Cyware Tags API

openapi: 3.2.0
info:
  title: Cyware Tags API
  contact:
    name: Cyware
    url: https://www.cyware.com/contact-us
  termsOfService: https://www.cyware.com/legal/terms-of-use
  version: '1.0'
  description: 'Operations tagged Tags across 2 of this provider''s published API definitions: cyware-intel-exchange-openapi.yml, cyware-orchestrate-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{ctix_host}/ctixapi
  description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
  variables:
    ctix_host:
      default: demo.cyware.com
- url: https://{co_host}/soarapi
  description: Tenant Orchestrate deployment. Replace {co_host} with your own Orchestrate host. Cyware uses https://demo.cyware.com/soar/ as the example host in the config of its open-source MCP server, and its docs reference the /soarapi base path.
  variables:
    co_host:
      default: demo.cyware.com
tags:
- name: Tags
  description: Tags
paths:
  /ingestion/tags/:
    servers:
    - url: https://{ctix_host}/ctixapi
      description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
      variables:
        ctix_host:
          default: demo.cyware.com
    post:
      operationId: createTag
      summary: Create Tag
      tags:
      - Tags
      description: Creates a tag in the Intel Exchange platform.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/tags/create-tag
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  description: Pass a unique name for the tag within 50 characters.
                  examples:
                  - SuperMalware
                colour_code:
                  type: string
                  description: Pass the hex color code for the ta.g
                  enum:
                  - '#5236E2'
                  - '#0068FA'
                  - '#EB9C00'
                  - '#FF5330'
                  - '#27865F'
                  - '#C4C81D'
                  - '#00A2C2'
                  - '#C341E7'
                  - '#AD6B76'
                  - '#95A1B1'
                  examples:
                  - '#5236E2'
            example:
              name: SuperMalware
              colour_code: '#5236E2'
      responses:
        '201':
          description: HTTP 201 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Returns the unique ID of the tag.
                    examples:
                    - 010beca6-719c-4288-9791-10ec913317b8
                  name:
                    type: string
                    description: Returns the name of the tag.
                    examples:
                    - SuperMalware
                  colour_code:
                    type: string
                    description: Returns the color defined for the tag.
                    examples:
                    - '#0068FA'
                  created:
                    type: number
                    description: Returns the created date and time of a tag in epoch format.
                    examples:
                    - 1744376435
                  created_by:
                    type: string
                    description: Returns the ID of the user who created the tag.
                    examples:
                    - 70f3d3ee-b7bc-4ceb-849e-16db0de5278b
                  modified_by:
                    type: string
                    description: Returns the ID of the user who last modified the tag details.
                    examples:
                    - 70f3d3ee-b7bc-4ceb-849e-16db0de5278b
                  modified:
                    type: number
                    description: Returns the modified date and time of a tag in epoch format.
                    examples:
                    - 1744376435
                  tag_type:
                    type: object
                    description: Returns the tag's type details. The four tag types are System, User, Privileged, and Source.
                    properties:
                      id:
                        type: string
                        description: Returns the ID of the tag type.
                        examples:
                        - user
                      name:
                        type: string
                        description: Returns the name of the tag type.
                        examples:
                        - User
                  is_active:
                    type: boolean
                    description: Returns true if the tag is active in Intel Exchange.
                    examples:
                    - true
              example:
                id: 010beca6-719c-4288-9791-10ec913317b8
                name: SuperMalware
                colour_code: '#0068FA'
                created: 1744376435
                created_by: 70f3d3ee-b7bc-4ceb-849e-16db0de5278b
                modified_by: 70f3d3ee-b7bc-4ceb-849e-16db0de5278b
                modified: 1744376435
                tag_type:
                  id: user
                  name: User
                is_active: true
      security:
      - ctixOpenApiSignature: []
  /ingestion/tags/{tag_id}/:
    servers:
    - url: https://{ctix_host}/ctixapi
      description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
      variables:
        ctix_host:
          default: demo.cyware.com
    get:
      operationId: tagDetails
      summary: Get Tag Details
      tags:
      - Tags
      description: Returns the details of a tag.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/tags/tag-details
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve records.
          default: '1'
        description: Pass the page number to retrieve records.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve on each page.
          maxLength: 100
          default: '10'
        description: Pass the number of records to retrieve on each page.
