> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# URLhaus

> Reference for the Tracecat URLhaus integration: registered actions, required secrets, expected inputs, and example workflow usage.

## List recent payloads

Action ID: `tools.urlhaus.list_recent_payloads`

List recent payloads. Calls GET /v1/payloads/recent/limit/\{limit}/ directly.

Reference: [https://urlhaus-api.abuse.ch/#payloads-recent](https://urlhaus-api.abuse.ch/#payloads-recent)

### Secrets

Required secrets:

* `abusech`: required values `ABUSECH_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  URLhaus API base URL.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of payloads to return. URLhaus allows up to 1000.

  Default: `100`.
</ParamField>

## List URL blocklist

Action ID: `tools.urlhaus.list_url_threats`

List recent URLs from URLhaus blocklist

Reference: [https://urlhaus-api.abuse.ch/#urls-recent](https://urlhaus-api.abuse.ch/#urls-recent)

### Secrets

Required secrets:

* `abusech`: required values `ABUSECH_API_KEY`.

### Input fields

<ParamField path="limit" type="integer">
  Maximum number of URLs to return.

  Default: `100`.
</ParamField>

## Lookup host

Action ID: `tools.urlhaus.lookup_host`

Look up a host, domain, or IPv4 address. Calls POST /v1/host/ directly.

Reference: [https://urlhaus-api.abuse.ch/#host](https://urlhaus-api.abuse.ch/#host)

### Secrets

Required secrets:

* `abusech`: required values `ABUSECH_API_KEY`.

### Input fields

<ParamField path="host" type="string" required>
  Host, domain, or IPv4 address to lookup.
</ParamField>

<ParamField path="base_url" type="string | null">
  URLhaus API base URL.

  Default: `null`.
</ParamField>

## Lookup payload

Action ID: `tools.urlhaus.lookup_payload`

Look up a payload by file hash. Calls POST /v1/payload/ directly.

Reference: [https://urlhaus-api.abuse.ch/#payload](https://urlhaus-api.abuse.ch/#payload)

### Secrets

Required secrets:

* `abusech`: required values `ABUSECH_API_KEY`.

### Input fields

<ParamField path="file_hash" type="string" required>
  MD5 or SHA256 hash of the payload to lookup.
</ParamField>

<ParamField path="base_url" type="string | null">
  URLhaus API base URL.

  Default: `null`.
</ParamField>

## Lookup URL

Action ID: `tools.urlhaus.lookup_url`

Look up a malware URL. Calls POST /v1/url/ directly.

Reference: [https://urlhaus-api.abuse.ch/#url](https://urlhaus-api.abuse.ch/#url)

### Secrets

Required secrets:

* `abusech`: required values `ABUSECH_API_KEY`.

### Input fields

<ParamField path="url" type="string" required>
  URL to lookup.
</ParamField>

<ParamField path="base_url" type="string | null">
  URLhaus API base URL.

  Default: `null`.
</ParamField>