Iterating over IOCs

Without any Previous Results

To list all IOCs, use the cursor-based pagination. Here is an example in Python:

Iterating over iocs from Scratch

# /// script
# requires-python = ">=3.13"
# dependencies = [
#     "httpx",
# ]
# ///
import httpx

API_KEY = "<your_api_key_here>"
URL = "https://api.rosti.bin.re/v2/iocs"

HEADERS = {
    'X-API-Key': API_KEY
}

cursor = None
iocs = []
while True:
    print(f"fetching iocs, have {len(iocs)} so far")
    params = {"cursor": cursor} if cursor else {}
    r = httpx.get(URL, headers=HEADERS, params=params)
    rj = r.json()

    iocs.extend(rj['data'])

    meta = rj["meta"]
    if not meta["has_more"]:
        break

    cursor = meta["next_cursor"]

print(f"fetched {len(iocs)} iocs total")

With Previous Results

If you previsouly fetched IOCs and want to get only new or updated IOCs since your last fetch, you can use the timestamp parameter. This should be set to the timestamp value of the most recent report you have. Since IOCs come back sorted in descending order by timestamp, this is simply the timestamp value of the first report in your previous results.

Here the modified Python script to only fetch IOCs updated since a given timestamp:

Iterating over iocs from Timestamp Offset

# /// script
# requires-python = ">=3.13"
# dependencies = [
#     "httpx",
# ]
# ///
import httpx
from datetime import datetime

API_KEY = "<your_api_key_here>"
URL = "https://api.rosti.bin.re/v2/iocs"

HEADERS = {
    'X-API-Key': API_KEY
}

starting_point = datetime.fromisoformat("2025-09-01T14:23:17Z")
cursor = None
iocs = []

print(f"fetching iocs updated since {starting_point.isoformat()}")
while True:
    print(f"fetching iocs, have {len(iocs)} so far")
    params = {}
    if cursor:
        params["cursor"] = cursor
    if starting_point:
        params["timestamp"] = starting_point.isoformat()

    r = httpx.get(URL, headers=HEADERS, params=params)
    rj = r.json()

    data = rj['data']
    iocs.extend(data)

    meta = rj["meta"]
    if not meta["has_more"]:
        break
    cursor = meta["next_cursor"]

if iocs:
    # IOCs come back in descending order by timestamp,
    # so the first one is the new most recent IOC
    starting_point = datetime.fromisoformat(iocs[0]['timestamp'])

print(f"fetched {len(iocs)} IOCs total")
print(f"new starting point is {starting_point.isoformat()}")