Cyware Allowed Indicators API

openapi: 3.2.0
info:
  title: Cyware Intel Exchange (CTIX) v3 Open Allowed Indicators API
  version: 3.6.2
  description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.


    Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.


    This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
  contact:
    name: Cyware
    url: https://www.cyware.com/contact-us
  termsOfService: https://www.cyware.com/legal/terms-of-use
  x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
  x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
  description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
  variables:
    ctix_host:
      default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Allowed Indicators
  description: Allowed Indicators
paths:
  /conversion/allowed_indicators/:
    post:
      operationId: addIndicatorsToAllowedList
      summary: Add Indicators to Allowed List
      tags:
      - Allowed Indicators
      description: Adds a list of indicators of a common IOC type to the allowed indicators list.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/indicators-allowed/add-indicators-to-allowed-list
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                type:
                  type: string
                  description: Pass the type of indicator.
                  examples:
                  - ipv4-addr
                values:
                  type: array
                  description: Pass the list of indicator values to be added to the allowed list.
                  items:
                    type: string
                    description: This is an example value.
                    examples:
                    - 91.108.17.134
                reason:
                  type: string
                  description: Pass a reason for adding the indicators to the allowed list.
                  examples:
                  - adding IP ioc
            example:
              type: ipv4-addr
              values:
              - 91.108.17.134
              reason: adding IP ioc
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  details:
                    type: object
                    description: Returns the categorized results of the requested operation.
                    properties:
                      invalid:
                        type: array
                        description: Returns the list of invalid IOCs passed.
                        items: {}
                      new_created:
                        type: array
                        description: Returns the list of newly added valid IOCs.
                        items:
                          type: string
                          description: This is an example value.
                          examples:
                          - 91.108.17.134
                      already_exists:
                        type: array
                        description: Returns the list of IOCs that are already available in the allowed indicators list.
                        items: {}
              example:
                details:
                  invalid: []
                  new_created:
                  - 91.108.17.134
                  already_exists: []
    get:
      operationId: listAllowedIndicators
      summary: Get Allowed Indicators List
      tags:
      - Allowed Indicators
      description: Returns a list of allowed indicators from the Intel Exchange platform.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/indicators-allowed/list-allowed-indicators
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve indicators.
          default: '1'
          examples:
          - '1'
        description: Pass the page number to retrieve indicators.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve on each page.
          maxLength: 100
          default: '10'
          examples:
          - '10'
        description: Pass the number of records to retrieve on each page.
      - name: type
        in: query
        required: false
        schema:
          type: string
          description: Pass an allowed indicator type to filter the result. To retrieve the supported list of allowed indicator types, see the **GET List Supported Allowed Indicator Types API**.
          examples:
          - url
        description: Pass an allowed indicator type to filter the result. To retrieve the supported list of allowed indicator types, see the **GET List Supported Allowed Indicator Types API**.
      - name: created_by_id
        in: query
        required: false
        schema:
          type: string
          description: Pass the ID of a user to filter records by the creator.
          examples:
          - 28265289-1fdb-437d-8b7f-09ea0ad9fe08
        description: Pass the ID of a user to filter records by the creator.
      - name: modified_by_id
        in: query
        required: false
        schema:
          type: string
          description: Pass the ID of a user to filter records by the modifier.
          examples:
          - 28265289-1fdb-437d-8b7f-09ea0ad9fe08
        description: Pass the ID of a user to filter records by the modifier.
      - name: created_from
        in: query
        required: false
        schema:
          type: string
          description: Pass the created from time in epoch format to filter records based on the created time.
          examples:
          - '1711929600'
        description: Pass the created from time in epoch format to filter records based on the created time.
      - name: created_to
        in: query
        required: false
        schema:
          type: string
          description: Pass the created time in epoch format to filter records based on the created time.
          examples:
          - '1712361599'
        description: Pass the created time in epoch format to filter records based on the created time.
      - name: last_active_from
        in: query
        required: false
        schema:
          type: string
          description: Pass the last active time in epoch format to filter records based on the last activity time.
          examples:
          - '1711929600'
        description: Pass the last active time in epoch format to filter records based on the last activity time.
      - name: last_active_to
        in: query
        required: false
        schema:
          type: string
          description: Pass the last active to time in epoch format to filter records based on the last activity time.
          examples:
          - '1712361599'
        description: Pass the last active to time in epoch format to filter records based on the last activity time.
