API and feeds

Everything on the Wall is available as a feed. The human feeds are open to anyone; the machine feed needs a free key so we can keep an eye on abuse.

Feeds — no key needed

Each entry is one published report: title, a plain-language summary, the severity, the report URL and the date it was published. Summaries are defanged — a feed reader can't turn one into a live link. Payload excerpts are never in a feed.

Feeds are cached at the edge and update when a report is published. Polling every few minutes is plenty; polling every second just gets you the cached copy.

Indicators — the machine feed

GET /api/v1/indicators returns a flat list, the shape a SIEM or a blocklist wants:

{
  "generated_at": "2026-03-12T09:41:00.000Z",
  "indicators": [
    {
      "url": "https://github.com/example/repo",
      "severity": "high",
      "technique": "agent_config_poisoning",
      "status": "live",
      "first_seen": "2026-03-01T14:22:10.000Z",
      "last_checked": "2026-03-12T06:00:00.000Z",
      "report_url": "https://malprompt.com/report/example-repo"
    }
  ]
}

Fields:

• url — the canonical target URL.
• severity — one of critical, high, medium, low, info. See the severity guide.
• technique — the classification of the report's most serious finding.
• status — live if the content is still public, removed if it's gone, unknown if we haven't been able to check.
• first_seen — when the report was published.
• last_checked — the last time we confirmed whether it's still there.
• report_url — the human-readable report.

No excerpt, no payload text, ever. If you need the evidence, open the report.

Getting a key

Sign in, open your account page, and create a key with a label so you remember what it's for. The key is shown once — we only keep a hash of it, so we can't show it to you again. Lost it? Revoke it and make another. Five active keys per account.

Send it as a bearer token:

curl -H "Authorization: Bearer mp_your_key_here" \
  https://malprompt.com/api/v1/indicators

A missing, unknown or revoked key gets the same 401 with the same body, on purpose — the endpoint won't tell anyone whether a key exists.

Rate limits

Keys are limited by the minute — 60 requests a minute on the free tier, counted per account rather than per key, so making a second key does not buy you a second allowance. Over the limit you get a 429 and a Retry-After header saying how long to wait. We record when each key was last used and how many requests it has made; that's how we spot a runaway script, and it's the only usage tracking on the endpoint.

The open feeds have no key and no per-key limit, but they are cached, so hammering them gains nothing.

Being a good citizen

• Cache what you fetch and respect Retry-After.
• Poll the feeds on the order of minutes, not seconds.
• Don't scrape the HTML pages — everything on them that's meant to be machine-readable is in the feeds.
• Doing something interesting with the data, or need a higher limit? Write to [email protected] and tell us about it.