openapi: 3.2.0
info:
title: Cyware Intel Exchange (CTIX) v3 Open Quick Add Intel API
version: 3.6.2
description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.
Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.
This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
contact:
name: Cyware
url: https://www.cyware.com/contact-us
termsOfService: https://www.cyware.com/legal/terms-of-use
x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
variables:
ctix_host:
default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Quick Add Intel
description: Quick Add Intel
paths:
/conversion/quick-intel/free-text/:
post:
operationId: createParseIocsTask
summary: Create Parse IOCs Task
tags:
- Quick Add Intel
description: "Creates an IOC parsing task to extract STIX objects from free text data or a web page.\n\n<Callout attributes='{\"isFitToPage\":true,\"dataType\":\"info\",\"style\":{\"width\":\"100%\",\"minWidth\":\"100%\"}}'>\n <p>Currently, this API endpoint does not support parsing IOCs from files such as PDF, CSV, XLS, and others.</p>\n</Callout>"
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/quick-add-intel/create-parse-iocs-task
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
data:
type: string
description: Pass the free text data within 50,000 characters or a web page URL to extract STIX objects. If the number of characters in the passed text data or the web page exceeds the character limit, then the initial 50,000 characters are parsed.
examples:
- 1.2.3.11, 1.1.2.1, domain.com
url:
type: boolean
description: Pass `true` to extract STIX objects from a web page. If you pass `false`, then the URL passed in the data parameter is parsed as free text.
examples:
- 'true'
required:
- data
example:
data: 1.2.3.11, 1.1.2.1, domain.com
url: 'true'
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
task_id:
type: string
description: Returns the ID of the parsing task. To retrieve the parsing task status, use the **Retrieve Parse IOCs Task Status** endpoint.
examples:
- 4310c8e6-c26e-4526-a3b2-7445c6798511
example:
task_id: 4310c8e6-c26e-4526-a3b2-7445c6798511
/conversion/quick-intel/vocabs/country_enum/:
get:
operationId: listCountryCodes
summary: Get Country Codes List
tags:
- Quick Add Intel
description: Returns a list of country codes based on the [STIX 2.1 enumeration](https://docs.oasis-open.org/cti/stix/v2.1/csprd01/stix-v2.1-csprd01.html#:~:text=bit%20x86%20architecture.-,10.20%20%E2%80%8BRegion%20Vocabulary,-Vocabulary%20Name:%20region). These country codes can be used to specify locations in the **Quick Add Intel** endpoint.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/quick-add-intel/list-country-codes
parameters:
- name: page
in: query
required: false
schema:
type: string
description: Pass the page number to retrieve records.
default: '1'
description: Pass the page number to retrieve records.
- name: page_size
in: query
required: false
schema:
type: string
description: Pass the number of records to retrieve on each page.
maxLength: 100
default: '10'
description: Pass the number of records to retrieve on each page.
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
'0':
type: object
properties:
value:
type: string
description: Returns the ISO country or region code.
examples:
- AC
label:
type: string
description: Returns the label of the country or region.
examples:
- AC
'1':
type: object
properties:
value:
type: string
examples:
- AN
label:
type: string
examples:
- AN
'2':
type: object
properties:
value:
type: string
examples:
- ZM
label:
type: string
examples:
- Zambia
example:
'0':
value: AC
label: AC
'1':
value: AN
label: AN
'2':
value: ZM
label: Zambia
/conversion/intel-history/:
get:
operationId: listQuickAddIntelHistory
summary: Get Quick Add Intel History List
tags:
- Quick Add Intel
description: Returns a list of intel added using quick add intel.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/quick-add-intel/list-quick-add-intel-history
parameters:
- name: q
in: query
required: false
schema:
type: string
description: Pass a query text to search for an intel based on the title.
examples:
- ip
description: Pass a query text to search for an intel based on the title.
- name: sort
in: query
required: false
schema:
type: string
description: Pass a comma-separated list of fields to sort the history.
enum:
- created
- title
examples:
- created
description: Pass a comma-separated list of fields to sort the history.
- name: created_from
in: query
required: false
schema:
type: string
description: Pass the time in epoch format to apply the created after (inclusive) filter.
examples:
- '1633521911.678808'
description: Pass the time in epoch format to apply the created after (inclusive) filter.
