Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
All 92 tools
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/cybelangel-alerts-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"
Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no email required.
A second provider on the same verified email joins the account you already have.
openapi: 3.1.0
info:
version: 1.0.0
title: References
description: |-
API for CybelAngel's Alerts.
Authentication uses standard [OAuth2 Bearer Tokens](https://tools.ietf.org/html/rfc6750).
Here is a simple example of how to fetch such a token with curl:
```shell
curl -X POST https://auth.cybelangel.com/oauth/token -H 'content-type: application/json -d '{"client_id": "client_id", "client_secret": "client_secret", "audience": "https://platform.cybelangel.com/", "grant_type": "client_credentials"}
```
The received access token can then be used as a Bearer token to request our API.
contact:
email: support@cybelangel.com
license:
url: 'https://cybelangel.com/'
name: Proprietary
servers:
- url: 'https://api.cybelangel.com'
paths:
/v1/alerts:
get:
tags:
- alerts
summary: Search alerts
description: 'Search alerts according to user filters.<br/><br/>Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.<br/>Requests for data outside of this range will not return any results.'
operationId: alerts_search_alerts_alerts_get
parameters:
- name: cursor
in: query
description: |-
Set it to the the 'cursor' value received from previous search request to iterate on the following alerts, beyond the limit set per request.
Searching from a cursor does not impact the total number of results.
Behavior is undefined if the filters and sort are changed between successive requests.
Note: with big datasets, iterating on cursor can be much slower than iterating on 'start_date' filter.
required: false
schema:
title: Cursor
description: |-
Set it to the the 'cursor' value received from previous search request to iterate on the following alerts, beyond the limit set per request.
Searching from a cursor does not impact the total number of results.
Behavior is undefined if the filters and sort are changed between successive requests.
Note: with big datasets, iterating on cursor can be much slower than iterating on 'start_date' filter.
anyOf:
- type: string
- name: order_by
in: query
description: |-
Can be multiple fields with +/- for ascending/descending sort.
Fields can be ingestion_date, detection_date, ml_score.
required: false
schema:
type: array
title: Order By
description: |-
Can be multiple fields with +/- for ascending/descending sort.
Fields can be ingestion_date, detection_date, ml_score.
default:
- +ingestion_date
- +detection_date
items:
type: string
pattern: '[+-]?(ingestion_date|detection_date|ml_score)'
minLength: 1
- name: stream_id
in: query
description: |-
Stream id used to filter alerts belonging to some organization.
A client can only query alerts for its allowed streams.
required: true
schema:
type: string
title: Stream Id
description: |-
Stream id used to filter alerts belonging to some organization.
A client can only query alerts for its allowed streams.
minLength: 1
examples:
- 90b18fad-b9ca-41db-bae1-b4964c1a4e84
examples:
default:
value: 90b18fad-b9ca-41db-bae1-b4964c1a4e84
- name: start_date
in: query
description: |-
Minimal ingestion date. Expects a date with timezone information.
Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.
Requests for data outside of this range will not return any results.
required: true
schema:
type: string
title: Start Date
description: |-
Minimal ingestion date. Expects a date with timezone information.
Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.
Requests for data outside of this range will not return any results.
format: date-time
examples:
- '2024-09-01T10:00:00.000Z'
examples:
default:
value: '2024-09-01T10:00:00.000Z'
- name: end_date
in: query
description: |-
Maximal ingestion date. Expects a date with timezone information.
Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.
Requests for data outside of this range will not return any results.
required: false
schema:
title: End Date
description: |-
Maximal ingestion date. Expects a date with timezone information.
Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.
Requests for data outside of this range will not return any results.
anyOf:
- type: string
format: date-time
- name: status
in: query
description: |-
Select only alerts having one of the requested statuses.
By default selects only 'new' alerts to exclude alerts automatically discarded by our ML tools or already processed by analysts.
required: false
schema:
type: array
title: Status
description: |-
Select only alerts having one of the requested statuses.
By default selects only 'new' alerts to exclude alerts automatically discarded by our ML tools or already processed by analysts.
default:
- new
items:
$ref: '#/components/schemas/AlertStatus'
- name: category
in: query
description: 'If set, select alerts with specified categories.'
required: false
schema:
type: array
title: Category
description: 'If set, select alerts with specified categories.'
default: []
items:
$ref: '#/components/schemas/AlertCategory'
- name: customer_assessment
in: query
description: |-
If set, select only alerts having one of the requested customer assessments.
