NordStellar Node Reference

This page documents every resource, operation, and parameter exposed by the NordStellar node, along with the Platform Integrations API endpoint each operation calls. For installation and credential setup, see Setup.

Node Basics

The node has a single Resource selector with two values, Event (the default) and Project. The available Operation list changes depending on which resource you pick.

All requests are sent to {Base URL}/v3, where the base URL comes from your credential and defaults to https://platform-integration-api.nordstellar.com. The access token is sent as a bearer token in the Authorization header.

Resource: Project

Get Many

Retrieves the projects available to your organization. Use this first — most event operations need a project ID.

Endpoint: GET /v3/projects

Parameter	Type	Default	Description
Return All	Boolean	false	Whether to return every project or stop at the limit below.
Limit	Number	50	Maximum number of projects to return. Only shown when Return All is off.

Output: One n8n item per project. The node unwraps the API's items array, so each output item is a project record rather than a single item containing the whole page.

Resource: Event

Get Many

Lists events for a single project, optionally narrowed to a date range. This is the operation most scheduled workflows are built around.

Endpoint: GET /v3/projects/{projectId}/events

Parameter	Type	Default	Required	Description
Project ID	String	—	Yes	GUID of the project to list events for.
Return All	Boolean	false	No	Whether to return every event or stop at the limit below.
Limit	Number	50	No	Maximum number of events to return. Only shown when Return All is off.
Filters → Date Added From	Date/Time	—	No	Only return events added on or after this time. Sent as the date-added-from query parameter.
Filters → Date Added To	Date/Time	—	No	Only return events added on or before this time. Sent as the date-added-to query parameter.

Both date filters live under the Filters collection — click Add Filter to reveal them. Values are sent in ISO 8601 format.

Output: One n8n item per event, with the items array unwrapped as above.

Get

Retrieves the complete record for one event, identified by its type and ID.

Endpoint: GET /v3/events/{eventType}/{eventId}

Parameter	Type	Default	Required	Description
Event Type	Options	Data Breach	Yes	The category of event to retrieve. See the table below.
Event ID	String	—	Yes	GUID of the event.

Output: A single item containing the full event record. The response shape varies by event type; see the API Reference for the fields returned for each one.

Supported Event Types

Event Type (in n8n)	API value
Attack Surface DNS Vulnerability	attack-surface-dns-vulnerabilities
Attack Surface Network Service Vulnerability	attack-surface-network-service-vulnerabilities
Attack Surface Web Application Vulnerability	attack-surface-web-application-vulnerabilities
Combo List	combo-lists
Consumer Credential	consumer-credentials
Dark Web Forum Post	dark-web-forum-posts
Dark Web Marketplace Post	dark-web-marketplace-posts
Dark Web Ransomware Post	dark-web-ransomware-posts
Dark Web Telegram Post	dark-web-telegram-posts
Data Breach	data-breaches
Domain Permutation	domain-permutations
Malware Infection	malware-infections

The API value is what appears in the type field of events returned by Get Many, so you can map one operation's output straight into the other's input.

Resolve

Marks an event as resolved, or reopens a previously resolved one. Use this to keep NordStellar in sync with the state of a ticket or incident elsewhere.

Endpoint: PATCH /v3/events/{eventId}/is_resolved

Parameter	Type	Default	Required	Description
Event ID	String	—	Yes	GUID of the event to update.
Resolved	Boolean	true	Yes	Turn on to resolve the event, off to reopen it.

Output: A single item containing the updated event state returned by the API.

Pagination

Both Get Many operations page through results the same way:

• With Return All off, the node makes one request and returns at most Limit items.
• With Return All on, the node follows the next link in each API response until no further pages remain, then returns the combined result.

Enabling Return All on a broad date range can produce a very large number of items in a single execution. Where you expect high volume, prefer a narrow Date Added From / Date Added To window and let a schedule trigger run the workflow more often.

Error Handling

The node validates inputs before contacting the API and fails the step early when something is wrong:

• Project ID and Event ID must be valid GUIDs.
• Event Type must be one of the supported values listed above.
• The request URL must be HTTPS on a nordstellar.com domain.

These checks matter most when parameters come from expressions rather than being typed in by hand, since an upstream node could otherwise feed an unexpected value into the request path.

To keep a workflow running when a single item fails — for example when resolving a batch of events and one ID is stale — enable Continue On Fail in the node's settings and branch on the error output.

Related

• Setup — install the node and connect your credential.
• Example Workflows — end-to-end patterns using these operations.
• Platform Integrations API — the underlying API, including how to generate access tokens.
• API Reference — full request and response schemas.