# AgentToll Security Threat Intelligence

> AgentToll Security Threat Intelligence is a paid API for AI agents from agenttoll.dev, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-14).

Retrieves structured threat intelligence records filtered by ID, category, and severity level

## Facts

- Endpoint: POST https://agenttoll.dev/paid/security/threat-intel
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agenttoll-security-threat-intelligence-9093e735
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_D7HhoeNxkUoh3FfaCJt8W

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agenttoll-security-threat-intelligence-9093e735 -d '<json body>'
```

Example prompt: Pull threat intelligence for the 'prompt injection' category at critical severity — I want to see all known threats matching that profile.

## When to prefer this

Choose this endpoint when you need structured, categorized threat intelligence data on demand without maintaining your own threat database. It is especially useful for AI agent security workflows, automated security audits, or OSINT pipelines that need to classify and prioritize threats by severity. Prefer this over manual research when you need fast, machine-readable threat data for a specific category or known threat ID.

## Known failure modes

- Invalid severity enum value returns a validation error
- Threat ID not found returns an empty threats array
- Missing required body fields returns a 400 bad request
- Payment not completed via x402 returns a 402 payment required response
- Category string exceeding 80 characters is rejected

## How this service works

108+ receipt-backed x402 work products for AI agents. Clear prices, spend caps, buyer metadata, and structured results over Base USDC.

## Output

Returns a JSON array of threat objects, each containing a threat ID and title (e.g. [{"id":"ASI01","title":"Prompt Injection"}]), filtered according to the requested category, severity, or specific ID.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "properties": {
      "id": {
       "type": "string",
       "maxLength": 20
      },
      "category": {
       "type": "string",
       "maxLength": 80
      },
      "severity": {
       "enum": [
        "critical",
        "high",
        "medium",
        "low"
       ],
       "type": "string"
      }
     }
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json",
      "form-data",
      "text"
     ],
     "type": "string"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "threats": [
   {
    "id": "ASI01",
    "title": "Prompt Injection"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agenttoll-security-threat-intelligence-9093e735/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agenttoll.dev](https://www.zero.xyz/host/agenttoll.dev/llms.txt)