openapi: 3.2.0
info:
title: Cyware Intel Exchange (CTIX) v3 Open Reports API
version: 3.6.2
description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.
Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.
This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
contact:
name: Cyware
url: https://www.cyware.com/contact-us
termsOfService: https://www.cyware.com/legal/terms-of-use
x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
variables:
ctix_host:
default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Reports
description: Reports
paths:
/ingestion/reports/:
post:
operationId: createReport
summary: Create Report
tags:
- Reports
description: "Create a basic (standard) report in Intel Exchange.\n\n<Callout attributes='{\"isFitToPage\":true,\"dataType\":\"info\",\"style\":{\"width\":\"100%\",\"minWidth\":\"100%\"}}'>\n <p>Do not use this endpoint to create advanced reports.</p>\n</Callout>"
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/reports/create-report
parameters:
- name: type
in: query
required: true
schema:
type: string
description: Pass the type of report to be created.
enum:
- basic
examples:
- basic
description: Pass the type of report to be created.
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
name:
type: string
description: Pass the name of the report.
examples:
- Intel Exchange report
type:
type: string
description: Pass the type of report to be created.
enum:
- basic
examples:
- basic
basic_report_type:
type: string
description: Pass the type of basic report to be created.
enum:
- custom
examples:
- custom
shared_type:
type: string
description: Pass the share type value.
enum:
- private
- global
examples:
- global
saved_search:
type: object
description: Pass the saved search or custom query details used for generating the report. You can use the List Saved Search endpoint to retrieve the required details.
properties:
meta_data:
type: string
description: Pass the saved search metadata to include in the report.
examples:
- '{\"object_type\":[\"indicator\"],\"query\":[{\"length\":28,\"dataKey\":{\"id\":\"type\",\"type\":\"select\",\"addAll\":true,\"reset\":true,\"multiple\":true,\"value\":\"id\",\"label\":\"Object Type\",\"values\":[{\"id\":\"indicator\",\"name\":\"Indicator\"},{\"id\":\"malware\",\"name\":\"Malware\"},{\"id\":\"threat-actor\",\"name\":\"Threat Actor\"},{\"id\":\"vulnerability\",\"name\":\"Vulnerability\"},{\"id\":\"attack-pattern\",\"name\":\"Attack Pattern\"},{\"id\":\"campaign\",\"name\":\"Campaign\"},{\"id\":\"course-of-action\",\"name\":\"Course of Action\"},{\"id\":\"identity\",\"name\":\"Identity\"},{\"id\":\"infrastructure\",\"name\":\"Infrastructure\"},{\"id\":\"intrusion-set\",\"name\":\"Intrusion Set\"},{\"id\":\"location\",\"name\":\"Location\"},{\"id\":\"malware-analysis\",\"name\":\"Malware Analysis\"},{\"id\":\"observed-data\",\"name\":\"Observed Data\"},{\"id\":\"opinion\",\"name\":\"Opinion\"},{\"id\":\"tool\",\"name\":\"Tool\"},{\"id\":\"report\",\"name\":\"Report\"},{\"id\":\"custom-object\",\"name\":\"Custom Object\"},{\"id\":\"observable\",\"name\":\"Observable\"},{\"id\":\"incident\",\"name\":\"Incident\"}]},\"key\":\"''Object Type''\",\"keyType\":\"select\",\"dataOperator\":{\"id\":\"=\",\"label\":\"=\"},\"operator\":\"=\",\"dataValue\":{\"id\":\"indicator\",\"name\":\"Indicator\"},\"value\":\"\\\"Indicator\\\"\"}]}'
name:
type: string
description: Pass the saved search name.
examples:
- Malware
query:
type: string
description: Pass the saved search query to generate the report.
examples:
- type = "malware"
required:
- meta_data
- query
schedule:
type: object
description: Pass the schedule details such as repeat type, start date and time, duration time, duration value, and repeat value.
properties:
repeat_type:
type: string
description: Pass the frequency of the schedule.
enum:
- once
- daily
- weekly
- monthly
examples:
- daily
start_datetime:
type: number
description: Pass the start time of the report in epoch format.
examples:
- '1638124200'
duration_value:
type: number
description: Pass the time frame in days to include the data in the report.
examples:
- '2'
repeat_value:
type: number
description: Pass the number of times to repeat the schedule.
examples:
- '2'
required:
- repeat_type
- start_datetime
- duration_value
- repeat_value
file_types:
type: array
description: Pass the report type.
items:
type: string
description: Pass the report type, such as CSV, XLS.
examples:
- csv
columns:
type: array
description: Pass the list of columns to be displayed in a basic report.
items:
type: object
properties:
key:
type: string
description: Pass the report column key.
examples:
- valid_until
label:
type: string
description: Pass the report column label.