- name: created_to
in: query
required: false
schema:
type: string
description: Pass the time in epoch format to apply the created before (inclusive) filter.
examples:
- '1633521911.678808'
description: Pass the time in epoch format to apply the created before (inclusive) filter.
- name: published_from
in: query
required: false
schema:
type: string
description: Pass the time in epoch format to apply the published after (inclusive) filter.
examples:
- '1633521911.678808'
description: Pass the time in epoch format to apply the published after (inclusive) filter.
- name: published_to
in: query
required: false
schema:
type: string
description: Pass the time in epoch format to apply the published before (inclusive) filter.
examples:
- '1633521911.678808'
description: Pass the time in epoch format to apply the published before (inclusive) filter.
- name: created_by_id
in: query
required: false
schema:
type: string
description: Pass the user ID to apply the created by filter.
examples:
- 524129ab-bb5d-4366-9ad6-1c9f77e8685a
description: Pass the user ID to apply the created by filter.
- name: status
in: query
required: false
schema:
type: string
description: Pass a status to apply the status filter.
enum:
- PENDING
- PROCESSING
- CREATED
- DRAFT
- FAILED
- PUBLISHED
examples:
- CREATED
description: Pass a status to apply the status filter.
- name: page_size
in: query
required: false
schema:
type: integer
description: Pass the number of records to retrieve on each page.
default: '10'
examples:
- '50'
description: Pass the number of records to retrieve on each page.
- name: page
in: query
required: false
schema:
type: integer
description: Pass the page number to retrieve the records.
default: '1'
examples:
- '3'
description: Pass the page number to retrieve the records.
- name: component
in: query
required: true
schema:
type: string
description: Pass `quick-add-intel` to retrieve the quick add intel history.
enum:
- quick-add-intel
examples:
- quick-add-intel
description: Pass `quick-add-intel` to retrieve the quick add intel history.
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
next:
type: string
description: Returns a link to the next page of the intel history.
examples:
- intel-history/?page=2&page_size=1
page_size:
type: number
description: Returns the number of records per page.
examples:
- 1
previous:
type: object
description: Returns a link to the previous page of the intel history.
results:
type: array
description: Returns the details of the quick add intel history.
items:
type: object
properties:
client_collections:
type: object
description: Returns a list of client collections in the platform. For quick add intel submissions, this value is `null`.
component:
type: string
description: Returns the component of the intel submission. For quick add intel submission, the value is `quick-add-intel`.
examples:
- quick-add-intel
created:
type: number
description: Returns the created date of the intel.
examples:
- 1706707031.759591
created_by:
type: object
description: Returns the details of the creator of the intel.
properties:
email:
type: string
description: Returns the email of the creator.
examples:
- john.doe@cyware.com
first_name:
type: string
description: Returns the first name of the creator.
examples:
- john
id:
type: string
description: Returns the unique ID of the creator.
examples:
- a2b82e81-8e7d-4e68-8a36-3d2d9cd518ad
last_name:
type: string
description: Returns the last name of the creator.
examples:
- doe
error_message:
type: string
description: Returns an error message if the intel creation fails. Else, returns null.
feed_id:
type: object
description: Returns the ID of the intel source. For Quick Add Intel, the default source is Import.
id:
type: string
description: Returns the ID of the quick add intel submission.
examples:
- 9fae8850-5956-4479-834c-8cd4d51c28aa
metadata:
type: object
description: Returns the metadata details of the intel, such as the Confidence Score, tags, and description.
modified:
type: number
description: Returns the last modified date of the intel.
examples:
- 1706707049.743087
modified_by:
type: object
description: Returns the details of the modifier of the intel.
properties:
email:
type: string
description: Returns the email of the modifier.
examples:
- john.doe@cyware.com
first_name:
type: string
description: Returns the first name of the modifier.
examples:
- john
id:
type: string
description: Returns the unique ID of the modifier.
examples:
- a2b82e81-8e7d-4e68-8a36-3d2d9cd518ad
last_name:
type: string
description: Returns the last name of the modifier.
examples:
- doe
published_on:
type: object
description: Returns the published date of the intel to a STIX collection in the platform.
report_id:
type: string
description: Returns the ID of the report objected that is created as part of the quick add intel submission.
examples:
- e121fe2f-4ecf-42ab-ac87-8e7c0ba8d24d
server_collections:
type: object
description: Returns a list of server collections in the platform. For quick add intel submissions, this value is null.
