Cyber Security API filters

Use cyber.type to choose cyber crime or cyber warfare, then add any filter from /v1/news/everything. With no filters, /v1/cyber-security/news returns the newest articles from both categories.

cyber.type

Use cyber.type to choose cyber crime or cyber warfare news.

Value	IPTC category	Category ID
crime	cyber crime	medtop:20000086
warfare	cyber warfare	medtop:20001361
(omitted)	either of the two	both IDs

curl "https://api.apitube.io/v1/cyber-security/news?cyber.type=warfare&api_key=YOUR_API_KEY"

Rules for cyber.type:

• One value per request. crime,warfare is rejected. To get both categories, leave the parameter out.
• Lowercase only. CRIME and Crime are rejected.
• Not empty. cyber.type= with no value is rejected.

All three cases return 400 with code ER0900. Passing cyber.type twice in one URL returns 400 ER0179, the same as any repeated parameter.

An article can belong to both categories. It then matches cyber.type=crime and cyber.type=warfare, and its cyber.type field always lists both: ["crime", "warfare"], whichever value you filtered by.

How the Cyber Security API combines filters

Articles must match both the cyber category and every filter you add. Filters narrow the feed to a smaller selection of cyber news.

• category.id=medtop:04000000 returns cyber articles that are also in the economy, business and finance category.
• A boolean query such as ransomware OR phishing searches inside the cyber selection, never outside it.
• Excluding a cyber category removes it from the result: cyber.type=crime&ignore.category.id=medtop:20000086 always returns an empty page.

News API filters that work well for security feeds

These filters work the same way as on /v1/news/everything. Follow the links for accepted values, syntax and limits.

Goal	Parameter	Example
Only one language	language.code	language.code=en
A date range	published_at.start, published_at.end	published_at.start=2026-10-01
Specific outlets	source.domain	source.domain=bleepingcomputer.com,thehackernews.com
Outlets from a country	source.country.code	source.country.code=gb
A word in the headline	title	title=ransomware
A boolean headline query	query	query=ransomware AND NOT bitcoin
A company or product maker	organization.name	organization.name=Microsoft
A country or city in the story	location.name	location.name=Ukraine
A corporate event	event.type	event.type=data-breach
Tone of coverage	sentiment.overall.polarity	sentiment.overall.polarity=negative
Order of results	sort.by, sort.order	sort.by=published_at&sort.order=desc
Page size and page	per_page, page	per_page=50&page=2
Plain-language request	prompt	prompt=ransomware attacks on hospitals this week

A few limits carry over from /v1/news/everything:

• Title search (title, title_starts_with, title_ends_with, title_pattern, query) covers at most 31 days of published_at. A wider range returns 400 ER0110; without a range the last 31 days are searched.
• Multi-value filters keep the first 3 values (source.domain, language.code, category.id, *.name filters) or the first 5 (event.type). Extra values are dropped without an error.
• location.name must match a known location entity. Check the spelling with /v1/suggest/entities; an unknown name returns 400 ER0218.
• prompt requires Basic or above. The filters it produces are combined with the cyber selection like any other filter.

Fields you cannot filter on

The response includes cyber.cves, cyber.vendors, cyber.in_kev, cyber.exploited and cyber.cvss, but these fields cannot filter a request. For example, cyber.cves=… or cyber.cvss.min=… returns 200 without applying that condition. The ER0368 warning in meta.warnings names the ignored parameter.

To keep only some vulnerabilities — for example, articles with in_kev: true or cvss of 9 and above — filter the results in your code. The quickstart has a ready script.

Field selection, facets and highlighting

Use these parameters to choose response fields, counts and highlighted text:

• fl returns only the listed fields. cyber returns the whole block; cyber.cves or cyber.in_kev return a single field of it. Example: fl=id,title,href,cyber.cves,cyber.in_kev.
• facet=1 with facet.field counts values across all matching cyber articles, not only the current page. Example: facet=1&facet.field=language.id,sentiment.overall.polarity.
• facet.range=1 counts matching articles within intervals, such as days: facet.range.field=published_at&facet.range.start=2026-10-01&facet.range.end=2026-10-15&facet.range.gap=+1DAY.
• hl=1 marks the terms from title (and extra terms from search) in the title and description, and returns the fragments in highlighting.

Related

• Response format — what each cyber field contains.
• API reference — the endpoint, request examples and error codes.
• Search articles — the full parameter list shared by this endpoint.