Accessing Enrichment Data via API

12 January 2026

These APIs provide access to additional enrichment data gathered for new signals using standard GET requests.

Enrichment data is gathered from various external data sources by the GSE for certain types of new signal shortly after they are received. Currently this is focused on DNS signals for which a lot of extra data is publicly available such as domain name registration data, IP address and infrastructure data (ASN, RIR), website hosting information and content.

In addition, enrichment data can be supplied by other users of the GSE in the form of feedback_enriched reports.

The Complete Signal API provides access to a comprehensive view for a given signal. This returns a rich data structure incorporating all new reports and all feedback received including a rational view of latest and historical enrichment data for the signal. The latest and historical GSE indexes are also returned.

The GSE Index Log API returns a historical timestamped list of all GSE Index values which have been calculated for a single signal.

The Signal Content API returns all historical content data which has been looked up for a signal. Currently this is only gathered for DNS signals for which an active website has been detected.

PLEASE NOTE: These APIs are only available to our Command tier partners.

GET https://signals.gse.live/feed/complete

Complete Signal

A Comprehensive enriched view of a signal. This includes all of the historical new reports, all feedback reports received, a normalised view of the enriched data for the signal (if any) and all calculated GSE Indexes.

Request Attributes

Required attributes

Name
signal
Type
string
Description
The signal for which the complete data set is being obtained.

Response Attributes

Name
signal
Type
string
Description
The signal for which the complete dataset has been generated

Name
reports
Type
array
Description
An array containing all of the new reports received for this signal

Name
feedback
Type
object
Description
An object containing all of the feedback information received for the signal.

This is structured with the following sub keys:
- - actioned: An array of actioned feedback reports received for this signal
- - noAction: An array of no action feedback reports received for this signal
- - enrichment: An object containing the following keys
  - - latest: An object containing latest enrichment data for this signal merged from all received enrichment feedback signals.
  - - log: An array of enrichment feedback reports received for the signal

Name
gseIndex
Type
number
Description
The latest value for the GSE Index for this signal if available.

Name
gseIndexLog
Type
array
Description
An array of all calculated GSE Index objects with the following properties
- - index_time The date and time that the GSE index was calculated.
- - score The value of the index at the point of calculation

Request

GET · /complete

curl -G https://signals.gse.live/feed/complete \
-H "API-KEY: YOUR-API-KEY-HERE" \
-H "API-SECRET: YOUR-API-SECRET-HERE" \ \
-d signal=[[value]] \

Response

[
  {
    "signal": "https://example.com",
    "reports": [{"signal": "https://example.com", "report_date":"2025-01-01 10:00:00", "abuse_type": "phishing", "signal_type": "url", "predictive":false,"confidence_score":89, "extra_data":{}}],
    "feedback": ,
    "gseIndex": 89,
    "gseIndexLog": 
  },
  // ...
]

GET https://signals.gse.live/feed/index

GSE Index Log

The log of all GSE Indexes which have been calculated for the supplied signal.

Request Attributes

Required attributes

Name
signal
Type
string
Description
The signal for which the GSE Index log is being generated

Response Attributes

Name
signal
Type
string
Description
The signal for which the GSE Index is being generated.

Name
index_time
Type
datetime
Description
The date and time when the GSE Index was generated

Name
score
Type
number
Description
The value of the GSE Index as calculated at the time indicated by the index_time attribute.

Request

GET · /index

curl -G https://signals.gse.live/feed/index \
-H "API-KEY: YOUR-API-KEY-HERE" \
-H "API-SECRET: YOUR-API-SECRET-HERE" \ \
-d signal=[[value]] \

Response

[
  {
    "signal": "https://example.com",
    "index_time": "2025-01-01 10:00:00",
    "score": 76
  },
  // ...
]

GET https://signals.gse.live/feed/content

Signal Content

Return an array of content objects if available for a supplied signal. Currently these are only calculated for DNS signals where web content is available but may be extended to other types in the future.

Request Attributes

Either attributes (one must be supplied)

Name
signal
Type
string
Description
A signal for which content entries are to be looked up.

Name
html_hash
Type
string
Description
A HTML hash for which content entries are to be looked up. This will typically have been obtained from enrichment data stored against DNS signals and will typically return only entries where there is a precise match for the whole HTML page in content.

Name
body_hash
Type
string
Description
A body hash for which content entries are to be looked up. This will typically have been obtained from enrichment data stored againstsignals and will return all entries where there is a precise match for the main body of the content. In the case of DNS signals this will usually be the text contained within the tag of the page.

Response Attributes

Name
signal
Type
string
Description
The signal for which matching content has been found,

Name
date_added
Type
datetime
Description
The date and time when this content was captured

Name
body_hash
Type
string
Description
A hash representing the body content for the signal - if a DNS signal this is usually the text contents of the element on the page,.

Name
html_hash
Type
string
Description
A hash representing the full html content for a signal. This is specific to DNS signals with HTML content

Name
body_text
Type
string
Description
The body text extracted from the content for a given signal. In the case of DNS signals this would usually be the text content of the <body> element within the website content.

Name
html_content
Type
string
Description
The HTML content extracted from the content for a given signal. This is only available for DNS signals where an active website has been detected.

Response

[
  {
    "signal": "https://example.com",
    "date_added": "2025-01-01 10:30:00",
    "body_hash": "9f454234ee23456",
    "html_hash": "8e32b32cd787123f",
    "body_text": "This is some example text contained within the body of signal content",
    "html_content": "<html>..SOME HTML CONTENT...</html>"
  },
  // ...
]

Prev Next