Developer Resources

Public API

The posts API provides programmatic access to all published threat intelligence on blacktemple.net. Responses are cached at the CDN edge for 1 hour with stale-while-revalidate for 24 hours.

Query Parameters

Response Format

The response returns a JSON object with posts, total, limit, and offset fields. Each post object includes the following:

curl "https://blacktemple.net/api/posts?severity=critical&limit=5"

{
  "posts": [
    {
      "title": "Critical RCE in OpenSSL 4.0 Exploited in the Wild",
      "slug": "critical-rce-openssl-4-exploited-in-wild",
      "date": "2026-02-23T00:00:00.000Z",
      "category": "vulnerabilities-exploits",
      "severity": "critical",
      "tags": ["openssl", "rce", "cve-2026-1234"],
      "summary": "A critical remote code execution vulnerability in OpenSSL 4.0 is being actively exploited...",
      "tldr": "Patch OpenSSL immediately. CVE-2026-1234 allows unauthenticated RCE.",
      "source": "BleepingComputer",
      "sourceUrl": "https://example.com/article",
      "readingTime": { "text": "3 min read", "minutes": 2.8, "words": 560 }
    }
  ],
  "total": 42,
  "limit": 5,
  "offset": 0
}

Embeddable Threat Widget

The widget endpoint returns self-contained HTML that renders a compact threat intelligence feed. Embed it on any page via an iframe with no JavaScript dependencies. Shows posts from the last 7 days only. Cached at the CDN edge for 30 minutes.

Query Parameters

<iframe
  src="https://blacktemple.net/api/widget"
  width="400"
  height="500"
  style="border:none;border-radius:8px;"
  title="blacktemple.net Threat Feed"
></iframe>

<iframe
  src="https://blacktemple.net/api/widget?theme=light&limit=5&severity=critical,high"
  width="400"
  height="500"
  style="border:none;border-radius:8px;"
  title="blacktemple.net Threat Feed (Light)"
></iframe>

Live Preview

RSS Feeds

Subscribe to the full feed or narrow down to specific threat categories. All feeds are standard RSS 2.0 compatible with any reader.

Per-Category Feeds

Weekly Threat Reports

Every Sunday, an AI-generated weekly threat intelligence summary is published covering all posts from the past 7 days. These reports provide a consolidated view of the threat landscape.

• -Groups stories by theme with cross-references to original posts.
• -Includes severity statistics, trend analysis, and notable shifts from the previous week.
• -Published as a regular blog post tagged weekly-roundup.
• -Available in the main RSS feed and the Industry & Policy category feed.
• -Filter via the API using the weekly-roundup tag.

curl "https://blacktemple.net/api/posts?tag=weekly-roundup&limit=4"

Threat Actor Tracking

Posts are automatically scanned for mentions of 58 known threat actor groups. When a match is found, color-coded badges are applied to the post and linked to filtered tag views for easy tracking.

Badge Types

Tracked Groups

Actor badges link to filtered tag views. For example, clicking an "APT28" badge navigates to /blog/tags/apt28 showing all posts mentioning that group. Use the API to query programmatically:

curl "https://blacktemple.net/api/posts?tag=apt28&limit=10"