API Reference

The Babel API gives programmatic access to the entire threat intelligence knowledge graph — actors, clusters, campaigns, tools, indicators, TTPs, CVEs, and reports.

Programmatic read access to the Babel API requires a membership key. The Babel website remains free and open — no account needed to browse.

Base URL

Base URLhttps://api.getbabel.io

Conventions

• All responses are JSON.
• All timestamps are ISO 8601 (UTC).
• Entity IDs are UUIDs. Most entity types also support lookup by slug (e.g. /actors/muddywater).
• Error responses return { "error": "message" } with an appropriate HTTP status code.

Access

Babel is free to use and always will be — the website needs no account, no key, nothing gated. Everything is there.

The API is the same corpus, in a form you can query directly: pull indicators into your pipeline, script against the graph, integrate with your own tooling. Serving that costs real infrastructure, so an API key comes with supporting Babel — either way you choose:

• Membership — fund the infrastructure.
• Intel Contributor — contribute intelligence instead.

Authentication

Authorization: Bearer YOUR_API_KEY

The same token is returned when you log in via POST /auth/login. Members and Intel Contributors can find their API key at any time on their profile page.

Rate limits

Limits are enforced per IP address and apply equally to all authenticated roles.

Endpoint group	Limit
All API requests combined	300 requests / minute
Ingest endpoints (POST /ingest, /ingest/stream, /ingest/text)	20 requests / 5 minutes
Re-enrichment (POST /indicators/:id/enrich)	5 requests / 10 minutes
Login, registration and password reset (POST /auth/login and similar)	10 requests / 15 minutes

The 300-per-minute limit is a single shared bucket across every endpoint, not per endpoint. The ingest, re-enrichment and login limits apply on top of it. Exceeding any limit returns 429 Too Many Requests.

Submissions also count against a monthly quota per account (submissions and extracted entities). The quota resets on the 1st of each month, and GET /contributor/me shows your current quota.

Endpoints without a key

GET /stats (platform-wide counts) is open and needs no key. Every other read endpoint requires a membership key.

Sources

GET/sources

Returns all intelligence sources known to Babel — the named publications, vendors, and organisations whose reports have been ingested.

Membership API key required (Bearer token). Returns an array of source objects:

Field	Type	Description
id	uuid	Unique identifier
name	string	Source name (e.g. Kaspersky)
type	string	Source category
url	string	Homepage of the source organisation
description	string	Brief description
evidence_type	string	Kind of evidence the source publishes: primary_research / advisory / independent / aggregator