Step 01
Initialize or go stateless.
Open a stateful session when your client maintains context. Use a single POST when each call is independent.
ThreatMinder · Maggie AI
Integration docs & API reference
Meet Maggie · ThreatMinder AI
Maggie is the ThreatMinder AI agent. Pick an integration surface — MCP for tool-driven clients, Batch API for CSV operations, Batch Analytics for scored documents — and move from first call to working rollout with live examples.
Quick examples
Switch surfaces and inspect the first call.
MCP
curl -X POST "__PRODUCTION_URL__/api/v2/mcp" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"create_batch"}}'
Batch API
curl -X POST "__PRODUCTION_URL__/api/v2/batch" \
-H "X-API-Key: YOUR_API_KEY" \
-F "file=@customers.csv" \
-F "name=customer-rollout"
Batch Analytics
curl -X POST "__PRODUCTION_URL__/api/v2/score-data/batch" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"intent":"vendor-risk","documents":[{"uri":"s3://bucket/doc.pdf"}]}'
Integration Studio
The primary tabs switch between product surfaces. The nested tabs switch between workflow, examples, and operational reference. That keeps the first screen compact while still putting real payloads one click away.
Step 01
Open a stateful session when your client maintains context. Use a single POST when each call is independent.
Step 02
Call tools/list to inspect the current runtime schemas before your
client issues tool calls.
Step 03
The current tool set exposes create_batch and
get_batch_result so job creation and retrieval stay explicit.
curl -X POST "__PRODUCTION_URL__/api/v2/mcp" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "initialize",
"params": {
"protocolVersion": "2024-11-05",
"clientInfo": { "name": "your-client", "version": "1.0.0" },
"capabilities": {}
}
}'
curl -X POST "__PRODUCTION_URL__/api/v2/mcp" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{
"jsonrpc": "2.0",
"id": 2,
"method": "tools/list",
"params": {}
}'
curl -X POST "__PRODUCTION_URL__/api/v2/mcp" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{
"jsonrpc": "2.0",
"id": 3,
"method": "tools/call",
"params": {
"name": "create_batch",
"arguments": {
"entityType": "BUSINESS",
"useCase": "RESTAURANT-ONBOARD",
"csvContent": "name,address,city,state,zip\nTaco Palace,123 Main St,Austin,TX,78701"
}
}
}'
Available tools
create_batch
Accepts entityType, useCase, and
csvContent. Returns the batch identity.
Available tools
get_batch_result
Accepts a UUID id and returns the processed CSV when the result
is ready.
Step 01
Batch validation depends on both, so map your source schema before upload.
Step 02
Treat the response ID as your job identity for retries, polling, and audit state inside your own system.
Step 03
When the result exists, ThreatMinder returns CSV content containing the enriched output.
PERSON template
first_name,last_name,address,city,state,zip,phone1,email,dob,external_id
Jane,Doe,123 Main St,Austin,TX,78701,5125550199,jane@example.com,1989-08-03,person-001
BUSINESS template
name,address,city,state,zip,phone1,email,external_id
Taco Palace,123 Main St,Austin,TX,78701,5125550148,ops@tacopalace.com,business-001
curl -X POST "__PRODUCTION_URL__/api/v2/batch" \
-H "X-API-Key: YOUR_API_KEY" \
-F "entityType=PERSON" \
-F "useCase=PARTNER-PERSONNEL" \
-F "file=@./people.csv;type=text/csv"
curl "__PRODUCTION_URL__/api/v2/batch/550e8400-e29b-41d4-a716-446655440000" \
-H "X-API-Key: YOUR_API_KEY"
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"entityType": "PERSON",
"useCase": "PARTNER-PERSONNEL"
}
curl -X POST "__PRODUCTION_URL__/api/v2/score-data" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-d '{
"usecase": "partner-personnel",
"batchId": "9edbab6e-7d52-4383-b813-cee40345877f",
"metadata": { "customerId": "acme-42" },
"docs": [
{
"id": "1745029250154",
"title": "Open source finding",
"content": "Subject appears in several posts describing threats and fraud.",
"type": "WEB",
"source": "https://example.com/report",
"language": "en"
}
],
"options": {
"priority": "sync"
}
}'
curl "__PRODUCTION_URL__/api/v2/score-data/9edbab6e-7d52-4383-b813-cee40345877f/summary" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"
curl "__PRODUCTION_URL__/api/v2/score-data/9edbab6e-7d52-4383-b813-cee40345877f/risk-keys?limit=50&offset=0&sortBy=count&sortOrder=desc" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"
curl "__PRODUCTION_URL__/api/v2/score-data/9edbab6e-7d52-4383-b813-cee40345877f/documents?limit=25&offset=0&sortBy=risk&sortOrder=desc" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"
Readable views
/summary and /text-summaryUse these endpoints when the consumer needs fast narrative or executive context.
Operational views
/documents and /risk-keysUse these when the consumer needs sortable, filterable, or queue-oriented batch views.
Need the public site?
Use the official site when the reader needs the external brand story. Use the studio above when the reader needs working integration detail, live payloads, and reference context.
Meet Maggie · API reference
Maggie is the ThreatMinder AI agent behind every batch, MCP call, and scored document workflow. This reference documents every endpoint she exposes so your team can wire real customer integrations against the production surface.
Meet Maggie
Maggie is the AI agent ThreatMinder exposes to customers. Everywhere you see a batch decision, a tool call, or a scored document, Maggie is the one running inference. The integration surfaces in this reference are the ways partner systems can hand her work and pick up her results.
What Maggie is
Entity screening, document scoring, and narrative extraction, all running behind a single ThreatMinder surface.
Where she plugs in
MCP for tool-driven clients. Batch API for CSV ops workflows. Batch Analytics for scored document pipelines.
