Crowdsec Hub API
The Hub API from Crowdsec — 2 operation(s) for hub.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/crowdsec:crowdsec-hub-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Service Hub API
description: This is the API to manage Crowdsec services
contact:
name: CrowdSec
url: https://crowdsec.net/
email: info@crowdsec.net
version: 1.87.2
servers:
- url: https://admin.api.crowdsec.net/v1/
description: Production server
security:
- ApiKeyAuth: []
- BasicAuth: []
tags:
- name: Hub
paths:
/hub/index/{tenant}/{branch}/.index.json:
get:
description: 'Get a (minimized) index file for ''cscli hub update''. May or may not include unused fields
(content, long descriptions, labels...) or redundant ones (author, name).'
operationId: getIndex
parameters:
- in: path
name: branch
required: true
schema:
title: Branch
type: string
- in: path
name: tenant
required: true
schema:
title: Tenant
type: string
- description: Include content in the index
in: query
name: with_content
required: false
schema:
default: false
description: Include content in the index
title: With Content
type: boolean
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/Index'
description: Successful Response
'422':
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
description: Validation Error
summary: Get a minimized index file (crowdsec only)
tags:
- Hub
head:
description: 'This endpoint returns cache-related headers for the index file without the full content.
It is useful for validating cache, checking resource freshness, and managing client-side
cache expiration policies. No body content is returned.'
operationId: headIndex
parameters:
- in: path
name: branch
required: true
schema:
title: Branch
type: string
- in: path
name: tenant
required: true
schema:
title: Tenant
type: string
- description: Include content in the index
in: query
name: with_content
required: false
schema:
default: false
description: Include content in the index
title: With Content
type: boolean
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/Index'
description: Successful Response
'422':
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
description: Validation Error
summary: Check cache control headers for the index file
tags:
- Hub
/hub/index/{tenant}/{branch}/{item_path}:
get:
description: Get an item's content from its path. This is usually a YAML file.
operationId: getItemContent
parameters:
- in: path
name: item_path
required: true
schema:
title: Item Path
type: string
- in: path
name: branch
required: true
schema:
title: Branch
type: string
- in: path
name: tenant
required: true
schema:
title: Tenant
type: string
responses:
'200':
content:
application/json:
schema: {}
description: Successful Response
'404':
description: No content field
'422':
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
description: Validation Error
summary: Get an item's content (crowdsec only)
tags:
- Hub
head:
description: 'This endpoint returns cache-related headers for an item''s content. It is useful for validating
cache, checking resource freshness, and managing client-side cache expiration policies. No body
content is returned.'
operationId: headItemContent
parameters:
- in: path
name: item_path
required: true
schema:
title: Item Path
type: string
- in: path
name: branch
required: true
schema:
title: Branch
type: string
- in: path
name: tenant
required: true
schema:
title: Tenant
type: string
responses:
'200':
content:
application/json:
schema: {}
description: Successful Response
'422':
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
description: Validation Error
summary: Check cache control headers for an item's content
tags:
- Hub
components:
schemas:
ValidationError:
properties:
loc:
items:
anyOf:
- type: string
- type: integer
type: array
title: Location
msg:
type: string
title: Message
type:
type: string
title: Error Type
type: object
required:
- loc
- msg
- type
title: ValidationError
ParserIndex:
properties:
content:
anyOf:
- type: string
- type: 'null'
description: The YAML content of the item, in plaintext.
