openapi: 3.2.0
info:
title: Cyware Intel Exchange (CTIX) v3 Open Dashboards API
version: 3.6.2
description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.
Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.
This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
contact:
name: Cyware
url: https://www.cyware.com/contact-us
termsOfService: https://www.cyware.com/legal/terms-of-use
x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
variables:
ctix_host:
default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Dashboards
description: Dashboards
paths:
/ingestion/analytics/dashboard/{dashboard_id}/:
delete:
operationId: deleteCustomDashboard
summary: Delete Custom Dashboard
tags:
- Dashboards
description: Deletes a custom dashboard for the given dashboard ID. You can retrieve the ID using the **List Dashboards API**.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/dashboards/delete-custom-dashboard
parameters:
- name: dashboard_id
in: path
required: true
schema:
type: string
description: Pass the ID of a custom dashboard. You can only delete dashboards that you have previously created.
examples:
- 3e2440cc-4377-4d18-9118-eaf77a1602fd
description: Pass the ID of a custom dashboard. You can only delete dashboards that you have previously created.
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
result:
type: string
description: Returns the success message.
examples:
- success
example:
result: success
get:
operationId: retrieveDashboardDetails
summary: Get Dashboard Details
tags:
- Dashboards
description: Returns data about the specific dashboard ID.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/dashboards/retrieve-dashboard-details
parameters:
- name: page
in: query
required: false
schema:
type: string
description: Pass the page number to retrieve records.
default: '1'
description: Pass the page number to retrieve records.
- name: page_size
in: query
required: false
schema:
type: string
description: Pass the number of records to retrieve on each page.
maxLength: 100
default: '10'
description: Pass the number of records to retrieve on each page.
- name: dashboard_id
in: path
required: true
schema:
type: string
description: 'Pass the ID of the dashboard. You can retrieve this ID using the **List Dashboards** API. For example: *7749e131-2161-4b19-b77d-e92aa7e945a9*.'
description: 'Pass the ID of the dashboard. You can retrieve this ID using the **List Dashboards** API. For example: *7749e131-2161-4b19-b77d-e92aa7e945a9*.'
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
created_by:
type: object
description: Returns details of the creator.
properties:
email:
type: string
description: Returns the email address of the user who created the dashboard.
examples:
- john.doe@example.com
first_name:
type: string
description: Returns the first name of the user.
examples:
- John
id:
type: string
description: Returns the user ID.
examples:
- 70f3d3ee-b7bc-4ceb-849e-16db0de5278b
last_name:
type: string
description: Returns the last name of the user.
examples:
- Doe
dashboard_id:
type: string
description: Returns the unique ID of the dashboard.
examples:
- 30038717-ce67-48b8-839f-dd84aeb7cc45
description:
type: string
description: Returns the description of the dashboard.
examples:
- Use this dashboard to visualize Intel Exchange automation rules metrics such as performance, processing by IoCs or domain objects, rule actions, and sources.
editable:
type: boolean
description: Returns true if the dashboard is editable, else returns false.
examples:
- false
is_default:
type: boolean
description: Returns true if it is a default dashboard, else returns false.
examples:
- false
layout:
type: array
description: Returns the layout of the widgets on a dashboard.
items:
type: object
properties:
columns:
type: array
description: Returns an array of widgets displayed in that row.
items:
type: object
properties:
available_charts:
type: array
description: Returns the available charts for the column
items:
type: string
description: Returns the available chart type.
enum:
- heatmap
- stacked-column-vertical
- table
examples:
- heatmap
axis:
type: object
description: Returns the axis details
properties:
xaxis:
type: string
description: Returns the name for the X-axis.
examples:
- Rules
yaxis:
type: string
description: Returns the name for the Y-axis.
examples:
- Count
filters:
type: object
description: Returns filters associated with the layout
name:
type: string
description: Returns the title of the widget.
examples:
- Rule Performance by Domain Objects
slug:
type: string
description: Returns a unique slug identifier for the widget.
examples:
- rulewise_coverage_on_sdos
table:
type: object
description: Returns the table details.
properties:
type:
type: string
description: Returns the layout type of the table.
examples:
- stacked
table_columns:
type: array
description: Returns the details of the table columns
items:
type: object
properties:
key:
type: string
description: Returns the data key associated with the column.
examples:
- x_labels
label:
type: string
description: Returns the display name shown as the column header.
examples:
- Rule Name
type:
type: string
description: Returns the data type.
examples:
- string
widget_type:
type: string
description: Returns the type of visualization used.
examples:
- heatmap
row:
type: number
description: Returns the number of rows
examples:
- 2
layout_type:
type: number
description: Returns 0 for a stationary dashboard or 1 for a rotating dashboard.
examples:
- 0
name:
type: string
description: Returns the name of the dashboard.
examples:
- Rules Dashboard
overview:
type: array
description: Returns the layout of the hero cards.
