# Introduction

The Cyber API turns deep and dark web content into structured JSON - posts from Tor sites, hacking forums, marketplaces, and chat platforms, crawled continuously and enriched for threat intelligence.

## Coverage

Content is collected from multiple networks, and your plan determines which of them your token can search:

`telegram`, `openweb`, `tor`, `public_chat`, `discord`

Results are automatically limited to the networks enabled on your account. Each post carries its network in `extended.network`.

## Enrichment

Every post is enriched at crawl time:

- **Entities** - emails, phone numbers, IPs, domains, credit cards, SSNs, crypto wallet ids, and CVE identifiers extracted from the text.
- **Persons, organizations, locations** - named entities mentioned in the post.
- **Cyber risk** - an overall risk score with separate site and content components.
- **Categories** - content classification of the post.
- **Author details** - display name, user id, profile link, and known adversary group associations.

## How it works

1. Send a `GET` request with a boolean query - see [Quickstart](cyber-api-quickstart).
2. Read the matching posts from the JSON response.
3. Follow the `next` URL to page through the rest - see [Pagination](cyber-api-pagination).

A matching segmentation endpoint returns aggregate counts (top networks, domains, authors) instead of posts - see [Segmentation API](cyber-api-segmentation) - and helper endpoints serve cached pages and images - see [Dark Cache & Images](cyber-api-cache-images).

> [!NOTE]
> The Cyber API requires its own permission and credit plan on your account. Without it, requests return `401` - contact sales@webz.io.