Malwarebytes
Malwarebytes is an American anti-malware and endpoint security company founded in 2008 and headquartered in Santa Clara, California. It sells consumer protection under the Malwarebytes brand (Premium Security, Mobile Security, Browser Guard, Privacy VPN, Identity Theft Protection, Personal Data Remover, AdwCleaner) and business endpoint security under the ThreatDown brand, powered by Malwarebytes. The programmable surface is ThreatDown: two large OAuth2-protected REST APIs — the Nebula API for direct-tenant endpoint security management and the OneView API for multi-tenant MSP management of sites and subscriptions — both served from api.threatdown.com and documented with public OpenAPI 3.0 definitions covering endpoints, detections, jobs, policies, quarantine, vulnerability and patch management, EDR/XDR, DNS filtering, device control, email protection and webhooks.
Solid contracts, transparent operations, and an easy start — typically complete on four or five facets with one clear soft spot.
API Evangelist profiles Malwarebytes the way a machine reads it — 113 machine-readable artifacts across 52 APIs, pulled from the provider's own public surface and indexed so a developer, an analyst, or an AI agent can evaluate it against every other provider on the network.
Every provider in the network is reduced to the same set of machine-readable artifacts — OpenAPI contracts, event specifications, GraphQL schemas, runnable collections, pricing and rate-limit signals, security posture, OAuth scopes, and the agent surfaces (MCP servers and skills) that let software drive the API on its own. We profile them because the interface is the part of a company you can actually inspect: it is a truer signal of what a provider does than any marketing page. From those artifacts we compute the Kin Score — Malwarebytes scores 58.4/100 (strong), with a separate agent-readiness read of 46/100 (agent ready). The full breakdown is below, followed by every artifact we hold — each card links through to its machine-readable definition on apis.io.
Kin Score
This is the API Evangelist rating — a single, repeatable read computed from the artifacts on this page. Green fill is points earned; the red track is points possible, so every bar shows earned-versus-possible at a glance.
Kin Score
How this is scored →scored 2026-08-17 · rubric v0.11.0
Put this on your own site. The badge is drawn live from Malwarebytes's current Kin Score — paste it once and it updates itself every time the score is recomputed. It follows your visitor's light or dark setting, and it links back here so anyone who sees it can read the full breakdown.
<!-- Kin Score · API Evangelist -->
<a href="https://providers.apievangelist.com/providers/malwarebytes/"
title="Malwarebytes on API Evangelist — API profile and Kin Score">
<img src="https://apis.io/badge/malwarebytes.svg"
alt="Malwarebytes Kin Score — API readiness rating by API Evangelist" width="150" height="150" loading="lazy">
</a>[](https://providers.apievangelist.com/providers/malwarebytes/)<!-- Kin Score · API Evangelist -->
<a href="https://providers.apievangelist.com/providers/malwarebytes/"
title="Malwarebytes on API Evangelist — API profile and Kin Score">
<img src="https://apis.io/badge/malwarebytes/card.svg"
alt="Malwarebytes Kin Score — API readiness rating by API Evangelist" width="340" height="120" loading="lazy">
</a>More shapes, themes and sizes → · Score as JSON · How badges work
How we profile Malwarebytes
Each block below is one kind of artifact we hold for Malwarebytes. For each we say what it is and why it earns a place in the profile, then list every one we've indexed — capped at two rows, scroll within the panel for the rest.
APIs 52
Each API is captured as its own OpenAPI definition — every operation, parameter, and response. This is the single most useful machine-readable description of what an API does, and it's what lets us score, lint, mock, and generate against it without asking the provider for anything.
Individual APIs this provider publishes, each with its own machine-readable definition.
Malwarebytes Account API
The Account API from Malwarebytes — 2 operation(s) for account.
Malwarebytes AI Detection & Response API
Manage governance rules and settings for AI Detection & Response (AIDR). Use these APIs to create per-tool authorization rules that determine whether specific AI tools are autho...
Malwarebytes App Block API
The App Block API from Malwarebytes — 20 operation(s) for app block.
Malwarebytes Assets API
The Assets API from Malwarebytes — 8 operation(s) for assets.
