API Reference
The Babel API gives programmatic access to the entire threat intelligence knowledge graph — actors, clusters, campaigns, tools, indicators, TTPs, CVEs, and reports.
Read endpoints are open — no account required. Register to get an API key to submit reports and access contributor features.
Base URL
Base URLhttps://api.getbabel.io
Conventions
- All responses are JSON.
- All timestamps are ISO 8601 (UTC).
- Entity IDs are UUIDs. Most entity types also support lookup by
slug(e.g./actors/muddywater). - Error responses return
{ "error": "message" }with an appropriate HTTP status code.
Authentication
Read endpoints are public. A Bearer token is required only to submit reports (Intel Contributor access) and to access account features. Register at getbabel.io to get your API key — available after email verification.
Authorization: Bearer YOUR_API_KEYThe same token is returned when you log in via POST /auth/login. You can also find your API key at any time on your profile page.
INFO
Access is role-based. Every registered account gets Reader access (full read access to all endpoints). To submit reports you need Intel Contributor access — apply here.
Roles
| Role | Read | Submit reports |
|---|---|---|
| reader | All endpoints | No |
| analyst | All endpoints | No |
| contributor | All endpoints | Yes (monthly quota applies) |
| master | All endpoints | Yes (higher quota) |
| admin | All endpoints | Yes (unlimited) |
Rate limits
Limits are enforced per IP address and apply equally to all roles, including unauthenticated requests.
| Endpoint group | Limit |
|---|---|
| Read endpoints (all GET routes) | 300 requests / minute |
| Ingest endpoints (POST /ingest and variants) | 20 requests / 5 minutes |
The read limit is a single shared bucket across all read endpoints combined, not per-endpoint. Exceeding either limit returns 429 Too Many Requests.
Sources
GET/sources
Returns all intelligence sources known to Babel — the named publications, vendors, and organisations whose reports have been ingested.
No authentication required. Returns an array of source objects:
| Field | Type | Description |
|---|---|---|
id | uuid | Unique identifier |
name | string | Source name (e.g. Kaspersky) |
type | string | Source category |
url | string | Homepage of the source organisation |
description | string | Brief description |
Source reliability classification — coming soon.
STIX 2.1 export — coming soon.