--- updatedAt: 2026-08-25T12:05:54.000Z agentTools: siteIndex: https://techdocs.akamai.com/llms.txt projectIndex: https://techdocs.akamai.com/etp-reporting/llms.txt --- # Get IOC change report Lists historical change information for a given record and record type. Omit `startTimeSec` and `endTimeSec` from the request URL to return all available historical information. # OpenAPI definition ```json { "externalDocs": { "description": "See documentation for Akamai's Secure Internet Access Enterprise Reporting API", "url": "https://techdocs.akamai.com/etp-reporting/reference" }, "info": { "license": { "name": "Apache 2.0", "url": "https://www.apache.org/licenses/LICENSE-2.0.html" }, "title": "Indicators of Compromise (IOC) reports", "version": "v3" }, "openapi": "3.0.0", "paths": { "/ioc/changes": { "get": { "description": "Lists historical change information for a given record and record type. Omit `startTimeSec` and `endTimeSec` from the request URL to return all available historical information.", "externalDocs": { "description": "See documentation for this operation in Akamai's Secure Internet Access Enterprise Reporting API", "url": "https://techdocs.akamai.com/etp-reporting/reference/get-ioc-changes" }, "operationId": "get-ioc-changes", "parameters": [ { "description": "The start time for report data, in epoch seconds.", "in": "query", "name": "startTimeSec", "required": true, "schema": { "example": 1333631700, "type": "integer" }, "x-akamai": { "file-path": "parameters/start-time-sec-query.yaml" } }, { "description": "The end time for report data, in epoch seconds.", "in": "query", "name": "endTimeSec", "required": true, "schema": { "example": 1333631700, "type": "integer" }, "x-akamai": { "file-path": "parameters/end-time-sec-query.yaml" } }, { "description": "The target record from which to get blocklisted domains.", "in": "query", "name": "record", "required": true, "schema": { "example": "facebook.com", "type": "string" }, "x-akamai": { "file-path": "parameters/record-query.yaml" } }, { "description": "__Enum__ Specifies the record type, either `DOMAIN` or `IP`.", "in": "query", "name": "recordType", "required": true, "schema": { "enum": [ "DOMAIN", "IP" ], "example": "DOMAIN", "type": "string" }, "x-akamai": { "file-path": "parameters/record-type-query.yaml" } }, { "description": "For customers who manage more than one account, this [runs the operation from another account](https://techdocs.akamai.com/developer/docs/manage-many-accounts-with-one-api-client). The Identity and Access Management API provides a [list of available account switch keys](https://techdocs.akamai.com/iam-api/reference/get-client-account-switch-keys).", "in": "query", "name": "accountSwitchKey", "required": false, "schema": { "example": "1-5C0YLB:1-8BYUX", "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "example": [ { "date": "2017-03-07T00:00:00Z", "description": "First tracked", "recordType": "DOMAIN", "state": "ADDED" }, { "date": "2017-03-07T00:00:00Z", "description": "Severity upgraded from Unknown to Suspected Malware", "key": "CONFIDENCE", "listId": "1", "listName": "Malware", "newValue": "Suspected", "oldValue": "Unknown", "recordType": "DOMAIN", "state": "CHANGED" } ], "schema": { "description": "Details of IOC changes for the given domain.", "items": { "additionalProperties": false, "properties": { "date": { "description": "ISO 8601 timestamp marking the record generation.", "type": "string" }, "description": { "description": "Describes the record.", "type": "string" }, "key": { "description": "The IOC context key. Either `REGISTRAR_NAME`, `REGISTRANT_NAME`, `REGISTRANT_ORG`, `CONTACT_EMAIL`, `REGISTRANT_EMAIL`, `REGISTRANT_ADDRESS`, `REGISTRANT_CITY`, `REGISTRANT_STATE`, `REGISTRANT_COUNTRY`, `REGISTRANT_TELEPHONE`, `WHO_IS_SERVER`, `CREATED_ON`, `EXPIRES_ON`, `LAST_UPDATED_ON`, `NAME_SERVER_NAMES`, `NAME_SERVER_IPS`, `CONFIDENCE`, `DESCRIPTION`, `URLS`, `THREAT_ID`, `CATEGORIES`, `AVC_APP_ID`, `AVC_CAT_ID`, `AVC_RISK_ID`, `AVC_OPERATIONS`, `AVC_TAGS`, `AVC_PROXY`, or `AVC_CURATION`.", "enum": [ "REGISTRAR_NAME", "REGISTRANT_NAME", "REGISTRANT_ORG", "CONTACT_EMAIL", "REGISTRANT_EMAIL", "REGISTRANT_ADDRESS", "REGISTRANT_CITY", "REGISTRANT_STATE", "REGISTRANT_COUNTRY", "REGISTRANT_TELEPHONE", "WHO_IS_SERVER", "CREATED_ON", "EXPIRES_ON", "LAST_UPDATED_ON", "NAME_SERVER_NAMES", "NAME_SERVER_IPS", "CONFIDENCE", "DESCRIPTION", "URLS", "THREAT_ID", "CATEGORIES", "AVC_APP_ID", "AVC_CAT_ID", "AVC_RISK_ID", "AVC_OPERATIONS", "AVC_TAGS", "AVC_PROXY", "AVC_CURATION" ], "type": "string" }, "listId": { "description": "The record's unique list identifier.", "type": "string" }, "listName": { "description": "The record's list name.", "type": "string" }, "newDetails": { "description": "The new record categorization details.", "items": { "additionalProperties": false, "properties": { "id": { "description": "The category's unique identifier.", "minLength": 0, "type": "string" }, "name": { "description": "The AUP category name.", "minLength": 1, "type": "string" } }, "required": [ "name", "id" ], "type": "object" }, "minItems": 0, "type": "array" }, "newValue": { "description": "The record's current categorization name.", "type": "string" }, "oldDetails": { "description": "The old record categorization details.", "items": { "additionalProperties": false, "properties": { "id": { "description": "Unique identifier for the category.", "minimum": 0, "type": "integer" }, "name": { "description": "Name of the AUP category.", "minLength": 1, "type": "string" } }, "required": [ "name", "id" ], "type": "object" }, "minItems": 0, "type": "array" }, "oldValue": { "description": "The record's previous categorization name.", "type": "string" }, "order": { "description": "The record's categorization order.", "type": "string" }, "path": { "description": "The record path.", "type": "string" }, "recordType": { "description": "The record type. Either `DOMAIN` or `IP`.", "enum": [ "DOMAIN", "IP" ], "type": "string" }, "state": { "description": "The record status. Either `ADDED`, `REMOVED`, `CHANGED`, or `READDED`.", "enum": [ "ADDED", "REMOVED", "CHANGED", "READDED" ], "type": "string" } }, "type": "object" }, "type": "array", "x-akamai": { "file-path": "schemas/ioc-record-changes.yaml" } } } }, "description": "Successful response." }, "400": { "content": { "application/problem+json": { "examples": { "invalid-format": { "summary": "Invalid request format", "value": { "detail": "The system cannot understand your request. Please check the syntax and correct any problems.", "instance": "1e4c346b-3a36-4527-9c37-86ae748b87c5", "status": 400, "title": "Bad Request", "type": "https://problems.omni.akamaiapis.net/http/bad-request" } }, "invalid-start-time": { "summary": "Invalid startTime", "value": { "detail": "Start time is invalid. Code-000104", "instance": "0415df5e-6e9c-4596-bdd3-9ada53b63599", "status": 400, "title": "Bad Request", "type": "https://problems.omni.akamaiapis.net/http/bad-request" } } }, "schema": { "additionalProperties": true, "description": "A common [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) Problem Response error.", "properties": { "detail": { "description": "A human-readable explanation specific to the problem.", "minLength": 1, "type": "string" }, "errors": { "description": "A list of HTTP problem details. The error response includes this list if there are several problems with a single request, to call out each of them separately.", "items": { "description": "A nested problem response error object.", "type": "object", "x-akamai": { "file-path": "schemas/http-problem-nested.yaml" } }, "minItems": 0, "type": "array" }, "instance": { "description": "The URI for this error occurrence.", "type": "string" }, "status": { "description": "The