openapi: 3.2.0
info:
title: Cyware Intel Exchange (CTIX) v3 Open Global Notes API
version: 3.6.2
description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.
Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.
This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
contact:
name: Cyware
url: https://www.cyware.com/contact-us
termsOfService: https://www.cyware.com/legal/terms-of-use
x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
variables:
ctix_host:
default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Global Notes
description: Global Notes
paths:
/ingestion/notes/:
post:
operationId: addNote
summary: Add Note
tags:
- Global Notes
description: Adds a note to a threat data object.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/global-notes/add-note
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
object_id:
type: string
description: Pass the ID of the threat data object to associate the note.
examples:
- 21f82259-a788-4dc2-bd14-1b8ba271b871
text:
type: string
description: Pass the description for the note.
examples:
- threat data note
type:
type: string
description: Pass the type of the note.
examples:
- threatdata
required:
- text
- type
example:
object_id: 21f82259-a788-4dc2-bd14-1b8ba271b871
text: threat data note
type: threatdata
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
created:
type: number
description: Returns the date and time of the creation of the note in EPOCH format.
examples:
- '1685607763'
created_by:
type: object
description: Returns the information of the user who created the notes. The information includes the email address, first name, ID, and last name of the user.
properties:
email:
type: string
description: Returns the email address of the user who created the note.
examples:
- john.doe@cyware.com
first_name:
type: string
description: Returns the first name of the user who created the note.
examples:
- john
id:
type: string
description: Returns the ID of the user who created the note.
examples:
- 58a66a94-fe9b-4928-ba44-d38fda6f06f3
last_name:
type: string
description: Returns the last name of the user who created the note.
examples:
- doe
id:
type: string
description: Returns the unique ID of the note.
examples:
- f684bd2b-245f-4cc2-bda5-efa64a66715d
is_json:
type: boolean
description: Returns a boolean flag that indicates whether the content of the note is formatted as JSON.
examples:
- 'false'
meta_data:
type: object
description: Returns any metadata saved with the notes.
modified:
type: number
description: Returns the date and time of the modification of the note in epoch format.
examples:
- '1685607763'
modified_by:
type: object
description: Returns the information of the user who modified the notes. The information includes the email address, first name, ID, and last name of the user.
properties:
email:
type: string
description: Returns the email address of the user who last modified the note.
examples:
- john.doe@cyware.com
first_name:
type: string
description: Returns the first name of the user who last modified the note.
examples:
- john
id:
type: string
description: Returns the user ID of the user who last modified the note.
examples:
- 58a66a94-fe9b-4928-ba44-d38fda6f06f3
last_name:
type: string
description: Returns the last name of the user who last modified the note.
examples:
- doe
object_id:
type: string
description: Returns the UUID of the threat data object associated with the notes.
examples:
- 21f82259-a788-4dc2-bd14-1b8ba271b871
text:
type: string
description: Returns the description associated with notes.
examples:
- threat notes
title:
type: object
description: Returns the title of the note.
type:
type: string
description: Returns the type which is saved for the note.
examples:
- threatdata
example:
created: '1685607763'
created_by:
email: john.doe@cyware.com
first_name: john
id: 58a66a94-fe9b-4928-ba44-d38fda6f06f3
last_name: doe
id: f684bd2b-245f-4cc2-bda5-efa64a66715d
is_json: 'false'
meta_data: {}
modified: '1685607763'
modified_by:
email: john.doe@cyware.com
first_name: john
id: 58a66a94-fe9b-4928-ba44-d38fda6f06f3
last_name: doe
object_id: 21f82259-a788-4dc2-bd14-1b8ba271b871
text: threat notes
title: {}
type: threatdata
x-alternate-documents:
- title: Add Note to Threat Data Object
operationId: addNoteToThreatDataObject
url: https://ctixapiv3.cyware.com/threat-data-objects/notes/add-note-to-threat-data-object
get:
operationId: listNotes
summary: Get Notes List
tags:
- Global Notes
description: This API endpoint retrieves a list of global notes.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/global-notes/list-notes
parameters:
- name: page
in: query
required: false
schema:
type: string
description: Pass the page number to retrieve the notes in a threat data object.
examples:
- '1'
description: Pass the page number to retrieve the notes in a threat data object.
