AlienVault OTX API
Free AlienVault Open Threat Exchange API: look up domains, IPs, URLs and file hashes against community threat intelligence, malware and passive DNS. Tested.
Endpoint tested and returned HTTP 200 on 2026-08-20
What is the AlienVault OTX API?
AlienVault OTX (Open Threat Exchange) is a free threat intelligence API letting you look up domains, IP addresses, URLs and file hashes against community-contributed indicators of compromise, malware samples and passive DNS records.
OTX is one of the largest open threat intelligence communities, where security researchers publish indicators of compromise as 'pulses'. Querying an indicator tells you whether it appears in any published threat report.
General indicator lookups work without authentication, which is unusual for threat intelligence. Deeper sections and pulse subscriptions require a free API key sent as an `X-OTX-API-KEY` header.
Quick facts
- Base URL
https://otx.alienvault.com/api/v1- Authentication
- General indicator lookups work anonymously. A free API key unlocks pulse subscriptions and some sections.
- Rate limit
- Not formally published; anonymous use is throttled more tightly than authenticated.
- Pricing
- Free, with a free account for higher limits.
- CORS
- Enabled — callable directly from browser JavaScript
- Official docs
- Read the docs
How to use the AlienVault OTX API
Every request below was executed against the live API on 2026-08-20, and the response shown is the real body it returned — not an illustration.
1. Look up threat intelligence for a domain
GET https://otx.alienvault.com/api/v1/indicators/domain/example.com/general
curl 'https://otx.alienvault.com/api/v1/indicators/domain/example.com/general'const res = await fetch("https://otx.alienvault.com/api/v1/indicators/domain/example.com/general");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);import requests
res = requests.get("https://otx.alienvault.com/api/v1/indicators/domain/example.com/general", timeout=20)
res.raise_for_status()
print(res.json()){
"sections": [
"general",
"geo",
"url_list",
"passive_dns",
"malware",
"whois",
"http_scans"
],
"whois": "http://whois.domaintools.com/example.com",
"alexa": "http://www.alexa.com/siteinfo/example.com",
"indicator": "example.com",
"type": "domain",
"type_title": "Domain",
"validation": [
{
"source": "akamai",
"message": "Akamai rank: #1608",
"name": "Akamai Popular Domain"
},
{
"source": "majestic",
"message": "Whitelisted domain example.com",
"name": "Whitelisted domain"
},
{
"source": "whitelist",
"message": "Whitelisted domain example.com",
"name": "Whitelisted domain"
}
],
"base_indicator": {
"id": 95944,
"indicator": "example.com",
"type": "domain",
"title": "",
"description": "",
"content": "",
"access_type": "public",
"access_reason": ""
},
"pulse_info": {
"count": 50,
"pulses": [
{
"id": "63d10e46581edfe9bba0da3f",
"name": "Microsoft Phishing Collection",
"description": "This page stores Microsoft phishing page IOCs. Legitimate website for the brand is https://microsoft.com\nNOLA defense is tracking newly observed phishing websites. Follow us on twitter https://twitter.com/noladefense",
"modified": "2026-08-19T15:37:55.946000",
"created": "2023-01-25T11:11:02.458000",
"tags": [
"urls",
"phishing",
"scam",
"microsoft"
],
"references": [
"https://www.virustotal.com/gui/collection/feParameters
| Parameter | Type | Required | Description |
|---|---|---|---|
indicators/domain/<domain>/<section> | path | Optional | Domain lookup. indicators/domain/example.com/general |
indicators/IPv4/<ip>/<section> | path | Optional | IP address lookup. indicators/IPv4/8.8.8.8/general |
indicators/file/<hash>/<section> | path | Optional | File hash lookup. indicators/file/<sha256>/general |
<section> | path | Optional | general, malware, url_list, passive_dns, whois, http_scans. general |
Response fields
sectionsarray- Which data sections are available for this indicator.
pulse_info.countinteger- How many threat reports reference this indicator — the key risk signal.
pulse_info.pulsesarray- The threat reports themselves, with names and tags.
whoisstring- Link to WHOIS data.
alexastring- Ranking link, where available.
(passive_dns) passive_dnsarray- Historical DNS resolutions for the indicator.
What you can build with the AlienVault OTX API
- Check whether a domain or IP appears in known threat reports
- Enrich security alerts with community threat intelligence
- Investigate malware infrastructure via passive DNS
- Build automated indicator reputation scoring
Common errors and how to fix them
pulse_info.count is 0
The indicator is not in any published pulse.
Fix: Absence is not proof of safety — it means nobody has reported it, not that it is clean.
403 on some sections
Certain sections need authentication.
Fix: Register a free account and send the key as an X-OTX-API-KEY header.
Throttled anonymously
Unauthenticated use is limited more tightly.
Fix: A free API key raises the allowance considerably.
AlienVault OTX API — frequently asked questions
Is AlienVault OTX free?
Yes, general indicator lookups work anonymously and a free account raises limits and unlocks additional sections.
What is a pulse?
A threat report published by an OTX community member, containing indicators of compromise. If an indicator appears in pulses, researchers have associated it with malicious activity.
Does a zero pulse count mean a domain is safe?
No. It means nobody has reported it, which is different from it being clean. Treat absence as an absence of evidence, not evidence of absence.
What is passive DNS useful for?
It shows historical resolutions for a domain or IP, which is how investigators map out related infrastructure — an attacker's domains often share hosting history.
Tools that pair with this API
AlienVault OTX is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-20; always check the official documentation before relying on this API in production, as terms and limits can change.