      - name: tag_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the ID of a tag to retrieve the details.
        description: Pass the ID of a tag to retrieve the details.
      responses:
        '200':
          description: HTTP 200 response
          content:
            json:
              schema:
                type: object
                properties:
                  colour_code:
                    type: string
                    description: Returns the hex color code associated with the tag.
                    examples:
                    - '#27865F'
                  created:
                    type: integer
                    description: Returns the epoch timestamp of when the tag was created.
                    examples:
                    - 1744292519
                  created_by:
                    type: object
                    description: Returns details of the user who created the tag.
                    properties:
                      email:
                        type: string
                        description: Returns the email address of the user.
                        examples:
                        - john.doe@example.com
                      first_name:
                        type: string
                        description: Returns the first name of the user.
                        examples:
                        - John
                      id:
                        type: string
                        description: Returns the ID of the user.
                        examples:
                        - 6b2ba7fa-8ffc-4756-b512-38e309af9d4c
                      last_name:
                        type: string
                        description: Returns the last name of the user.
                        examples:
                        - Doe
                  id:
                    type: string
                    description: Returns the ID of the tag.
                    examples:
                    - e49e56cf-5a54-4c61-8ac5-2933e43f1d73
                  is_active:
                    type: boolean
                    description: Returns true if the tag is active in Intel Exchange.
                    examples:
                    - true
                  modified:
                    type: integer
                    description: Returns the epoch timestamp of when the tag was last modified.
                    examples:
                    - 1744292519
                  modified_by:
                    type: object
                    description: Returns details of the user who modified the tag.
                    properties:
                      email:
                        type: string
                        description: Returns the email address of the user.
                        examples:
                        - jane.smith@example.com
                      first_name:
                        type: string
                        description: Returns the first name of the user.
                        examples:
                        - Jane
                      id:
                        type: string
                        description: Returns the ID of the user.
                        examples:
                        - 6b2ba7fa-8ffc-4756-b512-38e309af9d4c
                      last_name:
                        type: string
                        description: Returns the last name of the user.
                        examples:
                        - Smith
                  name:
                    type: string
                    description: Returns the tag name.
                    examples:
                    - malware_type
                  tag_type:
                    type: object
                    description: Returns the tag's type details. The four tag types are System, User, Privileged, and Source.
                    properties:
                      id:
                        type: string
                        description: Returns the ID of the tag type.
                        examples:
                        - user
                      name:
                        type: string
                        description: Returns the name of the tag type.
                        examples:
                        - User
                  theme:
                    type: string
                    description: Returns the theme associated with the tag.
                    examples:
                    - green
              example:
                colour_code: '#27865F'
                created: 1744292519
                created_by:
                  email: john.doe@example.com
                  first_name: John
                  id: 6b2ba7fa-8ffc-4756-b512-38e309af9d4c
                  last_name: Doe
                id: e49e56cf-5a54-4c61-8ac5-2933e43f1d73
                is_active: true
                modified: 1744292519
                modified_by:
                  email: jane.smith@example.com
                  first_name: Jane
                  id: 6b2ba7fa-8ffc-4756-b512-38e309af9d4c
                  last_name: Smith
                name: malware_type
                tag_type:
                  id: user
                  name: User
                theme: green
      x-alternate-documents:
      - title: List Tags in Tag Group
        operationId: getTagGroupDetails
        url: https://ctixapiv3.cyware.com/tag-groups/get-tag-group-details
      security:
      - ctixOpenApiSignature: []
  /ingestion/tags/tag-category/allowed/:
    servers:
    - url: https://{ctix_host}/ctixapi
      description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
      variables:
        ctix_host:
          default: demo.cyware.com
    get:
      operationId: getAllowedTagGroupCategories
      summary: Get Allowed Tag Categories
      tags:
      - Tags
      description: Returns a list of tag categories that the current user has access to.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/tags/get-allowed-tag-group-categories
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve records.
          default: '1'
        description: Pass the page number to retrieve records.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve on each page.
          default: '10'
        description: Pass the number of records to retrieve on each page.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  results:
                    type: array
                    description: Returns a list of tag category objects available to the user.
