Cyware Detailed Submission API

openapi: 3.2.0
info:
  title: Cyware Intel Exchange (CTIX) v3 Open Detailed Submission API
  version: 3.6.2
  description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.


    Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.


    This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
  contact:
    name: Cyware
    url: https://www.cyware.com/contact-us
  termsOfService: https://www.cyware.com/legal/terms-of-use
  x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
  x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
  description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
  variables:
    ctix_host:
      default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Detailed Submission
  description: Detailed Submission
paths:
  /conversion/shareable-intel/{intel-id}/attack-pattern/:
    delete:
      operationId: bulkDeleteAttackPatternSdo
      summary: Bulk Delete Attack Pattern SDO
      tags:
      - Detailed Submission
      description: Bulk deletes particular SDOs added to the detailed STIX form submission using the unique identifiers of the SDO.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/detailed-submission/attack-pattern/bulk-delete-attack-pattern-sdo
      parameters:
      - name: intel-id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of intel submission.
        description: Pass the unique ID of intel submission.
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                ids:
                  type: array
                  description: Pass the list of IDs of the attack pattern SDO to delete.
                  items:
                    type: string
                    description: This is an example ID.
                    examples:
                    - attack-pattern--6cd0b806-b675-4894-9a42-f3a0254a3036
            example:
              ids:
              - attack-pattern--6cd0b806-b675-4894-9a42-f3a0254a3036
      responses:
        '200':
          description: This request does not return any response body
          content:
            application/json:
              schema:
                type: object
                properties:
                  raw:
                    type: string
              example:
                raw: ''
      x-alternate-documents:
      - title: Delete All Attack Pattern SDO
        operationId: deleteAllAttackPatternSdo
        url: https://ctixapiv3.cyware.com/detailed-submission/attack-pattern/delete-all-attack-pattern-sdo
    post:
      operationId: createAttackPatternSdo
      summary: Create Attack Pattern SDO
      tags:
      - Detailed Submission
      description: Adds an attack pattern SDO in the initiated detailed STIX form submission.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/detailed-submission/attack-pattern/create-attack-pattern-sdo
      parameters:
      - name: intel-id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of intel submission.
        description: Pass the unique ID of intel submission.
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                created_by_ref:
                  type: object
                  description: Pass the list that contains the ID and name of the SDO being referred.
                  properties:
                    id:
                      type: string
                      description: Pass the unique identifier of the referred SDO.
                      examples:
                      - identity--30a5479b-e172-4497-80b6-a2d6b58b4c78
                    name:
                      type: string
                      description: Pass the name of the referred SDO.
                      examples:
                      - CTIX
                revoked:
                  type: boolean
                  description: Pass true to specify if the SDO is revoked; otherwise, pass false.
                  examples:
                  - 'false'
                labels:
                  type: array
                  description: Pass the list that contains the ID and label names attached to the SDO.
                  items:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Pass the unique identifier of the label.
                        examples:
                        - c5ffddd6-3057-475c-9ae5-a95b9eb0c7df
                      name:
                        type: string
                        description: Pass the name of the label.
                        examples:
                        - ActivityCluster/IrenicAngler
                name:
                  type: string
                  description: Pass the name of the SDO.
                  examples:
                  - ap1
                description:
                  type: string
                  description: Pass the description of the SDO.
                  examples:
                  - sdjsbdhbshvb
                custom_properties:
                  type: array
                  description: Pass the list that contains the unique identifier for the custom property, type, name, and the value to add for the same.
                  items:
                    type: object
                    properties:
                      key:
                        type: object
                        description: Pass the custom property key details.
                        properties:
                          id:
                            type: string
                            description: Pass the unique identifier of the key.
                            examples:
                            - bea5a1c4-63a5-4747-a1a5-53c1a89da6bc
                          name:
                            type: string
                            description: Pass the name of the key.
                            examples:
                            - Relevance Score
                          type:
                            type: number
                            description: Pass the data type of the key.
                            examples:
                            - '1'
                      value:
                        type: number
                        description: Returns the value of the custom property.
                        examples:
                        - '2'
                aliases:
                  type: array
                  description: Pass the list that specifies the also-known names of the SDO.
                  items:
                    type: string
                    description: This is an example value.
                    examples:
                    - ap1
                tlp:
                  type: object
                  description: Pass the list that contains the UI label and value of TLP.
                  properties:
                    label:
                      type: string
                      description: Pass the UI label/name of the TLP.
                      examples:
                      - Amber
                    value:
                      type: string
                      description: Pass the value of the TLP.
                      examples:
                      - AMBER
                kill_chain_phases:
                  type: array
                  description: Pass the list that contains the standard STIX kill chain name and the phase name for the same.
                  items:
                    type: object
                    properties:
                      kill_chain_name:
                        type: string
                        description: Pass the name of the kill chain.