This is the **customer.assessment** field that may be set by clients using the API.
required: false
schema:
type: array
title: Customer Assessment
description: |-
If set, select only alerts having one of the requested customer assessments.
This is the **customer.assessment** field that may be set by clients using the API.
default: []
items:
$ref: '#/components/schemas/CustomerAssessment'
- name: keyword
in: query
description: 'If set, select alerts matching specified keywords aliases.'
required: false
schema:
type: array
title: Keyword
description: 'If set, select alerts matching specified keywords aliases.'
default: []
items:
type: string
minLength: 1
- name: keyword_id
in: query
description: 'If set, select alerts matching specified keyword identifiers.'
required: false
schema:
type: array
title: Keyword Id
description: 'If set, select alerts matching specified keyword identifiers.'
default: []
items:
type: string
minLength: 1
- name: min_ml_score
in: query
description: 'If set, select alerts with equal or higher ''ml.score''.'
required: false
schema:
type: integer
title: Min Ml Score
description: 'If set, select alerts with equal or higher ''ml.score''.'
minimum: 0
maximum: 100
default: 0
- name: hostname
in: query
description: 'If set, select alerts with any specified hostname value.'
required: false
schema:
type: array
title: Hostname
description: 'If set, select alerts with any specified hostname value.'
default: []
items:
type: string
minLength: 1
- name: ip
in: query
description: 'If set, select alerts with specified IP address among ''ip'', ''server_ip'' or ''victim_ip'' fields.'
required: false
schema:
type: array
title: Ip
description: 'If set, select alerts with specified IP address among ''ip'', ''server_ip'' or ''victim_ip'' fields.'
default: []
items:
type: string
minLength: 1
- name: search_query
in: query
description: Words to search in alerts text fields.
required: false
schema:
title: Search Query
description: Words to search in alerts text fields.
anyOf:
- type: string
minLength: 1
- name: limit
in: query
description: Max number of returned alerts. Increasing it will also increase the payload.
required: false
schema:
type: integer
title: Limit
description: Max number of returned alerts. Increasing it will also increase the payload.
minimum: 0
maximum: 1000
default: 10
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/AlertList'
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ValidationError_'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
'404':
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnknownError_'
security:
- jwt: []
servers:
- url: 'https://api.cybelangel.com'
'/v1/alerts/{alert_id}':
get:
tags:
- alerts
summary: Get an alert
description: 'Get an alert by its unique id.<br/><br/>Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.<br/>Requests for data outside of this range will not return any results.'
operationId: alerts_search_an_alert_alerts__alert_id__get
parameters:
- name: alert_id
in: path
description: ID of an alert.
required: true
schema:
type: string
title: Alert Id
description: ID of an alert.
minLength: 1
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/PublicAlert'
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ValidationError_'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
'404':
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnknownError_'
security:
- jwt: []
servers:
- url: 'https://api.cybelangel.com'
'/v1/alerts/{alert_id}/customer':
patch:
tags:
- alerts
summary: Set customer fields
description: Allow to edit customer-maintained fields in an alert published by the API.<br/><br/>The only use now is to assess the alerts.<br/>These assessments may then be used by CybelAngel to improve the alerts automated filtering.
operationId: alerts_patch_an_alert_alerts__alert_id__customer_patch
parameters:
- name: alert_id
in: path
description: ID of an alert.
required: true
schema:
type: string
title: Alert Id
description: ID of an alert.
minLength: 1
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/AlertRequestCustomerFieldsPatch'
responses:
'204':
description: No Content
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ValidationError_'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
'404':
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnknownError_'
security:
- jwt: []
servers:
- url: 'https://api.cybelangel.com'
'/v1/alerts/{alert_id}/credentials':
get:
tags:
- alerts
summary: Get leak alert credentials (deprecated)
description: This endpoint is deprecated and will be removed in a future release.<br/>Use /v1/alerts/<alert_id>/leak-credentials instead.
operationId: alerts_get_alert_credentials_deprecated_alerts__alert_id__credentials_get
parameters:
- name: alert_id
in: path
description: ID of an alert.
required: true
schema:
type: string
title: Alert Id
description: ID of an alert.
