Authentication

Mon, 01 Jan 0001 00:00:00 +0000

Authentication#

API Keys#

HashWatch uses API keys for authentication on all private endpoints. An API key looks like this:

<team-id>.<secret>

For example: acme-ir.sk_live_a1b2c3d4e5f6...

Sending your API key#

Include your key in the X-API-Key header on every request:

curl https://api.hashwatch.us/api/v1/intel/stats \
 -H "X-API-Key: acme-ir.sk_live_a1b2c3d4e5f6..."

API keys are never logged or stored in plaintext — only a secure HMAC hash is kept on the server. Keep your key confidential; it cannot be recovered if lost (request a new one from your administrator).

Endpoints

Mon, 01 Jan 0001 00:00:00 +0000

Endpoints#

Base URL: https://api.hashwatch.us

Public endpoints (no authentication)#

GET /public/hash-of-day#

Returns today’s known-good hashes for all tracked software. Results are cached for up to 1 hour.

curl https://api.hashwatch.us/public/hash-of-day

Add ?date=YYYY-MM-DD to retrieve a specific day’s snapshot:

curl "https://api.hashwatch.us/public/hash-of-day?date=2026-06-01"

Response:

{
 "date": "2026-06-05",
 "generated_at": "2026-06-05T02:14:37Z",
 "cache_hit": true,
 "hashes": [
 {
 "id": "...",
 "executable_name": "chrome-win64.msi",
 "version": "124.0.6367.82",
 "vendor": "Google LLC",
 "platform": "windows",
 "arch": "amd64",
 "hash_sha256": "b94d27b9934d3e08a52e52d7da7dabfac484efe04294e576e9e7c3e07ccb1e83",
 "hash_sha1": null,
 "hash_md5": null,
 "source_url": "https://dl.google.com/...",
 "download_verified": true,
 "valid_from": "2026-06-05T02:13:01Z",
 "sig_signer": "Google LLC",
 "sig_issuer": "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
 "sig_serial": "0a...",
 "sig_thumbprint": "1a2b..."
 }
 ]
}

Fields:

API Reference on HashWatch Docs