HackNoticeInstall

Summary

Replaces the tags on a HackNotice third-party watchlist domain, identified by its document ID, by sending a PUT request with a { "tags": [...] } body.

Inputs

• Watchlist ID (required) — Document ID of the third-party watchlist item to update. It is trimmed and URL-encoded into the path /hackwatchlist/{id}. An empty value throws an error.
• Tags (required) — JSON array of tags (default []). It can be a JSON string or an array. It must parse to an array, otherwise the node throws 'Tags must be a valid JSON array' or 'Tags must be a JSON array'. The array is sent as { "tags": [...] }.

Output shape

One or more n8n items holding the API's JSON response for the updated watchlist item. Each item is paired to its input item. If the response is an array, it becomes one item per element.

The exact response fields are defined by the HackNotice API and are not shown in the source. A string response is parsed as JSON. If parsing fails, it is wrapped as { value: ... }. Non-object entries are also wrapped as { value }. An empty array sends { "tags": [] }, which presumably clears the tags, but the source doesn't confirm this. The operation runs once per input item. API errors surface as a node API error.

Examples

Example 1: Tag a watched vendor domain as critical after triage.

Resource: Third Party Watchlist; Operation: Update by ID; Watchlist ID: {{$json._id}}; Tags: ["critical","vendor"]

Example 2: Set tags dynamically from an earlier node's output.

Watchlist ID: {{$json.id}}; Tags (expression): {{ JSON.stringify($json.newTags) }}

Links

• n8n community nodes installation guide