Malwarebytes Authentication API
The Authentication API from Malwarebytes — 2 operation(s) for authentication.
Malwarebytes Case Management API
The Case Management APIs are for managing Managed Detection and Response (MDR) and Managed Threat Hunting (MTH) cases.
Malwarebytes Content Filtering API
The Content Filtering APIs are for managing content filtering rules used by the DNS module. These rules control what domains or categories of domains your endpoints have access to.
Malwarebytes Copilot API
The Copilot API from Malwarebytes — 10 operation(s) for copilot.
Malwarebytes Detections API
Detections contain information on threats such as malware, ransomware, and malicious URLs found across your account. Use the detection APIs to export detection data and retrieve...
Malwarebytes Device Control API
The Device Control feature manages access to USB storage drives. Activity is logged every time a USB device is blocked or restricted to read-only. Use the Device Control APIs to...
Malwarebytes DNS API
The DNS API from Malwarebytes — 4 operation(s) for dns.
Malwarebytes DNS Logs API
The DNS Filtering module limits the number of domain-based threats in your environment by allowing and blocking access across the network. Each time this occurs, a record is gen...
Malwarebytes Drive Encryption API
The Drive Encryption API from Malwarebytes — 5 operation(s) for drive encryption.
Malwarebytes Email Protection API
The Email Protection API from Malwarebytes — 79 operation(s) for email protection.
Malwarebytes Endpoints API
## Endpoints Introduction An Endpoint is a device which has the ThreatDown Endpoint Agent installed. Currently, there are available Endpoint Agents for Windows, macOS, and Linux...
Malwarebytes Events API
An event is a general term for a threat that has occurred, remediation or other action taken on a threat, and other endpoint-related activity.
Malwarebytes Exclusions API
Exclusions allow you to prevent trusted applications, websites, and services from being detected by our security engine. This means they won't be scanned or blocked. Use these A...
Malwarebytes Firewall Management API
The Firewall Management API from Malwarebytes — 20 operation(s) for firewall management.
Malwarebytes Flight Recorder API
EDR customers can use Flight Recorder to search event data captured on endpoints that have suspicious activity monitoring enabled. Use these APIs to search through files, regist...
Malwarebytes Grid API
# Grid Introduction Using the following API, you can search endpoints, detections, software inventory, vulnerabilities, rid rules, os-patches, device control events and dns logs...
Malwarebytes Groups API
Groups are used to contain and organize endpoints. Policies, which determine the software settings, and endpoints, are assigned to groups. Endpoints use the policies in the grou...
Malwarebytes Ignore Rules API
The Ignore Rules API from Malwarebytes — 4 operation(s) for ignore rules.
Malwarebytes Info API
The Info API from Malwarebytes — 1 operation(s) for info.
Malwarebytes Installation Tokens API
Use these APIs to generate, send, and revoke installation tokens used to activate Mobile Security for Business.
Malwarebytes Installers API
The Installers APIs allow you to deploy the endpoint agent to Windows and macOS devices.
Malwarebytes ITDR API
The ITDR API from Malwarebytes — 29 operation(s) for itdr.
Malwarebytes Jobs API
Jobs are tasks that are issued to endpoints. Use these APIs to manage, search, and export jobs.
Malwarebytes Licensing API
The Licensing API from Malwarebytes — 1 operation(s) for licensing.
Malwarebytes MDR API
The MDR API from Malwarebytes — 2 operation(s) for mdr.
Malwarebytes MXDR API
The MXDR API from Malwarebytes — 4 operation(s) for mxdr.
Malwarebytes Notifications API
This API offers a powerful tool to create notification subscriptions. There are different categories of notifications, for each category different constraints and output fields ...
Malwarebytes OS Patches API
The OS Patches API from Malwarebytes — 8 operation(s) for os patches.
Malwarebytes Policies API
A policy is a set of configurations that determine how the endpoint agent monitors your endpoints, such as protection and scan settings. Once a policy has been created, it needs...
Malwarebytes Preferences API
The Preferences APIs allow you to enable or disable all notifications of a specific type (email, webhook, slack, teams, admin app), without needing to modify or delete multiple ...