Who uses it
This reference is for the engineers wiring Maggie into a production customer workflow — not the end user.
Maggie exposes two auth schemes depending on the surface. Pick the one that matches the endpoint you're calling — the reference entries below label the expected header in every request.
Batch & MCP
X-API-KeyIssued per customer tenant. Send on every request as an HTTP header.
X-API-Key: YOUR_API_KEY
Batch Analytics
Authorization: BearerRotating access token acquired out-of-band. Required on every analytics route.
Authorization: Bearer YOUR_ACCESS_TOKEN
The production base URL used across this reference is rendered below from the docs environment. Partners typically pin this value in their own config and surface it in their deployment manifests.
Maggie returns structured JSON for non-2xx responses. Most errors carry a
stable code, a human message, and an optional
details object for field-level context.
{
"code": "validation_failed",
"message": "useCase is required",
"details": {
"field": "useCase"
}
}
Batch API
The Batch API is the operational surface. Upload a CSV of entities, capture the returned UUID, then poll the retrieval endpoint until the enriched CSV is ready. Two endpoints, one identity, explicit states.
__PRODUCTION_URL__/api/v2/batch
Starts an async batch. Returns the batch identity so you can poll for the result.
X-API-KeyentityTypePERSON or BUSINESS.useCasePARTNER-PERSONNEL).filenamecurl -X POST "__PRODUCTION_URL__/api/v2/batch" \
-H "X-API-Key: YOUR_API_KEY" \
-F "entityType=PERSON" \
-F "useCase=PARTNER-PERSONNEL" \
-F "file=@./people.csv;type=text/csv"
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"entityType": "PERSON",
"useCase": "PARTNER-PERSONNEL"
}
__PRODUCTION_URL__/api/v2/batch/:id
Poll this endpoint with the UUID from upload. When processing completes it returns the enriched CSV payload.
:idPOST /api/v2/batch.200202404curl "__PRODUCTION_URL__/api/v2/batch/550e8400-e29b-41d4-a716-446655440000" \
-H "X-API-Key: YOUR_API_KEY"
Maggie validates uploads against the entity schema bound to entityType. Mapping your source columns up front is the fastest way to ship a stable integration.
PERSON
first_name,last_name,address,city,state,zip,phone1,email,dob,external_id
Jane,Doe,123 Main St,Austin,TX,78701,5125550199,jane@example.com,1989-08-03,person-001
BUSINESS
name,address,city,state,zip,phone1,email,external_id
Taco Palace,123 Main St,Austin,TX,78701,5125550148,ops@tacopalace.com,business-001
MCP
MCP is the surface for copilots, agents, and orchestrators that already think
in tools and sessions. All calls target a single endpoint and are dispatched by
JSON-RPC method.
__PRODUCTION_URL__/api/v2/mcp
Open a stateful MCP session. Skip when your client is fully stateless.
X-API-KeyContent-Typeapplication/jsoncurl -X POST "__PRODUCTION_URL__/api/v2/mcp" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "initialize",
"params": {
"protocolVersion": "2024-11-05",
"clientInfo": { "name": "your-client", "version": "1.0.0" },
"capabilities": {}
}
}'
__PRODUCTION_URL__/api/v2/mcp
Inspect the current tool schemas before issuing a call.
curl -X POST "__PRODUCTION_URL__/api/v2/mcp" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{ "jsonrpc": "2.0", "id": 2, "method": "tools/list", "params": {} }'
__PRODUCTION_URL__/api/v2/mcp
Use create_batch to start a run. Retrieve later with get_batch_result.
curl -X POST "__PRODUCTION_URL__/api/v2/mcp" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{
"jsonrpc": "2.0",
"id": 3,
"method": "tools/call",
"params": {
"name": "create_batch",
"arguments": {
"entityType": "BUSINESS",
"useCase": "RESTAURANT-ONBOARD",
"csvContent": "name,address,city,state,zip\nTaco Palace,123 Main St,Austin,TX,78701"
}
}
}'
Batch Analytics
This surface is for dashboards, queues, and alerting flows. Ingest documents into a batch, then query the batch through summary, document, and risk-key views depending on what the downstream consumer needs.
__PRODUCTION_URL__/api/v2/score-data
Submit one or more documents bound to a batchId. Maggie scores and indexes them for later queries.
curl -X POST "__PRODUCTION_URL__/api/v2/score-data" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-d '{
"usecase": "partner-personnel",
"batchId": "9edbab6e-7d52-4383-b813-cee40345877f",
"metadata": { "customerId": "acme-42" },
"docs": [
{
"id": "1745029250154",
"title": "Open source finding",
"content": "Subject appears in several posts describing threats and fraud.",
"type": "WEB",
"source": "https://example.com/report",
"language": "en"
}
],
"options": { "priority": "sync" }
}'
__PRODUCTION_URL__/api/v2/score-data/:batchId/summary
Narrative + executive rollup for a batch. Also available as /text-summary.
curl "__PRODUCTION_URL__/api/v2/score-data/9edbab6e-7d52-4383-b813-cee40345877f/summary" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"
__PRODUCTION_URL__/api/v2/score-data/:batchId/documents
Paginated, sortable view. Use for queues and review tables.
curl "__PRODUCTION_URL__/api/v2/score-data/9edbab6e-7d52-4383-b813-cee40345877f/documents?limit=25&offset=0&sortBy=risk&sortOrder=desc" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"
__PRODUCTION_URL__/api/v2/score-data/:batchId/risk-keys
Aggregated risk signals across the batch. Drive alerts and dashboards from here.
curl "__PRODUCTION_URL__/api/v2/score-data/9edbab6e-7d52-4383-b813-cee40345877f/risk-keys?limit=50&offset=0&sortBy=count&sortOrder=desc" \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"