- name: page_size
in: query
required: false
schema:
type: string
description: Pass the number of notes to retrieve on each page.
maxLength: 100
examples:
- '10'
description: Pass the number of notes to retrieve on each page.
- name: object_id
in: query
required: false
schema:
type: string
description: Pass the ID of a threat data object to retrieve the associated notes.
examples:
- c611c22c-8175-41e8-ae51-aee29c7b1c29
description: Pass the ID of a threat data object to retrieve the associated notes.
- name: created_by
in: query
required: false
schema:
type: string
description: Pass the ID of a user to retrieve the associated notes.
examples:
- 58a66a94-fe9b-4928-ba44-d38fda6f06f3
description: Pass the ID of a user to retrieve the associated notes.
- name: created_from
in: query
required: false
schema:
type: string
description: Pass the start date of the notes created state in epoch format to filter notes.
examples:
- '1685607229'
description: Pass the start date of the notes created state in epoch format to filter notes.
- name: created_to
in: query
required: false
schema:
type: string
description: Pass the end date of the notes created date in epoch format to filter notes.
examples:
- '1685607261'
description: Pass the end date of the notes created date in epoch format to filter notes.
- name: q
in: query
required: false
schema:
type: string
description: Pass the query text to search in notes.
examples:
- sha
description: Pass the query text to search in notes.
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
next:
type: object
description: Returns the link to the next page. Returns null in case it is the last page.
page_size:
type: number
description: Returns the number of notes displayed per page.
examples:
- '10'
previous:
type: object
description: Returns the link to the previous page. Returns null in case it is the first page.
results:
type: array
description: Returns the information, such as created date and time, user details, note ID, and more.
items:
type: object
properties:
created:
type: number
description: Returns the date and time when the notes were created.
examples:
- '1685607260'
created_by:
type: object
description: Returns the information of the user who created the notes. The information includes the email address, first name, ID, and last name of the user.
properties:
email:
type: string
description: Returns the email address of the user who created the note.
examples:
- john.doe@cyware.com
first_name:
type: string
description: Returns the first name of the user who created the note.
examples:
- john
id:
type: string
description: Returns the ID of the user who created the note.
examples:
- 58a66a94-fe9b-4928-ba44-d38fda6f06f3
last_name:
type: string
description: Returns the last name of the user who created the note.
examples:
- doe
id:
type: string
description: Returns the unique ID of the notes.
examples:
- 79134691-2a05-4fcb-94b0-e3966c5a7e80
is_json:
type: boolean
description: Returns a boolean flag that indicates whether the content of the note is formatted as JSON.
examples:
- 'false'
meta_data:
type: object
description: Returns any metadata saved with the notes.
properties:
component:
type: string
description: Identifies the Intel Exchange module or functional area associated with the note.
examples:
- threatdata
object_id:
type: string
description: Returns the unique identifier of the object.
examples:
- c611c22c-8175-41e8-ae51-aee29c7b1c29
type:
type: string
description: Returns the type.
examples:
- report
modified:
type: number
description: Returns the UUID of the threat data object associated with the notes.
examples:
- '1685607260'
modified_by:
type: object
description: Returns the information of the user who modified the notes. The information includes the email address, first name, ID, and last name of the user.
properties:
email:
type: string
description: Returns the email address of the user who last modified the note.
examples:
- john.doe@cyware.com
first_name:
type: string
description: Returns the first name of the user who last modified the note.
examples:
- john
id:
type: string
description: Returns the user ID of the user who last modified the note.
examples:
- 58a66a94-fe9b-4928-ba44-d38fda6f06f3
last_name:
type: string
description: Returns the last name of the user who last modified the note.
examples:
- doe
object_id:
type: string
description: Returns the UUID of the threat data object associated with the notes.
examples:
- c611c22c-8175-41e8-ae51-aee29c7b1c29
text:
type: string
description: Returns the description associated with notes.
