Cyware Import Intel API

openapi: 3.2.0
info:
  title: Cyware Intel Exchange (CTIX) v3 Open Import Intel API
  version: 3.6.2
  description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.


    Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.


    This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
  contact:
    name: Cyware
    url: https://www.cyware.com/contact-us
  termsOfService: https://www.cyware.com/legal/terms-of-use
  x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
  x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
  description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
  variables:
    ctix_host:
      default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Import Intel
  description: Import Intel
paths:
  /conversion/import/{format}/:
    post:
      operationId: importIntel
      summary: Import Intel
      tags:
      - Import Intel
      description: "Imports threat data to Intel Exchange.\n\nThe formats supported for import are as follows:\n\n<Table style=\"width:100%;min-width:100%\" colSizes='[\"initial\",\"initial\",\"155px\",\"initial\"]' isHeaderAdded='true' tableHeader='[{\"id\":\"72d731c7-ebb1-49cd-8c66-b61b425b73af\",\"title\":\"Format\"},{\"id\":\"be6d9056-f3f6-4e7e-9dec-81a55a8c377f\",\"title\":\"Value\"},{\"id\":\"5146e66f-e608-4d4c-b37f-fea0cf7e7f2a\",\"title\":\"Allowed File Type\"},{\"id\":\"c4796b75-42df-4055-ac0c-bdf2566f0608\",\"title\":\"Default Collection\"}]'>\n  <table-row>\n    <table-cell><p class=\"slate-p \">MISP</p></table-cell>\n    <table-cell><p class=\"slate-p \">misp</p></table-cell>\n    <table-cell><p class=\"slate-p \">.json</p></table-cell>\n    <table-cell><p class=\"slate-p \">misp</p></table-cell>\n  </table-row>\n  <table-row>\n    <table-cell><p class=\"slate-p \">Open IOC</p></table-cell>\n    <table-cell><p class=\"slate-p \">openioc</p></table-cell>\n    <table-cell><p class=\"slate-p \">.xml</p></table-cell>\n    <table-cell><p class=\"slate-p \">openioc</p></table-cell>\n  </table-row>\n  <table-row>\n    <table-cell><p class=\"slate-p \">STIX 1.x</p></table-cell>\n    <table-cell><p class=\"slate-p \">stix1</p></table-cell>\n    <table-cell><p class=\"slate-p \">.xml</p></table-cell>\n    <table-cell><p class=\"slate-p \">.xml</p></table-cell>\n  </table-row>\n  <table-row>\n    <table-cell><p class=\"slate-p \">STIX 2.1</p></table-cell>\n    <table-cell><p class=\"slate-p \">stix2</p></table-cell>\n    <table-cell><p class=\"slate-p \">.json</p></table-cell>\n    <table-cell><p class=\"slate-p \">Stix2</p></table-cell>\n  </table-row>\n  <table-row>\n    <table-cell><p class=\"slate-p \">STIX 2.0</p></table-cell>\n    <table-cell><p class=\"slate-p \">stix20</p></table-cell>\n    <table-cell><p class=\"slate-p \">.json</p></table-cell>\n    <table-cell><p class=\"slate-p \">Stix2</p></table-cell>\n  </table-row>\n  <table-row>\n    <table-cell><p class=\"slate-p \">STIX 1.x URL</p></table-cell>\n    <table-cell><p class=\"slate-p \">stix1url</p></table-cell>\n    <table-cell><p class=\"slate-p \">URL</p></table-cell>\n    <table-cell><p class=\"slate-p \">url</p></table-cell>\n  </table-row>\n  <table-row>\n    <table-cell><p class=\"slate-p \">CSV (Recorded Future)</p></table-cell>\n    <table-cell><p class=\"slate-p \">csv-recorded-future</p></table-cell>\n    <table-cell><p class=\"slate-p \">.csv</p></table-cell>\n    <table-cell><p class=\"slate-p \">csv</p></table-cell>\n  </table-row>\n  <table-row>\n    <table-cell><p class=\"slate-p \">CSV (Cyware)</p></table-cell>\n    <table-cell><p class=\"slate-p \">cy-csv</p></table-cell>\n    <table-cell><p class=\"slate-p \">.csv</p></table-cell>\n    <table-cell><p class=\"slate-p \">csv</p></table-cell>\n  </table-row>\n</Table>\n\nOptionally, you can specify a collection to which the file is imported. If no collection is specified, the data is imported to the default collection. To retrieve import collections, use the **Get Source Collections** endpoint.\n\n<Callout attributes='{\"isFitToPage\":true,\"dataType\":\"info\",\"style\":{\"width\":\"100%\",\"minWidth\":\"100%\"}}'>\n  <p>For STIX 1.x URL, the body must include the URL value. For more information, see the example request.</p>\n</Callout>"
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/import-intel/import-intel
      parameters:
      - name: version
        in: query
        required: false
        schema:
          type: string
          description: If the format (path variable) value is stix1 or stix2, enter the STIX version.
          enum:
          - '1.0'
          - '2.0'
          - '2.1'
          default: '2.1'
          examples:
          - '2.1'
        description: If the format (path variable) value is stix1 or stix2, enter the STIX version.
      - name: format
        in: path
        required: true
        schema:
          type: string
          description: Pass the format for the import. Refer to preceding table for more information.
          enum:
          - cy-csv
          - misp
          - openioc
          - stix1
          - stix2
          - stix20
          - stix1url
          - csv-recorded-future
          examples:
          - stix2
        description: Pass the format for the import. Refer to preceding table for more information.
      requestBody:
        required: false
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  format: binary
                  description: Select the file to be imported.
                collection_id:
                  type: string
                  description: Enter the ID of the collection to which the file is imported. To retrieve the `collection_id`, use the **Get Source Collections** endpoint. Data is imported to both the default collection as well as this specified collection.
                  examples:
                  - 603dd2cf-2c3e-4a6b-8200-505d3586df1f
            example:
              file: ''
              collection_id: 603dd2cf-2c3e-4a6b-8200-505d3586df1f
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  details:
                    type: string
                    description: Returns the import status details. To confirm if the intel was successfully imported, sign in to the Intel Exchange platform and check the Notifications section.
                    examples:
                    - You will be notified once file got uploaded.
              example:
                details: You will be notified once file got uploaded.
components:
  securitySchemes:
    ctixOpenApiSignature:
      type: apiKey
      in: query
      name: AccessID
      description: 'Intel Exchange Open API credentials. Every request carries three query parameters: AccessID (the access ID of the Open API credential), Expires (an epoch timestamp, at most 30 seconds in the future) and Signature - an HMAC-SHA1 of "AccessID\nExpires" keyed with the secret key, Base64 encoded and then URL encoded. See https://ctixapiv3.cyware.com/authentication'
externalDocs:
  description: Cyware Intel Exchange API Reference
  url: https://ctixapiv3.cyware.com/