Cyware Administration API

openapi: 3.2.0
info:
  title: Cyware Intel Exchange (CTIX) v3 Open Administration API
  version: 3.6.2
  description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.


    Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.


    This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
  contact:
    name: Cyware
    url: https://www.cyware.com/contact-us
  termsOfService: https://www.cyware.com/legal/terms-of-use
  x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
  x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
  description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
  variables:
    ctix_host:
      default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Administration
  description: Administration
paths:
  /event-logs/audit-logs/:
    get:
      operationId: listConfigurationChangeLogs
      summary: Get Configuration Change Log List
      tags:
      - Administration
      description: Returns a list of logs of the configuration changes in the platform.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/administration/audit-log-management/list-configuration-change-logs
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve logs.
          default: '1'
          examples:
          - '1'
        description: Pass the page number to retrieve logs.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of logs to retrieve per page.
          default: '10'
          examples:
          - '10'
        description: Pass the number of logs to retrieve per page.
      - name: user_id
        in: query
        required: false
        schema:
          type: string
          description: Pass the unique ID of a user to filter logs.
          examples:
          - 41755c7b-8370-456c-88b4-3df6c767e896
        description: Pass the unique ID of a user to filter logs.
      - name: created_from
        in: query
        required: false
        schema:
          type: string
          description: Pass the created time in epoch format from which you want to retrieve logs.
          examples:
          - '1704067200'
        description: Pass the created time in epoch format from which you want to retrieve logs.
      - name: created_to
        in: query
        required: false
        schema:
          type: string
          description: Pass the created time in epoch format until which you want to retrieve logs.
          examples:
          - '1704758399'
        description: Pass the created time in epoch format until which you want to retrieve logs.
      - name: section
        in: query
        required: false
        schema:
          type: string
          description: Pass the configuration section to filter logs. To retrieve the name of the sections, use the **GET List Configuration Sections API**.
          examples:
          - Configuration
        description: Pass the configuration section to filter logs. To retrieve the name of the sections, use the **GET List Configuration Sections API**.
      - name: action
        in: query
        required: false
        schema:
          type: string
          description: Pass the action type to filter logs.
          enum:
          - ADD
          - EDIT
          - DELETE
          examples:
          - ADD
        description: Pass the action type to filter logs.
      - name: entity_type
        in: query
        required: false
        schema:
          type: string
          description: Pass the entity type of the configuration that is modified.
          examples:
          - User
        description: Pass the entity type of the configuration that is modified.
      - name: field
        in: query
        required: false
        schema:
          type: string
          description: Pass the name of a field to filter logs.
          examples:
          - is_active
        description: Pass the name of a field to filter logs.
      - name: sort
        in: query
        required: false
        schema:
          type: string
          description: Pass the parameter to sort logs. By default logs are returned in descending order (latest logs are returned first) based on the created time.
          examples:
          - -created
        description: Pass the parameter to sort logs. By default logs are returned in descending order (latest logs are returned first) based on the created time.
      - name: q
        in: query
        required: false
        schema:
          type: string
          description: Pass the query text to search logs.
          examples:
          - tenant
        description: Pass the query text to search logs.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  next:
                    type: string
                    description: Returns a link to the next page of the response.
                    examples:
                    - audit-logs/?page=2&page_size=10
                  previous:
                    type: object
                    description: Returns a link to the previous page of the response.
                  total:
                    type: number
                    description: Returns the total number of logs available in the platform.
                    examples:
                    - 1734
                  page_size:
                    type: number
                    description: Returns the number of logs returned per page.
                    examples:
                    - 10
                  results:
                    type: array
                    description: Returns the list of configuration changes.
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                          description: Returns the unique ID of the log.
                          examples:
                          - b028c080-a1cb-4415-a5fe-636b7bfbd922
                        created:
                          type: number
                          description: Returns the created time of the log in epoch format.
                          examples:
                          - 1704706649
                        modified:
                          type: number
                          description: Returns the modified time of the log in epoch format.
                          examples:
                          - 1704706649
                        request_ip:
                          type: string
                          description: Returns IP address of the server.
                          examples:
                          - 182.71.120.154
                        user_id:
                          type: string
                          description: Returns the unique ID of the user who modified the configuration.
                          examples:
                          - b4deaf5d-2ab2-4663-83c0-ea4fe9542723
                        user_email:
                          type: string
                          description: Returns the email address of the user who modified the configuration.
                          examples:
                          - tedd.t@cyware.com
                        section:
                          type: string
                          description: Returns the configuration section that is modified.
                          examples:
                          - User Management
                        entity_id:
                          type: string
                          description: Returns the ID of the entity that is modified.
                          examples:
                          - john.doe@cyware.com
                        entity_type:
                          type: string
                          description: Returns the type of entity that is modified.
