Ingest a Report

Submit a publicly accessible intelligence report for automated extraction and ingestion. Babel fetches the URL, extracts entities and relationships using LLM analysis, enriches any indicators, and merges results with the existing knowledge graph.

Submit a report

POST/ingestAuth required

Submit a report URL. Processing runs synchronously — the response is returned once ingestion completes.

Parameter	Type		Description
url	string	req	Publicly accessible URL of the report or advisory

Example request

curl -X POST https://api.getbabel.io/ingest \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://example.com/threat-report.pdf" }'

Response shapes

Processing runs synchronously — the response is returned once ingestion completes. Three outcome shapes are possible:

Success — new report processed:

{
  "success": true,
  "already_exists": false,
  "primary": {
    "report_id": "a3f2c8d1-...",
    "title": "MuddyWater targets Israeli organisations",
    "summary": {
      "source": "Kaspersky",
      "actors": 1,
      "clusters": 0,
      "campaigns": 0,
      "tools": 2,
      "ttps": 8,
      "cves": 1,
      "indicators": 12,
      "edges": 34,
      "historical_skipped": 0
    }
  },
  "depth1": [],
  "depth2": [],
  "already_existed": [],
  "failed": []
}

depth1 and depth2 contain summary objects for any discovery URLs followed during ingestion. already_existed lists URLs already in the database. failed lists URLs that could not be fetched.

Already ingested — URL was previously processed:

{
  "success": true,
  "already_exists": true,
  "title": "MuddyWater targets Israeli organisations",
  "url": "https://example.com/threat-report.pdf"
}

Fetch failed — the URL could not be retrieved:

{
  "success": false,
  "fetch_failed": true,
  "url": "https://example.com/threat-report.pdf",
  "tried": ["https://example.com/threat-report.pdf"],
  "error": "HTTP 403"
}

Streaming ingestion

POST/ingest/streamAuth required

Same as /ingest but uses server-sent events to stream progress updates in real time. Useful for UI integrations.

Text ingestion

POST/ingest/textAuth required

Submit raw report text instead of a URL. Use when the target page is behind a paywall or login.

Parameter	Type		Description
url	string	req	Canonical URL of the report (used for deduplication and provenance — the page does not need to be accessible)
text	string	req	Full text content of the report (max 5 MB)