API overview.
The Liberty91 API gives you programmatic access to the same intelligence you see in the platform. It is a straightforward REST API returning JSON, so you can wire Liberty91 into a SOAR playbook, a TIP, SIEM enrichment, or your own scripts without learning anything exotic.
The one thing to understand first
Liberty91 has two layers, and picking the right one is most of the work of integrating well.
- A Threat Event is a real-world occurrence, one specific breach.
- An Event is one report about it.
Reporting repeats itself: a single breach might be covered by a vendor
write-up, three news articles and a leak-site post. That is five Events and one
Threat Event. Consume /threat-events/ and you read the occurrence once, with
every source attached and disagreement between them visible. Consume /events/
and you get five rows to deduplicate yourself.
Start at Threat Events. Use Events when you specifically need the individual documents.
Base URL
https://api.liberty91.com/api/v1/
HTTPS only. The API is designed for server-to-server use, so your key should live in a backend service, never in a browser.
Your first request
Create an API key in the platform (see Authentication and API keys), then read the occurrences relevant to you:
curl "https://api.liberty91.com/api/v1/threat-events/?relevant=true&min_credibility=2" \
-H "X-API-Key: l91_live_xxxxxxxxxxxxxxxxxxxxxxxx"Every response carries X-RateLimit-* and X-Credits-* headers, so your
integration always knows where it stands. See
Rate limits and credits.
What is available
| Area | What you can do | Docs |
|---|---|---|
| Threat Events | Read deduplicated occurrences with their sources, trust signals, entities and per-organization relevance | Threat Events |
| Threat library | The canonical catalog: resolve actor aliases to ids, dated ATT&CK techniques, CVSS/EPSS/KEV on vulnerabilities | Threat library |
| Search | Flat filters or boolean condition groups, returning occurrences; run your saved searches | Search |
| Events | Read individual reports, ingest your own intelligence | Events |
| IOCs | Exact lookup, filtered lists, CSV and STIX 2.1 export | IOCs |
| Reports | List, generate, poll and download intelligence packages | Reports |
| Alerts | Read alert rules, their criteria, and what they matched | Alerts |
| Organizations | Assets, suppliers, document upload and extraction | Organizations |
Design principles
- One key, one account. A key belongs to a single billing account and can only ever see that account's data. There is no way to reach across tenants.
- You see what you are entitled to. Threat Events and their sources are filtered to the reporting you hold, see what you can and cannot see.
- Scoped access. Keys carry read and write scopes, so a lookup integration never needs permission to ingest or generate anything.
- Cursor pagination everywhere. List endpoints return a
nextlink; follow it until it is null. See Pagination and errors. - Async where the work is heavy. Ingesting a report, generating a package and extracting entities from a document all return immediately, and you poll a status field to completion.
- Additive versioning. Within v1 the contract only grows. Fields are added, never renamed or removed, so integrations do not break under you.
- Intelligence, not account configuration. Enrichment provider credentials are configured in the app by a person and are never readable or writable over the API, so no key can be used to read another vendor's key. What each provider found does come back, on IOCs.
Machine-readable reference
The OpenAPI 3.0 schema and an interactive reference are published alongside the API. Every operation carries its parameters, response types and error codes, so they are a good target for a client generator.
- Interactive docs: https://api.liberty91.com/api/v1/docs/
- Raw OpenAPI schema: https://api.liberty91.com/api/v1/schema/
Both are unauthenticated and cost no credits.
Frequently asked questions
What can I do with the Liberty91 API?
Read deduplicated Threat Events with their sources and trust signals, query the canonical threat catalog and resolve actor aliases, search with boolean queries, look up and export IOCs, ingest your own reporting, generate and download intelligence packages, and read alert rules and their matches.
Is the Liberty91 API REST or GraphQL?
REST. All endpoints live under https://api.liberty91.com/api/v1/ and return
JSON, with cursor pagination on every list endpoint.
Does the API cost extra?
API usage is metered against your account's monthly credit pool. Most read requests cost a single credit, and failed requests are never charged. The full cost table is on the rate limits and credits page.