HoneyDB
Get API key
API

HoneyDB API

Access current threat information via the HoneyDB API. The API provides data on active bad hosts, honeypot interaction details, stats, historical data, and various helper endpoints for additional context.

Terms and Conditions

HoneyDB is a community-driven honeypot data aggregation platform. HoneyDB collects and publishes honeypot data via its platform API. Registered HoneyDB users can access the API free of charge for non-commercial uses.

Cases that involve commercialization require a commercial, non-free license. Examples include Managed/Software-as-a-Service services, distributing HoneyDB data as a commercial product, or using/distributing HoneyDB data as a value-added service/product.

For more information about commercial licensing, see the commercial plan offerings.

HoneyDB makes no guarantees as to the availability of its services (website and APIs). In addition, all information is provided “as is” and HoneyDB disclaims all warranties. All access to the server is logged.

Request Limits

In an effort to provide a stable service, an API request limit needs to be enforced to manage server load. Community accounts have a limit of 1,000 counted requests per day, resetting at midnight UTC. Enterprise and Commercial plans have monthly limits per their plan — see plans. When your account exceeds its request limit, the API will respond with a status code of 429 (Too Many Requests).

API query responses include headers to provide usage status. The consumed/remaining headers report numbers for your account’s active quota window — daily for Community, monthly for paid plans — indicated by the window header:

  • honeydb-qpm-consumed — counted queries you have submitted in the current quota window.
  • honeydb-qpm-remaining — counted queries remaining in the current quota window.
  • honeydb-quota-window — daily or monthly; which window the numbers above refer to.

Uncounted Endpoints

On all plans, geo, netinfo, ASN prefixes, CIDR expansion, and third-party threat list lookups don’t count toward your quota. Specifically, requests to the following endpoints are uncounted:

  • All netinfo endpoints (lookup, network-addresses, prefixes, as-name, geolocation)
  • All datacenter endpoints (AWS, GCP, IBM, Azure variants, Oracle, Cloudflare)
  • ip-cidr (CIDR expansion)
  • Third-party threat list lookups: ipinfo/tor, ipinfo/sansip, ipinfo/ciarmy, ipinfo/et-compromised, ipinfo/project-honeypot, ipinfo/pallebone, ipinfo/threatfox, ipinfo/blocklist-net-ua, and the equivalent ip-threatinfo endpoints

Documentation

HoneyDB API Documentation — hosted on Postman.

API Clients

HoneyDB API Python library and CLI tool — Python Package (GitHub).

pip install honeydb

SIEM / Threat Intel Platforms:

API Keys

Sign in to generate your API ID and secret key — your account and keys are created free on first sign-in.