      - name: sort
        in: query
        required: false
        schema:
          type: string
          description: Pass `-created` to sort the result in descending order based on the created time. Pass `created` to sort the result in ascending order.
          examples:
          - -created
        description: Pass `-created` to sort the result in descending order based on the created time. Pass `created` to sort the result in ascending order.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  next:
                    type: object
                    description: Returns a link to the next page.
                  page_size:
                    type: number
                    description: Returns the number of records retrieved per page.
                    examples:
                    - '10'
                  previous:
                    type: object
                    description: Returns a link to the previous page.
                  results:
                    type: array
                    description: Returns the detailed list of indicators.
                    items:
                      type: object
                      properties:
                        created:
                          type: number
                          description: Returns the timestamp when the allowed indicator was created.
                          examples:
                          - '1712294333'
                        created_by:
                          type: object
                          description: Returns the details of the user who created the allowed indicator.
                          properties:
                            email:
                              type: string
                              description: Returns the email address of the user who created the allowed indicator.
                              examples:
                              - john.doe@cyware.com
                            first_name:
                              type: string
                              description: Returns the first name of the user who created the allowed indicator.
                              examples:
                              - john
                            id:
                              type: string
                              description: Returns the ID of the user who created the allowed indicator.
                              examples:
                              - 4c8841ea-28f7-4a68-8a7b-46bba21c30ba
                            last_name:
                              type: string
                              description: Returns the last name of the user who created the allowed indicator.
                        id:
                          type: string
                          description: Returns the unqiue ID of the allowed indicator.
                          examples:
                          - df896cee-ef03-4f9f-bb27-4f7cf60c0954
                        include_emails:
                          type: boolean
                          description: Returns true if the emails of a domain are allowed, else returns false.
                          examples:
                          - 'false'
                        include_subdomains:
                          type: boolean
                          description: Returns true if the subdomains of a domain are allowed. Else returns false.
                          examples:
                          - 'false'
                        include_urls:
                          type: boolean
                          description: Returns true if the subdomains of a domain are allowed. Else returns false.
                          examples:
                          - 'false'
                        modified:
                          type: number
                          description: Returns the timestamp when the allowed indicator was last modified.
                          examples:
                          - '1712294333'
                        modified_by:
                          type: object
                          description: Returns the details of the user who last modified the allowed indicator.
                          properties:
                            email:
                              type: string
                              description: Returns the email address of the user who last modified the allowed indicator.
                              examples:
                              - john.doe@cyware.com
                            first_name:
                              type: string
                              description: Returns the first name of the user who last modified the allowed indicator.
                              examples:
                              - john
                            id:
                              type: string
                              description: Returns the user ID of the user who last modified the allowed indicator.
                              examples:
                              - 4c8841ea-28f7-4a68-8a7b-46bba21c30ba
                            last_name:
                              type: string
                              description: Returns the last name of the user who last modified the allowed indicator.
                        type:
                          type: string
                          description: Returns the type of the IOC.
                          examples:
                          - ipv4-addr
                        value:
                          type: string
                          description: Returns the value of the IOC
                          examples:
                          - 91.108.17.134
                  total:
                    type: number
                    description: Returns the total number of allowed indicators available in the Intel Exchange platform.
                    examples:
                    - '1'
              example:
                next: {}
                page_size: '10'
                previous: {}
                results:
                - created: '1712294333'
                  created_by:
                    email: john.doe@cyware.com
                    first_name: john
                    id: 4c8841ea-28f7-4a68-8a7b-46bba21c30ba
                    last_name: ''
                  id: df896cee-ef03-4f9f-bb27-4f7cf60c0954
                  include_emails: 'false'
                  include_subdomains: 'false'
                  include_urls: 'false'
                  modified: '1712294333'
                  modified_by:
                    email: john.doe@cyware.com
                    first_name: john
                    id: 4c8841ea-28f7-4a68-8a7b-46bba21c30ba
                    last_name: ''
                  type: ipv4-addr
                  value: 91.108.17.134
                total: '1'
  /conversion/allowed_indicators/{indicator_id}/:
    get:
      operationId: allowedIndicatorDetails
      summary: Get Allowed Indicator Details
      tags:
      - Allowed Indicators
      description: Returns the details of an allowed indicator.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/indicators-allowed/allowed-indicator-details
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve records.
          default: '1'
        description: Pass the page number to retrieve records.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve on each page.
          maxLength: 100
          default: '10'
        description: Pass the number of records to retrieve on each page.
