The Signal HTTP API. Base URL https://ninjasignal.ninja. Public endpoints need no key and are rate-limited per IP. Keyed endpoints are included in the Team tier — send your key in the X-API-Key header.
/api/intel/defconauth: noneToday's DEFCON threat brief as JSON — level, headline threat, ranked from CISA KEV, EPSS, CVSS and ubiquity. Reads the once-a-day published artifact; a request can never trigger model spend.
curl https://ninjasignal.ninja/api/intel/defcon
/api/v1/threat/checkauth: noneInstant IOC / CVE verdict from the live graph — compact shape built for widgets and integrations. Verdicts: malicious, suspicious, known, unknown, with confidence 0–100.
iocthe value to check — IP, domain, URL, hash or CVE id (max 500 chars)curl "https://ninjasignal.ninja/api/v1/threat/check?ioc=CVE-2024-3400"
/api/intel/crawlersauth: noneAI Crawler Observatory data — which AI bots read the estate, verified vs impersonated per source IP. Deterministic, computed from edge logs.
curl https://ninjasignal.ninja/api/intel/crawlers
/api/intel/crawlers/impersonators.txtauth: nonePlain-text blockable feed of IPs sending AI-crawler user-agents from networks that are not the real operator. One IP per line — drop straight into a WAF or firewall list.
curl https://ninjasignal.ninja/api/intel/crawlers/impersonators.txt
/api/intel/askauth: noneAsk-the-graph showcase — curated natural-language→Cypher examples with real answers, served from a cached artifact. Free-form questions are available to signed-in users.
curl https://ninjasignal.ninja/api/intel/ask
/api/rules/exportauth: API key (Team tier)Export live graph IOCs as a ready-to-deploy detection rule. Deterministic, zero-LLM — Sigma output converts to 20+ SIEMs via sigma-cli.
ioc_typeip · domain · hash · md5 · sha1 · sha256 · url (default ip)formatsigma · yara · suricata · splunk (default sigma)limitmax IOCs to include, up to 500 (default 200)curl "https://ninjasignal.ninja/api/rules/export?ioc_type=ip&format=sigma"
/api/stix/exportauth: API key (Team tier)Full STIX 2.1 JSON bundle of graph intelligence, filterable by object type, actor and date.
typescomma-separated STIX object types (optional)actorscomma-separated actor names (optional)sinceISO date — only objects seen after this (optional)tlp_maxhighest TLP marking to include (default amber)curl "https://ninjasignal.ninja/api/stix/export?since=2026-08-01&tlp_max=amber"
Signal speaks TAXII 2.1, so any standards-compliant client can subscribe to graph intelligence as STIX 2.1 objects — no bespoke integration.
/api/taxii2/auth: noneTAXII 2.1 discovery document — server title, contact and the API root.
/api/taxii2/collections/auth: noneList every TAXII collection this server exposes (metadata only).
/api/taxii2/collections/{collection_id}auth: noneMetadata for a single collection.
/api/taxii2/collections/{collection_id}/objects/auth: none for the public ransomware collection; API key for the premium collectionSTIX 2.1 objects from a collection — point any TAXII 2.1 client (OpenCTI, MISP, ThreatConnect…) at this server and pull. Also available as /manifest/ with the same parameters. 30 requests/minute.
added_afterRFC 3339 timestamp — only objects Signal added or refreshed after this (optional). date_added (manifest + X-TAXII-Date-Added-First/Last headers) is Signal's server ingest time, not the STIX created datelimitpage size (default 1000, max 5000). Changed Oct 2026: responses are now paged by default — previously the whole collection came back in one response; follow "next" while "more" is truenextopaque cursor from the previous page's "next" field; "more": true means another page existscurl "https://ninjasignal.ninja/api/taxii2/collections/{id}/objects/?limit=1000"