                          examples:
                          - User
                        entity_value:
                          type: string
                          description: Returns the value of entity that is modified.
                          examples:
                          - aniket.bhardwaj
                        ui_repr:
                          type: string
                          description: Returns the UI representation.
                          examples:
                          - Normal
                        action:
                          type: string
                          description: Returns the type of configuration change performed, such as added, edited, or deleted.
                          examples:
                          - EDIT
                        old_value:
                          type: object
                          description: Returns the previous value of the field.
                          properties:
                            value:
                              type: string
                              description: Returns true if the value was present, otherwise false.
                              examples:
                              - 'false'
                        new_value:
                          type: object
                          description: Returns the current value of the field.
                          properties:
                            value:
                              type: string
                              description: Returns true if the value was present, otherwise false.
                              examples:
                              - 'true'
                        field:
                          type: string
                          description: Returns the name of the field that is modified.
                          examples:
                          - is_active
              example:
                next: audit-logs/?page=2&page_size=10
                previous: {}
                total: 1734
                page_size: 10
                results:
                - id: b028c080-a1cb-4415-a5fe-636b7bfbd922
                  created: 1704706649
                  modified: 1704706649
                  request_ip: 182.71.120.154
                  user_id: b4deaf5d-2ab2-4663-83c0-ea4fe9542723
                  user_email: tedd.t@cyware.com
                  section: User Management
                  entity_id: john.doe@cyware.com
                  entity_type: User
                  entity_value: aniket.bhardwaj
                  ui_repr: Normal
                  action: EDIT
                  old_value:
                    value: 'false'
                  new_value:
                    value: 'true'
                  field: is_active
  /event-logs/audit-logs/utilities/section/:
    get:
      operationId: listConfigurationSections
      summary: Get Configuration Section List
      tags:
      - Administration
      description: Returns the name of the configuration sections in the platform.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/administration/audit-log-management/list-configuration-sections
      parameters:
      - name: 'page '
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve records.
          default: '1'
        description: Pass the page number to retrieve records.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve per page.
          default: '10'
        description: Pass the number of records to retrieve per page.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  results:
                    type: array
                    description: Returns the names of the configuration sections.
                    items:
                      type: string
                      description: This is an example value.
                      examples:
                      - Auth Config Management
              example:
                results:
                - Auth Config Management
  /publishing/subscriber/polling_logs/{subscriber_id}/:
    get:
      operationId: listSubscriberLogs
      summary: Get Subscriber Log List
      tags:
      - Administration
      description: Returns a list of activity logs of a subscriber on the platform.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/administration/audit-log-management/list-subscriber-logs
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve logs.
          default: '1'
          examples:
          - '1'
        description: Pass the page number to retrieve logs.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of logs to retrieve on each page.
          maxLength: 100
          default: '10'
          examples:
          - '10'
        description: Pass the number of logs to retrieve on each page.
      - name: timestamp_from
        in: query
        required: false
        schema:
          type: string
          description: Pass the created time in epoch format from which you want to retrieve logs.
          examples:
          - '1704067200'
        description: Pass the created time in epoch format from which you want to retrieve logs.
      - name: timestamp_to
        in: query
        required: false
        schema:
          type: string
          description: Pass the created time in epoch format until which you want to retrieve logs.
          examples:
          - '1704758399'
        description: Pass the created time in epoch format until which you want to retrieve logs.
      - name: response_code
        in: query
        required: false
        schema:
          type: string
          description: Pass the HTTP status code to filter logs.
          enum:
          - '200'
          - '201'
          - '206'
          - '400'
          - '401'
          - '402'
          - '403'
          - '404'
          - '429'
          - '500'
          examples:
          - '200'
        description: Pass the HTTP status code to filter logs.
      - name: request_method
        in: query
        required: false
        schema:
          type: string
          description: Pass the HTTP request method to filter logs.
          enum:
          - get
          - post
          - put
          - delete
          examples:
          - get
        description: Pass the HTTP request method to filter logs.
      - name: collection_id
        in: query
        required: false
        schema:
          type: string
          description: Pass the unique ID of a collection to filter logs.
          examples:
          - 57546b94-da09-4a16-9e69-d1d20969e1ab
        description: Pass the unique ID of a collection to filter logs.
      - name: action
        in: query
        required: false
        schema:
          type: string
          description: Pass the action type of the subscriber.
          enum:
          - Inbox
          - Polling
          - Discovery
          - Collection Detail
          - Object Status
          - Taxii API root
          - Collection List
          - Object List
          - Object Detail
          - Collection Manifest
          examples:
          - Inbox
        description: Pass the action type of the subscriber.