minLength: 1
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/CredentialsResponse'
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ValidationError_'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
'404':
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
'410':
description: Gone
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_GoneError_'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnknownError_'
deprecated: true
security:
- jwt: []
servers:
- url: 'https://api.cybelangel.com'
'/v1/alerts/{alert_id}/leak-credentials':
get:
tags:
- alerts
summary: Get leak alert credentials
description: Get credentials associated with an alert.
operationId: alerts_get_alert_credentials_alerts__alert_id__leak_credentials_get
parameters:
- name: alert_id
in: path
description: ID of an alert.
required: true
schema:
type: string
title: Alert Id
description: ID of an alert.
minLength: 1
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/CredentialsResponse'
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ValidationError_'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
'404':
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnknownError_'
security:
- jwt: []
servers:
- url: 'https://api.cybelangel.com'
'/v1/alerts/{alert_id}/codeshare-findings':
get:
tags:
- alerts
summary: Get codeshare alert findings
description: 'Get sensitive code snippets for a codeshare alert.<br/><br/>Note: downloading hundreds of thousands of findings may take a few dozen seconds.'
operationId: alerts_get_codeshare_findings_alerts__alert_id__codeshare_findings_get
parameters:
- name: alert_id
in: path
description: ID of an alert.
required: true
schema:
type: string
title: Alert Id
description: ID of an alert.
minLength: 1
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/FindingsResponse'
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ValidationError_'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
'404':
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnknownError_'
security:
- jwt: []
servers:
- url: 'https://api.cybelangel.com'
'/v1/alerts/{alert_id}/dns-screenshot':
get:
tags:
- alerts
summary: Get DNS alert screenshot.
description: 'Get the website screenshot associated with a DNS alert.<br/><br/>If a screenshot is present, it is returned as a PNG file.<br/>If no screenshot was taken for the alert, a 204 NO_CONTENT is returned.<br/>If the alert is older than 180 days a GONE response is returned.'
operationId: alerts_get_alert_dns_screenshot_alerts__alert_id__dns_screenshot_get
parameters:
- name: alert_id
in: path
description: ID of an alert.
required: true
schema:
type: string
title: Alert Id
description: ID of an alert.
minLength: 1
responses:
'200':
description: OK
content:
image/png:
schema:
type: string
contentMediaType: application/octet-stream
'204':
description: No Content
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ValidationError_'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
'404':
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
'410':
description: Gone
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_GoneError_'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnknownError_'
security:
- jwt: []
servers:
- url: 'https://api.cybelangel.com'
/v1/leak-credentials:
get:
tags:
- alerts
summary: Get leak credentials
description: Get leak credentials we collected.
operationId: alerts_get_leak_credentials_leak_credentials_get
parameters:
- name: stream_id
in: query
description: |-
Stream id used to filter alerts belonging to some organization.
A client can only query alerts for its allowed streams.
required: true
schema:
type: string
title: Stream Id
description: |-
Stream id used to filter alerts belonging to some organization.
A client can only query alerts for its allowed streams.
minLength: 1
examples:
- 90b18fad-b9ca-41db-bae1-b4964c1a4e84
examples:
default:
value: 90b18fad-b9ca-41db-bae1-b4964c1a4e84
- name: start_date
in: query
description: Minimal ingestion date. Expects a date with timezone information.
required: true
schema:
type: string
title: Start Date
description: Minimal ingestion date. Expects a date with timezone information.
format: date-time
examples:
- '2024-09-01T10:00:00.000Z'
examples:
default:
value: '2024-09-01T10:00:00.000Z'
- name: end_date
in: query
description: Maximal ingestion date. Expects a date with timezone information.
required: false
schema:
title: End Date
description: Maximal ingestion date. Expects a date with timezone information.
anyOf:
- type: string
format: date-time
- name: match
in: query
description: Words to search in credentials logins and targets.
required: false
schema:
title: Match
description: Words to search in credentials logins and targets.
anyOf:
- type: string
minLength: 1
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/CredentialsResponse'
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ValidationError_'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
'404':
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
'410':
description: Gone
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_GoneError_'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnknownError_'
security:
- jwt: []
servers:
- url: 'https://api.cybelangel.com'
/v1/stix/alerts:
get:
tags:
- stix
summary: Search alerts in STIX 2.1 format
description: 'Search alerts according to user filters and return them as a Bundle in STIX 2.1 format.<br/>See https://oasis-open.github.io/cti-documentation/stix/intro for more information on this format.<br/><br/>Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.<br/>Requests for data outside of this range will not return any results.'
operationId: stix_search_stix_alerts_stix_alerts_get
parameters:
- name: cursor
in: query
description: |-
Set it to the the 'cursor' value received from previous search request to iterate on the following alerts, beyond the limit set per request.