      - name: indicator_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the ID of an allowed indicator.
          examples:
          - df896cee-ef03-4f9f-bb27-4f7cf60c0954
        description: Pass the ID of an allowed indicator.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                    description: Returns the type of IOC.
                    examples:
                    - ipv4-addr
                  value:
                    type: string
                    description: Returns the value of the IOC.
                    examples:
                    - 91.108.17.134
                  id:
                    type: string
                    description: Returns the unique ID of the allowed indicator.
                    examples:
                    - df896cee-ef03-4f9f-bb27-4f7cf60c0954
                  modified_by:
                    type: string
                    description: Returns the ID of the user who last modified the entry.
                    examples:
                    - 4c8841ea-28f7-4a68-8a7b-46bba21c30ba
                  modified:
                    type: number
                    description: Returns the last modified date and time in epoch format.
                    examples:
                    - '1712294333'
                  include_subdomains:
                    type: boolean
                    description: Returns true if the subdomains of a domain are allowed, else returns false.
                    examples:
                    - 'false'
                  include_urls:
                    type: boolean
                    description: Returns true if the URLs of a domain or IPv4 address are allowed, else returns false.
                    examples:
                    - 'false'
                  include_emails:
                    type: boolean
                    description: Returns true if the emails and domain are allowed, else returns false.
                    examples:
                    - 'false'
                  created_by:
                    type: string
                    description: Returns the ID of the user that added the allowed indicator.
                    examples:
                    - 4c8841ea-28f7-4a68-8a7b-46bba21c30ba
                  created:
                    type: number
                    description: Returns the created date and time in epoch format.
                    examples:
                    - '1712294333'
              example:
                type: ipv4-addr
                value: 91.108.17.134
                id: df896cee-ef03-4f9f-bb27-4f7cf60c0954
                modified_by: 4c8841ea-28f7-4a68-8a7b-46bba21c30ba
                modified: '1712294333'
                include_subdomains: 'false'
                include_urls: 'false'
                include_emails: 'false'
                created_by: 4c8841ea-28f7-4a68-8a7b-46bba21c30ba
                created: '1712294333'
    delete:
      operationId: deleteAllowedIndicator
      summary: Delete Allowed Indicator
      tags:
      - Allowed Indicators
      description: Deletes a particular allowed indicator entry from the dashboard.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/indicators-allowed/delete-allowed-indicator
      parameters:
      - name: indicator_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the ID of an allowed indicator to delete.
          examples:
          - 8af39afb-6503-4f57-a347-4b42475abd59
        description: Pass the ID of an allowed indicator to delete.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  details:
                    type: string
                    description: Returns a success or failure message.
                    examples:
                    - Deletion Success
              example:
                details: Deletion Success
    put:
      operationId: updateAllowedIndicator
      summary: Update Allowed Indicator
      tags:
      - Allowed Indicators
      description: Updates the specified allowed indicator.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/indicators-allowed/update-allowed-indicator
      parameters:
      - name: indicator_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the ID of the allowed list indicator.
          examples:
          - 8af39afb-6503-4f57-a347-4b42475abd59
        description: Pass the ID of the allowed list indicator.
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                include_emails:
                  type: boolean
                  description: Pass true to parse emails, else pass false.
                  examples:
                  - 'false'
                include_subdomains:
                  type: boolean
                  description: Parse true to parse subdomains, else pass false.
                  examples:
                  - 'false'
                include_urls:
                  type: boolean
                  description: Pass true to parse the URLs, else parse false.
                  examples:
                  - 'false'
                type:
                  type: string
                  description: Pass the type of IOC.
                  examples:
                  - ipv4-addr
                value:
                  type: string
                  description: Pass the value of the corresponding IOC.
                  examples:
                  - 1.2.3.45
            example:
              include_emails: 'false'
              include_subdomains: 'false'
              include_urls: 'false'
              type: ipv4-addr
              value: 1.2.3.45
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  type:
                    type: string
                    description: Returns the type of IOC.
                    examples:
                    - ipv4-addr
                  value:
                    type: string
                    description: Returns the value of the IOC.
                    examples:
                    - 1.2.3.45
                  id:
                    type: string
                    description: Returns the ID of the allowed indicator entry.
                    examples:
                    - 8af39afb-6503-4f57-a347-4b42475abd59
                  modified_by:
                    type: string
                    description: Returns the ID of the user that last modified the entry.
                    examples:
                    - 6063f29f-0224-4891-8761-34ef988fa080
                  modified:
                    type: number
                    description: Returns the date and time of the last modification of the allowed indicator entry.
                    examples:
                    - '1641491689'
                  include_subdomains:
                    type: boolean
                    description: Returns true if the subdomains are parsed, else returns false.
                    examples:
                    - 'false'
                  include_urls:
                    type: boolean
                    description: Returns true if the URLs are parsed, else returns false.
                    examples:
                    - 'false'
                  include_emails:
                    type: boolean
                    description: Returns true if the emails are parsed, else returns false.
                    examples:
                    - 'false'
                  created_by:
                    type: string
                    description: Returns the ID of the user that created the allowed list entry.
