API credentials and full documentation are automatically sent to your email within 5 minutes of payment confirmation. If you don't receive access within 15 minutes, contact support immediately.

Yes. Starting June 30th, 2026, every API key purchase includes a free 1-year Elite website subscription at no extra cost, giving you full site access alongside the API. For now, the Elite upgrade is applied manually after purchase rather than instantly, until automated provisioning is in place. Your API credentials will still arrive automatically, but the Elite access may take a little longer to appear. If you already have an active Elite subscription through the payment processor, that subscription will be cancelled to prevent future charges, and the free 1-year Elite period will be added to your existing remaining subscription time. Existing subscribers will not receive another account login email, so please check Account to confirm that the additional year has been added and to view your updated expiration date. New Elite subscribers will receive a separate email with the login details for their account once access is in place. This bundle is one-directional. Purchasing a website subscription does not include API access.

You won't lose any time you've already paid for, and you won't be charged twice for Elite. Because Elite access is currently applied by hand, your included year is arranged manually so it doesn't overlap wastefully with your existing subscription, and in most cases your current Elite term is left to run and the included year is added around it. Just use the same email for your API purchase as your Elite account so it can be matched up correctly. As with all Elite provisioning right now, this may take a little longer to appear than your API credentials, which still arrive automatically. Once the time is added, you can confirm your new expiration date under Account.

Due to the immediate access nature of digital API credentials, all sales are final. No refunds are provided after credentials are issued. See the full Refund Policy for details.

API access automatically terminates at the end of your 365-day period. We do not auto-renew subscriptions. You'll receive email reminders at 30 days and 7 days before expiration with instructions to renew if desired.

No. API access is offered on an annual basis only, with no cryptocurrency payments.

No. API access is offered at a flat annual rate with no trials or promotional pricing. Representative request and response samples are available on this page so the data structure can be reviewed before purchase. A discount would only be offered when paying for multiple years. The initial rate is the same for all customers.

Yes. If your organization needs an invoice for procurement or accounting, send a pre-purchase message before paying by card. The billing or purchasing contact can be different from the person who will use the API. Please include the organization name, billing contact email, designated API user email, and any purchase order or invoice details your team requires. Dark Web Informer will not provide personal residential details or other personal information to satisfy invoice-processing requirements. Bank transfers, when accepted, are processed directly through the payment processor and not through personally shared bank account details. Bank transfer payments may take a few business days to fully clear, unlike card payments which are usually confirmed much faster. For invoice or bank-transfer payments, API credentials and documentation are not issued automatically. Payment must fully clear first, then credentials and documentation will be sent manually to the designated API user.

Yes. Higher daily request quotas and additional API keys are available as paid add-ons. Additional keys are useful when your organization wants separate keys for production, testing, SIEM ingestion, analyst tools, or different internal workflows. Send a pre-purchase message or contact support after purchase to discuss the add-on you need.

The standard license covers internal use within a single organization only. Using the data to deliver services to your own clients, such as monitoring their domains, sending them alerts, or including the data in client-facing reports, counts as third-party access and requires a separate agreement. If you're an MSP or MSSP interested in this, send a pre-purchase message describing your use case. Internal use of the API within your own MSP, for example securing your own infrastructure, is covered by the standard license.

No. API keys are licensed for single-organization internal use only. Credential sharing, reselling data, or providing access to third parties violates the Terms of Service and will result in immediate termination without refund. If your organization needs separate keys for different workflows or internal teams, purchase additional API keys instead.

Abuse includes: exceeding rate limits through distributed requests, credential sharing, scraping for resale, automated bulk downloading beyond normal operational needs, or any activity that degrades service for other users. Normal security operations, SIEM ingestion, and research queries are fully permitted within rate limits.

Yes. The email support address is included in the email that provides you with your API key. Typical response time is 1 business day for technical questions and troubleshooting. Support only covers clarifying API usage, expected behavior, and endpoint documentation. Building, maintaining, or integrating custom scripts and application-specific code is the customer's responsibility.

The API provides access to a broad and continuously expanding Dark Web Informer intelligence dataset, offering a searchable collection of threat actor activity, ransomware disclosures, and related intelligence tracked by the platform. The platform currently processes an average of 900+ alerts per day across the threat feed alone, though daily counts naturally fluctuate with threat actor activity. The dataset currently includes over 186,000+ threat feed alerts and 31,800+ ransomware feed alerts, sourced from 27+ forums and 4 monitored shoutboxes, with coverage continuing to grow, updated in real time as threat actors publish new content. Screenshots are available for threat feed and ransomware feed entries where captured; no screenshot data is provided for other data types. It also includes a comprehensive historical repository of more than 174,000+ indicators of compromise (IOCs) sourced from a trusted third-party vendor. Additional capabilities include exports to most major intelligence feeds, an expanding curated cybersecurity news feed from reliable outlets, and more.

Yes. STIX 2.1 format support for the threat feed, ransomware feed, and IOC feed is available. JSON and CSV exports remain available for supported feeds.

The API is actively maintained and monitored. While we don't guarantee specific uptime percentages, the service is designed for 24/7 operation with redundancy built in. Any extended outages or maintenance windows are communicated via all socials and via the uptime page.

Interruptions are rare and usually brief. The API is actively monitored, and current status and incident history are visible on the uptime page; extended outages or planned maintenance are announced there and on all social channels. Collection and processing pipelines run independently of the API layer, so a brief interruption to the API does not create a gap in the underlying dataset: alerts continue to be gathered and are available as soon as service resumes. There is no auto-renewal, so you are never silently billed during a disruption, and API-key holders can reach support directly by email. Specific uptime percentages are not guaranteed; see the service availability answer above.