IOCs: lookup, list, and export.
The IOC endpoints expose the indicators in your account, complete with verdicts,
confidence scores, TLP handling markings, and sighting timestamps. They are the natural
integration point for SIEM enrichment, SOAR playbooks, and TIP synchronisation. All
three endpoints require the iocs.read scope.
Look up an indicator
Exact-match lookup for a single value:
curl "https://api.liberty91.com/api/v1/iocs/lookup/?value=evil-domain.example" \
-H "X-API-Key: $LIBERTY91_API_KEY"The response carries a found flag and the matching records:
{
"value": "evil-domain.example",
"found": true,
"results": [
{
"id": "7f9e1a2b-3c4d-5e6f-8a9b-0c1d2e3f4a5b",
"value": "evil-domain.example",
"kind": "domain",
"tlp": "TLP:GREEN",
"verdict": "MALICIOUS",
"confidence": 90,
"tags": ["phishing", "credential-harvesting"],
"whitelisted": false,
"first_seen": "2026-06-02T08:30:00Z",
"last_seen": "2026-07-05T11:15:00Z",
"created_at": "2026-06-02T08:31:12Z"
}
]
}A miss is not an error: you get 200 with "found": false and an empty results
array, which keeps enrichment pipelines simple.
List IOCs
GET /api/v1/iocs/ returns a cursor-paginated list, filterable along every dimension
you would expect:
| Filter | Values |
|---|---|
kind | ip, domain, url, url-path, md5, sha1, sha256, filename, other |
verdict | MALICIOUS, SUSPICIOUS, BENIGN, UNKNOWN |
tlp | Effective handling marking, for example TLP:RED |
since | ISO 8601 date or datetime; returns IOCs created at or after it |
search | Substring match on the value, minimum 3 characters |
whitelisted | true or false |
For example, all malicious IP addresses added in July:
curl "https://api.liberty91.com/api/v1/iocs/?kind=ip&verdict=MALICIOUS&since=2026-07-01" \
-H "X-API-Key: $LIBERTY91_API_KEY"See Pagination and errors for walking the full result
set and the page_size parameter.
Export IOCs
For bulk transfer into another system, the export endpoint streams a file instead of a paginated list:
# CSV, up to 10,000 rows
curl "https://api.liberty91.com/api/v1/iocs/export/?format=csv" \
-H "X-API-Key: $LIBERTY91_API_KEY" -o iocs.csv
# STIX 2.1 bundle, up to 5,000 objects
curl "https://api.liberty91.com/api/v1/iocs/export/?format=stix" \
-H "X-API-Key: $LIBERTY91_API_KEY" -o iocs-bundle.jsonThe same filters as the list endpoint apply, so you can export exactly the slice you need. An export costs 10 credits, charged when the request is accepted; if a download is interrupted mid-transfer, rerun it, ideally with a narrower filter.
If you are feeding a TIP such as MISP or OpenCTI, prefer the STIX export. The bundle carries typed objects and relationships that survive the trip, where CSV flattens them.
Frequently asked questions
How do I check a single indicator against Liberty91?
Call GET /api/v1/iocs/lookup/?value= with the exact indicator value. The response
tells you whether it was found and returns every matching IOC record with verdict,
confidence, and TLP marking.
Can I export IOCs in STIX format?
Yes. GET /api/v1/iocs/export/?format=stix returns a STIX 2.1 bundle of up to 5,000
IOCs. CSV export supports up to 10,000 rows.
How do I pull only new IOCs since my last sync?
Pass the since filter with an ISO 8601 date or datetime to the list endpoint. Combined
with cursor pagination, that gives you a clean incremental sync.