Search results
This reference covers the indicator object in a lookup response. See request parameters, response metadata and response conventions. Pro fields provide additional context where available; compact views contain fewer fields.
Fields are conditional unless stated otherwise. Types below describe populated values; optional values may also be null. Access labels describe capability, not guaranteed data for every indicator.
URL fields
indicator| Field | Type | Meaning |
|---|---|---|
type | string | URL record. |
value | string | Opaque URL identifier. Reuse it for URL relationship requests; do not reconstruct it. |
analysis | object | Threat assessment. Field reference → |
first_seen | string | First observation time. ISO 8601 timestamp with timezone. |
last_seen | string | Latest observation time. ISO 8601 timestamp with timezone. |
tags | array<string> | Descriptive indicator labels. |
crowd_context | object · Pro | Community and actor context, where available. Field reference → |
relations | object | Related object groups when requested with full+relations and authorized. See Relationships. Field reference → |
url | string | Complete URL represented by the record. |
host | string | URL hostname. |
tld | string · Pro | Public suffix or top-level domain. |
indicator.contextobjectContext for an object returned through a relationship.
| Field | Type | Meaning |
|---|---|---|
relationship | string | Relationship connecting this object to the source indicator. |
indicator.linksobjectOptional navigation links.
| Field | Type | Meaning |
|---|---|---|
self | string | Canonical resource link, when provided. |
indicator.httpobject · ProObserved HTTP response details.
| Field | Type | Meaning |
|---|---|---|
status_code | integer | Observed response status code. |
content_length | integer | Observed response content length in bytes. |
content_sha256 | string | SHA-256 of the observed response body. |
Illustrative response
Illustrative data showing the response structure. Optional fields may be omitted.
{
"meta": {
"request_id": "example-request",
"timestamp": "2026-01-15T12:00:00Z",
"quota_remaining": 100,
"took_ms": 12
},
"indicator": {
"type": "url",
"value": "aacc00f0518c9ab0a5c8a40a721eb816ba18db020c7d32e20f3b53a82c3d30ca",
"url": "https://beacon.example/path",
"host": "beacon.example",
"analysis": {
"malicious": true,
"severity": "medium",
"confidence": 60,
"detections": "28/32",
"family": "ExampleFamily",
"has_actor": false
},
"crowd_context": {
"misc_tags": [
"dropper"
]
},
"http": {
"status_code": 200,
"content_length": 512,
"content_sha256": "dacad43e2e6da5595622be3857f80e13d69c94d24b700ede8a2881e3ae42b36c"
},
"first_seen": "2026-01-15T12:00:00Z",
"last_seen": "2026-01-15T12:00:00Z"
}
}