Cyware

Cyware Analytics API

Analytics

GitHub OpenAPI

Operations 1

GET /v1/analytics/data-source/ Get Most Active Instances #

Documentation

📖
Documentation
https://techdocs.cyware.com/ctix/en/product-documentation.html
📖
APIReference
https://ctixapiv3.cyware.com/
📖
Authentication
https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/authentication/cyware-authentication.yml
📖
Documentation
https://techdocs.cyware.com/co/en/product-documentation.html
📖
APIReference
https://orchestrateapi.cyware.com/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-analytics-api-openapi.yml

Other Resources

🔗
Conventions
https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/conventions/cyware-conventions.yml
🔗
ErrorCatalog
https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/errors/cyware-problem-types.yml
🔗
DataModel
https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/data-model/cyware-data-model.yml
🔗
LLMsTxt
https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/llms/cyware-intel-exchange-api-llms.txt
🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/asyncapi/cyware-orchestrate-webhooks.yml
🔗
LLMsTxt
https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/llms/cyware-orchestrate-api-llms.txt

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/cyware-analytics-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

cyware-analytics-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Cyware Orchestrate (CO) Open Analytics API
  version: v1
  description: Public Open API for Cyware Orchestrate, Cyware's security orchestration, automation and response (SOAR) platform.
  contact:
    name: Cyware
    url: https://www.cyware.com/contact-us
  termsOfService: https://www.cyware.com/legal/terms-of-use
  x-apievangelist-source: https://orchestrateapi.cyware.com/llms.txt
  x-apievangelist-method: generated
servers:
- url: https://{co_host}/soarapi
  description: Tenant Orchestrate deployment. Replace {co_host} with your own Orchestrate host. Cyware uses https://demo.cyware.com/soar/ as the example host in the config of its open-source MCP server, and its docs reference the /soarapi base path.
  variables:
    co_host:
      default: demo.cyware.com
security:
- coOpenApiSignature: []
tags:
- name: Analytics
  description: Analytics
paths:
  /v1/analytics/data-source/:
    get:
      operationId: mostActiveInstances
      summary: Get Most Active Instances
      tags:
      - Analytics
      description: Returns the most frequently used instances in playbook executions for the non-purged data.
      externalDocs:
        description: Cyware Orchestrate API reference
        url: https://orchestrateapi.cyware.com/analytics/most-active-instances
      parameters:
      - name: AccessID
        in: query
        required: false
        schema:
          type: string
          description: The Access ID is used to authenticate the Cyware Orchestrate API endpoint.
          examples:
          - 57d008c4-xxxx-4880-xxxx-1feb943d06ac,
        description: The Access ID is used to authenticate the Cyware Orchestrate API endpoint.
      - name: Signature
        in: query
        required: false
        schema:
          type: string
          description: The Signature is used to authenticate the Cyware Orchestrate API endpoint.
          examples:
          - ohaUEcyA8hH3WPUo7Y/QOf+zWY0=
        description: The Signature is used to authenticate the Cyware Orchestrate API endpoint.
      - name: Expires
        in: query
        required: false
        schema:
          type: string
          description: This parameter is used to define an expiry time for the API call.
          examples:
          - 72a48f16-xxxx-4023-xxxx-40f8e58d1f41
        description: This parameter is used to define an expiry time for the API call.
      - name: categorize_by
        in: query
        required: true
        schema:
          type: string
          description: Pass`categorize_by=most_active_instances` to retrieve the most active instances.
          examples:
          - most_active_instances
        description: Pass`categorize_by=most_active_instances` to retrieve the most active instances.
      - name: created__gte
        in: query
        required: false
        schema:
          type: string
          description: Pass the start time in unix time format to retrieve the most active instances.
          examples:
          - '1640131200'
        description: Pass the start time in unix time format to retrieve the most active instances.
      - name: created__lte
        in: query
        required: false
        schema:
          type: string
          description: Pass the end time in unix time format to retrieve the most active instances.
          examples:
          - '1640723199'
        description: Pass the end time in unix time format to retrieve the most active instances.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: Returns the analytics data on the most active instance for the specified time range.
                    items:
                      type: object
                      properties:
                        label:
                          type: string
                          description: Returns the title of the instance.
                          examples:
                          - Test Instance
                        value:
                          type: number
                          description: Returns the number of times an instance is utilized in playbooks execution.
                          examples:
                          - '8'
              example:
                data:
                - label: Test Instance
                  value: '8'
      x-alternate-documents:
      - title: Get Event Count
        operationId: eventCount
        url: https://orchestrateapi.cyware.com/analytics/event-count
      - title: Get Events With Error
        operationId: eventsWithError
        url: https://orchestrateapi.cyware.com/analytics/events-with-error
      - title: Get Incoming Source Events
        operationId: incomingSourceEvents
        url: https://orchestrateapi.cyware.com/analytics/incoming-source-events
      - title: Get Most Active Actions
        operationId: mostActiveActions
        url: https://orchestrateapi.cyware.com/analytics/most-active-actions
      - title: Get Most Active Apps
        operationId: mostActiveApps
        url: https://orchestrateapi.cyware.com/analytics/most-active-apps
      - title: Get Most Active Playbooks
        operationId: mostActivePlaybook
        url: https://orchestrateapi.cyware.com/analytics/most-active-playbook
      - title: Get Most Used Actions
        operationId: mostUsedActions
        url: https://orchestrateapi.cyware.com/analytics/most-used-actions
      - title: Get Most Used Apps
        operationId: mostUsedApps
        url: https://orchestrateapi.cyware.com/analytics/most-used-apps
      - title: Get Most Used Instance
        operationId: mostUsedInstance
        url: https://orchestrateapi.cyware.com/analytics/most-used-instance
      - title: Get Playbook Average Execution Time
        operationId: playbookAvgExecutionTime
        url: https://orchestrateapi.cyware.com/analytics/playbook-avg-execution-time
      - title: Get Playbook Run Count
        operationId: playbookRunCount
        url: https://orchestrateapi.cyware.com/analytics/playbook-run-count
      - title: Get Unprocessed Events
        operationId: unprocessedEvents
        url: https://orchestrateapi.cyware.com/analytics/unprocessed-events
components:
  securitySchemes:
    coOpenApiSignature:
      type: apiKey
      in: query
      name: access_id
      description: Orchestrate Open API credentials. Every request carries access_id, expires (epoch, current time + up to 30 seconds) and signature query parameters, where StringToSign = access_id + "\n" + expires and Signature = Base64(HMAC-SHA1(secret_key, StringToSign)). See https://orchestrateapi.cyware.com/authentication
externalDocs:
  description: Cyware Orchestrate API Reference
  url: https://orchestrateapi.cyware.com/