Searching from a cursor does not impact the total number of results.
Behavior is undefined if the filters and sort are changed between successive requests.
Note: with big datasets, iterating on cursor can be much slower than iterating on 'start_date' filter.
required: false
schema:
title: Cursor
description: |-
Set it to the the 'cursor' value received from previous search request to iterate on the following alerts, beyond the limit set per request.
Searching from a cursor does not impact the total number of results.
Behavior is undefined if the filters and sort are changed between successive requests.
Note: with big datasets, iterating on cursor can be much slower than iterating on 'start_date' filter.
anyOf: []
- name: order_by
in: query
description: |-
Can be multiple fields with +/- for ascending/descending sort.
Fields can be ingestion_date, detection_date, ml_score.
required: false
schema:
type: array
title: Order By
description: |-
Can be multiple fields with +/- for ascending/descending sort.
Fields can be ingestion_date, detection_date, ml_score.
default:
- +ingestion_date
- +detection_date
items:
type: string
pattern: '[+-]?(ingestion_date|detection_date|ml_score)'
minLength: 1
- name: stream_id
in: query
description: |-
Stream id used to filter alerts belonging to some organization.
A client can only query alerts for its allowed streams.
required: true
schema:
type: string
title: Stream Id
description: |-
Stream id used to filter alerts belonging to some organization.
A client can only query alerts for its allowed streams.
minLength: 1
examples:
- 90b18fad-b9ca-41db-bae1-b4964c1a4e84
examples:
default:
value: 90b18fad-b9ca-41db-bae1-b4964c1a4e84
- name: start_date
in: query
description: |-
Minimal ingestion date. Expects a date with timezone information.
Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.
Requests for data outside of this range will not return any results.
required: true
schema:
type: string
title: Start Date
description: |-
Minimal ingestion date. Expects a date with timezone information.
Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.
Requests for data outside of this range will not return any results.
format: date-time
examples:
- '2024-09-01T10:00:00.000Z'
examples:
default:
value: '2024-09-01T10:00:00.000Z'
- name: end_date
in: query
description: |-
Maximal ingestion date. Expects a date with timezone information.
Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.
Requests for data outside of this range will not return any results.
required: false
schema:
title: End Date
description: |-
Maximal ingestion date. Expects a date with timezone information.
Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.
Requests for data outside of this range will not return any results.
anyOf: []
- name: status
in: query
description: |-
Select only alerts having one of the requested statuses.
By default selects only 'new' alerts to exclude alerts automatically discarded by our ML tools or already processed by analysts.
required: false
schema:
type: array
title: Status
description: |-
Select only alerts having one of the requested statuses.
By default selects only 'new' alerts to exclude alerts automatically discarded by our ML tools or already processed by analysts.
default:
- new
items:
$ref: '#/components/schemas/AlertStatus'
- name: category
in: query
description: 'If set, select alerts with specified categories.'
required: false
schema:
type: array
title: Category
description: 'If set, select alerts with specified categories.'
default: []
items:
$ref: '#/components/schemas/AlertCategory'
- name: customer_assessment
in: query
description: |-
If set, select only alerts having one of the requested customer assessments.
This is the **customer.assessment** field that may be set by clients using the API.
required: false
schema:
type: array
title: Customer Assessment
description: |-
If set, select only alerts having one of the requested customer assessments.
This is the **customer.assessment** field that may be set by clients using the API.
default: []
items:
$ref: '#/components/schemas/CustomerAssessment'
- name: keyword
in: query
description: 'If set, select alerts matching specified keywords aliases.'
required: false
schema:
type: array
title: Keyword
description: 'If set, select alerts matching specified keywords aliases.'
default: []
items:
type: string
minLength: 1
- name: keyword_id
in: quer
# --- truncated at 32 KB (92 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cybelangel/refs/heads/main/openapi/cybelangel-alerts-openapi.yml