                    examples:
                    - 754c15c6-e922-4bde-95b2-e80d9d1cf87c
                  created:
                    type: number
                    description: Returns the date and time of the creation of the allowed list entry.
                    examples:
                    - '1641464479'
              example:
                type: ipv4-addr
                value: 1.2.3.45
                id: 8af39afb-6503-4f57-a347-4b42475abd59
                modified_by: 6063f29f-0224-4891-8761-34ef988fa080
                modified: '1641491689'
                include_subdomains: 'false'
                include_urls: 'false'
                include_emails: 'false'
                created_by: 754c15c6-e922-4bde-95b2-e80d9d1cf87c
                created: '1641464479'
  /conversion/allowed_indicators/bulk-actions/:
    post:
      operationId: bulkAction
      summary: Bulk Action
      tags:
      - Allowed Indicators
      description: Perform bulk actions such as follow, unfollow, and delete on multiple allowed indicators in one API request.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/indicators-allowed/bulk-action
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                action:
                  type: string
                  description: Pass from the following actions.
                  enum:
                  - follow
                  - unfollow
                  - delete
                  examples:
                  - delete
                ids:
                  type: array
                  description: Returns the list of unique identifiers for the items on which the action should be applied.
                  items:
                    type: string
                    description: This is an example value.
                    examples:
                    - 15e4bac8-1ee4-4207-99e2-a8e14e16552d
            example:
              action: delete
              ids:
              - 15e4bac8-1ee4-4207-99e2-a8e14e16552d
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  details:
                    type: string
                    description: Returns the success message.
                    examples:
                    - Action applied succesfully
              example:
                details: Action applied succesfully
  /conversion/allowed_indicators/reasons/:
    post:
      operationId: createReason
      summary: Create Reason
      tags:
      - Allowed Indicators
      description: Creates a new reason for an allowed indicator.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/indicators-allowed/create-reason
      parameters:
      - name: indicator_id
        in: query
        required: false
        schema:
          type: string
          description: Pass the ID of the indicator.
          examples:
          - <id>
        description: Pass the ID of the indicator.
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                reason:
                  type: string
                  description: Pass the reason for an allowed indicator.
                  examples:
                  - test reason -whitelist
            example:
              reason: test reason -whitelist
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Returns the unique ID of the reason object.
                    examples:
                    - 83f2efb5-ca0d-4400-bad2-baf4b7361532
                  created:
                    type: number
                    description: Returns the date and time of the creation of reason.
                    examples:
                    - '1641492061'
                  modified:
                    type: number
                    description: Returns the date and time of the modification of reason.
                    examples:
                    - '1641492061'
                  created_by:
                    type: string
                    description: Returns the ID of the user who created the reason.
                    examples:
                    - 6063f29f-0224-4891-8761-34ef988fa080
                  modified_by:
                    type: string
                    description: Returns the ID of the user who modified the reason.
                    examples:
                    - 6063f29f-0224-4891-8761-34ef988fa080
                  reason:
                    type: string
                    description: Returns text describing the updated reason.
                    examples:
                    - test reason -whitelist
                  is_active:
                    type: boolean
                    description: Returns true if the reason is active, else returns false.
                    examples:
                    - 'true'
                  whitelist:
                    type: string
                    description: Returns the unique ID of the allowed indicator related to the reason.
                    examples:
                    - 8af39afb-6503-4f57-a347-4b42475abd59
              example:
                id: 83f2efb5-ca0d-4400-bad2-baf4b7361532
                created: '1641492061'
                modified: '1641492061'
                created_by: 6063f29f-0224-4891-8761-34ef988fa080
                modified_by: 6063f29f-0224-4891-8761-34ef988fa080
                reason: test reason -whitelist
                is_active: 'true'
                whitelist: 8af39afb-6503-4f57-a347-4b42475abd59
    get:
      operationId: reasonsList
      summary: Get Reasons List
      tags:
      - Allowed Indicators
      description: Returns a paginated response with all the saved reasons for an allowed indicator.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/indicators-allowed/reasons-list
      parameters:
      - name: indicator_id
        in: query
        required: false
        schema:
          type: string
          description: Pass the unique key of the allowed list object.
          examples:
          - <indicator_id>
        description: Pass the unique key of the allowed list object.
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve records.
          default: '1'
        description: Pass the page number to retrieve records.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve on each page.
          maxLength: 100
          default: '10'
        description: Pass the number of records to retrieve on each page.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  next:
                    type: object
                    description: Returns a link to the next page.
                  previous:
                    type: object
                    description: Returns a link to the prev

# --- truncated at 32 KB (61 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-allowed-indicators-api-openapi.yml