Entity Details

This API endpoint provides detailed information about a specific threat intelligence entity, including its attributes, metadata, geolocations, and latest associations.

Endpoint: https://apis.threatwinds.com/api/analytics/v1/entity/{id}/details

Parameters

Headers

Header	Type	Required	Description
Authorization	string	Optional	Bearer token from an active session. Authentication is optional but improves rate limits.
api-key	string	Optional	API key. Authentication is optional but improves rate limits.
api-secret	string	Optional	API secret. Authentication is optional but improves rate limits.

Parameter	Type	Required	Description
id	string	Yes	The unique identifier of the entity you want to retrieve details for

Request

To get details for a specific entity, use a GET request, for example:

curl -X 'GET' \
  'https://apis.threatwinds.com/api/analytics/v1/entity/ip-ad0c2ed9a0a9b23822e5907b0d009bcaf8f969db793cd1d94c40e17e0287c04b/details' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <YOUR_BEARER_TOKEN>'

Or using API key and secret:

curl -X 'GET' \
  'https://apis.threatwinds.com/api/analytics/v1/entity/ip-ad0c2ed9a0a9b23822e5907b0d009bcaf8f969db793cd1d94c40e17e0287c04b/details' \
  -H 'accept: application/json' \
  -H 'api-key: <YOUR_API_KEY>' \
  -H 'api-secret: <YOUR_API_SECRET>'

Response

A successful response returns a JSON object containing detailed information about the entity, including:

Field	Description
attributes	Core attributes of the entity (type, value, reputation, accuracy, label, description, etc.). The value field can be any valid JSON type (string, number, boolean, object, or array)
metadata	Contains all entity attributes EXCEPT the primary attribute (key matching entity type). For an IP entity, the ip field goes to attributes.value but subnet, text, etc. appear in metadata. Keys are dynamic and type-specific
geolocations	Geolocation information; included for IP entities and for non-threat entities that have IP associations
latest_associations	Recent entities associated with this entity
extended_metadata	Cross-referenced entities: other entities whose primary attribute matches a non-primary attribute value of the queried entity (e.g., ASN entity matching metadata.asn)

Key attributes fields:

Field	Type	Description
label	string	Human-readable label for the entity type (from the type definition table, not the entity itself)
description	string	Description of the entity type (from the type definition table, not the entity itself)

Reputation & Accuracy Scales

Reputation Scale

Score	Label
-3	Alarming
-2	Worrying
-1	Concerning
0	Indefinable
1	Adequate
2	Good
3	Exceptional

Accuracy Scale

Score	Label
≤0	Inaccurate
1	Imprecise
2	Fairly precise
3	Precise

How This Maps to the Search API

The same entity can be returned by both Entity Retrieval (Search API) and this endpoint (Analytics API), but in two different shapes. Do not parse one with the other’s expectations:

	Search API (/search/v1/entity/{id})	Analytics API (this endpoint)
Envelope	Flat — fields at the top level	Wrapped in attributes (plus metadata, geolocations, latest_associations, extended_metadata)
id	Top-level	Nested in attributes.id
reputation	Integer only (reputation: 3)	String label and score (reputation: "Exceptional", reputation_score: 3)
best / worst	bestReputation / worstReputation (integers)	best_reputation(_score) / worst_reputation(_score)
timestamps	@timestamp (created), lastSeen	first_seen, last_seen
case	camelCase (lastSeen, wellKnown)	snake_case (last_seen, first_seen)
value	attributes.ip (attribute keyed by type)	attributes.value
extra fields	wellKnown, visibleBy present	no wellKnown; adds label, description, metadata, geolocations, latest_associations, extended_metadata

The id itself is identical in both — [type]-[hash] (e.g. ip-ad0c2ed9…) — so an ID you get from a search result works as the {id} here. Only the field layout and the reputation representation differ.

Example response:

{
  "attributes": {
    "id": "ip-ad0c2ed9a0a9b23822e5907b0d009bcaf8f969db793cd1d94c40e17e0287c04b",
    "type": "ip",
    "value": "8.8.8.8",
"label": "IP Address",
"description": "An IP address entity",
    "reputation": "Exceptional",
    "reputation_score": 3,
    "best_reputation": "Exceptional",
    "best_reputation_score": 3,
    "worst_reputation": "Indefinable",
    "worst_reputation_score": 0,
    "accuracy": "Precise",
    "accuracy_score": 3,
    "first_seen": "2021-01-01T00:00:00Z",
    "last_seen": "2023-06-15T14:30:00Z",
    "tags": ["dns", "google", "public"]
  },
  "metadata": {
    "asn": 15169,
    "aso": "Google LLC",
    "country": "United States"
  },
  "geolocations": [
    {
      "city": "Mountain View",
      "country": "United States",
      "latitude": 37.4056,
      "longitude": -122.0775,
      "accuracy_radius": 1000,
      "asn": 15169,
      "aso": "Google LLC",
      "object": "8.8.8.0/24"
    }
  ],
  "latest_associations": [
    {
      "id": "domain-b7c3e81a4f2d9c05e6a1f0d38b2c47e9a1b5c8d0f3e6a9c2b4d7f0e1",
      "type": "domain",
      "value": "dns.google",
      "reputation": "Exceptional",
      "reputation_score": 3,
      "accuracy": "Precise",
      "accuracy_score": 3,
      "first_seen": "2021-02-15T00:00:00Z",
      "last_seen": "2023-06-10T12:00:00Z"
    }
  ],
  "extended_metadata": [
    {
      "id": "registrar-5a91c3e82f7d0b46a1c8e5d2f9b3a7c4d0e6f1b8a2c9d4e7f3b0a6c5d8e1f2",
      "type": "registrar",
      "value": "Google LLC",
      "reputation": "Exceptional",
      "reputation_score": 3,
      "accuracy": "Precise",
      "accuracy_score": 3,
      "first_seen": "2021-02-15T00:00:00Z",
      "last_seen": "2023-06-10T12:00:00Z"
    }
  ]
}

Error Response Headers

For responses with error status codes, the following headers are included:

Header	Description
x-error	Human-readable error message describing what went wrong
x-error-id	Unique identifier for error tracking and support

Error Codes

Status Code	Description	Possible Cause
400	Bad Request	Invalid entity ID or invalid request parameters
401	Unauthorized	Invalid authentication credentials
404	Not Found	Entity not found
500	Internal Server Error	Server-side error; please contact support if persistent