status:
type: string
description: Returns the intel creation status.
examples:
- CREATED
title:
type: string
description: Returns the title of the intel.
examples:
- ips
tlp:
type: string
description: Returns the TLP of the intel.
examples:
- NONE
total:
type: number
description: Returns the number of records available in the quick add history.
examples:
- 168553
example:
next: intel-history/?page=2&page_size=1
page_size: 1
previous: {}
results:
- client_collections: {}
component: quick-add-intel
created: 1706707031.759591
created_by:
email: john.doe@cyware.com
first_name: john
id: a2b82e81-8e7d-4e68-8a36-3d2d9cd518ad
last_name: doe
error_message: ''
feed_id: {}
id: 9fae8850-5956-4479-834c-8cd4d51c28aa
metadata: {}
modified: 1706707049.743087
modified_by:
email: john.doe@cyware.com
first_name: john
id: a2b82e81-8e7d-4e68-8a36-3d2d9cd518ad
last_name: doe
published_on: {}
report_id: e121fe2f-4ecf-42ab-ac87-8e7c0ba8d24d
server_collections: {}
status: CREATED
title: ips
tlp: NONE
total: 168553
x-alternate-documents:
- title: Get Intel History Investigations
operationId: intelHistoryInvestigations
url: https://ctixapiv3.cyware.com/threat-investigation/publishing/intel-history-investigations
/conversion/quick-intel/vocabs/region_ov/:
get:
operationId: listRegions
summary: Get Regions List
tags:
- Quick Add Intel
description: Returns the list of [STIX 2.1 region open vocabulary](https://docs.oasis-open.org/cti/stix/v2.1/csprd01/stix-v2.1-csprd01.html#:~:text=bit%20x86%20architecture.-,10.20%20%E2%80%8BRegion%20Vocabulary,-Vocabulary%20Name:%20region). These regions can be used to specify locations in the **Quick Add Intel** endpoint.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/quick-add-intel/list-regions
parameters:
- name: page
in: query
required: false
schema:
type: string
description: Pass the page number to retrieve records.
default: '1'
description: Pass the page number to retrieve records.
- name: page_size
in: query
required: false
schema:
type: string
description: Pass the number of records to retrieve on each page.
maxLength: 100
default: '10'
description: Pass the number of records to retrieve on each page.
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
'0':
type: object
properties:
value:
type: string
description: Returns the value of the world region based on the United Nations geoscheme.
examples:
- africa
label:
type: string
description: Returns the label of the world region.
examples:
- africa
'1':
type: object
properties:
value:
type: string
examples:
- eastern-africa
label:
type: string
examples:
- eastern-africa
'2':
type: object
properties:
value:
type: string
examples:
- middle-africa
label:
type: string
examples:
- middle-africa
example:
'0':
value: africa
label: africa
'1':
value: eastern-africa
label: eastern-africa
'2':
value: middle-africa
label: middle-africa
/conversion/quick-intel/create-stix/:
post:
operationId: quickAddIntel
summary: Quick Add Intel
tags:
- Quick Add Intel
description: "Creates intel by providing minimal details of indicators, SDOs, relations, custom objects, and indicators parsed from free text.\n\n<Callout attributes='{\"isFitToPage\":true,\"dataType\":\"info\",\"style\":{\"width\":\"100%\",\"minWidth\":\"100%\"}}'>\n <p><strong class=\"slate-bold\">Default Source</strong>: Import</p>\n <p><strong class=\"slate-bold\">Default Collection</strong>: Free Text</p>\n</Callout>\n\n**Note**: At least one of the `indicators`, `sdos`, `observables`, or `custom_objects` is required to create an intel.\n\n<Accordion attributes='{\"style\":{\"width\":\"100%\"}}'>\n<AccordionItem title=\"The Indicators Object\" iconUrl=\"\"><p>The <code class=\"slate-code\">indicators</code> object in Quick Add Intel accepts the IOC type as the key and a comma-separated list of IOC values as the value. You can pass a maximum of 5000 characters as the IOC value per IOC type.