBlocklist": ["e3b0c44298fc1c149afbf4c8996fb924"]
      },
      "config": {
        "heartbeatInterval": 60,
        "logLevel": "info"
      }
    }
  }
  ```
</ResponseExample>

<Tip>
  The agent-update endpoint uses delta updates when a `currentVersion` is provided. This minimizes bandwidth by only sending new or modified rules since the agent's last update.
</Tip>