      - name: sort
        in: query
        required: false
        schema:
          type: string
          description: Pass the parameter to sort logs. By default logs are returned in descending order (latest logs are returned first) based on the created time.
          examples:
          - -timestamp
        description: Pass the parameter to sort logs. By default logs are returned in descending order (latest logs are returned first) based on the created time.
      - name: q
        in: query
        required: false
        schema:
          type: string
          description: Pass the query text to search logs.
          examples:
          - sample text
        description: Pass the query text to search logs.
      - name: subscriber_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of a subscriber.
          examples:
          - 5f071899-b78a-4844-953e-68128f256d32
        description: Pass the unique ID of a subscriber.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  next:
                    type: string
                    description: Returns a link to the next page of the response.
                    examples:
                    - subscriber/polling_logs/5f071899-b78a-4844-953e-68128f256d32/?page=2&page_size=10
                  previous:
                    type: object
                    description: Returns a link to the previous page of the response.
                  page_size:
                    type: number
                    description: Returns the number of logs returned per page.
                    examples:
                    - 10
                  total:
                    type: number
                    description: Returns the total number of logs available in the platform.
                    examples:
                    - 392
                  results:
                    type: array
                    description: Returns the list of activity logs.
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                          description: Returns the unique ID of the log.
                          examples:
                          - b14a5e48-c337-4b4d-81a7-3770fe1ab1ee
                        api:
                          type: string
                          description: Returns the API endpoint used.
                          examples:
                          - /ctix21/collections/f6842cdd-a734-49f3-b13d-4fb1ec2ce6a8/objects/?added_after=2023-12-16T11%3A30%3A00.000000Z&limit=200
                        error_message:
                          type: string
                          description: Returns message if the request results in an error.
                        collection_id:
                          type: array
                          description: Returns a list of the IDs of the associated collections.
                          items:
                            type: string
                            description: This is an example value.
                            examples:
                            - f6842cdd-a734-49f3-b13d-4fb1ec2ce6a8
                        feed_count:
                          type: number
                          description: Returns the number of feeds.
                          examples:
                          - 30
                        subscriber_name:
                          type: string
                          description: Returns the name of the subscriber.
                          examples:
                          - STIX Subscriber
                        subscriber_id:
                          type: string
                          description: Returns the ID of the subscriber.
                          examples:
                          - 5f071899-b78a-4844-953e-68128f256d32
                        response_code:
                          type: number
                          description: Returns the HTTP response code.
                          examples:
                          - 200
                        collection_name:
                          type: string
                          description: Returns the name of the name of the associated collection from which data is polled or inboxed.
                          examples:
                          - api_automation_stixw_collection1699616980
                        ip_address:
                          type: string
                          description: Returns the IP address of the server.
                          examples:
                          - 3.228.242.33
                        request_headers:
                          type: string
                          description: Returns the headers passed with the API request in key-value pairs.
                          examples:
                          - '{"Content-Type": null, "Accept": "application/taxii+json;version=2.1", "Authorization": "*********", "User-Agent": "CTIX-3.0", "WWW-Authenticate": null, "X-TAXII-Date-Added-First": null, "X-TAXII-Date-Added-Last": null}'
                        request_method:
                          type: string
                          description: Returns the HTTP request method used.
                          examples:
                          - GET
                        response_time:
                          type: number
                          description: Returns the total time taken to respond in seconds.
                          examples:
                          - 3404.2890071868896
                        action:
                          type: string
                          description: Returns the type of action made.
                          examples:
                          - Object List
                        timestamp:
                          type: number
                          description: Returns the creation time of the log in epoch format.
                          examples:
                          - 1704007240.269333
                        organization_name:
                          type: string
                          description: Returns the organization name associated with the user. Returns the subscriber name if there is no organization associated with the subscriber.
                          examples:
                          - STIX Subscriber
                        request_data:
                          type: string
                          description: Returns the data passed with the API request.
                        taxii_version:
                          type: string
                          description: Returns the STIX version.
                          examples:
                          - 2.x
                  hide_aggregate_col:
                    type: boolean
                    description: Indicates whether to hide aggregate columns in UI.