Malwarebytes Products API
The Products API from Malwarebytes — 3 operation(s) for products.
Malwarebytes Quarantine API
When a harmful file is found on a device, it can be neutralized and placed in quarantine, preventing it from posing a threat. You can utilize the Quarantine APIs to export or ch...
Malwarebytes Remediation API
The Remediation API from Malwarebytes — 3 operation(s) for remediation.
Malwarebytes Remote Intrusion Detection API
A remote intrusion detection (RID) occurs when a brute force protection rule is triggered according to policy settings. Use these APIs to export and search for RID rules by spec...
Malwarebytes Reports API
The Reports API from Malwarebytes — 8 operation(s) for reports.
Malwarebytes Sandbox API
The Sandbox API from Malwarebytes — 2 operation(s) for sandbox.
Malwarebytes Schedules API
Scheduled scans allow you to automate scans to run based on a certain schedule, rather than manually triggering a scan. Use these APIs to create and manage your scan schedules.
Malwarebytes Security Advisor API
The Security Advisor API from Malwarebytes — 8 operation(s) for security advisor.
Malwarebytes Sites API
Create and manage sites through APIs. Using sites APIs you can easily segment the usage and the subscriptions for your customers. In order to obtain an `account_id` for one of y...
Malwarebytes Subscriptions API
Subscriptions allow you to enable and manage ThreatDown security services for your customers by setting terms, volume and duration.
Malwarebytes Suspicious Activity API
Suspicious Activities are found using Endpoint Detection and Response (EDR). When Suspicious Activity Monitoring is enabled via the policy, EDR watches for potentially malicious...
Malwarebytes Syslog API
The Syslog API from Malwarebytes — 5 operation(s) for syslog.
Malwarebytes Usage API
The Usage API from Malwarebytes — 9 operation(s) for usage.
Malwarebytes Users API
The Users API from Malwarebytes — 5 operation(s) for users.
Malwarebytes Vulnerability Assessment API
The Vulnerability Assessment API from Malwarebytes — 5 operation(s) for vulnerability assessment.
Malwarebytes Vulnerability Management API
The Vulnerability Management API from Malwarebytes — 14 operation(s) for vulnerability management.
Malwarebytes Webhooks API
## Using Webhooks ThreatDown can send webhook events that notify your application any time an event happens on your account. This is useful for transactions which are not report...
Malwarebytes XDR API
The XDR API from Malwarebytes — 4 operation(s) for xdr.
Scroll within the panel for all 52 ·
Open Collections 53
Open, tool-agnostic collections carry the same runnable value as Postman without locking you to one client — the portable, forkable form of the same exercise.
Open, tool-agnostic API collections (OpenAPI-derived and Bruno).
API Collection
OPEN COLLECTIONThreatDown Account API
OPEN COLLECTIONMalwarebytes AI Detection & Response API
OPEN COLLECTIONMalwarebytes App Block API
OPEN COLLECTIONMalwarebytes Assets API
OPEN COLLECTIONMalwarebytes Authentication API
OPEN COLLECTIONMalwarebytes Case Management API
OPEN COLLECTIONMalwarebytes Content Filtering API
OPEN COLLECTIONThreatDown Copilot API
OPEN COLLECTIONMalwarebytes Detections API
OPEN COLLECTIONMalwarebytes Device Control API
OPEN COLLECTIONThreatDown DNS API
OPEN COLLECTIONThreatDown DNS Logs API
OPEN COLLECTIONThreatDown Drive Encryption API
OPEN COLLECTIONMalwarebytes Email Protection API
OPEN COLLECTIONMalwarebytes Endpoints API
OPEN COLLECTIONMalwarebytes Events API
OPEN COLLECTIONMalwarebytes Exclusions API
OPEN COLLECTIONMalwarebytes Firewall Management API
OPEN COLLECTIONMalwarebytes Flight Recorder API
OPEN COLLECTIONMalwarebytes Grid API
OPEN COLLECTIONMalwarebytes Groups API
OPEN COLLECTIONMalwarebytes Ignore Rules API
OPEN COLLECTIONThreatDown Info API
OPEN COLLECTIONMalwarebytes Installation Tokens API
OPEN COLLECTIONMalwarebytes Installers API
OPEN COLLECTIONThreatDown ITDR API
OPEN COLLECTIONMalwarebytes Jobs API
OPEN COLLECTIONThreatDown Licensing API
