News API

One GET endpoint. One bearer token. Cyber-security stories from 50+ outlets, rewritten into plain-language briefs and tagged by topic, as JSON.

Authentication

Send your key as a bearer token:

Authorization: Bearer cisoai_...

X-API-Key: cisoai_... is accepted as an alternative, because clients reach for it. Bearer is the documented form.

The endpoint

GET https://cisoai.au/api/news

That is the whole API. There is no second endpoint, no SDK, and no OAuth flow.

Parameters

Categories

Threat Intelligence · Security News · Cybersecurity Research · Government Advisory · Industry News

Sources

The Hacker News, Infosecurity Magazine, CrowdStrike, Cisco Talos, Unit 42, Project Zero, Krebs on Security, Dark Reading, CISA, ASD's ACSC, and a financial wire whose per-story publisher is used as the source name. The live list is in every response under sources, so you never have to hard-code it.

Response

{
  "articles": [ /* see fields below */ ],
  "count": 20,
  "plan": "pro",
  "limit": 20,
  "fullBody": true
}

Article fields

Fields are additive. Nothing already published gets renamed or removed without notice, so parsing defensively for new keys is safe and parsing strictly is not.

Free and paid

The free tier needs no key and no signing up — use it to decide whether the data is worth paying for. Every field name you will eventually depend on is already in its response, so moving to a paid key is a header change and nothing else.

Pricing and keys →

Errors

Errors return JSON with an error field. Never treat a 5xx as an authentication failure — the two are deliberately kept distinct so you are not chasing a key problem during an outage.

Examples

curl

curl "https://cisoai.au/api/news?limit=50&category=Threat%20Intelligence" \
  -H "Authorization: Bearer $CISOAI_API_KEY"

Node

// Server-side. Never ship the key to a browser.
const response = await fetch(
  "https://cisoai.au/api/news?limit=200",
  { headers: { Authorization: `Bearer ${process.env.CISOAI_API_KEY}` } }
);
if (!response.ok) throw new Error(`news api ${response.status}`);
const { articles } = await response.json();

Python

import os, requests

r = requests.get(
    "https://cisoai.au/api/news",
    params={"limit": 200, "distinct": 1},
    headers={"Authorization": f"Bearer {os.environ['CISOAI_API_KEY']}"},
    timeout=30,
)
r.raise_for_status()
articles = r.json()["articles"]

Serving it to your own front end

The pattern to copy: a small server-side route holds the key and your page calls that route same-origin. This is how bugxhunter.com renders its feed — a Cloudflare Pages Function that proxies, with the key in a secret and never in the markup.

// functions/api/news.js — your origin, your cache, your key stays server-side
export async function onRequest({ env }) {
  const upstream = await fetch("https://cisoai.au/api/news?limit=24", {
    headers: { Authorization: `Bearer ${env.CISOAI_API_KEY}` },
  });
  if (!upstream.ok) return new Response('{"articles":[]}', {
    headers: { "Content-Type": "application/json" },
  });
  return new Response(await upstream.text(), {
    headers: {
      "Content-Type": "application/json",
      "Cache-Control": "public, max-age=300",
    },
  });
}

Note the empty-list fallback rather than an error: a news section is worth degrading, not worth breaking a page over.

Limits and freshness

• The corpus refreshes every three hours. Polling more often than that mostly returns what you already have. Once or twice an hour is plenty.
• Cache your responses. Five minutes is a sensible floor and costs you nothing in freshness.
• No monthly request cap, but 60 requests per minute. The limit is per key, not per IP address, so nothing another customer does can affect you. Go over it and you get 429 Rate limit exceeded with a Retry-After header; wait that long and you are through. It exists so a runaway loop is throttled rather than billed, and it is roughly two orders of magnitude above the polling this page recommends. Planning something high-volume? Tell us first and we will say honestly whether this is the right fit.
• Roughly 28 new stories a day, with a retention window of 200. If you need a longer archive, ask.

Managing your key

• Issued once. Your key is emailed when payment clears and shown once on the page you land on afterwards. We store a hash of it, not the key, so nobody here can read it back to you.
• Lost it? Email us and we will issue a replacement and revoke the old one.
• Failed payment suspends rather than deletes. Your key resumes working once the payment goes through, so you never have to deploy a new credential because a card expired.
• Cancelling leaves your key working until the end of the period you have paid for.
• Use a separate key per application. Then revoking one never takes out another, and their usage is distinguishable.

Attribution and terms

Briefs are rewritten summaries of publicly available reporting, not reproductions of it. Every record names its source and links the originalUrl.

• Link to originalUrl when you republish. The reporting is someone else's work and the link is how they are credited.
• Credit CISO AI where the briefs themselves are displayed.
• Do not resell the feed as a competing data product.
• Content is provided as-is for information. It is not security advice, and it should not be the only thing standing between you and a decision that matters.