examples:
- "type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"
title: Content
description:
anyOf:
- type: string
- type: 'null'
description: A short, plaintext description of the item
title: Description
labels:
anyOf:
- additionalProperties:
anyOf:
- type: string
- items:
type: string
type: array
- type: integer
type: object
- type: 'null'
description: Classification labels for the item
examples:
- behavior: ftp:bruteforce
classification:
- attack.T1110
confidence: 3
label: VSFTPD Bruteforce
remediation: true
service: vsftpd
spoofable: 0
title: Labels
path:
anyOf:
- type: string
- type: 'null'
description: Relative path to the item's YAML content
examples:
- scenarios/crowdsecurity/vsftpd-bf.yaml
title: Path
references:
anyOf:
- items:
type: string
type: array
- type: 'null'
description: List of references to external resources
title: References
stage:
description: The stage of the parser
title: Stage
type: string
version:
anyOf:
- type: string
- type: 'null'
description: Current version of the collection
examples:
- '0.2'
title: Version
versions:
anyOf:
- additionalProperties:
$ref: '#/components/schemas/VersionDetail'
type: object
- type: 'null'
description: A dictionary where each key is a version number (e.g., '0.1', '0.2')
examples:
- '0.1':
deprecated: false
digest: 3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1
'0.2':
deprecated: false
digest: d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91
title: Versions
required:
- stage
title: ParserIndex
type: object
CollectionIndex:
properties:
appsec-configs:
anyOf:
- items:
type: string
type: array
- type: 'null'
description: List of appsec-configs
title: Appsec-Configs
appsec-rules:
anyOf:
- items:
type: string
type: array
- type: 'null'
description: List of appsec-rules
title: Appsec-Rules
collections:
anyOf:
- items:
type: string
type: array
- type: 'null'
description: List of collections
title: Collections
content:
anyOf:
- type: string
- type: 'null'
description: The YAML content of the item, in plaintext.
examples:
- "type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"
title: Content
contexts:
anyOf:
- items:
type: string
type: array
- type: 'null'
description: List of contexts
title: Contexts
description:
anyOf:
- type: string
- type: 'null'
description: A short, plaintext description of the item
title: Description
labels:
anyOf:
- additionalProperties:
anyOf:
- type: string
- items:
type: string
type: array
- type: integer
type: object
- type: 'null'
description: Classification labels for the item
examples:
- behavior: ftp:bruteforce
classification:
- attack.T1110
confidence: 3
label: VSFTPD Bruteforce
remediation: true
service: vsftpd
spoofable: 0
title: Labels
parsers:
anyOf:
- items:
type: string
type: array
- type: 'null'
description: List of parsers
title: Parsers
path:
anyOf:
- type: string
- type: 'null'
description: Relative path to the item's YAML content
examples:
- scenarios/crowdsecurity/vsftpd-bf.yaml
title: Path
postoverflows:
anyOf:
- items:
type: string
type: array
- type: 'null'
description: List of postoverflows
title: Postoverflows
references:
anyOf:
- items:
type: string
type: array
- type: 'null'
description: List of references to external resources
title: References
scenarios:
anyOf:
- items:
type: string
type: array
- type: 'null'
description: List of scenarios
title: Scenarios
version:
anyOf:
- type: string
- type: 'null'
description: Current version of the collection
examples:
- '0.2'
title: Version
versions:
anyOf:
- additionalProperties:
$ref: '#/components/schemas/VersionDetail'
type: object
- type: 'null'
description: A dictionary where each key is a version number (e.g., '0.1', '0.2')
examples:
- '0.1':
deprecated: false
digest: 3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1
'0.2':
deprecated: false
digest: d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91
title: Versions
title: CollectionIndex
type: object
PostoverflowIndex:
properties:
content:
anyOf:
- type: string
- type: 'null'
description: The YAML content of the item, in plaintext.
examples:
- "type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"
title: Content
description:
anyOf:
- type: string
- type: 'null'
description: A short, plaintext description of the item
title: Description
labels:
anyOf:
- additionalProperties:
anyOf:
- type: string
- items:
type: string
type: array
- type: integer
type: object
- type: 'null'
description: Classification labels for the item
examples:
- behavior: ftp:bruteforce
classification:
- attack.T1110
confidence: 3
label: VSFTPD Bruteforce
remediation: true
service: vsftpd
spoofable: 0
title: Labels
path:
anyOf:
- type: string
- type: 'null'
description: Relative path to the item's YAML content
examples:
- scenarios/crowdsecurity/vsftpd-bf.yaml
title: Path
references:
anyOf:
- items:
type: string
type: array
- type: 'null'
description: List of references to external resources
title: References
stage:
description: The stage of the postoverflow
title: Stage
type: string
version:
anyOf:
- type: string
- type: 'null'
description: Current version of the collection
examples:
- '0.2'
title: Version
versions:
anyOf:
- additionalProperties:
$ref: '#/components/schemas/VersionDetail'
type: object
- type: 'null'
description: A dictionary where each key is a version number (e.g., '0.1', '0.2')
examples:
- '0.1':
deprecated: false
digest: 3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1
'0.2':
deprecated: false
digest: d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91
title: Versions
required:
- stage
title: PostoverflowIndex
type: object
AppsecConfigIndex:
properties:
content:
anyOf:
- type: string
- type: 'null'
description: The YAML content of the item, in plaintext.
