Download Feeds

This API endpoint allows you to download feed files containing threat intelligence data.

Endpoint: https://apis.threatwinds.com/api/feeds/v1/download/list/{level}/{type}/{name}

Parameters

Headers

Parameter	Type	Required	Description
Authorization	string	Optional	Bearer token from an active session. Authentication is optional but improves rate limits.
api-key	string	Optional	API key. Authentication is optional but improves rate limits.
api-secret	string	Optional	API secret. Authentication is optional but improves rate limits.

Path Parameters

Parameter	Type	Required	Description
level	string	Yes	Accuracy level of the feed. Possible values: “level1”, “level2”, “level3”
type	string	Yes	Type of feed. Possible values: “accumulative”, “daily”
name	string	Yes	Name of the feed (e.g., “ip”, “md5”, etc.)

Note: All path parameter values (level, type, name) are case-sensitive. Available feeds can be discovered via the Feed Lists endpoint.

Request

To download a feed file, use a GET request, for example:

curl -X 'GET' \
  'https://apis.threatwinds.com/api/feeds/v1/download/list/level1/accumulative/ip' \
  -H 'Authorization: Bearer <YOUR_BEARER_TOKEN>'

Or using API key and secret:

curl -X 'GET' \
  'https://apis.threatwinds.com/api/feeds/v1/download/list/level1/accumulative/ip' \
  -H 'api-key: <YOUR_API_KEY>' \
  -H 'api-secret: <YOUR_API_SECRET>'

Note: The response format is determined by the type path parameter (accumulative or daily). The Accept header is ignored.

Response

A successful response will return the feed file content in one of the following formats:

Feed Type	Content Type	File Extension	Description
accumulative	application/gzip	.list.tar.gz	Compressed tar archive of complete feed data
daily	application/x-ndjson	.ndjson	Newline-delimited JSON of daily updates

The response includes a Content-Disposition header indicating the filename:

Header	Value
Content-Type	application/gzip or application/x-ndjson
Content-Disposition	attachment; filename=<filename>

The filename is constructed as <name>_<level>.list.tar.gz for accumulative feeds or <name>_<level>.ndjson for daily feeds. For example, requesting level1/accumulative/ip returns filename ip_level1.list.tar.gz.

Error Response Headers

For responses with status codes other than 200, the following headers are included:

Header	Description
x-error	Human-readable error message describing what went wrong
x-error-id	Unique identifier for error tracking and support

Error Codes

Status Code	Description	Possible Cause
400	Bad Request	Invalid accuracy level or feed type
404	Not Found	File not found
500	Internal Server Error	Server-side error; please contact support if persistent

Checksum File

You can download the checksum file (bases.sum) which contains MD5 hashes for all available feed files. This allows you to verify the integrity of downloaded feeds.

Endpoint: https://apis.threatwinds.com/api/feeds/v1/download/checksum

Parameters

Headers

Parameter	Type	Required	Description
Authorization	string	Optional	Bearer token from an active session. Authentication is optional but improves rate limits.
api-key	string	Optional	API key. Authentication is optional but improves rate limits.
api-secret	string	Optional	API secret. Authentication is optional but improves rate limits.

Request

To download the checksum file, use a GET request:

curl -X 'GET' \
  'https://apis.threatwinds.com/api/feeds/v1/download/checksum' \
  -H 'Authorization: Bearer <YOUR_BEARER_TOKEN>'

Or using API key and secret:

curl -X 'GET' \
  'https://apis.threatwinds.com/api/feeds/v1/download/checksum' \
  -H 'api-key: <YOUR_API_KEY>' \
  -H 'api-secret: <YOUR_API_SECRET>'

Response

A successful response will return the bases.sum file as plain text, containing MD5 checksums for all feed files. The response includes a Content-Disposition: attachment; filename=bases.sum header.

Example Response:

d41d8cd98f00b204e9800998ecf8427e  ip_level1.list.tar.gz
5d41402abc4b2a76b9719d911017c592  md5_level1.list.tar.gz
7d793037a0760186574b0282f2f435e7  domain_level2.list.tar.gz
...

Each line contains an MD5 hash followed by the corresponding feed filename.

Error Codes

Status Code	Description	Possible Cause
404	Not Found	Checksum file not found
500	Internal Server Error	Server-side error; please contact support if persistent