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                          description: Returns the unique identifier of the tag category.
                          examples:
                          - user
                        name:
                          type: string
                          description: Returns the display name of the tag category.
                          examples:
                          - User
                        colour_code:
                          type: string
                          description: Returns the color code associated with the tag category.
                          examples:
                          - '#0068FA'
              example:
                results:
                - id: user
                  name: User
                  colour_code: '#0068FA'
      security:
      - ctixOpenApiSignature: []
  /v1/tags/:
    servers:
    - url: https://{co_host}/soarapi
      description: Tenant Orchestrate deployment. Replace {co_host} with your own Orchestrate host. Cyware uses https://demo.cyware.com/soar/ as the example host in the config of its open-source MCP server, and its docs reference the /soarapi base path.
      variables:
        co_host:
          default: demo.cyware.com
    get:
      operationId: getListOfTags
      summary: Get Tags List
      tags:
      - Tags
      description: Returns the list of tags.
      externalDocs:
        description: Cyware Orchestrate API reference
        url: https://orchestrateapi.cyware.com/tags/get-list-of-tags
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve the tags list.
          default: '1'
        description: Pass the page number to retrieve the tags list.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of items to retrieve per page.
          default: '10'
        description: Pass the number of items to retrieve per page.
      - name: modified__gte
        in: query
        required: false
        schema:
          type: string
          description: Pass the custom date in Unix timestamp format. Returns a list of tags modified after the specified time.
        description: Pass the custom date in Unix timestamp format. Returns a list of tags modified after the specified time.
      - name: modified__lte
        in: query
        required: false
        schema:
          type: string
          description: Pass the custom date in Unix timestamp format. Returns a list of tags modified before the specified time.
        description: Pass the custom date in Unix timestamp format. Returns a list of tags modified before the specified time.
      - name: ordering
        in: query
        required: false
        schema:
          type: string
          description: 'Pass a sorting option to filter tags based on it. For example: *title*.'
        description: 'Pass a sorting option to filter tags based on it. For example: *title*.'
      - name: modified
        in: query
        required: false
        schema:
          type: string
          description: Pass the last modified value to filter tags.
          enum:
          - last_week
          - last_month
          - last_year
          - custom time
          examples:
          - last_week
        description: Pass the last modified value to filter tags.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  link:
                    type: object
                    description: Returns the endpoints for the next and previous pages.
                    properties:
                      next:
                        type: string
                        description: Returns the API endpoint to the next page.
                        examples:
                        - openapi/v1/tags/?page=9&page_size=1&Expires={{expires}}&AccessID={{open_api_access_id}}&Signature={{signature}}
                      previous:
                        type: string
                        description: Returns the API endpoint to the previous page.
                        examples:
                        - openapi/v1/tags/?page=7&page_size=1&Expires={{expires}}&AccessID={{open_api_access_id}}&Signature={{signature}}
                  count:
                    type: number
                    description: Returns the total number of tags in Orchestrate.
                    examples:
                    - 1
                  results:
                    type: array
                    description: Returns the list of tags in Orchestrate.
                    items:
                      type: object
                      properties:
                        unique_id:
                          type: string
                          description: Returns the dynamically generated unique ID for the tag.
                          examples:
                          - 8cdb66cb-3671-4cc0-a3d8-4b433e081535
                        title:
                          type: string
                          description: Returns the title of the tag.
                          examples:
                          - Detection
                        description:
                          type: string
                          description: Returns the description of the tag.
