ASTRA API

a security threat reporting & analysis dashboard

threat intelligence dashboard and API. all API endpoints require an API key. sign in with Google to get one.

base URL:
auth: pass X-API-Key: your_key header for authenticated requests.

download postman collection sign in to auto-inject your API key

endpoints

GET /api/indicators

list indicators, newest/highest-priority first.

param	type	description
`type`	string	filter: ip, domain, url, hash, email
`source`	string	filter by source: otx, urlhaus, threatfox
`priority_min`	float	minimum priority score (0-100)
`tag`	string	filter by tag
`search`	string	substring search on indicator value
`limit`	int	results per page (1-500, default 50)
`offset`	int	pagination offset

curl "https://aadi.zip/~astra/api/indicators?type=ip&priority_min=50&limit=10"

GET /api/indicators/{id}

get a single indicator by ID.

GET /api/stats

dashboard statistics: counts by type, source, priority distribution.

curl "https://aadi.zip/~astra/api/stats"

GET /api/export

bulk export indicators as JSON or CSV.

param	type	description
`format`	string	json or csv (default: json)
`type`	string	filter by indicator type
`priority_min`	float	minimum priority score
`limit`	int	max results (1-10000, default 1000)

curl "https://aadi.zip/~astra/api/export?format=csv&priority_min=25" -o threats.csv

GET /api/feeds

feed source status: last poll time, total indicators per source.

POST /api/poll

manually trigger a poll cycle (fetches all feeds, deduplicates, rescores). requires API key.

authentication

sign in with Google (button above) to get a personal API key. the dashboard itself uses a built-in frontend key for public viewing. API keys are generated server-side via OAuth only.

rate limits

tier	limit
API key	20 req/min (per key)

rate limit headers: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset

sources

AlienVault OTX: community threat intel pulses
abuse.ch URLhaus: malicious URL tracking
abuse.ch ThreatFox: IOC sharing platform
CISA KEV: known exploited vulnerabilities
Feodo Tracker: botnet C2 tracking

response format

{
  "data": [
    {
      "id": 42,
      "type": "ip",
      "value": "185.220.101.42",
      "source": "otx,threatfox",
      "tags": ["c2", "cobalt_strike"],
      "priority": 67.5,
      "priority_label": "high",
      "first_seen": 1722345600.0,
      "last_seen": 1722432000.0,
      "source_count": 2,
      "raw": {"pulse_id": "...", "threat_type": "..."}
    }
  ],
  "total": 1247,
  "limit": 50,
  "offset": 0
}