AlienVault OTX API

Free AlienVault Open Threat Exchange API: look up domains, IPs, URLs and file hashes against community threat intelligence, malware and passive DNS. Tested.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 20 Aug 2026

What is the AlienVault OTX API?

AlienVault OTX (Open Threat Exchange) is a free threat intelligence API letting you look up domains, IP addresses, URLs and file hashes against community-contributed indicators of compromise, malware samples and passive DNS records.

OTX is one of the largest open threat intelligence communities, where security researchers publish indicators of compromise as 'pulses'. Querying an indicator tells you whether it appears in any published threat report.

General indicator lookups work without authentication, which is unusual for threat intelligence. Deeper sections and pulse subscriptions require a free API key sent as an `X-OTX-API-KEY` header.

Quick facts

Base URL: https://otx.alienvault.com/api/v1
Authentication: General indicator lookups work anonymously. A free API key unlocks pulse subscriptions and some sections.
Rate limit: Not formally published; anonymous use is throttled more tightly than authenticated.
Pricing: Free, with a free account for higher limits.
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the AlienVault OTX API

Every request below was executed against the live API on 20 Aug 2026, and the response shown is the real body it returned — not an illustration.

1. Look up threat intelligence for a domain

GET https://otx.alienvault.com/api/v1/indicators/domain/example.com/general

curl

curl 'https://otx.alienvault.com/api/v1/indicators/domain/example.com/general'

JavaScript (fetch)

const res = await fetch("https://otx.alienvault.com/api/v1/indicators/domain/example.com/general");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://otx.alienvault.com/api/v1/indicators/domain/example.com/general", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

{
  "sections": [
    "general",
    "geo",
    "url_list",
    "passive_dns",
    "malware",
    "whois",
    "http_scans"
  ],
  "whois": "http://whois.domaintools.com/example.com",
  "alexa": "http://www.alexa.com/siteinfo/example.com",
  "indicator": "example.com",
  "type": "domain",
  "type_title": "Domain",
  "validation": [
    {
      "source": "akamai",
      "message": "Akamai rank: #1608",
      "name": "Akamai Popular Domain"
    },
    {
      "source": "majestic",
      "message": "Whitelisted domain example.com",
      "name": "Whitelisted domain"
    },
    {
      "source": "whitelist",
      "message": "Whitelisted domain example.com",
      "name": "Whitelisted domain"
    }
  ],
  "base_indicator": {
    "id": 95944,
    "indicator": "example.com",
    "type": "domain",
    "title": "",
    "description": "",
    "content": "",
    "access_type": "public",
    "access_reason": ""
  },
  "pulse_info": {
    "count": 50,
    "pulses": [
      {
        "id": "63d10e46581edfe9bba0da3f",
        "name": "Microsoft Phishing Collection",
        "description": "This page stores Microsoft phishing page IOCs. Legitimate website for the brand is https://microsoft.com\nNOLA defense is tracking newly observed phishing websites. Follow us on twitter https://twitter.com/noladefense",
        "modified": "2026-08-19T15:37:55.946000",
        "created": "2023-01-25T11:11:02.458000",
        "tags": [
          "urls",
          "phishing",
          "scam",
          "microsoft"
        ],
        "references": [
          "https://www.virustotal.com/gui/collection/fe

Parameters

Parameter	Type	Required	Description
`indicators/domain/<domain>/<section>`	path	Optional	Domain lookup. `indicators/domain/example.com/general`
`indicators/IPv4/<ip>/<section>`	path	Optional	IP address lookup. `indicators/IPv4/8.8.8.8/general`
`indicators/file/<hash>/<section>`	path	Optional	File hash lookup. `indicators/file/<sha256>/general`
`<section>`	path	Optional	general, malware, url_list, passive_dns, whois, http_scans. `general`

Response fields

sectionsarray: Which data sections are available for this indicator.
pulse_info.countinteger: How many threat reports reference this indicator — the key risk signal.
pulse_info.pulsesarray: The threat reports themselves, with names and tags.
whoisstring: Link to WHOIS data.
alexastring: Ranking link, where available.
(passive_dns) passive_dnsarray: Historical DNS resolutions for the indicator.

What you can build with the AlienVault OTX API

Check whether a domain or IP appears in known threat reports
Enrich security alerts with community threat intelligence
Investigate malware infrastructure via passive DNS
Build automated indicator reputation scoring

Common errors and how to fix them

pulse_info.count is 0

The indicator is not in any published pulse.

Fix: Absence is not proof of safety — it means nobody has reported it, not that it is clean.

403 on some sections

Certain sections need authentication.

Fix: Register a free account and send the key as an X-OTX-API-KEY header.

Throttled anonymously

Unauthenticated use is limited more tightly.

Fix: A free API key raises the allowance considerably.

AlienVault OTX API — frequently asked questions

Is AlienVault OTX free?

Yes, general indicator lookups work anonymously and a free account raises limits and unlocks additional sections.

What is a pulse?

A threat report published by an OTX community member, containing indicators of compromise. If an indicator appears in pulses, researchers have associated it with malicious activity.

Does a zero pulse count mean a domain is safe?

No. It means nobody has reported it, which is different from it being clean. Treat absence as an absence of evidence, not evidence of absence.

What is passive DNS useful for?

It shows historical resolutions for a domain or IP, which is how investigators map out related infrastructure — an attacker's domains often share hosting history.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

Alternatives to AlienVault OTX API

If AlienVault OTX does not fit, these security & auth apis cover similar ground. Every one was called before publishing, and each links to its own reference page with a working curl command and the response it returned.

API	What it does	Auth	CORS	Last verified
Pwned Passwords	Free Have I Been Pwned password API with no key. Check if a password appears in known breaches using k-anonymity — the password never leaves your server. Tested.	No key	Yes	19 Aug 2026
Have I Been Pwned Breaches	Free Have I Been Pwned breach list API with no key: every catalogued data breach with date, affected accounts and compromised data types. Tested curl example.	No key	Yes	19 Aug 2026
NVD CVE	Free NIST National Vulnerability Database API: search CVEs by id, keyword, severity, CVSS score and date with full descriptions and references. Tested example.	No key	Yes	19 Aug 2026
CIRCL CVE Search	Free CIRCL CVE Search API with no key: query vulnerabilities by id, vendor or product, and pull the latest published CVEs. CORS enabled. Tested example.	No key	Yes	19 Aug 2026
Cert Spotter	Free SSLMate Cert Spotter API with no key: search certificate transparency logs for every TLS certificate issued for a domain, with issuer, SANs and validity dates.	No key	Yes	21 Aug 2026
CIRCL hashlookup	Free CIRCL hashlookup API with no key: check MD5, SHA-1 or SHA-256 file hashes against NSRL and other known-good datasets to filter out legitimate system files.	No key	No	21 Aug 2026

All Security & Auth APIs

AlienVault OTX is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 20 Aug 2026; always check the official documentation before relying on this API in production, as terms and limits can change.