examples:
- "type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"
title: Content
description:
anyOf:
- type: string
- type: 'null'
description: A short, plaintext description of the item
title: Description
labels:
anyOf:
- additionalProperties:
anyOf:
- type: string
- items:
type: string
type: array
- type: integer
type: object
- type: 'null'
description: Classification labels for the item
examples:
- behavior: ftp:bruteforce
classification:
- attack.T1110
confidence: 3
label: VSFTPD Bruteforce
remediation: true
service: vsftpd
spoofable: 0
title: Labels
path:
anyOf:
- type: string
- type: 'null'
description: Relative path to the item's YAML content
examples:
- scenarios/crowdsecurity/vsftpd-bf.yaml
title: Path
references:
anyOf:
- items:
type: string
type: array
- type: 'null'
description: List of references to external resources
title: References
version:
anyOf:
- type: string
- type: 'null'
description: Current version of the collection
examples:
- '0.2'
title: Version
versions:
anyOf:
- additionalProperties:
$ref: '#/components/schemas/VersionDetail'
type: object
- type: 'null'
description: A dictionary where each key is a version number (e.g., '0.1', '0.2')
examples:
- '0.1':
deprecated: false
digest: 3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1
'0.2':
deprecated: false
digest: d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91
title: Versions
title: AppsecConfigIndex
type: object
Index:
description: Index document served to crowdsec/cscli.
properties:
appsec-configs:
additionalProperties:
$ref: '#/components/schemas/AppsecConfigIndex'
title: Appsec-Configs
type: object
appsec-rules:
additionalProperties:
$ref: '#/components/schemas/AppsecRuleIndex'
title: Appsec-Rules
type: object
collections:
additionalProperties:
$ref: '#/components/schemas/CollectionIndex'
title: Collections
type: object
contexts:
additionalProperties:
$ref: '#/components/schemas/ContextIndex'
title: Contexts
type: object
parsers:
additionalProperties:
$ref: '#/components/schemas/ParserIndex'
title: Parsers
type: object
postoverflows:
additionalProperties:
$ref: '#/components/schemas/PostoverflowIndex'
title: Postoverflows
type: object
scenarios:
additionalProperties:
$ref: '#/components/schemas/ScenarioIndex'
title: Scenarios
type: object
title: Index
type: object
VersionDetail:
properties:
deprecated:
anyOf:
- type: boolean
- type: 'null'
default: false
description: Indicates whether this version is deprecated.
title: Deprecated
digest:
description: The SHA256 digest of the versioned file.
examples:
- Detect FTP bruteforce (vsftpd)
title: Digest
type: string
required:
- digest
title: VersionDetail
type: object
ScenarioIndex:
properties:
content:
anyOf:
- type: string
- type: 'null'
description: The YAML content of the item, in plaintext.