examples:
- Valid Until
internal_recipients:
type: object
description: Pass the list of internal recipients with whom to share the report.
properties:
to:
type: array
description: Pass details of the internal recipient of the report.
items:
type: object
properties:
user_id:
type: string
description: Enter the user ID.
examples:
- 3504aa4a-1e56-40c6-89d7-fc3c6adc2b03
first_name:
type: string
description: Enter the first name of the internal recipient.
examples:
- John
last_name:
type: string
description: Enter the last name of the internal recipient.
examples:
- Doe
email:
type: string
description: Enter the email address.
examples:
- johndoe@example.com
cc:
type: array
description: Enter the cc email addresses for the internal recipients
items: {}
bcc:
type: array
description: Enter the bcc email addresses for the internal recipients
items: {}
query_key:
type: string
description: Pass the key to sort data in the report.
enum:
- '`ctix_created`'
- '`ctix_modified`'
default: '`ctix_created`'
external_recipients:
type: object
description: Pass the list of external recipients (outside Intel Exchange) with whom to share the report.
properties:
to:
type: array
description: Pass details of the external recipients
items:
type: string
description: The email address of the external recipient.
examples:
- bca@cyware.com
cc:
type: array
description: The cc email address of external recipients
items: {}
bcc:
type: array
description: The bcc email address of external recipients
items: {}
required:
- name
- type
- shared_type
- saved_search
- schedule
- file_types
- columns
example:
name: Intel Exchange report
type: basic
basic_report_type: custom
shared_type: global
saved_search:
meta_data: '{\"object_type\":[\"indicator\"],\"query\":[{\"length\":28,\"dataKey\":{\"id\":\"type\",\"type\":\"select\",\"addAll\":true,\"reset\":true,\"multiple\":true,\"value\":\"id\",\"label\":\"Object Type\",\"values\":[{\"id\":\"indicator\",\"name\":\"Indicator\"},{\"id\":\"malware\",\"name\":\"Malware\"},{\"id\":\"threat-actor\",\"name\":\"Threat Actor\"},{\"id\":\"vulnerability\",\"name\":\"Vulnerability\"},{\"id\":\"attack-pattern\",\"name\":\"Attack Pattern\"},{\"id\":\"campaign\",\"name\":\"Campaign\"},{\"id\":\"course-of-action\",\"name\":\"Course of Action\"},{\"id\":\"identity\",\"name\":\"Identity\"},{\"id\":\"infrastructure\",\"name\":\"Infrastructure\"},{\"id\":\"intrusion-set\",\"name\":\"Intrusion Set\"},{\"id\":\"location\",\"name\":\"Location\"},{\"id\":\"malware-analysis\",\"name\":\"Malware Analysis\"},{\"id\":\"observed-data\",\"name\":\"Observed Data\"},{\"id\":\"opinion\",\"name\":\"Opinion\"},{\"id\":\"tool\",\"name\":\"Tool\"},{\"id\":\"report\",\"name\":\"Report\"},{\"id\":\"custom-object\",\"name\":\"Custom Object\"},{\"id\":\"observable\",\"name\":\"Observable\"},{\"id\":\"incident\",\"name\":\"Incident\"}]},\"key\":\"''Object Type''\",\"keyType\":\"select\",\"dataOperator\":{\"id\":\"=\",\"label\":\"=\"},\"operator\":\"=\",\"dataValue\":{\"id\":\"indicator\",\"name\":\"Indicator\"},\"value\":\"\\\"Indicator\\\"\"}]}'
name: Malware
query: type = "malware"
schedule:
repeat_type: daily
start_datetime: '1638124200'
duration_value: '2'
repeat_value: '2'
file_types:
- csv
columns:
- key: valid_until
label: Valid Until
internal_recipients:
to:
- user_id: 3504aa4a-1e56-40c6-89d7-fc3c6adc2b03
first_name: John
last_name: Doe
email: johndoe@example.com
cc: []
bcc: []
query_key: ''
external_recipients:
to:
- bca@cyware.com
cc: []
bcc: []
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
basic_report_type:
type: string
description: Returns the type of basic report, such as saved or custom.
examples:
- custom
columns:
type: array
description: Returns the list of columns in a report.
items:
type: object
description: Retrieves the report column details
properties:
key:
type: string
description: Returns the valid until column key.
examples:
- valid_until
label:
type: string
description: Returns the valid until column label.
examples:
- Valid Until
created:
type: number
description: Returns the epoch time of when the report was created.
examples:
- '1692188813'
created_by:
type: object
description: Returns the details of the user who created the report.
properties:
email:
type: string
description: Returns the email address of the user who created the report.
examples:
- john.doe@cyware.com
first_name:
type: string
description: Returns the first name of the user who created the report.
