Talos Threat Data API v1.0: Query Bounding and Pagination Decision Pending

The primary goal is to retrieve comprehensive threat data from the Talos Threat Data API v1.0 for use in security analytics. However, the current API design returns the entire result set for a query with no pagination parameters documented, and internally caps responses at 1,000 records. Queries that exceed this limit are silently truncated, producing incomplete datasets. Additionally, the per‑IP rate limit of 100 requests per minute can be quickly exhausted by large, single‑response queries, increasing the risk of throttling or denial‑of‑service scenarios on client applications.

These constraints create uncertainty for developers who need to process large datasets reliably. The Talos documentation notes future plans for pagination but does not specify whether an offset‑based or cursor‑based scheme will be adopted, nor how backward compatibility will be preserved for existing clients that currently rely on a single‑response model.

Key unresolved questions include:

• What pagination strategy (offset or cursor) is intended for the next major release of the API?
• How will clients detect and handle the current silent truncation beyond 1,000 records?
• What measures will be taken to ensure backward compatibility while exposing pagination controls?