API v1.1.0

Hanasand Public Intelligence API

Customer onboarding

Organization, API key, first request.

Each key is for one organization, expires after 90 days, and is shown only once.

Checking your signed-in organizations.

Authenticated request

curl "https://api.hanasand.com/api/v1/actors?page=1&limit=20" \
  -H "X-API-Key: $HANASAND_API_KEY"

Authentication

Send a provisioned key in X-API-Key. Single search is anonymously rate-limited; batch search and most collection routes accept an exact method-and-route key scope or an authenticated session. organization-specific alerts require an organization API key.

Responses include X-Request-Id and quota headers. API responses are no-store; a batch returns HTTP 207 when one or more queries fail.

Endpoints

Method	Path	Purpose	Access	Key scope
POST	/ti/search	Search public threat intelligence	Anonymous	None
POST	/ti/search/batch	Search up to 25 unique queries	API key or session	POST /api/v1/ti/search/batch
GET	/actors	List threat actors	API key or session	GET /api/v1/actors
GET	/aliases	List alternative names for threat actors	API key or session	GET /api/v1/aliases
GET	/incidents	List reported security incidents	API key or session	GET /api/v1/incidents
GET	/findings	List findings extracted from source reports	API key or session	GET /api/v1/findings
GET	/evidence	List source records supporting actors, incidents, and findings	API key or session	GET /api/v1/evidence

Generate TypeScript types

npx openapi-typescript https://hanasand.com/api/openapi/ti -o src/hanasand-api.d.ts

Pagination

Use page=1, page=2, and so on. Set limit to the number of records per page, up to 100 (default 50). Responses include pagination.totalPages and pagination.nextPage. A null next page means you have reached the end.

Typed client

import createClient from 'openapi-fetch'
import type { paths } from './hanasand-api'

const api = createClient<paths>({
  baseUrl: 'https://api.hanasand.com/api/v1',
  headers: { 'X-API-Key': process.env.HANASAND_API_KEY! }
})

const { data, error } = await api.GET('/actors', {
  params: { query: { page: 1, limit: 20 } }
})
if (error) throw new Error(error.error.message)

Errors

BadRequestInvalid input

UnauthorizedMissing or invalid credentials

ForbiddenCredential scope does not permit this operation

RateLimitedRate limit exceeded

InternalErrorUnexpected request processing failure

UnavailableUpstream intelligence service unavailable

Response contents

Public responses exclude raw stolen material, restricted locators, customer tenant data, secrets, and internal object references.