examples:
- john
id:
type: string
description: Returns the ID of the user who created the report.
examples:
- 0d4408bd-9f94-47ec-98eb-6f32ecfd8b13
last_name:
type: string
description: Returns the last name of the user who created the report.
date_last_run:
type: object
description: Returns the date and time in epoch format at which the report was manually run.
external_recipients:
type: object
description: Returns the list of external recipients with whom to share the report.
properties:
bcc:
type: array
description: Returns the external recipients marked as bcc
items: {}
cc:
type: array
description: Returns the external recipients marked as cc
items: {}
to:
type: array
description: Returns the external recipient details of the report
items:
type: string
description: Returns the email address of the external recipient.
examples:
- bca@cyware.com
file_types:
type: array
description: Returns the report formats, such as CSV and XLS.
items:
type: string
description: Returns the report format.
examples:
- csv
id:
type: string
description: Returns the unique ID of the report.
examples:
- 334c3ff3-bfcc-402c-ad6a-e13cb830a602
internal_recipients:
type: object
description: Returns the list of internal recipients with whom to share the report.
properties:
bcc:
type: array
description: Returns the internal recipients marked as bcc.
items: {}
cc:
type: array
description: Returns the internal recipients marked as cc.
items: {}
to:
type: array
description: Returns the internal recipient details.
items:
type: object
properties:
user:
type: object
description: Enter the user details
modified:
type: number
description: Returns the epoch time of the last modified date.
examples:
- '1692188813'
modified_by:
type: object
description: Returns the details of the user who last modified the report
properties:
email:
type: string
description: Returns the email address of the user who last modified the report.
examples:
- john.doe@cyware.com
first_name:
type: string
description: Returns the first name of the user who last modified the report.
examples:
- john
id:
type: string
description: Returns the user ID of the user who last modified the report.
examples:
- 0d4408bd-9f94-47ec-98eb-6f32ecfd8b13
last_name:
type: string
description: Returns the last name of the user who last modified the report.
examples:
- doe
name:
type: string
description: Returns the name of the report.
examples:
- Vulnerability Report
query_key:
type: string
description: Returns the sorting type in basic reports.
examples:
- ctix_created
saved_search:
type: object
description: Returns the saved search object for the corresponding report used for generating the report.
properties:
created_by:
type: object
description: Returns the details of the user who created the report
properties:
email:
type: string
description: Returns the email address of the user who last created the report.
examples:
- john.doe@cyware.com
first_name:
type: string
description: Returns the first name of the user who last created the report.
examples:
- john
id:
type: string
description: Returns the user ID of the user who last created the report.
examples:
- 76fbe1c3-5fd0-4674-9666-69921edafb94
last_name:
type: string
description: Returns the last name of the user who last created the report.
examples:
- doe
description:
type: object
description: Returns the report description, if any
editable:
type: boolean
description: Returns if the report is editable.
examples:
- 'false'
id:
type: string
description: Returns the unique ID of the report.
examples:
- 57d957a8-c468-4a94-8c23-b74aa3540fb0
is_threat_data_search:
type: boolean
description: Returns a boolean indicating whether the search pertains to threat data.
examples:
- 'true'
meta_data:
type: string
description: Returns the metadata about the search query, filters, and object types.
examples:
- '{"object_type":["vulnerability"],"query":[{"length":32,"dataKey":{"id":"type","type":"select","addAll":true,"reset":true,"multiple":true,"value":"id","label":"Object Type","values":[{"id":"indicator","name":"Indicator"},{"id":"malware","name":"Malware"},{"id":"threat-actor","name":"Threat Actor"},{"id":"vulnerability","name":"Vulnerability"},{"id":"attack-pattern","name":"Attack Pattern"},{"id":"campaign","name":"Campaign"},{"id":"course-of-action","name":"Course of Action"},{"id":"identity","name":"Identity"},{"id":"infrastructure","name":"Infrastructure"},{"id":"intrusion-set","name":"Intrusion Set"},{"id":"location","name":"Location"},{"id":"malware-analysis","name":"Malware Analysis"},{"id":"observed-data","name":"Observed Data"},{"id":"opinion","name":"Opinion"},{"id":"tool","name":"Tool"},{"id":"report","name":"Report"},{"id":"custom-object","name":"Custom Object"},{"id":"observable","name":"Observable"},{"id":"incident","name":"Incident"}]},"key":"''Object Type''","keyType":"select","dataOperator":{"id":"=","label":"="},"operator":"=","dataValue":{"id":"vulnerability","name":"Vulnerability"},"value":"\"Vulnerability\""}]}'
name:
type: string
description: Returns the name of the report.
examples:
- Vulnerability
order:
type: number
description: Returns the ordering index for the saved search.
