Cyware Fang/Defang API

openapi: 3.2.0
info:
  title: Cyware Intel Exchange (CTIX) v3 Open Fang/Defang API
  version: 3.6.2
  description: Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware's threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x.
  contact:
    name: Cyware
    url: https://www.cyware.com/contact-us
  termsOfService: https://www.cyware.com/legal/terms-of-use
  x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
  x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
  description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
  variables:
    ctix_host:
      default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Fang/Defang
  description: Fang/Defang
paths:
  /conversion/analyst-tools/fang-defang-text/:
    post:
      operationId: fangDefangIndicators
      summary: Fang/Defang Indicators
      tags:
      - Fang/Defang
      description: 'Convert fanged data into defanged format and vice versa.


        If categorize = true is passed in the request parameters, then the response includes the IOC types and the fanged or defanged data as key-value pairs.'
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/fang-defang/fang-defang-indicators
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                text:
                  type: string
                  description: Pass the data to Fang or Defang.
                  examples:
                  - '1.1.1.1

                    www.domain.com

                    sample@domain.com

                    https://www.domain.com'
                categorize:
                  type: boolean
                  description: Pass true to categorize the passed data into IOC types.
                  default: 'false'
                  examples:
                  - 'false'
                type:
                  type: string
                  description: Pass one of the following.
                  enum:
                  - fang
                  - defang
              required:
              - text
            example:
              text: '1.1.1.1

                www.domain.com

                sample@domain.com

                https://www.domain.com'
              categorize: 'false'
              type: ''
      responses:
        '201':
          description: HTTP 201 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  raw_text:
                    type: array
                    description: Returns the fanged or defanged data in raw test format.
                    items:
                      type: string
                      description: This is an example value.
                      examples:
                      - '1[.]1[.]1[.]1

                        www[.]domain[.]com

                        sample(at)domain[.]com

                        hXXps://www[.]domain[.]com'
              example:
                raw_text:
                - '1[.]1[.]1[.]1

                  www[.]domain[.]com

                  sample(at)domain[.]com

                  hXXps://www[.]domain[.]com'
components:
  securitySchemes:
    ctixOpenApiSignature:
      type: apiKey
      in: query
      name: AccessID
      description: 'Intel Exchange Open API credentials. Every request carries three query parameters: AccessID (the access ID of the Open API credential), Expires (an epoch timestamp, at most 30 seconds in the future) and Signature - an HMAC-SHA1 of "AccessID\nExpires" keyed with the secret key, Base64 encoded and then URL encoded. See https://ctixapiv3.cyware.com/authentication'
externalDocs:
  description: Cyware Intel Exchange API Reference
  url: https://ctixapiv3.cyware.com/