                          examples:
                          - Incident Detection Phase
                        color:
                          type: string
                          description: Returns the color code of the tag.
                          examples:
                          - '#86F822'
                        created:
                          type: string
                          description: Returns the creation date and time of the tag.
                          examples:
                          - '2021-11-15T04:36:23.630418Z'
                        modified:
                          type: string
                          description: Returns the date and time when the tag was last modified.
                          examples:
                          - '2021-11-15T04:36:39.608580Z'
                        created_by_data:
                          type: object
                          description: Returns the details of the user who created the tag.
                          properties:
                            unique_id:
                              type: string
                              description: Returns the unique ID of the user who created the tag.
                              examples:
                              - 62d3f79e-6139-4ba7-a162-33d69f87f8d1
                            first_name:
                              type: string
                              description: Returns the first name of the user who created the tag.
                              examples:
                              - John
                            last_name:
                              type: string
                              description: Returns the last name of the user who created the tag.
                              examples:
                              - Doe
                            full_name:
                              type: string
                              description: Returns the full name of the user who created the tag.
                              examples:
                              - John Doe
                        modified_by_data:
                          type: object
                          description: Returns the details of the user who last modified the tag.
                          properties:
                            unique_id:
                              type: string
                              description: Returns the unique ID of the user who last modified the tag.
                              examples:
                              - 62d3f79e-6139-4ba7-a162-33d69f87f8d1
                            first_name:
                              type: string
                              description: Returns the first name of the user who last modified the tag.
                              examples:
                              - John
                            last_name:
                              type: string
                              description: Returns the last name of the user who last modified the tag.
                              examples:
                              - Smith
                            full_name:
                              type: string
                              description: Returns the full name of the user who last modified the tag.
                              examples:
                              - John Smith
                        playbook_count:
                          type: number
                          description: Returns the total number playbooks associated with the tag.
                          examples:
                          - 0
              example:
                link:
                  next: openapi/v1/tags/?page=9&page_size=1&Expires={{expires}}&AccessID={{open_api_access_id}}&Signature={{signature}}
                  previous: openapi/v1/tags/?page=7&page_size=1&Expires={{expires}}&AccessID={{open_api_access_id}}&Signature={{signature}}
                count: 1
                results:
                - unique_id: 8cdb66cb-3671-4cc0-a3d8-4b433e081535
                  title: Detection
                  description: Incident Detection Phase
                  color: '#86F822'
                  created: '2021-11-15T04:36:23.630418Z'
                  modified: '2021-11-15T04:36:39.608580Z'
                  created_by_data:
                    unique_id: 62d3f79e-6139-4ba7-a162-33d69f87f8d1
                    first_name: John
                    last_name: Doe
                    full_name: John Doe
                  modified_by_data:
                    unique_id: 62d3f79e-6139-4ba7-a162-33d69f87f8d1
                    first_name: John
                    last_name: Smith
                    full_name: John Smith
                  playbook_count: 0
      security:
      - coOpenApiSignature: []
  /v1/tags/{tag_unique_id}/:
    servers:
    - url: https://{co_host}/soarapi
      description: Tenant Orchestrate deployment. Replace {co_host} with your own Orchestrate host. Cyware uses https://demo.cyware.com/soar/ as the example host in the config of its open-source MCP server, and its docs reference the /soarapi base path.
      variables:
        co_host:
          default: demo.cyware.com
    get:
      operationId: getTagDetails
      summary: Get Tag Details
      tags:
      - Tags
      description: Returns the details of a specific tag.
      externalDocs:
        description: Cyware Orchestrate API reference
        url: https://orchestrateapi.cyware.com/tags/get-tag-details
      parameters:
      - name: tag_unique_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of the tag to retrieve the details. You can retrieve the unique ID of tags using the **Get Tags List** endpoint.
        description: Pass the unique ID of the tag to retrieve the details. You can retrieve the unique ID of tags using the **Get Tags List** endpoint.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  unique_id:
                    type: string
                    description: Returns the dynamically generated unique ID for the tag.
