Cyware Fang/Defang API

openapi: 3.2.0
info:
  title: Cyware Intel Exchange (CTIX) v3 Open Fang/Defang API
  version: 3.6.2
  description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.


    Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.


    This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
  contact:
    name: Cyware
    url: https://www.cyware.com/contact-us
  termsOfService: https://www.cyware.com/legal/terms-of-use
  x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
  x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
  description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
  variables:
    ctix_host:
      default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Fang/Defang
  description: Fang/Defang
paths:
  /conversion/analyst-tools/fang-defang-text/:
    post:
      operationId: fangDefangIndicators
      summary: Fang/Defang Indicators
      tags:
      - Fang/Defang
      description: "Convert fanged data into defanged format and vice versa.\n\n<Callout attributes='{\"isFitToPage\":true,\"dataType\":\"info\",\"style\":{\"width\":\"100%\",\"minWidth\":\"100%\"}}'>\n  <p>If <code class=\"slate-code\">categorize = true</code> is passed in the request parameters, then the response includes the IOC types and the fanged or defanged data as key-value pairs.</p>\n</Callout>"
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/fang-defang/fang-defang-indicators
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                text:
                  type: string
                  description: Pass the data to Fang or Defang.
                  examples:
                  - '1.1.1.1

                    www.domain.com

                    sample@domain.com

                    https://www.domain.com'
                categorize:
                  type: boolean
                  description: Pass true to categorize the passed data into IOC types.
                  default: 'false'
                  examples:
                  - 'false'
                type:
                  type: string
                  description: Pass one of the following.
                  enum:
                  - fang
                  - defang
              required:
              - text
            example:
              text: '1.1.1.1

                www.domain.com

                sample@domain.com

                https://www.domain.com'
              categorize: 'false'
              type: ''
      responses:
        '201':
          description: HTTP 201 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  raw_text:
                    type: array
                    description: Returns the fanged or defanged data in raw test format.
                    items:
                      type: string
                      description: This is an example value.
                      examples:
                      - '1[.]1[.]1[.]1

                        www[.]domain[.]com

                        sample(at)domain[.]com

                        hXXps://www[.]domain[.]com'
              example:
                raw_text:
                - '1[.]1[.]1[.]1

                  www[.]domain[.]com

                  sample(at)domain[.]com

                  hXXps://www[.]domain[.]com'
components:
  securitySchemes:
    ctixOpenApiSignature:
      type: apiKey
      in: query
      name: AccessID
      description: 'Intel Exchange Open API credentials. Every request carries three query parameters: AccessID (the access ID of the Open API credential), Expires (an epoch timestamp, at most 30 seconds in the future) and Signature - an HMAC-SHA1 of "AccessID\nExpires" keyed with the secret key, Base64 encoded and then URL encoded. See https://ctixapiv3.cyware.com/authentication'
externalDocs:
  description: Cyware Intel Exchange API Reference
  url: https://ctixapiv3.cyware.com/