examples:
- "type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"
title: Content
description:
anyOf:
- type: string
- type: 'null'
description: A short, plaintext description of the item
title: Description
labels:
anyOf:
- additionalProperties:
anyOf:
- type: string
- items:
type: string
type: array
- type: integer
type: object
- type: 'null'
description: Classification labels for the item
examples:
- behavior: ftp:bruteforce
classification:
- attack.T1110
confidence: 3
label: VSFTPD Bruteforce
remediation: true
service: vsftpd
spoofable: 0
title: Labels
path:
anyOf:
- type: string
- type: 'null'
description: Relative path to the item's YAML content
examples:
- scenarios/crowdsecurity/vsftpd-bf.yaml
title: Path
references:
anyOf:
- items:
type: string
type: array
- type: 'null'
description: List of references to external resources
title: References
version:
anyOf:
- type: string
- type: 'null'
description: Current version of the collection
examples:
- '0.2'
title: Version
versions:
anyOf:
- additionalProperties:
$ref: '#/components/schemas/VersionDetail'
type: object
- type: 'null'
description: A dictionary where each key is a version number (e.g., '0.1', '0.2')
examples:
- '0.1':
deprecated: false
digest: 3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1
'0.2':
deprecated: false
digest: d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91
title: Versions
title: ScenarioIndex
type: object
ContextIndex:
properties:
content:
anyOf:
- type: string
- type: 'null'
description: The YAML content of the item, in plaintext.
examples:
- "type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"
title: Content
description:
anyOf:
- type: string
- type: 'null'
description: A short, plaintext description of the item
title: Description
labels:
anyOf:
- additionalProperties:
anyOf:
- type: string
- items:
type: string
type: array
- type: integer
type: object
- type: 'null'
description: Classification labels for the item
examples:
- behavior: ftp:bruteforce
classification:
- attack.T1110
confidence: 3
label: VSFTPD Bruteforce
remediation: true
service: vsftpd
spoofable: 0
title: Labels
path:
anyOf:
- type: string
- type: 'null'
description: Relative path to the item's YAML content
examples:
- scenarios/crowdsecurity/vsftpd-bf.yaml
title: Path
references:
anyOf:
- items:
type: string
type: array
- type: 'null'
description: List of references to external resources
title: References
version:
anyOf:
- type: string
- type: 'null'
description: Current version of the collection
examples:
- '0.2'
title: Version
versions:
anyOf:
- additionalProperties:
$ref: '#/components/schemas/VersionDetail'
type: object
- type: 'null'
description: A dictionary where each key is a version number (e.g., '0.1', '0.2')
examples:
- '0.1':
deprecated: false
digest: 3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1
'0.2':
deprecated: false
digest: d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91
title: Versions
title: ContextIndex
type: object
AppsecRuleIndex:
properties:
content:
anyOf:
- type: string
- type: 'null'
description: The YAML content of the item, in plaintext.
examples:
- "type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"
title: Content
description:
anyOf:
- type: string
- type: 'null'
description: A short, plaintext description of the item
title: Description
labels:
anyOf:
- additionalProperties:
anyOf:
- type: string
- items:
type: string
type: array
- type: integer
type: object
- type: 'null'
description: Classification labels for the item
examples:
- behavior: ftp:bruteforce
classification:
- attack.T1110
confidence: 3
label: VSFTPD Bruteforce
remediation: true
service: vsftpd
spoofable: 0
title: Labels
path:
anyOf:
- type: string
- type: 'null'
description: Relative path to the item's YAML content
examples:
- scenarios/crowdsecurity/vsftpd-bf.yaml
title: Path
references:
anyOf:
- items:
type: string
type: array
- type: 'null'
description: List of references to external resources
title: References
version:
anyOf:
- type: string
- type: 'null'
description: Current version of the collection
examples:
- '0.2'
title: Version
versions:
anyOf:
- additionalProperties:
$ref: '#/components/schemas/VersionDetail'
type: object
- type: 'null'
description: A dictionary where each key is a version number (e.g., '0.1', '0.2')
examples:
- '0.1':
deprecated: false
digest: 3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1
'0.2':
deprecated: false
digest: d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91
title: Versions
title: AppsecRuleIndex
type: object
HTTPValidationError:
properties:
detail:
items:
$ref: '#/components/schemas/ValidationError'
type: array
title: Detail
type: object
title: HTTPValidationError
securitySchemes:
ApiKeyAuth:
type: apiKey
in: header
name: x-api-key
description: If integration key is provided, can also work to get integration content
BasicAuth:
type: http
scheme: basic
description: Basic Auth for integration content endpoint only