items:
type: object
properties:
columns:
type: array
description: Returns an array of hero cards displayed in that row.
items:
type: object
properties:
available_charts:
type: array
description: Returns an array of available chart types.
items:
type: string
description: Returns the available charts.
examples:
- hero
filters:
type: object
description: Returns filters applied to this widget.
icon:
type: string
description: Returns the icon name used to visually represent the widget.
examples:
- cyicon-whitelisted
name:
type: string
description: Returns the title of the overview widget.
examples:
- Allowed Indicators
redirections:
type: array
description: Returns an array of objects defining what happens when users click the card.
items:
type: object
properties:
component:
type: string
description: Returns the name of the module/page to redirect to.
examples:
- threatdata
filters:
type: object
description: Returns filter criteria to apply to the redirected page.
properties:
is_whitelisted:
type: boolean
description: Returns a boolean value indicating whether the indicator is part of the allowed (whitelisted) indicator list.
examples:
- true
object:
type: string
description: Returns the object of the filter input.
examples:
- indicator
slug:
type: string
description: Returns the unique identifier for the overview widget.
examples:
- allowed_sdos
widget_type:
type: string
description: Returns the type of widget, typically hero, for the overview section.
examples:
- hero
row:
type: number
description: Returns the row number for the overview section.
examples:
- 6
rotation_timer:
type: number
description: Returns the duration of rotation of widgets, when the layout of the dashboard is a rotating dashboard.
examples:
- 30
shared_type:
type: string
description: Returns the privacy parameter of the saved search as global, private, or system.
examples:
- system
shared_users:
type: array
description: Returns the list of users if the privacy parameter is set to specific users.
items: {}
example:
created_by:
email: john.doe@example.com
first_name: John
id: 70f3d3ee-b7bc-4ceb-849e-16db0de5278b
last_name: Doe
dashboard_id: 30038717-ce67-48b8-839f-dd84aeb7cc45
description: Use this dashboard to visualize Intel Exchange automation rules metrics such as performance, processing by IoCs or domain objects, rule actions, and sources.
editable: false
is_default: false
layout:
- columns:
- available_charts:
- heatmap
axis:
xaxis: Rules
yaxis: Count
filters: {}
name: Rule Performance by Domain Objects
slug: rulewise_coverage_on_sdos
table:
type: stacked
table_columns:
- key: x_labels
label: Rule Name
type: string
widget_type: heatmap
row: 2
layout_type: 0
name: Rules Dashboard
overview:
- columns:
- available_charts:
- hero
filters: {}
icon: cyicon-whitelisted
name: Allowed Indicators
redirections:
- component: threatdata
filters:
is_whitelisted: true
object: indicator
slug: allowed_sdos
widget_type: hero
row: 6
rotation_timer: 30
shared_type: system
shared_users: []
/ingestion/analytics/dashboard_export/:
post:
operationId: exportDashboard
summary: Export Dashboard
tags:
- Dashboards
description: Exports a dashboard in the Intel Exchange application. On successful exporting, you will receive an email with the subject line **Cyware Dashboard Report Mail**.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/dashboards/export-dashboard
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
dashboards:
type: array
description: Pass the list of dashboards to export.
items:
type: string
description: Pass the dashboard ID. You can retrieve the ID using the **List Dashboards API**.
examples:
- c28f0aec-3640-45df-a3ab-37ed35745d8a
start_date:
type: string
description: Pass the start date of the date range to show data in the dashboard.
default: One month from current epoch timestamp
examples:
- '1634601600'
end_date:
type: string
description: Pass the end date of the date range to show the data in the dashboard.
default: Current epoch timestamp
examples:
- '1637279999'
template_config:
type: object
description: Pass the configuration of the export format of the dashboard.
properties:
type:
type: string
description: Pass the export format for the dashboards.
enum:
- png
- pdf
- email
examples:
- png
width:
type: number
description: Pass the width for the dashboard report.
default: '1064'
examples:
- 1064
format:
type: string
description: Pass the format for the dashboard report.
default: a3
examples:
- a3
widget_count:
type: number
description: Pass the number of widgets to be included in the export.
default: '10'
examples:
- 1
height:
type: number
description: Pass the height of the dashboard report.
default: '1372'
examples:
- 611
extraHeight:
type: number
description: Pass the extra height details.
default: '150'
examples:
- 150
pdf_required:
type: boolean
description: Pass true if you want the PDF included in the email.
default: '150'
examples:
- false
external_recipients:
type: object
description: Pass the list of emails of the external users to mail the dashboard to in cc and bcc format.
properties:
to:
type: array
description: Pass details of the external recipient of the report.
items: {}
cc:
type: array
description: Enter the cc email addresses for the external recipients.
items: {}
bcc:
type: array
description: Enter the bcc email addresses for the external recipients.
items: {}
internal_recipients:
type: object
description: Pass the list of the emails of the internal users to mail the dashboard to in cc and bcc format.