examples:
- '1'
pinned:
type: boolean
description: Returns a boolean indicating if the saved search is pinned for quick access.
examples:
- 'false'
query:
type: string
description: Returns the query string used in the saved search.
examples:
- type = "vulnerability"
shared_type:
type: string
description: Returns the shared type, such as global or private.
examples:
- global
shared_users:
type: array
description: Returns the list of users with whom the saved search is shared.
items: {}
type:
type: string
description: Returns the type of report, such as basic or advanced.
examples:
- cql
schedule:
type: object
description: Returns the schedule details of the report
properties:
duration_value:
type: number
description: Returns the duration in days to capture data in the report.
examples:
- '2'
ends_on:
type: object
description: Returns details of when the report ends
properties:
attempts_left:
type: number
description: Returns the number of attempts left.
examples:
- '10'
type:
type: string
description: Returns the number of occurrences.
examples:
- occurrences
value:
type: number
description: Returns the value associated with the end condition.
examples:
- '10'
id:
type: string
description: Returns the unique ID of the schedule.
examples:
- 37bbeaac-a8d2-4571-a259-ee710342213e
repeat_on:
type: object
description: Returns the details of how often the report schedule repeats
repeat_type:
type: string
description: Returns the time interval for the re-run of the report.
examples:
- daily
start_datetime:
type: number
description: Returns the starting date and time in epoch format from which the report captures the received data.
examples:
- '1638124200'
shared_type:
type: string
description: Returns the shared type, such as global or private.
examples:
- global
type:
type: string
description: Returns the type of report, such as basic or advanced.
examples:
- basic
example:
basic_report_type: custom
columns:
- key: valid_until
label: Valid Until
created: '1692188813'
created_by:
email: john.doe@cyware.com
first_name: john
id: 0d4408bd-9f94-47ec-98eb-6f32ecfd8b13
last_name: ''
date_last_run: {}
external_recipients:
bcc: []
cc: []
to:
- bca@cyware.com
file_types:
- csv
id: 334c3ff3-bfcc-402c-ad6a-e13cb830a602
internal_recipients:
bcc: []
cc: []
to:
- user: {}
modified: '1692188813'
modified_by:
email: john.doe@cyware.com
first_name: john
id: 0d4408bd-9f94-47ec-98eb-6f32ecfd8b13
last_name: doe
name: Vulnerability Report
query_key: ctix_created
saved_search:
created_by:
email: john.doe@cyware.com
first_name: john
id: 76fbe1c3-5fd0-4674-9666-69921edafb94
last_name: doe
description: {}
editable: 'false'
id: 57d957a8-c468-4a94-8c23-b74aa3540fb0
is_threat_data_search: 'true'
meta_data: '{"object_type":["vulnerability"],"query":[{"length":32,"dataKey":{"id":"type","type":"select","addAll":true,"reset":true,"multiple":true,"value":"id","label":"Object Type","values":[{"id":"indicator","name":"Indicator"},{"id":"malware","name":"Malware"},{"id":"threat-actor","name":"Threat Actor"},{"id":"vulnerability","name":"Vulnerability"},{"id":"attack-pattern","name":"Attack Pattern"},{"id":"campaign","name":"Campaign"},{"id":"course-of-action","name":"Course of Action"},{"id":"identity","name":"Identity"},{"id":"infrastructure","name":"Infrastructure"},{"id":"intrusion-set","name":"Intrusion Set"},{"id":"location","name":"Location"},{"id":"malware-analysis","name":"Malware Analysis"},{"id":"observed-data","name":"Observed Data"},{"id":"opinion","name":"Opinion"},{"id":"tool","name":"Tool"},{"id":"report","name":"Report"},{"id":"custom-object","name":"Custom Object"},{"id":"observable","name":"Observable"},{"id":"incident","name":"Incident"}]},"key":"''Object Type''","keyType":"select","dataOperator":{"id":"=","label":"="},"operator":"=","dataValue":{"id":"vulnerability","name":"Vulnerability"},"value":"\"Vulnerability\""}]}'
name: Vulnerability
order: '1'
pinned: 'false'
query: type = "vulnerability"
shared_type: global
shared_users: []
type: cql
schedule:
duration_value: '2'
ends_on:
attempts_left: '10'
type: occurrences
value: '10'
id: 37bbeaac-a8d2-4571-a259-ee710342213e
repeat_on: {}
repeat_type: daily
start_datetime: '1638124200'
shared_type: global
type: basic
get:
operationId: listReports
summary: Get Reports List
tags:
- Reports
description: Returns a list of reports from the Intel Exchange application.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/reports/list-reports
parameters:
- name: type
in: query
required: false
schema:
type: string
description: Pass the type of rep
# --- truncated at 32 KB (117 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-reports-api-openapi.yml