</p>\n<p>For the allowed list of IOC types and the respective key to pass in the <code class=\"slate-code\">indicators</code> object, refer to the following table:</p>\n<p>IOC Type</p>\n<p>IOC Key</p>\n<p>IPv4</p>\n<p><code class=\"slate-code\">ipv4-addr</code></p>\n<p>IPv6</p>\n<p><code class=\"slate-code\">ipv6-addr</code></p>\n<p>Domain</p>\n<p><code class=\"slate-code\">domain</code></p>\n<p>URL</p>\n<p><code class=\"slate-code\">url</code></p>\n<p>Email Address</p>\n<p><code class=\"slate-code\">email</code></p>\n<p>MD5</p>\n<p><code class=\"slate-code\">md5</code></p>\n<p>SHA1</p>\n<p><code class=\"slate-code\">sha1</code></p>\n<p>SHA224</p>\n<p><code class=\"slate-code\">sha224</code></p>\n<p>SHA256</p>\n<p><code class=\"slate-code\">sha256</code></p>\n<p>SHA384</p>\n<p><code class=\"slate-code\">sha384</code></p>\n<p>SHA512</p>\n<p><code class=\"slate-code\">sha512</code></p>\n<p>SSDEEP</p>\n<p><code class=\"slate-code\">ssdeep</code></p></AccordionItem>\n<AccordionItem title=\"The Parse Indicators Object\" iconUrl=\"\"><p>The <code class=\"slate-code\">parse_indicators</code> object in Quick Add Intel accepts the IOC type as the key and a list of parsed IOC values as the value. For the allowed list of IOC types and the respective key to pass in the <code class=\"slate-code\">parse_indicators</code> object, refer to the following table:</p>\n<p>IOC Type</p>\n<p>IOC Key</p>\n<p>IPv4</p>\n<p><code class=\"slate-code\">ips</code></p>\n<p>IPv6</p>\n<p><code class=\"slate-code\">ipv6</code></p>\n<p>Domain</p>\n<p><code class=\"slate-code\">domains</code></p>\n<p>URL</p>\n<p><code class=\"slate-code\">urls</code></p>\n<p>Email Address</p>\n<p><code class=\"slate-code\">emails</code></p>\n<p>MD5</p>\n<p><code class=\"slate-code\">md5</code></p>\n<p>SHA1</p>\n<p><code class=\"slate-code\">sha1</code></p>\n<p>SHA224</p>\n<p><code class=\"slate-code\">sha224</code></p>\n<p>SHA256</p>\n<p><code class=\"slate-code\">sha256</code></p>\n<p>SHA384</p>\n<p><code class=\"slate-code\">sha384</code></p>\n<p>SHA512</p>\n<p><code class=\"slate-code\">sha512</code></p>\n<p>SSDEEP</p>\n<p><code class=\"slate-code\">ssdeep</code></p>\n<p>CVE IDs</p>\n<p><code class=\"slate-code\">cve_ids</code></p>\n<p>Windows Registry Key</p>\n<p><code class=\"slate-code\">registry_key_path</code></p>\n<p>File Paths</p>\n<p><code class=\"slate-code\">file_paths</code></p>\n<p>Autonomous System</p>\n<p><code class=\"slate-code\">as</code></p>\n<p>X.509 certificates</p>\n<p><code class=\"slate-code\">x509-certificate</code></p>\n<p>MAC Address</p>\n<p><code class=\"slate-code\">mac-addr</code></p></AccordionItem>\n<AccordionItem title=\"The Custom Objects Object\" iconUrl=\"\"><p>The <code class=\"slate-code\">custom_objects</code> object in Quick Add Intel accepts the ID of a custom object as the key and a list of custom attribute objects as the value.</p>\n<p>The custom attribute object accepts the name of the primary attribute of a custom object as the key and the attribute value as the value.</p>\n<p>To retrieve the custom object IDs and the respective primary attribute, use the <em class=\"slate-italic\">GET Custom Object Details</em> API in <strong class=\"slate-bold\">Administration</strong> > <strong class=\"slate-bold\">Custom Entities Management</strong> > <strong class=\"slate-bold\">Custom Objects</strong>.</p></AccordionItem>\n<AccordionItem title=\"The SDOs Object\" iconUrl=\"\"><p>The <code class=\"slate-code\">sdos</code> object in Quick Add Intel accepts the STIX Domain Object (SDO) type as the key and a comma-separated list of SDO values as the value. You can pass a maximum of 5000 characters as the SDO value per SDO type.