xThreat REST API Reference (v2.0)

Automate binary uploads, remote URL unpacking, hash correlation, and IOC intelligence queries using your SHA-256 hashed Bearer API key.

1. Authentication & API Keys

Generate Key in Console

Every API request must include an Authorization header containing your personal xth_live_... token generated in the Researcher Console. Keys are verified against their SHA-256 digest in Cloudflare D1.

Authorization: Bearer xth_live_<your_48_char_hex_secret>

POST/api/v1/analyze(multipart/form-data · Max 50 MB)

Uploads a binary, PE executable, ELF, or JAR/ZIP archive for static unpacking, C2 configuration extraction, VirusTotal v3 correlation, and Hatching Triage VM detonation.

curl -X POST https://xthreat.rip/api/v1/analyze \
  -H "Authorization: Bearer xth_live_YOUR_API_KEY" \
  -F "file=@./suspicious_sample.exe" \
  -F "isPrivate=false"

POST/api/v1/analyze(application/json · URL or Hash)

Streams and unpacks a remote payload URL (with SSRF protection and built-in upload.ee & dosya.co unpackers) or correlates an existing MD5 / SHA-1 / SHA-256 digest.

import requests

resp = requests.post(
    "https://xthreat.rip/api/v1/analyze",
    headers={
        "Authorization": "Bearer xth_live_YOUR_API_KEY",
        "Content-Type": "application/json",
    },
    json={
        "url": "https://example.com/stage2_loader.bin",
        "isPrivate": True,
    },
)
print(resp.json())
# {"success": True, "id": "XTH-...", "sha256": "...", "verdict": "MALICIOUS", "score": 94}

GET/api/report/:id_or_sha256

Returns the complete unified threat report including vendor verdicts, extracted C2 configurations, MITRE ATT&CK behavioral signatures, network flows, and PE/JAR sections. Pass ?refresh=true to re-poll upstream engines.

curl -H "Authorization: Bearer xth_live_KEY" \
  https://xthreat.rip/api/report/261013-redline9a

GET/api/intel?q=<indicator>

Queries the xThreat IOC database, VirusTotal v3, and ASN/Geo intelligence. Supports structured prefixes: hash:, ip:, domain:, family:.

curl -H "Authorization: Bearer xth_live_KEY" \
  "https://xthreat.rip/api/intel?q=ip:185.215.113.42"