HoneyDB API
Access current threat information via the HoneyDB API. The API provides data on active bad hosts, honeypot interaction details, stats, historical data, and various helper endpoints for additional context.
Terms and Conditions
HoneyDB is a community-driven honeypot data aggregation platform. HoneyDB collects and publishes honeypot data via its platform API. Registered HoneyDB users can access the API free of charge for internal use, including protecting their own organization’s systems. Running HoneyDB data through third-party tools you operate for your own defense, such as a SIEM, is internal use.
A commercial license is required to redistribute HoneyDB data, or to use it in any product, service or tool offered to others, whether free or paid. “Use” includes HoneyDB data that is ingested, indexed, processed, correlated, used to train models, or otherwise used as an input to that offering, whether or not the data appears in its output. Examples include managed security services (MSSP/MDR) that use HoneyDB data to protect their clients’ systems, Software-as-a-Service products, threat feeds, and IP reputation or lookup tools.
Redistribution means making HoneyDB data, or any output derived from it, available to anyone outside your organization. This includes raw records and derived indicators: a flag, label, score, verdict, or match result. An example is an IP lookup or reputation page that tells users an address “appears on HoneyDB” or “is a known bad host.” It also includes a score or verdict that HoneyDB data contributes to, even when it is combined with other sources. Using HoneyDB data inside your organization to make your own decisions (blocking, alerting, triage, research) is not redistribution.
For more information about commercial licensing, see the commercial plan offerings.
HoneyDB makes no guarantees as to the availability of its services (website and APIs). In addition, all information is provided “as is” and HoneyDB disclaims all warranties. All access to the server is logged.
Request Limits
In an effort to provide a stable service, an API request limit needs to be enforced to manage server load. Community accounts have a limit of 1,000 counted requests per day, resetting at midnight UTC. Enterprise and Commercial plans have monthly limits per their plan — see plans. When your account exceeds its request limit, the API will respond with a status code of 429 (Too Many Requests).
API query responses include headers to provide usage status. The consumed/remaining headers report numbers for your account’s active quota window — daily for Community, monthly for paid plans — indicated by the window header:
- honeydb-qpm-consumed — counted queries you have submitted in the current quota window.
- honeydb-qpm-remaining — counted queries remaining in the current quota window.
- honeydb-quota-window —
dailyormonthly; which window the numbers above refer to.
Uncounted Endpoints
Requests to the following endpoints don’t count toward your quota:
- Specific List threat lookups, /api/ip/<ip>/threatinfo/<list>, which return the list’s own data as published, where <list> is one of: sansip, project-honeypot, threatfox, blocklist-net-ua. The summary /api/ip/<ip>/threatinfo is counted.
- Datacenter endpoints: /api/datacenter/aws, /api/datacenter/gcp, /api/datacenter/ibm, /api/datacenter/azure, /api/datacenter/azure/china, /api/datacenter/azure/germany, /api/datacenter/azure/gov, /api/datacenter/oracle, /api/datacenter/cloudflare.
- Nodes endpoints: /api/nodes and /api/nodes/mydata.
- Monitors management endpoints, for every method: /api/monitors, /api/monitors/<client_id>, /api/monitors/clients, /api/monitors/clients/<client_id>, /api/monitors/notifications, /api/monitors/notifications/<client_id>. /api/monitors/logs is counted.
All other API requests count toward your quota.
Documentation
HoneyDB API Documentation — hosted on Postman.
API Clients
HoneyDB API Python library and CLI tool — Python Package (GitHub).
pip install honeydbSIEM / Threat Intel Platforms:
- FortiSOAR — Connector documentation
- Logstash — GEM Package (GitHub)
- OpenCTI — external-import connector (GitHub)
- Splunk — Splunkbase (GitHub)
- Splunk SOAR — Splunkbase (GitHub)
- ThreatQuotient — HoneyDB CDF (see the ThreatQ integration guide)
API Keys
Sign in to generate your API ID and secret key — your account and keys are created free on first sign-in.