News API

Three GET endpoints. One bearer token. Cyber-security stories from 28 outlets, rewritten into plain-language briefs and tagged by topic, as JSON.

Authentication

Send your key as a bearer token:

Authorization: Bearer cisoai_...

X-API-Key: cisoai_... is accepted as an alternative, because clients reach for it. Bearer is the documented form.

Endpoints

All three are on https://cisoai.au, take the same key and count against the same rate limit. There is no SDK and no OAuth flow.

To run a request from your browser with your own key, use the interactive reference. It is generated from the OpenAPI file, which you can also import into Postman or a code generator.

Latest briefs

GET https://cisoai.au/api/news

Categories

Threat Intelligence · Security News · Cybersecurity Research · Government Advisory · Industry News

Sources

The Hacker News, Infosecurity Magazine, CrowdStrike, Cisco Talos, Unit 42, Project Zero, Krebs on Security, Dark Reading, CISA, ASD's ACSC, and a financial wire whose per-story publisher is used as the source name. The live list is in every response under sources, as name and category pairs, so you never have to hard-code it.

Response

{
  "articles": [ /* see fields below */ ],
  "count": 20,
  "plan": "pro",
  "limit": 20,
  "fullBody": true,
  "sources": [ { "name": "Dark Reading", "category": "Threat Intelligence" } ]
}

sources lists every outlet the feed reads, whatever filters the request used.

Article fields

Fields are additive. Nothing already published gets renamed or removed without notice, so parsing defensively for new keys is safe and parsing strictly is not.

Archive search

GET https://cisoai.au/api/archive

/api/news stops at the newest 200 stories. The archive goes back to the first brief, in May 2025, and is where you search. It returns a light listing; fetch the full text of any result from /api/news/{slug}.

{
  "articles": [
    {
      "slug": "critical-sonicwall-sma-1000-flaw",
      "headline": "Critical SonicWall SMA 1000 Flaw Is Being Actively Exploited",
      "source": "Dark Reading",
      "tags": ["SonicWall", "vulnerability"],
      "publishedAt": "2026-10-12T21:42:42.000Z",
      "url": "https://cisoai.au/brief/critical-sonicwall-sma-1000-flaw"
    }
  ],
  "count": 1,
  "total": 105,
  "limit": 20,
  "next": "MjAyNi0xMC0xMlQyMTo0Mjo0Mi4wMDBafGNyaXRpY2Fs...",
  "plan": "pro"
}

Results are newest first. total is the number of briefs that match, across all pages. next is null on the last page; to read everything, keep passing it back as cursor until it is. A cursor marks a place in the results rather than a page number, so stories published while you are paging never cause one to repeat.

The archive is rebuilt after each ingest run, so a new story can appear in /api/news before it appears here. Search covers headlines and tags, not the full text of the briefs.

One brief by slug

GET https://cisoai.au/api/news/{slug}

Returns one brief with every field in the article table above, including body. It works for any brief in the archive, not only the newest 200, so it is also how you fetch a story again from a slug you stored.

{
  "article": { /* the same fields as an entry in /api/news */ },
  "plan": "pro",
  "fullBody": true
}

A slug that does not exist answers 404.

Access

There is no keyless tier. A request without a key is answered 401, here and on every other hostname the feed is served from. To see the briefs before you buy, read them on cisoai.au: the API returns the same stories.

The rate limit is listed because it should not be a surprise after you have paid. The corpus only changes when ingest runs, every three hours, so 60 requests a minute is far above what reading it needs. If you are close to it, cache the response rather than asking us for a higher ceiling.

Pricing and keys →

Errors

Errors return JSON with an error field. Never treat a 5xx as an authentication failure — the two are deliberately kept distinct so you are not chasing a key problem during an outage.

Examples

curl

curl "https://cisoai.au/api/news?limit=50&category=Threat%20Intelligence" \
  -H "Authorization: Bearer $CISOAI_API_KEY"

Node

// Server-side. Never ship the key to a browser.
const response = await fetch(
  "https://cisoai.au/api/news?limit=200",
  { headers: { Authorization: `Bearer ${process.env.CISOAI_API_KEY}` } }
);
if (!response.ok) throw new Error(`news api ${response.status}`);
const { articles } = await response.json();

Python

import os, requests

r = requests.get(
    "https://cisoai.au/api/news",
    params={"limit": 200, "distinct": 1},
    headers={"Authorization": f"Bearer {os.environ['CISOAI_API_KEY']}"},
    timeout=30,
)
r.raise_for_status()
articles = r.json()["articles"]

Reading the whole archive

import os, requests

headers = {"Authorization": f"Bearer {os.environ['CISOAI_API_KEY']}"}
params = {"q": "ransomware", "from": "2026-01-01", "limit": 100}
found = []
while True:
    page = requests.get("https://cisoai.au/api/archive", params=params, headers=headers, timeout=30).json()
    found += page["articles"]
    if not page["next"]:
        break
    params["cursor"] = page["next"]

# The full text of one result
brief = requests.get(f"https://cisoai.au/api/news/{found[0]['slug']}", headers=headers, timeout=30).json()["article"]

Serving it to your own front end

The pattern to copy: a small server-side route holds the key and your page calls that route same-origin. This is how bugxhunter.com renders its feed — a Cloudflare Pages Function that proxies, with the key in a secret and never in the markup.

// functions/api/news.js — your origin, your cache, your key stays server-side
export async function onRequest({ env }) {
  const upstream = await fetch("https://cisoai.au/api/news?limit=24", {
    headers: { Authorization: `Bearer ${env.CISOAI_API_KEY}` },
  });
  if (!upstream.ok) return new Response('{"articles":[]}', {
    headers: { "Content-Type": "application/json" },
  });
  return new Response(await upstream.text(), {
    headers: {
      "Content-Type": "application/json",
      "Cache-Control": "public, max-age=300",
    },
  });
}

Note the empty-list fallback rather than an error: a news section is worth degrading, not worth breaking a page over.

Limits and freshness

• The corpus refreshes every three hours. Polling more often than that mostly returns what you already have. Once or twice an hour is plenty.
• Cache your responses. Five minutes is a sensible floor and costs you nothing in freshness.
• No monthly request cap, but 60 requests per minute. The limit is per key, not per IP address, so nothing another customer does can affect you. Go over it and you get 429 Rate limit exceeded with a Retry-After header; wait that long and you are through. It exists so a runaway loop is throttled rather than billed, and it is roughly two orders of magnitude above the polling this page recommends. Planning something high-volume? Tell us first and we will say honestly whether this is the right fit.
• Roughly 100 new stories a week, unevenly: a quiet day brings under ten and a busy one forty. /api/news serves the newest 200; /api/archive reaches all of them.

Managing your key

• Issued once. Your key is emailed when payment clears and shown once on the page you land on afterwards. We store a hash of it, not the key, so nobody here can read it back to you.
• Lost it? Email us and we will issue a replacement and revoke the old one.
• Failed payment suspends rather than deletes. Your key resumes working once the payment goes through, so you never have to deploy a new credential because a card expired.
• Cancelling leaves your key working until the end of the period you have paid for.
• Use a separate key per application. Then revoking one never takes out another, and their usage is distinguishable.

Attribution and terms

Briefs are rewritten summaries of publicly available reporting, not reproductions of it. Every record names its source and links the originalUrl.

• Link to originalUrl when you republish. The reporting is someone else's work and the link is how they are credited.
• Credit CISO AI where the briefs themselves are displayed.
• Do not resell the feed as a competing data product.
• Content is provided as-is for information. It is not security advice, and it should not be the only thing standing between you and a decision that matters.