                    examples:
                    - false
              example:
                next: subscriber/polling_logs/5f071899-b78a-4844-953e-68128f256d32/?page=2&page_size=10
                previous: {}
                page_size: 10
                total: 392
                results:
                - id: b14a5e48-c337-4b4d-81a7-3770fe1ab1ee
                  api: /ctix21/collections/f6842cdd-a734-49f3-b13d-4fb1ec2ce6a8/objects/?added_after=2023-12-16T11%3A30%3A00.000000Z&limit=200
                  error_message: ''
                  collection_id:
                  - f6842cdd-a734-49f3-b13d-4fb1ec2ce6a8
                  feed_count: 30
                  subscriber_name: STIX Subscriber
                  subscriber_id: 5f071899-b78a-4844-953e-68128f256d32
                  response_code: 200
                  collection_name: api_automation_stixw_collection1699616980
                  ip_address: 3.228.242.33
                  request_headers: '{"Content-Type": null, "Accept": "application/taxii+json;version=2.1", "Authorization": "*********", "User-Agent": "CTIX-3.0", "WWW-Authenticate": null, "X-TAXII-Date-Added-First": null, "X-TAXII-Date-Added-Last": null}'
                  request_method: GET
                  response_time: 3404.2890071868896
                  action: Object List
                  timestamp: 1704007240.269333
                  organization_name: STIX Subscriber
                  request_data: ''
                  taxii_version: 2.x
                hide_aggregate_col: false
  /rest-auth/logs/user/{user_id}/:
    get:
      operationId: listUserActivityLogs
      summary: Get User Activity Log List
      tags:
      - Administration
      description: Returns a list of activity logs of a user on the platform.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/administration/audit-log-management/list-user-activity-logs
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve logs.
          default: '1'
          examples:
          - '1'
        description: Pass the page number to retrieve logs.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of logs to retrieve on each page.
          maxLength: 100
          default: '10'
          examples:
          - '10'
        description: Pass the number of logs to retrieve on each page.
      - name: sort
        in: query
        required: false
        schema:
          type: string
          description: Pass the parameter to sort logs. By default logs are returned in descending order (latest logs are returned first) based on the created time.
          examples:
          - -timestamp
        description: Pass the parameter to sort logs. By default logs are returned in descending order (latest logs are returned first) based on the created time.
      - name: timestamp_from
        in: query
        required: false
        schema:
          type: string
          description: Pass the created time in epoch format from which you want to retrieve logs.
          examples:
          - '1704067200'
        description: Pass the created time in epoch format from which you want to retrieve logs.
      - name: timestamp_to
        in: query
        required: false
        schema:
          type: string
          description: Pass the created time in epoch format until which you want to retrieve logs.
          examples:
          - '1704758399'
        description: Pass the created time in epoch format until which you want to retrieve logs.
      - name: response
        in: query
        required: false
        schema:
          type: string
          description: Pass the HTTP status code to filter logs.
          enum:
          - '200'
          - '201'
          - '206'
          - '400'
          - '401'
          - '402'
          - '403'
          - '404'
          - '429'
          - '500'
          examples:
          - '201'
        description: Pass the HTTP status code to filter logs.
      - name: method
        in: query
        required: false
        schema:
          type: string
          description: Pass the HTTP request method to filter logs.
          enum:
          - get
          - post
          - put
          - delete
          examples:
          - post
        description: Pass the HTTP request method to filter logs.
      - name: q
        in: query
        required: false
        schema:
          type: string
          description: Pass the query text to search logs.
          examples:
          - sample text
        description: Pass the query text to search logs.
      - name: user_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of a user.
          examples:
          - 854bb75f-8e23-4f17-9d52-fd6ef6a4c863
        description: Pass the unique ID of a user.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  next:
                    type: string
                    description: Returns a link to the next page of the response.
                    examples:
                    - logs/user/854bb75f-8e23-4f17-9d52-fd6ef6a4c863/?page=2&page_size=10&sort=-timestamp
                  previous:
                    type: object
                    description: Returns a link to the previous page of the response.
                  page_size:
                    type: number
                    description: Returns the number of logs returned per page.
                    examples:
                    - 10
                  total:
                    type: number
                    description: Returns the total number of logs available in the platform.
                    examples:
                    - 10627
                  results:
                    type: array
                    description: Returns the lists of activity logs of a user.
                    items:
                      type: object
                      properties:
                        access_id:
                          type: object
                          description: Returns the access ID used by the user to access the platform via the open API. Returns null if accessed using the user interface.
                        api:
                          type: string
                          description: Returns the API endpoint used.
                          examples:
                          - /ctixapi/ingestion/rules/
                        api_end_time:
                          type: number
                          description: Returns the end time of the API request process in epoch format.
                          examples:
                          - 1697186770
                        api_name:
                          type: object
                          description: Returns the name of the API used.
                        api_process_time:
                          type: number
                          description: Returns the total time taken to process the API request in seconds.
                          examples:
                          - 0.062
                        api_start_time:
                          type: number
                          description: Returns the start time of the API request process in epoch format.
                          examples:
                          - 1697186770
                        error_response_data:
                          type: object
                          description: Returns a message if the API request results in an error.
                        ip_address:
                          type: string
                          description: Returns the IP address of the server.
                          examples:
                          - 182.71.120.154
                        method:
                          type: string
                          description: Returns HTTP r

# --- truncated at 32 KB (625 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-administration-api-openapi.yml