examples:
- sha256
title:
type: object
description: Returns the title of the note.
type:
type: string
description: Returns the type which is saved for note.
examples:
- threatdata
total:
type: number
description: Returns the total number of records the API returns.
examples:
- '2'
example:
next: {}
page_size: '10'
previous: {}
results:
- created: '1685607260'
created_by:
email: john.doe@cyware.com
first_name: john
id: 58a66a94-fe9b-4928-ba44-d38fda6f06f3
last_name: doe
id: 79134691-2a05-4fcb-94b0-e3966c5a7e80
is_json: 'false'
meta_data:
component: threatdata
object_id: c611c22c-8175-41e8-ae51-aee29c7b1c29
type: report
modified: '1685607260'
modified_by:
email: john.doe@cyware.com
first_name: john
id: 58a66a94-fe9b-4928-ba44-d38fda6f06f3
last_name: doe
object_id: c611c22c-8175-41e8-ae51-aee29c7b1c29
text: sha256
title: {}
type: threatdata
total: '2'
x-alternate-documents:
- title: Get Notes List in Threat Data Object
operationId: listNotesInThreatDataObject
url: https://ctixapiv3.cyware.com/threat-data-objects/notes/list-notes-in-threat-data-object
/ingestion/ingestion-api/bulk-notes/:
post:
operationId: bulkNote
summary: Bulk Note
tags:
- Global Notes
description: Creates notes in bulk for multiple threat data objects.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/global-notes/bulk-note
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
type:
type: string
description: Pass the object type.
enum:
- threatdata
examples:
- threatdata
text:
type: string
description: Pass the note content to be added to the specified threat data objects.
examples:
- this is report description - demo
object_ids:
type: array
description: Pass the list of object UUIDs to which the note should be attached. To get the `object_id`, use the **List Threat Data endpoint**.
items:
type: string
description: This is an example ID.
examples:
- a4b77a74-4ed0-4def-8163-04dd27fd4229
required:
- type
- text
example:
type: threatdata
text: this is report description - demo
object_ids:
- a4b77a74-4ed0-4def-8163-04dd27fd4229
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
status:
type: string
description: 'Returns the overall result. For example: *SUCCESS*, *PARTIAL SUCCESS*, or *FAILED*.'
examples:
- SUCCESS
message:
type: string
description: Returns the reason based on the status.
examples:
- The provided note text has been applied to all valid objects.
example:
status: SUCCESS
message: The provided note text has been applied to all valid objects.
/ingestion/notes/{note_id}/:
delete:
operationId: deleteNote
summary: Delete Note
tags:
- Global Notes
description: Deletes a note by its unique ID.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/global-notes/delete-note
parameters:
- name: note_id
in: path
required: true
schema:
type: string
description: Pass the ID of a note to delete.
examples:
- 95005e32-3e30-4e80-9d26-2061cc36b1a8
description: Pass the ID of a note to delete.
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
properties:
details:
type: string
description: Returns a success or failure message.
examples:
- success
example:
details: success
x-alternate-documents:
- title: Delete Note
operationId: threatDataObjectsNotesDeleteNote
url: https://ctixapiv3.cyware.com/threat-data-objects/notes/delete-note
get:
operationId: noteDetails1
summary: Get Note Details
tags:
- Global Notes
description: This API endpoint retrieves the details of a specific note identified by the `note_id`.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/global-notes/note-details-1
parameters:
- name: page
in: query
required: false
schema:
type: string
description: Pass the page number to retrieve records.
default: '1'
description: Pass the page number to retrieve records.
- name: page_size
in: query
required: false
schema:
type: string
description: Pass the number of records to retrieve on each page.
maxLength: 100
default: '10'
description: Pass the number of records to retrieve on each page.
- name: note_id
in: path
required: true
schema:
type: string
description: Pass the ID of a note to retrieve the details.
examples:
- e64ba06c-acb7-4a3d-82f3-b99de11a8531
description: Pass the ID of a note to retrieve the details.