                        examples:
                        - foo
                      phase_name:
                        type: string
                        description: Pass the specific phase name from the defined kill chain.
                        examples:
                        - pre-attack
            example:
              created_by_ref:
                id: identity--30a5479b-e172-4497-80b6-a2d6b58b4c78
                name: CTIX
              revoked: 'false'
              labels:
              - id: c5ffddd6-3057-475c-9ae5-a95b9eb0c7df
                name: ActivityCluster/IrenicAngler
              name: ap1
              description: sdjsbdhbshvb
              custom_properties:
              - key:
                  id: bea5a1c4-63a5-4747-a1a5-53c1a89da6bc
                  name: Relevance Score
                  type: '1'
                value: '2'
              aliases:
              - ap1
              tlp:
                label: Amber
                value: AMBER
              kill_chain_phases:
              - kill_chain_name: foo
                phase_name: pre-attack
      responses:
        '201':
          description: HTTP 201 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  created_by_ref:
                    type: object
                    description: Returns the list that contains the ID and name of the SDO being referred.
                    properties:
                      id:
                        type: string
                        description: Returns the unique identifier of the referred SDO.
                        examples:
                        - identity--30a5479b-e172-4497-80b6-a2d6b58b4c78
                      name:
                        type: string
                        description: Returns the name of the referred SDO.
                        examples:
                        - CTIX
                  tlp:
                    type: object
                    description: Returns the list that contains the UI label and value of TLP.
                    properties:
                      label:
                        type: string
                        description: Returns the UI label/name of the TLP.
                        examples:
                        - Amber
                      value:
                        type: string
                        description: Returns the value of the TLP.
                        examples:
                        - AMBER
                  revoked:
                    type: boolean
                    description: Returns true to specify if the SDO is revoked, else pass false.
                    examples:
                    - 'false'
                  labels:
                    type: array
                    description: Returns the list that contains the ID and label names attached to the SDO.
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                          description: Returns the unique identifier of the label.
                          examples:
                          - c5ffddd6-3057-475c-9ae5-a95b9eb0c7df
                        name:
                          type: string
                          description: Returns the name of the label.
                          examples:
                          - ActivityCluster/IrenicAngler
                  custom_properties:
                    type: array
                    description: Returns the list containing the unique identifier for the custom property, type, name, and the value to add.
                    items:
                      type: object
                      properties:
                        key:
                          type: object
                          description: Returns the custom property key details.
                          properties:
                            name:
                              type: string
                              description: Returns the name of the key.
                              examples:
                              - Relevance Score
                            id:
                              type: string
                              description: Returns the unique identifier of the key.
                              examples:
                              - bea5a1c4-63a5-4747-a1a5-53c1a89da6bc
                            type:
                              type: string
                              description: Returns the data type of the key.
                              examples:
                              - int
                        value:
                          type: number
                          description: Returns the value of the custom property.
                          examples:
                          - '2'
                  name:
                    type: string
                    description: Returns the name of the SDO.
                    examples:
                    - ap1
                  description:
                    type: string
                    description: Returns the description of the SDO.
                    examples:
                    - sdjsbdhbshvb
                  aliases:
                    type: array
                    description: Returns the list that specifies the also-known names of the SDO.
                    items:
                      type: string
                      description: This is an example value.
                      examples:
                      - ap1
                  kill_chain_phases:
                    type: array
                    description: Returns the list that contains the standard STIX kill chain name and the phase name for the same.
                    items:
                      type: object
                      properties:
                        kill_chain_name:
                          type: string
                          description: Pass the name of the kill chain.
                          examples:
                          - foo
                        phase_name:
                          type: string
                          description: Pass the specific phase name from the defined kill chain.
                          examples:
                          - pre-attack
                  id:
                    type: string
                    description: Returns the unique identifier for the SDO.
                    examples:
                    - attack-pattern--31cebb81-3914-4b61-a92d-e67f4a95602d
              example:
                created_by_ref:
                  id: identity--30a5479b-e172-4497-80b6-a2d6b58b4c78
                  name: CTIX
                tlp:
                  label: Amber
                  value: AMBER
                revoked: 'false'
                labels:
                - id: c5ffddd6-3057-475c-9ae5-a95b9eb0c7df
                  name: ActivityCluster/IrenicAngler
                custom_properties:
                - key:
                    name: Relevance Score
                    id: bea5a1c4-63a5-4747-a1a5-53c1a89da6bc
                    type: int
                  value: '2'
                name: ap1
                description: sdjsbdhbshvb
                aliases:
                - ap1
                kill_chain_phases:
                - kill_chain_name: foo
                  phase_name: pre-attack
                id: attack-pattern--31cebb81-3914-4b61-a92d-e67f4a95602d
    get:
      operationId: listAttackPatternSdo
      summary: Get Attack Pattern SDOs List
      tags:
      - Detailed Submission
      description: List the attack pattern SDOs in a paginated response added under the given ID of the detailed STIX form submission.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/detailed-submission/attack-pattern/list-attack-pattern-sdo
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number.