                    examples:
                    - 7e0d1309-cd11-4e5d-8325-42f62f4d6762
                  title:
                    type: string
                    description: Returns the title of the tag.
                    examples:
                    - Detection
                  description:
                    type: string
                    description: Returns the description of the tag.
                    examples:
                    - Incident Detection Phase
                  color:
                    type: string
                    description: Returns the color code of the tag.
                    examples:
                    - '#172b4d'
                  created:
                    type: string
                    description: Returns the date and time when the tag was created.
                    examples:
                    - '2021-12-23T11:53:26.726065Z'
                  modified:
                    type: string
                    description: Returns the date and time when the tag was last modified.
                    examples:
                    - '2022-01-17T18:57:37.102341Z'
                  created_by_data:
                    type: object
                    description: Returns the details of the user who created the tag.
                    properties:
                      unique_id:
                        type: string
                        description: Returns the unique ID of the user who created the tag.
                        examples:
                        - 83bd4970-dcd2-4108-81e5-8ce4989d10e4
                      first_name:
                        type: string
                        description: Returns the first name of the user who created the tag.
                        examples:
                        - John
                      last_name:
                        type: string
                        description: Returns the last name of the user who created the tag.
                        examples:
                        - Doe
                      full_name:
                        type: string
                        description: Returns the full name of the user who created the tag.
                        examples:
                        - John Doe
                  modified_by_data:
                    type: object
                    description: Returns the details of the user who last modified the tag.
                    properties:
                      unique_id:
                        type: string
                        description: Returns the unique ID of the user who last modified the tag.
                        examples:
                        - 62d3f79e-6139-4ba7-a162-33d69f87f8d1
                      first_name:
                        type: string
                        description: Returns the first name of the user who last modified the tag.
                        examples:
                        - John
                      last_name:
                        type: string
                        description: Returns the last name of the user who last modified the tag.
                        examples:
                        - Smith
                      full_name:
                        type: string
                        description: Returns the full name of the user who last modified the tag.
                        examples:
                        - John Smith
                  playbook_count:
                    type: number
                    description: Returns the number of playbooks associated with the tag.
                    examples:
                    - '3'
              example:
                unique_id: 7e0d1309-cd11-4e5d-8325-42f62f4d6762
                title: Detection
                description: Incident Detection Phase
                color: '#172b4d'
                created: '2021-12-23T11:53:26.726065Z'
                modified: '2022-01-17T18:57:37.102341Z'
                created_by_data:
                  unique_id: 83bd4970-dcd2-4108-81e5-8ce4989d10e4
                  first_name: John
                  last_name: Doe
                  full_name: John Doe
                modified_by_data:
                  unique_id: 62d3f79e-6139-4ba7-a162-33d69f87f8d1
                  first_name: John
                  last_name: Smith
                  full_name: John Smith
                playbook_count: '3'
      security:
      - coOpenApiSignature: []
components:
  securitySchemes:
    ctixOpenApiSignature:
      type: apiKey
      in: query
      name: AccessID
      description: 'Intel Exchange Open API credentials. Every request carries three query parameters: AccessID (the access ID of the Open API credential), Expires (an epoch timestamp, at most 30 seconds in the future) and Signature - an HMAC-SHA1 of "AccessID\nExpires" keyed with the secret key, Base64 encoded and then URL encoded. See https://ctixapiv3.cyware.com/authentication'
    coOpenApiSignature:
      type: apiKey
      in: query
      name: access_id
      description: Orchestrate Open API credentials. Every request carries access_id, expires (epoch, current time + up to 30 seconds) and signature query parameters, where StringToSign = access_id + "\n" + expires and Signature = Base64(HMAC-SHA1(secret_key, StringToSign)). See https://orchestrateapi.cyware.com/authentication
x-refined-from:
- cyware-intel-exchange-openapi.yml
- cyware-orchestrate-openapi.yml