OPEN COLLECTIONMalwarebytes MDR API
OPEN COLLECTIONThreatDown MXDR API
OPEN COLLECTIONMalwarebytes Notifications API
OPEN COLLECTIONMalwarebytes OS Patches API
OPEN COLLECTIONMalwarebytes Policies API
OPEN COLLECTIONMalwarebytes Preferences API
OPEN COLLECTIONThreatDown Products API
OPEN COLLECTIONMalwarebytes Quarantine API
OPEN COLLECTIONThreatDown Remediation API
OPEN COLLECTIONMalwarebytes Remote Intrusion Detection API
OPEN COLLECTIONMalwarebytes Reports API
OPEN COLLECTIONThreatDown Sandbox API
OPEN COLLECTIONMalwarebytes Schedules API
OPEN COLLECTIONThreatDown Security Advisor API
OPEN COLLECTIONThreatDown Sites API
OPEN COLLECTIONThreatDown Subscriptions API
OPEN COLLECTIONMalwarebytes Suspicious Activity API
OPEN COLLECTIONThreatDown Syslog API
OPEN COLLECTIONMalwarebytes Usage API
OPEN COLLECTIONMalwarebytes Users API
OPEN COLLECTIONThreatDown Vulnerability Assessment API
OPEN COLLECTIONMalwarebytes Vulnerability Management API
OPEN COLLECTIONMalwarebytes Webhooks API
OPEN COLLECTIONThreatDown XDR API
OPEN COLLECTIONScroll within the panel for all 53 ·
MCP Servers 1
Model Context Protocol servers expose these APIs directly to AI agents. We profile them because agent-native access is the fastest-growing way this provider's capabilities actually get used.
Model Context Protocol servers that expose these APIs to AI agents.
malwarebytes-mcp.yml
MCP SERVERRate Limits 1
Rate limits are the difference between a demo that works and a production integration that doesn't fall over. Publishing them is an operational-transparency signal — and a hard requirement for any agent that plans its own throughput.
Documented rate limits and quota policies.
Malwarebytes Rate Limits
RATE LIMITSEvent Specifications 1
Not every API is request/response. AsyncAPI describes the event-driven and streaming side — the webhooks and channels — so the asynchronous half of the interface is documented the same way the synchronous half is.
AsyncAPI definitions for this provider's event-driven and streaming APIs.
Malwarebytes Threatdown Webhooks
ASYNCAPISecurity Posture 4
Authentication, domain security, vulnerability disclosure, and trust-center signals — the evidence that a provider takes security seriously enough to document it. We profile it because you can't govern what you can't see.
Authentication, domain security, vulnerability disclosure, and trust-center signals.
Scopes 1
OAuth scopes are the vocabulary of least-privilege access. Profiling them shows exactly what an integration — or an agent acting on a user's behalf — is allowed to do.
OAuth scopes governing access to this provider's APIs.
Resources
Every other property we hold for Malwarebytes — documentation, portals, status pages, policies, and corporate surface — grouped by the job it does, following the integrator's arc from getting started to running in production.
Get Started 3
Portal, sign-up, and the first successful call
Documentation 2
Reference material describing how the API behaves
Agent Surfaces 4
MCP servers, agent skills, and machine-readable catalogs
Design & Contract 6
Pagination, idempotency, versioning, errors, and events
Build 2
SDKs, sample code, and the tooling you integrate with
Access & Security 8
Authentication, authorization, and security posture
Scroll within the panel for all 8 ·
Operate 7
Status, limits, changes, and where to get help
Scroll within the panel for all 7 ·
Commercial 3
Pricing, plans, and the legal terms of use
Company 2
The organization behind the API
Other 1
Properties that don't map to a standard resource type
← All providers · Data indexed from github.com/api-evangelist/malwarebytes · machine-readable index on apis.io
This is an independent, third-party profile of Malwarebytes, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.
The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.
Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.
info@apievangelist.com
·
Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and
you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.