API Reference

The Babel API gives programmatic access to the entire threat intelligence knowledge graph — actors, clusters, campaigns, tools, indicators, TTPs, CVEs, and reports.

Programmatic read access to the Babel API requires a membership key. The Babel website remains free and open — no account needed to browse.

Base URL

Base URLhttps://api.getbabel.io

Conventions

• All responses are JSON.
• All timestamps are ISO 8601 (UTC).
• Entity IDs are UUIDs. Most entity types also support lookup by slug (e.g. /actors/muddywater).
• Error responses return { "error": "message" } with an appropriate HTTP status code.

Access

Babel is free to use and always will be — the website needs no account, no key, nothing gated. Everything is there.

The API is the same corpus, in a form you can query directly: pull indicators into your pipeline, script against the graph, integrate with your own tooling. Serving that costs real infrastructure, so an API key comes with supporting Babel — either way you choose:

• Membership — fund the infrastructure.
• Intel Contributor — contribute intelligence instead.

Authentication

Authorization: Bearer YOUR_API_KEY

The same token is returned when you log in via POST /auth/login. Members and Intel Contributors can find their API key at any time on their profile page.

Rate limits

Limits are enforced per IP address and apply equally to all authenticated roles.

Endpoint group	Limit
Read endpoints (all GET routes)	300 requests / minute
Ingest endpoints (POST /ingest and variants)	20 requests / 5 minutes

The read limit is a single shared bucket across all read endpoints combined, not per-endpoint. Exceeding either limit returns 429 Too Many Requests.

Sources

GET/sources

Returns all intelligence sources known to Babel — the named publications, vendors, and organisations whose reports have been ingested.

Membership API key required (Bearer token). Returns an array of source objects:

Field	Type	Description
id	uuid	Unique identifier
name	string	Source name (e.g. Kaspersky)
type	string	Source category
url	string	Homepage of the source organisation
description	string	Brief description