API overview.
One Bearer key, 22 mounted route groups, and an evidence chain plus retriever trace on every answer.
Docs & SDKs in the portal is the hands-on version of this page: key anatomy, the exact auth header, scopes, region routing, error codes and webhook signatures, with buttons through to your own keys and the sandbox. It needs a session; this page does not.
Authentication
A single Bearer key per request. Keys are tenant-scoped, minted per profile, revocable individually, and rate-limited per key with a per-plan burst ceiling.
-H "Authorization: Bearer $OMNI_INTEL_KEY"The key determines the tenant, and the tenant determines what row-level security will allow. There is no request parameter that can widen that scope.
The route surface
| Group | Purpose |
|---|---|
/v1/enrich/{indicator} | Look up an IP, domain, URL, hash or email with full evidence |
/v1/cve/{id} | CVE context — CVSS, EPSS, KEV status, affected products |
/v1/actor | Threat actor profile and aliases |
/v1/malware | Malware family context |
/v1/ttp | MITRE technique context |
/v1/ask | Free-form question, cited answer |
/v1/graph/traverse | Pivot from an entity across relationships |
/v1/private/submit | Push your own indicators (tenant-scoped) |
/v1/stix | STIX 2.1 bundle export and object counts |
/v1/rules/generate | Detection content from a seed — YARA, Sigma, KQL, SPL |
/v1/feeds | Feed inventory and freshness |
/v1/webhooks | Outbound subscription management |
/v1/usage | Your consumption against quota |
/v1/kb | Knowledge base search and document retrieval |
/v1/reports | Generated report bundles |
Also mounted: research, investigate, agentic, attribute, defensive, theme and an admin group. Twenty-two groups in total.
Every response carries provenance
evidence[]— one entry per contributing source, with url, fetch time, confidence and TLP.trace.retrievers[]— which strategies ran, hit counts and latencies.- A
request_idon errors, so a failure can be correlated with server logs.
Errors
Errors are JSON with a stable code, a human message, and a request_id. The code is what you switch on; the message is for humans and may change.
{
"code": "bad_request",
"message": "indicators.0.value: String must contain at least 3 character(s)",
"request_id": "req_01JQ..."
}Rate limits
Two independent limits: a monthly request quota and a per-second burst ceiling, both set by plan. Exceeding the burst is rate-limited with a clear error rather than silently dropped, and consumption is visible on your usage page before the month ends.
See plans & quotas for the numbers.
The spec lags the surface
specs/openapi/v1.yaml is the contract that generates the SDK clients, and it currently documents six paths: /enrich/{indicator}, /cve/{id}, /actor/{name}, /ask, /graph/traverse and /private/submit.
Everything else on this page is served by the gateway but not in the spec, which means it has no generated typed client and no contract guarantee. If you are building something you need stability from, prefer the six — and treat the rest as live-but-unversioned until the spec catches up.