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
created:
type: number
description: Returns the date and time of the creation of the note.
examples:
- '1685610463'
created_by:
type: object
description: Returns the information of the user who created the notes. The information includes the email address, first name, ID, and last name of the user.
properties:
email:
type: string
description: Returns the email address of the user who created the note.
examples:
- john.doe@cyware.com
first_name:
type: string
description: Returns the first name of the user who created the note.
examples:
- john
id:
type: string
description: Returns the ID of the user who created the note.
examples:
- 58a66a94-fe9b-4928-ba44-d38fda6f06f3
last_name:
type: string
description: Returns the last name of the user who created the note.
examples:
- doe
id:
type: string
description: Returns the unique ID of the note.
examples:
- e30d3246-c793-4f64-ba51-66e418216eeb
is_json:
type: boolean
description: Returns a boolean flag that indicates whether the content of the note is formatted as JSON.
examples:
- 'false'
meta_data:
type: object
description: Returns any metadata saved with the notes.
properties:
component:
type: string
description: Identifies the Intel Exchange module or functional area associated with the note.
examples:
- threatdata
object_id:
type: string
description: Returns the unique identifier of the object.
examples:
- c611c22c-8175-41e8-ae51-aee29c7b1c29
type:
type: string
description: Returns the type.
examples:
- report
modified:
type: number
description: Returns the date and time of the modification of the note.
examples:
- '1685610463'
modified_by:
type: object
description: Returns the information of the user who modified the notes. The information includes the email address, first name, ID, and last name of the user.
properties:
email:
type: string
description: Returns the email address of the user who last modified the note.
examples:
- john.doe@cyware.com
first_name:
type: string
description: Returns the first name of the user who last modified the note.
examples:
- john
id:
type: string
description: Returns the user ID of the user who last modified the note.
examples:
- 58a66a94-fe9b-4928-ba44-d38fda6f06f3
last_name:
type: string
description: Returns the last name of the user who last modified the note.
examples:
- doe
object_id:
type: string
description: Returns the UUID of the threat data object associated with the notes.
examples:
- c611c22c-8175-41e8-ae51-aee29c7b1c29
text:
type: string
description: Returns the description associated with notes.
examples:
- note content
title:
type: object
description: Returns the title of the note.
type:
type: string
description: Returns the type of the note.
examples:
- threatdata
example:
created: '1685610463'
created_by:
email: john.doe@cyware.com
first_name: john
id: 58a66a94-fe9b-4928-ba44-d38fda6f06f3
last_name: doe
id: e30d3246-c793-4f64-ba51-66e418216eeb
is_json: 'false'
meta_data:
component: threatdata
object_id: c611c22c-8175-41e8-ae51-aee29c7b1c29
type: report
modified: '1685610463'
modified_by:
email: john.doe@cyware.com
first_name: john
id: 58a66a94-fe9b-4928-ba44-d38fda6f06f3
last_name: doe
object_id: c611c22c-8175-41e8-ae51-aee29c7b1c29
text: note content
title: {}
type: threatdata
x-alternate-documents:
- title: Get Note Details in Threat Data Object
operationId: noteDetails
url: https://ctixapiv3.cyware.com/threat-data-objects/notes/note-details
put:
operationId: updateNote
summary: Update Note
tags:
- Global Notes
description: Updates the details of a note.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/global-notes/update-note
parameters:
- name: note_id
in: path
required: true
schema:
type: string
description: Pass the ID of a note to update.
examples:
- 95005e32-3e30-4e80-9d26-2061cc36b1a8
description: Pass the ID of a note to update.
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
text:
type: string
description: Pass the description for the note.
examples:
- New note content
example:
text: New note content
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
created:
type: number
description: Returns the date and time of the creation of the note in epoch format.
examples:
- '1685607229'
created_by:
type: object
description: 'Returns the information of the user who created the notes. The information includes
the email address, first name, ID, and last name of the user.'
properties:
email:
type: string
description: Returns the email address of the user who created the note.
examples:
- john.doe@cyware.com
first_name:
# --- truncated at 32 KB (37 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-global-notes-api-openapi.yml