Cyber Alerts API – Cloudflare restriction, pagination and IoC clarification

API Platform
1

Hi NHS Developer Community,

We are integrating the NHS Cyber Alerts API as a data source for Threat Intelligence and other relevant cyber-alert information.

We need clarification on the following issues:

1. Cloudflare / WAF restriction

The API works correctly when accessed through a browser and returns the expected JSON response.

However, when the same endpoint is accessed through Postman or our backend application, the request is intercepted by Cloudflare and returns:

“Just a moment… Enable JavaScript and cookies to continue”

The API documentation states that the Cyber Alerts API is open-access and does not require authentication.

Could you please confirm:

  • Is server-to-server/programmatic access to the Cyber Alerts API officially supported?

  • Is there an approved way for a backend application to access the API?

  • Can the application’s outbound IP be allowlisted, or can the relevant Cloudflare/WAF rule be configured to permit API access?

  • Is the Cyber Alerts API part of the NHS API Platform/developer onboarding process, or is it a standalone service?

We are looking for the officially supported approach, rather than trying to bypass the Cloudflare challenge.

2. Pagination

We tested the following URLs directly through a browser:

https://digital.nhs.uk/restapi/CyberAlert/

https://digital.nhs.uk/restapi/CyberAlert/?page=1

https://digital.nhs.uk/restapi/CyberAlert/?page=2

All three currently return the same JSON response, although the documentation indicates that page=x should return different pages.

Could you please confirm whether pagination is currently working as expected, or if there is another supported way to retrieve all alerts?

3. IoC data / indicatorsCompromise

We observed that the indicatorsCompromise field is empty in several alerts we reviewed, while the responses contain other information such as CVEs, advisory content, remediation guidance and reference URLs.

Could you please clarify:

  • Is an empty indicatorsCompromise field expected for some alerts?

  • Should indicatorsCompromise be considered the primary/authoritative source for IoC extraction?

  • If indicatorsCompromise is empty, should another field or section be considered for IoC extraction?

  • Are there any guidelines on which IoC types should be extracted, such as IPs, domains, URLs or hashes?

Any guidance on these points would be appreciated, particularly regarding the officially supported approach for server-to-server access.

2

Hi @Prafful_Nikam

Thank you for your query and apologies for the delayed response.

Unfortunately, the Cyber Alerts API is not managed through the Digital Onboarding Service, so we do not have visibility of its configuration, supported access methods, or infrastructure settings. As a result, we are unable to confirm whether any network restrictions, allowlisting arrangements, or other service-specific requirements apply.

For clarification on the supported integration approach and investigation of the behaviour you are experiencing, please contact the Cyber Alerts API team directly.

I am unable to find a direct email address for the Cyber Alerts API team. Please feel free to raise a request through our Customer Service Portal who should be able to redirect you query to the correct team:

Thanks,

NHS England API Platform team

Please note: The API Platform team can only address queries relevant to the NHS England API Platform, including security, rate limiting, logging, monitoring and alerting. For any API, CIS2, NHS Login specific queries, please reach out to the relevant API / Service teams.