Threat Feed API

The Threat Feed exposes your workspaces’ attack data over a simple REST API — first-party signal from your own machines, ready for a firewall, SIEM, or script.

API keys

Create keys under Integrations:

• Name, expiry (never / 30 / 90 / 365 days), and scope:
  • workspace — this workspace’s data only;
  • provider — your whole MSP scope (you + managed customers) with one key.
• The full key (dyn_live_…) is shown once at creation — store it then. The list afterwards shows only a prefix, status, and last-used time.
• Revoke takes effect immediately. Rotate by creating a new key, switching consumers, then revoking the old.

Authenticate with a Bearer header:

curl -H "Authorization: Bearer dyn_live_XXXXXXXX" \
  "https://api.dynacop.com/api/v1/attacks"

The Integrations screen shows ready-to-paste curl / PowerShell / Postman examples with your key.

The attacks endpoint

GET /api/v1/attacks returns attacking source IPs seen against your fleet, with attempts, service, first/last seen, and block state.

Useful query parameters:

Parameter	Meaning
days / since	Time range: days=1..30 (default 7) or an ISO 8601 since timestamp
min_attempts	Only sources at or above this attempt count
blocked	true / false — only blocked (or only unblocked) sources
format	json (default) or text — a plaintext IP list, one IP per line, ideal for firewall/blocklist ingestion (Accept: text/plain also selects it)

Responses support ETag: send If-None-Match and you’ll get a cheap 304 Not Modified when nothing changed — poll politely.

Excluding sensitive resources

Any resource can be excluded from all API output with its API export policy switch (for example, domain controllers). Opt-out wins everywhere — the feed, and any public statistics.

Privacy contract

The feed contains attacker-side data only. Usernames tried by attackers are visible in the panel, not in the feed; your internal names (workspaces, resources, people) never leave through this API.