Skip to content
POST/api/v2/ioc/history

Query history (retired, moved to the Management API)

Retrieve past IOC Verdict queries, optionally filtered by indicator type, time range, or company. > **Retired. Use the Management API instead:** > `GET /api/v2/mgmt/enrich-logs/search-history`. It accepts the same API > key (or a dashboard session) and returns a paginated, filterable list > of the tenant's IOC Verdict queries. Note that it is **not** gated on > the `history` permission, and its filter set is not a superset of the > body below: `bulk_request_id`, `http_status`, `indicator_normalized` > and the `label*` filters are not currently exposed there. > > This route is retired in the Enrich API and returns `404`. The > request/response schemas below are kept for reference only: they > document the historical Enrich contract, **not** the Management API > contract, and no plan exists to re-enable this path.

HistoryView OpenAPI spec ↗

Request body

  • date_gtestring
    Start date (inclusive)
  • date_ltstring
    End date (exclusive)
  • user_idstring
  • apikeystring
  • bulk_request_idstring
  • exclude_bulk_requestsboolean
  • http_statusinteger
  • auth_typestring
  • indicator_typeenumipdomainip_blockfile_hash_sha256asn
  • indicator_valuestring
  • indicator_normalizedstring
  • label_directionenumsafemalicious
  • label_familystring
  • label_groupstring
  • label_namestring
  • labelstring

Example

json
{
  "date_gte": "2026-01-01T00:00:00Z",
  "date_lt": "2026-01-01T00:00:00Z",
  "user_id": "string",
  "apikey": "string",
  "bulk_request_id": "string",
  "exclude_bulk_requests": false,
  "http_status": 0,
  "auth_type": "string",
  "indicator_type": "ip",
  "indicator_value": "string",
  "indicator_normalized": "string",
  "label_direction": "safe",
  "label_family": "string",
  "label_group": "string",
  "label_name": "string",
  "label": "string"
}

Responses

Query history

  • resultsobject[]
    • datestring
    • apikeystring
    • bulk_request_idstring
    • http_statusinteger
    • auth_typestring
    • indicatorIndicatorObject
    • evidence_detailsstring
    • label_detailsstring
    • riskobject
    • scoresobject
    • labelsobject[]
    • label_countinteger

Code samples

bash
curl -X POST 'https://api.verdictiq.io/api/v2/ioc/history' \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: sk_<your-api-key>' \
  -d '{
  "date_gte": "2026-01-01T00:00:00Z",
  "date_lt": "2026-01-01T00:00:00Z",
  "user_id": "string",
  "apikey": "string",
  "bulk_request_id": "string",
  "exclude_bulk_requests": false,
  "http_status": 0,
  "auth_type": "string",
  "indicator_type": "ip",
  "indicator_value": "string",
  "indicator_normalized": "string",
  "label_direction": "safe",
  "label_family": "string",
  "label_group": "string",
  "label_name": "string",
  "label": "string"
}'