Skip to content

Vysion API Documentation

Vysion provides a powerful API for accessing threat intelligence information from our comprehensive database. Our API enables you to search and retrieve critical data from multiple threat intelligence sources.

  • Document Intelligence: Search through extensive threat intelligence documents
  • Ransomware Tracking: Access detailed ransomware victim and statistics data
  • Instant Messaging Intelligence: Retrieve data from various messaging platforms
  • Real-time Feeds: Subscribe to live threat intelligence feeds
  • Multiple Integrations: Native Python library, MISP and OpenCTI integrations, and MCP server

You can make your first authenticated request in a few minutes. The Quickstart walks through each step in detail, including how to read the response and refine a search.

  1. Get an API key

    Contact us with your use case and organization details. Your key authorizes every request through the x-api-key header. See Authentication.

  2. Send a request

    All endpoints live under https://api.vysion.ai/api/v2 and return JSON. Try the example below with curl or the Python client.

  3. Read the result

    Search endpoints return a data object with a total count and a list of hits. The Quickstart explains the main fields.

  4. Go deeper

    Add query operators, date ranges and network filters, then move on to leaks, ransomware, instant messaging and feeds in the API reference.

We provide comprehensive language bindings and examples in:

  • Shell/cURL - Direct HTTP API access
  • Python - Official Python client library
  • MISP - Native MISP module integration
  • OpenCTI - Docker Compose connectors
  • MCP - Server for AI assistants
Terminal window
curl "https://api.vysion.ai/api/v2/document/search?q=malware" \
--header 'Accept: application/json' \
--header 'x-api-key: YOUR_API_KEY'

This documentation covers Vysion API v2.0.0