          examples:
          - '1'
        description: Pass the page number.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records shown on each page.
          maxLength: 100
          default: '10'
          examples:
          - '10'
        description: Pass the number of records shown on each page.
      - name: intel-id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of the intel submission.
        description: Pass the unique ID of the intel submission.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  next:
                    type: object
                    description: Returns the link to the next page, or returns null if it is the last page of the result set.
                  previous:
                    type: object
                    description: Returns the link to the previous page, or returns null if it is the first page of the result set.
                  total:
                    type: number
                    description: Returns the total number of records returned by the API.
                    examples:
                    - '3'
                  page_size:
                    type: number
                    description: Returns the number of records per page.
                    examples:
                    - '10'
                  results:
                    type: array
                    description: Returns the list containing the ID and name of the attack pattern SDOs.
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                          description: Returns the unique identifier of the attack pattern SDO.
                          examples:
                          - attack-pattern--9fa6642c-3115-4a5c-8ad2-a4d5504e69d6
                        name:
                          type: string
                          description: Returns the name of attack pattern SDO.
                          examples:
                          - ap1
              example:
                next: {}
                previous: {}
                total: '3'
                page_size: '10'
                results:
                - id: attack-pattern--9fa6642c-3115-4a5c-8ad2-a4d5504e69d6
                  name: ap1
  /conversion/shareable-intel/{intel-id}/attack-pattern/{attack-pattern-id}/:
    delete:
      operationId: deleteAttackPatternSdo
      summary: Delete Attack Pattern SDO
      tags:
      - Detailed Submission
      description: Deletes a particular SDO added to the detailed STIX form submission using the unique identifier of the SDO.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/detailed-submission/attack-pattern/delete-attack-pattern-sdo
      parameters:
      - name: intel-id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of intel submission.
        description: Pass the unique ID of intel submission.
      - name: attack-pattern-id
        in: path
        required: true
        schema:
          type: string
          description: Pass the attack pattern ID.
        description: Pass the attack pattern ID.
      responses:
        '200':
          description: This request does not return any response body
          content:
            application/json:
              schema:
                type: object
                properties:
                  raw:
                    type: string
              example:
                raw: null
    get:
      operationId: retrieveAttackPatternSdo
      summary: Get Attack Pattern SDO
      tags:
      - Detailed Submission
      description: Returns an attack pattern SDO in the initiated detailed STIX form submission using the unique identifier of the attack pattern and the detailed submission.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/detailed-submission/attack-pattern/retrieve-attack-pattern-sdo
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve records.
          default: '1'
        description: Pass the page number to retrieve records.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve on each page.
          maxLength: 100
          default: '10'
        description: Pass the number of records to retrieve on each page.
      - name: intel-id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of the intel submission.
        description: Pass the unique ID of the intel submission.
      - name: attack-pattern-id
        in: path
        required: true
        schema:
          type: string
          description: Pass the attack pattern ID.
        description: Pass the attack pattern ID.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Returns the unique identifier for the SDO.
                    examples:
                    - attack-pattern--31cebb81-3914-4b61-a92d-e67f4a95602d
                  created_by_ref:
                    type: object
                    description: Returns the list that contains the ID and name of the SDO being referred.
                    properties:
                      id:
                        type: string
                        description: Returns the unique identifier of the referred SDO.
                        examples:
                        - identity--30a5479b-e172-4497-80b6-a2d6b58b4c78
                      name:
                        type: string
                        description: Returns the name of the referred SDO.
                        examples:
                        - CTIX
                  tlp:
                    type: object
                    description: Returns the list that contains the UI label and value of TLP.
                    properties:
                      label:
                        type: string
                        description: Returns the UI label/name of the TLP.
                        examples:
                        - Amber
                      value:
                        type: string
                        description: Returns the value of the TLP.
                        examples:
                        - AMBER
                  revoked:
                    type: boolean
                    description: Returns true if the SDO object is revoked, else returns false.
                    examples:
                    - 'false'
                  labels:
                    type: array
                    description: Returns the list that contains the ID and name of the labels attached to the SDO.