HTTP status code generated by the origin server.", "minimum": 0, "type": "integer" }, "title": { "description": "A short, human-readable summary of the problem type.", "minLength": 1, "type": "string" }, "type": { "description": "A URI that identifies the problem type.", "minLength": 1, "type": "string" } }, "required": [ "type", "title", "detail", "instance", "status" ], "type": "object", "x-akamai": { "file-path": "schemas/http-problem.yaml" } } } }, "description": "[Bad Request](https://techdocs.akamai.com/etp-reporting/reference/400).", "x-akamai": { "file-path": "errors/400.yaml" } }, "403": { "content": { "application/problem+json": { "example": { "detail": "Insufficient permissions. Code-01", "instance": "3e3f11da-e205-409a-be77-24e459f29fa8", "status": 403, "title": "Forbidden", "type": "https://problems.omni.akamaiapis.net/http/forbidden" }, "schema": { "additionalProperties": true, "description": "A common [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) Problem Response error.", "properties": { "detail": { "description": "A human-readable explanation specific to the problem.", "minLength": 1, "type": "string" }, "errors": { "description": "A list of HTTP problem details. The error response includes this list if there are several problems with a single request, to call out each of them separately.", "items": { "description": "A nested problem response error object.", "type": "object", "x-akamai": { "file-path": "schemas/http-problem-nested.yaml" } }, "minItems": 0, "type": "array" }, "instance": { "description": "The URI for this error occurrence.", "type": "string" }, "status": { "description": "The HTTP status code generated by the origin server.", "minimum": 0, "type": "integer" }, "title": { "description": "A short, human-readable summary of the problem type.", "minLength": 1, "type": "string" }, "type": { "description": "A URI that identifies the problem type.", "minLength": 1, "type": "string" } }, "required": [ "type", "title", "detail", "instance", "status" ], "type": "object", "x-akamai": { "file-path": "schemas/http-problem.yaml" } } } }, "description": "[Access forbidden](https://techdocs.akamai.com/etp-reporting/reference/403).", "x-akamai": { "file-path": "errors/insufficient-permissions-403.yaml" } } }, "summary": "Get IOC change report", "tags": [ "IOC reports" ] }, "x-akamai": { "file-path": "paths/changes.yaml", "path-info": "/ioc/changes" } } }, "servers": [ { "url": "https://{hostname}/etp-report/v3" } ], "tags": [ { "description": "Generate reports for Indicators of Compromise (IOC) records. IOCs are artifacts observed on a network or in an operating system that indicate a computer intrusion with high confidence.", "name": "IOC reports" } ], "x-akamai": { "auth-type": "EDGE_GRID", "file-path": "08-ioc.yaml" }, "x-readme": { "explorer-enabled": false, "samples-languages": [ "curl", "python", "node" ] } } ``` # Sibling pages * [Get IOC time series report](https://techdocs.akamai.com/etp-reporting/reference/get-time-series.md) * [Get IOC change report](https://techdocs.akamai.com/etp-reporting/reference/get-ioc-changes.md) * [Get IOC AVC details report](https://techdocs.akamai.com/etp-reporting/reference/get-ioc-details-avc.md) * [Get IOC CIDR details report](https://techdocs.akamai.com/etp-reporting/reference/get-ioc-details-cidr.md) * [Get IOC domain tree report](https://techdocs.akamai.com/etp-reporting/reference/get-ioc-domain-tree.md) * [Get IOC time series report](https://techdocs.akamai.com/etp-reporting/reference/get-time-series-1.md) * [Get IOC AVC details report](https://techdocs.akamai.com/etp-reporting/reference/get-ioc-details-avc-1.md) * [Get IOC CIDR details report](https://techdocs.akamai.com/etp-reporting/reference/get-ioc-details-cidr-1.md) * [Get IOC domain tree report](https://techdocs.akamai.com/etp-reporting/reference/get-ioc-domain-tree-1.md)