</p>\n<p>For the allowed list of SDO types and the respective key to pass in the <code class=\"slate-code\">sdos</code> object, refer to the following table:</p>\n<p>SDO Type</p>\n<p>SDO Key</p>\n<p>Vulnerability</p>\n<p><code class=\"slate-code\">vulnerability</code></p>\n<p>Malware</p>\n<p><code class=\"slate-code\">malware</code></p>\n<p>Campaign</p>\n<p><code class=\"slate-code\">campaign</code></p>\n<p>Threat Actor</p>\n<p><code class=\"slate-code\">threat-actor</code></p>\n<p>Intrusion Set</p>\n<p><code class=\"slate-code\">intrusion-set</code></p>\n<p>Attack Pattern</p>\n<p><code class=\"slate-code\">attack-pattern</code></p>\n<p>Incident</p>\n<p><code class=\"slate-code\">incident</code></p>\n<p>Course of Action</p>\n<p><code class=\"slate-code\">course-of-action</code></p>\n<p>Identity</p>\n<p><code class=\"slate-code\">identity</code></p>\n<p>Tool</p>\n<p><code class=\"slate-code\">tool</code></p>\n<p>Infrastructure</p>\n<p><code class=\"slate-code\">infrastructure</code></p>\n<p>Location</p>\n<p><code class=\"slate-code\">location</code></p>\n<p>Malware Analysis</p>\n<p><code class=\"slate-code\">malware-analysis</code></p></AccordionItem>\n<AccordionItem title=\"The Observables Object\" iconUrl=\"\"><p>The <code class=\"slate-code\">observables</code> object in Quick Add Intel accepts the STIX Cyber Observable Object (SCO) type as the key and a comma-separated list of SCO values as the value. You can pass a maximum of 5000 characters as the SCO value per SCO type.</p>\n<p>For the allowed list of SCO types and the respective key to pass in the <code class=\"slate-code\">observables</code> object, refer to the following table:</p>\n<p>SCO Type</p>\n<p>SCO Key</p>\n<p>Artifact</p>\n<p><code class=\"slate-code\">artifact</code></p>\n<p>Directory</p>\n<p><code class=\"slate-code\">directory</code></p>\n<p>Email Message</p>\n<p><code class=\"slate-code\">email-message</code></p>\n<p>MAC Address</p>\n<p><code class=\"slate-code\">mac-addr</code></p>\n<p>Mutex</p>\n<p><code class=\"slate-code\">mutex</code></p>\n<p>Network Traffic</p>\n<p><code class=\"slate-code\">network-traffic</code></p>\n<p>Process</p>\n<p><code class=\"slate-code\">process</code></p>\n<p>Software</p>\n<p><code class=\"slate-code\">software</code></p>\n<p>User Account</p>\n<p><code class=\"slate-code\">user-account</code></p>\n<p>X.509 Certificate</p>\n<p><code class=\"slate-code\">x509-certificate</code></p>\n<p>File</p>\n<p><code class=\"slate-code\">file</code></p></AccordionItem>\n</Accordion>"
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/quick-add-intel/quick-add-intel
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
parsed_indicators:
type: object
description: Pass the IOC types and indicators parsed from free text. For more information, see *The Parse Indicators Object*.
metadata:
type: object
description: Pass the additional information to add to the intel.
properties:
tlp:
type: string
description: Pass the TLP value for the intel.
enum:
- GREEN
- AMBER
- RED
- WHITE
- NONE
is_apply_all:
type: boolean
description: Pass true to apply the metadata to all intel objects. Else, pass false to apply the metadata to the report object that is created as part of the quick add intel submission only.
default: 'false'
examples:
- 'true'
custom_scores:
type: object
description: Pass the custom score key and the score in key-value pairs.
properties:
x_ctix_customscore_2:
type: number
description: This is an example value.
examples:
- '2'
confidence:
type: number
description: Pass a Source Confidence Score for the intel between 0 and 100.
examples:
- '91'
labels:
type: array
description: Pass a list of tag IDs to add to the intel. To retrieve the list of tags, use the **List Tags** API in the **Tags** section.
items: {}
description:
type: string
description: Pass a description for the intel within 1000 characters.
examples:
- Sample source vulnerability description
import:
type: object
description: Returns import-specific configuration or metadata.
indicators:
type: object
description: Pass the IOC types and IOC values in key-value pairs. For more information, see *The Indicators Object*.
properties:
ipv4-addr:
# --- truncated at 32 KB (66 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-quick-add-intel-api-openapi.yml