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                          description: Returns the unique identifier the label.
                          examples:
                          - c5ffddd6-3057-475c-9ae5-a95b9eb0c7df
                        name:
                          type: string
                          description: Returns the name the label.
                          examples:
                          - ActivityCluster/IrenicAngler
                  custom_properties:
                    type: array
                    description: Returns the list that contains the unique identifier for the custom property, type, name, and the value user wishes to add for the same.
                    items:
                      type: object
                      properties:
                        key:
                          type: object
                          description: Returns the custom property key details.
                          properties:
                            name:
                              type: string
                              description: Returns the name of the key.
                              examples:
                              - Relevance Score
                            id:
                              type: string
                              description: Returns the unique identifier of the key.
                              examples:
                              - bea5a1c4-63a5-4747-a1a5-53c1a89da6bc
                            type:
                              type: string
                              description: Returns the data type of the key.
                              examples:
                              - int
                        value:
                          type: number
                          description: Returns the value of the custom property.
                          examples:
                          - '2'
                  name:
                    type: string
                    description: Returns the name of the SDO.
                    examples:
                    - ap1
                  description:
                    type: string
                    description: Returns the description of the SDO.
                    examples:
                    - sdjsbdhbshvb
                  aliases:
                    type: array
                    description: Returns the list that specifies the also-known names of the SDO.
                    items:
                      type: string
                      description: This is an example value.
                      examples:
                      - ap1
                  kill_chain_phases:
                    type: array
                    description: Returns the list that contains the standard STIX kill chain name and the phase name for the same.
                    items:
                      type: object
                      properties:
                        kill_chain_name:
                          type: string
                          description: Returns the name of the kill chain.
                          examples:
                          - foo
                        phase_name:
                          type: string
                          description: Returns the specific phase name from the defined kill chain.
                          examples:
                          - pre-attack
              example:
                id: attack-pattern--31cebb81-3914-4b61-a92d-e67f4a95602d
                created_by_ref:
                  id: identity--30a5479b-e172-4497-80b6-a2d6b58b4c78
                  name: CTIX
                tlp:
                  label: Amber
                  value: AMBER
                revoked: 'false'
                labels:
                - id: c5ffddd6-3057-475c-9ae5-a95b9eb0c7df
                  name: ActivityCluster/IrenicAngler
                custom_properties:
                - key:
                    name: Relevance Score
                    id: bea5a1c4-63a5-4747-a1a5-53c1a89da6bc
                    type: int
                  value: '2'
                name: ap1
                description: sdjsbdhbshvb
                aliases:
                - ap1
                kill_chain_phases:
                - kill_chain_name: foo
                  phase_name: pre-attack
    put:
      operationId: updateAttackPatternSdo
      summary: Update Attack Pattern SDO
      tags:
      - Detailed Submission
      description: Updates the attack pattern SDO in the initiated detailed STIX form submission.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/detailed-submission/attack-pattern/update-attack-pattern-sdo
      parameters:
      - name: intel-id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of the intel submission.
        description: Pass the unique ID of the intel submission.
      - name: attack-pattern-id
        in: path
        required: true
        schema:
          type: string
          description: Pass the attack pattern ID.
        description: Pass the attack pattern ID.
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                created_by_ref:
                  type: object
                  description: Pass the list that contains the ID and name of the SDO being referred.
                  properties:
                    id:
                      type: string
                      description: Pass the unique identifier of the referred SDO.
                      examples:
                      - identity--30a5479b-e172-4497-80b6-a2d6b58b4c78
                    name:
                      type: string
                      description: Pass the name of the referred SDO.
                      examples:
                      - CTIX
                revoked:
                  type: boolean
                  description: Pass true to specify if the SDO is revoked, else pass false.
                  examples:
                  - 'false'
                labels:
                  type: array
                  description: Pass the list that contains the ID and label names attached to the SDO.
                  items:
                    type: object
                    properties:
                      id:
                        type: string
                        description: Pass the unique identifier of the label.
                        examples:
                        - c5ffddd6-3057-475c-9ae5-a95b9eb0c7df
                      name:
                        type: string
                        description: Pass the name of the label.
                        examples:
                        - ActivityCluster/IrenicAngler
                name:
                  type: string
                  description: Pass the name of the SDO.
                  examples:
                  - ap1
                description:
                  type: string
                  description: Pass the description of the SDO.
                  examples:
                  - sdjsbdhbshvb
                custom_properties:
                  type: array
                  description: Pass the list that contains the unique identifier for the custom property, type, name, and the value to add for the same.
                  items:
                    type: object
                    properties:
                      key

# --- truncated at 32 KB (751 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-detailed-submission-api-openapi.yml