Threat Feed API
The Threat Feed exposes your workspaces’ attack data over a simple REST API — first-party signal from your own machines, ready for a firewall, SIEM, or script.
API keys
Section titled “API keys”Create keys under Integrations:
- Name, expiry (never / 30 / 90 / 365 days), and scope:
- workspace — this workspace’s data only;
- provider — your whole MSP scope (you + managed customers) with one key.
- The full key (
dyn_live_…) is shown once at creation — store it then. The list afterwards shows only a prefix, status, and last-used time. - Revoke takes effect immediately. Rotate by creating a new key, switching consumers, then revoking the old.
Authenticate with a Bearer header:
curl -H "Authorization: Bearer dyn_live_XXXXXXXX" \ "https://api.dynacop.com/api/v1/attacks"The Integrations screen shows ready-to-paste curl / PowerShell / Postman examples with your key.
The attacks endpoint
Section titled “The attacks endpoint”GET /api/v1/attacks returns attacking source IPs seen against your fleet, with attempts, service, first/last seen, and block state.
Useful query parameters:
| Parameter | Meaning |
|---|---|
days / since |
Time range: days=1..30 (default 7) or an ISO 8601 since timestamp |
min_attempts |
Only sources at or above this attempt count |
blocked |
true / false — only blocked (or only unblocked) sources |
format |
json (default) or text — a plaintext IP list, one IP per line, ideal for firewall/blocklist ingestion (Accept: text/plain also selects it) |
Responses support ETag: send If-None-Match and you’ll get a cheap 304 Not Modified when nothing changed — poll politely.
Excluding sensitive resources
Section titled “Excluding sensitive resources”Any resource can be excluded from all API output with its API export policy switch (for example, domain controllers). Opt-out wins everywhere — the feed, and any public statistics.
Privacy contract
Section titled “Privacy contract”The feed is scoped to your key: a workspace key sees only that workspace; a provider key sees your managed customers. For each attacker IP it returns your own resource names — and, for provider keys, your customer workspace names — so you can tell which of your machines an IP hit. These are your own names for your own assets, returned only to your own scoped key.
The feed does not include the usernames attackers tried (those are visible in the panel only) or any internal database identifiers. Any resource can be excluded from all API output with its API export policy switch.