properties:
to:
type: array
description: Pass details of the internal recipient of the report.
items:
type: object
properties:
id:
type: string
description: Enter the user ID to share the dashboard export. You can retrieve the ID using the **List Dashboards API**.
examples:
- 70258fac-5905-4232-8b2d-4243dc8bb224
first_name:
type: string
description: Enter the first name of the user.
examples:
- John
last_name:
type: string
description: Enter the last name of the user.
examples:
- Doe
cc:
type: array
description: Enter the cc email addresses for the internal recipients.
items: {}
bcc:
type: array
description: Enter the bcc email addresses for the internal recipients.
items: {}
example:
dashboards:
- c28f0aec-3640-45df-a3ab-37ed35745d8a
start_date: '1634601600'
end_date: '1637279999'
template_config:
type: png
width: 1064
format: a3
widget_count: 1
height: 611
extraHeight: 150
pdf_required: false
external_recipients:
to: []
cc: []
bcc: []
internal_recipients:
to:
- id: 70258fac-5905-4232-8b2d-4243dc8bb224
first_name: John
last_name: Doe
cc: []
bcc: []
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
result:
type: string
description: Returns a success message.
examples:
- Your Dashboard will be mailed to you as soon as it is ready.
example:
result: Your Dashboard will be mailed to you as soon as it is ready.
/ingestion/analytics/dashboard/:
get:
operationId: listDashboards
summary: Get Dashboards List
tags:
- Dashboards
description: Returns all system dashboards as well as dashboards you created.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/dashboards/list-dashboards
parameters:
- name: page
in: query
required: false
schema:
type: string
description: Pass the page number to retrieve records.
default: '1'
description: Pass the page number to retrieve records.
- name: page_size
in: query
required: false
schema:
type: string
description: Pass the number of records to retrieve on each page.
maxLength: 100
default: '10'
description: Pass the number of records to retrieve on each page.
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
results:
type: array
description: Returns the list of the containing data.
items:
type: object
properties:
created_by:
type: object
description: Returns user details who created the dashboard, such as email, first name, user ID, and last name.
properties:
email:
type: string
description: Returns the email address of the user who created the report.
examples:
- system.default@cyware.com
first_name:
type: string
description: Returns the first name of the user who created the report.
examples:
- John
id:
type: string
description: Returns the ID of the user who created the report.
examples:
- 70f3d3ee-b7bc-4ceb-849e-16db0de5278b
last_name:
type: string
description: Returns the last name of the user who created the report.
examples:
- Doe
dashboard_id:
type: string
description: Returns the unique ID of the dashboard.
examples:
- d2295055-47a2-4a31-8e73-f79d3f873e23
description:
type: string
description: Returns the description of the dashboard.
examples:
- Use this dashboard to visualize standard threat analyst metrics such as IoC count, domain objects, TLP distribution, recurring tags, and feed sources.
editable:
type: boolean
description: Returns true if the dashboard is editable, else returns false.
examples:
- false
is_default:
type: boolean
description: Returns true if it is a default dashboard, else returns false.
examples:
- true
layout_type:
type: number
description: Returns zero for a stationary dashboard or one for a rotating dashboard.
examples:
- 1
name:
type: string
description: Returns the name of the dashboard.
examples:
- Analyst Dashboard
no_export:
type: boolean
description: Returns false if you have the option to export the dashboard.
examples:
- false
rotation_timer:
type: number
description: Returns the duration of rotation of widgets, when the layout of the dashboard is a rotating dashboard.
examples:
- 30
shared_type:
type: string
description: Returns the privacy parameter of the saved search as global, private, or system.
examples:
- system
example:
results:
- created_by:
email: system.default@cyware.com
first_name: John
id: 70f3d3ee-b7bc-4ceb-849e-16db0de5278b
last_name: Doe
dashboard_id: d2295055-47a2-4a31-8e73-f79d3f873e23
description: Use this dashboard to visualize standard threat analyst metrics such as IoC count, domain objects, TLP distribution, recurring tags, and feed sources.
editable: false
is_default: true
layout_type: 1
name: Analyst Dashboard
no_export: false
rotation_timer: 30
shared_type: system
/ingestion/analytics/utilities/tld/data/:
get:
operationId: retrieveTopLevelDomainTld
summary: Get Top Level Domain (TLD)
tags:
- Dashboards
description: Returns all top-level domains in Intel Exchange.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/dashboards/retrieve-top-level-domain-tld
parameters:
- name: page
in: query
required: false
schema:
type: integer
description: Pass the page number to retrieve details from.
default: '2'
description: Pass the page number to retrieve details from.
- name: page_size
in: query
required: false
schema:
type: integer
description: Pass the number of TLDs to be retrieved on each page.
default: '10'
description: Pass the number of TLDs to be retrieved on each page.
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
# --- truncated at 32 KB (63 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-dashboards-api-openapi.yml