Shadowserver Foundation API
Community OpenAPI document · agent-readySecurityThreat DetectionapiKey10 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Programmatically query asn origin for ip addresses, get malware sample information. Covers 10 operations with apiKey authentication.
Use for: I need to query asn origin for ip addresses, I want to malware sample information, Search for honeypot cve statistics, Find all exploited vulnerability statistics
Not supported: Does not handle payments, communications, or crm - use for security only.
Shadowserver Foundation provides APIs for querying ASN/network routing data, malware information, honeypot statistics, and security reports. The API exposes 10 endpoints secured with apiKey authentication.
Install Jentic One Beta
Connect the Shadowserver Foundation API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Shadowserver Foundation API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fshadowserver.org%2Fshadowserver" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fshadowserver.org%2Fshadowserver" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Shadowserver Foundation API.
Query ASN origin for IP addresses
Get malware sample information
List subscribed report lists
Query and filter Shadowserver Foundation API records by parameters
Monitor Shadowserver Foundation API operational status and events
Use Cases
Patterns agents use Shadowserver Foundation API for, with concrete tasks.
★ Security Operations
Use the Shadowserver Foundation API to perform security operations programmatically. The API provides 10 endpoints covering core functionality including query asn origin for ip addresses, get malware sample information, get honeypot cve statistics.
Call GET /net/asn to query asn origin for ip addresses
Automated ASN Management
Automate asn operations by combining multiple Shadowserver Foundation API endpoints. Agents can get malware sample information and then get honeypot cve statistics in a single workflow.
Call GET /malware/info to get malware sample information, then verify the result
AI Agent Integration via Jentic
AI agents discover and call Shadowserver Foundation API endpoints through Jentic without managing credentials directly. An agent searches for the required operation by intent, receives the matching endpoint schema, and executes the call with Jentic-managed authentication. This eliminates the need to read API documentation or handle apiKey tokens manually.
Search Jentic for 'query asn origin for ip addresses', load the operation schema, and execute with Jentic-managed credentials
Key Endpoints
10 endpoints — shadowserver foundation provides apis for querying asn/network routing data, malware information, honeypot statistics, and security reports.
METHOD
PATH
DESCRIPTION
GET
/net/asn
Query ASN origin for IP addresses
GET
/malware/info
Get malware sample information
POST
/honeypot/common-vulnerabilities
Get honeypot CVE statistics
POST
/honeypot/exploited-vulnerabilities
Get exploited vulnerability statistics
POST
/honeypot/vulnerability-count
Get vulnerability count
POST
/reports/subscribed
List subscribed report lists
POST
/reports/types
List available report types
POST
/reports/list
List available reports
GET
/net/asn
Query ASN origin for IP addresses
GET
/malware/info
Get malware sample information
POST
/honeypot/common-vulnerabilities
Get honeypot CVE statistics
POST
/honeypot/exploited-vulnerabilities
Get exploited vulnerability statistics
POST
/honeypot/vulnerability-count
Get vulnerability count
POST
/reports/subscribed
List subscribed report lists
POST
/reports/types
List available report types
POST
/reports/list
List available reports
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the Shadowserver Foundation API by hand means passing your apikey as a query parameter on every call to api.shadowserver.org and threading it through each report and honeypot request yourself. Through Jentic you install once, import the Shadowserver Foundation API from the API Directory, store the key once, and your agent calls it.
Permission scoping
Shadowserver takes its targets in the request body rather than as path resources, so scope the agent to the operations it needs, such as querying ASN origin or listing subscribed reports, and leave out the ones it should not run.
Credential isolation
Your Shadowserver Foundation API key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'query ASN origin for an IP' or 'list subscribed reports', and Jentic returns the matching Shadowserver operation with its input schema so the agent calls the right endpoint without browsing the reference docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
Alternative
Snyk
Alternative security API
Choose Snyk when you need a different approach to security operations
FAQs
Specific to using Shadowserver Foundation API through Jentic.
What authentication does the Shadowserver Foundation API use?
The Shadowserver Foundation API uses an API key passed in the `apikey` query. Through Jentic, these credentials are stored encrypted in your Jentic One instance and injected at execution time, so raw secrets never enter the agent context.
Can I query asn origin for ip addresses with the Shadowserver Foundation API?
Yes. Use the GET /net/asn endpoint. The API returns structured JSON responses that agents can parse and act on directly.
What are the rate limits for the Shadowserver Foundation API?
Rate limits are not specified in the OpenAPI spec. Check the vendor documentation for current limits. Through Jentic, rate limiting is handled automatically with retry logic built into the execution layer.
How do I query asn origin for ip addresses through Jentic?
Install the Jentic SDK with pip install jentic, authenticate through Jentic One, the self-hosted execution layer, then search for 'query asn origin for ip addresses'. Jentic returns the matching Shadowserver Foundation API operation with its input schema. Load the schema and execute the call - credentials are injected automatically.
How many endpoints does the Shadowserver Foundation API have?
The Shadowserver Foundation API exposes 10 endpoints covering asn, malware, honeypot operations.
Can I limit what my agent is allowed to do with the Shadowserver Foundation API?
Yes. Jentic One is self-hosted, so you run it yourself and your own rules decide which Shadowserver operations and credentials the agent may use. Because Shadowserver takes its targets in the request body rather than as path resources, you scope the agent to only the operations it needs, such as GET /net/asn to query ASN origin or POST /reports/subscribed to list subscribed reports. You leave out the operations it should not run, so the agent cannot reach honeypot statistics or malware lookups unless you allow them.
GET STARTED