Cyware Threat Data API

openapi: 3.2.0
info:
  title: Cyware Intel Exchange (CTIX) v3 Open Threat Data API
  version: 3.6.2
  description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.


    Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.


    This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
  contact:
    name: Cyware
    url: https://www.cyware.com/contact-us
  termsOfService: https://www.cyware.com/legal/terms-of-use
  x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
  x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
  description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
  variables:
    ctix_host:
      default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Threat Data
  description: Threat Data
paths:
  /ingestion/file/{file_id}/:
    get:
      operationId: retrieveDownloadLink
      summary: Get Download Link
      tags:
      - Threat Data
      description: Retrieves a URL to download the export file. The URL includes the file ID and a token.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-data/export/retrieve-download-link
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve records.
          default: '1'
        description: Pass the page number to retrieve records.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve on each page.
          maxLength: 100
          default: '10'
        description: Pass the number of records to retrieve on each page.
      - name: file_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the file ID generated by the **Generate Export File API** endpoint.
          examples:
          - df21ff51-0d9e-4380-be78-b75889860702
        description: Pass the file ID generated by the **Generate Export File API** endpoint.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  url:
                    type: string
                    description: You can use the token from this URL and use it in the **Download Export File API**.
                    examples:
                    - https://tenantname.com/ctixapi/ingestion/external_download/df21ff51-0d9e-4380-be78-b75889860702/?token=61973ea7-5387-4e4b-a221-970fc1dca4e0
              example:
                url: https://tenantname.com/ctixapi/ingestion/external_download/df21ff51-0d9e-4380-be78-b75889860702/?token=61973ea7-5387-4e4b-a221-970fc1dca4e0
      x-alternate-documents:
      - title: Get Token to Download File
        operationId: tokenToDownloadFile
        url: https://ctixapiv3.cyware.com/reports/token-to-download-file
  /ingestion/threat-data/ai-search/:
    post:
      operationId: aiAssistedSearch
      summary: AI-Assisted Search
      tags:
      - Threat Data
      description: 'Converts a natural language prompt into an Intel Exchange search query.


        ### Changelog


        <Accordion attributes=''{"style":{"width":"100%"}}''>

        <AccordionItem title="Release v3.7.7.0" iconUrl=""><p>Added a new endpoint for AI-assisted search in Threat Data.</p></AccordionItem>

        </Accordion>'
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-data/ai-assisted-search
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                prompt:
                  type: string
                  description: Pass the natural language query to convert into a search filter.
                  examples:
                  - Show IPv4 objects with risk score greater than 80 created in the last week
                timezone_offset:
                  type: number
                  description: Pass the timezone offset in minutes from UTC. For example, pass -330 for IST (UTC+5:30).
                  examples:
                  - -330
              required:
              - prompt
            example:
              prompt: Show IPv4 objects with risk score greater than 80 created in the last week
              timezone_offset: -330
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  query:
                    type: string
                    description: Returns the generated search query in Intel Exchange filter syntax.
                    examples:
                    - '''type'' = "indicator" AND ''ioc_type'' = "ipv4-addr" AND ''confidence_score'' > "80" AND ''ctix_created'' >= "1779185864000"'
              example:
                query: '''type'' = "indicator" AND ''ioc_type'' = "ipv4-addr" AND ''confidence_score'' > "80" AND ''ctix_created'' >= "1779185864000"'
  /ingestion/threat-data/bulk-action/analyst_score/:
    post:
      operationId: bulkAddAnalystScore
      summary: Bulk Add Analyst Score
      tags:
      - Threat Data
      description: Add the analyst Confidence Score to multiple threat data objects.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-add-analyst-score
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                object_type:
                  type: string
                  description: Pass the type of threat data objects. To get the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**.
                  examples:
                  - indicator
                object_ids:
                  type: array
                  description: Pass the list of threat data object IDs to perform the bulk action. To retrieve a list of object IDs, use the **List Threat Data API** under the Threat Data section.
                  items:
                    type: string
                    description: This is an example value.
                    examples:
                    - 49d5e95e-3889-42de-8280-1ebf5c7cb95a
                data:
                  type: object
                  description: Pass the relation data to pass with the request.
                  properties:
                    analyst_score:
                      type: number
                      description: Pass the analyst Confidence Score between 0 to 100 to be added the objects.
                      examples:
                      - '67'
            example:
              object_type: indicator
              object_ids:
              - 49d5e95e-3889-42de-8280-1ebf5c7cb95a
              data:
                analyst_score: '67'
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: Returns a success or failure message.
                    examples:
                    - Action Successfully Executed
              example:
                message: Action Successfully Executed
  /ingestion/threat-data/bulk-action/add_relation/:
    post:
      operationId: bulkAddRelation
      summary: Bulk Add Relation
      tags:
      - Threat Data
      description: Add a relation to multiple threat data objects.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-add-relation
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                object_type:
                  type: string
                  description: Pass the type of threat data objects. To get the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**.
                  examples:
                  - indicator
                object_ids:
                  type: array
                  description: Pass the list of threat data object IDs to perform the bulk action. To retrieve a list of object IDs, use the **List Threat Data API** under the Threat Data section.
                  items:
                    type: string
                    description: This is an example value.
                    examples:
                    - 49d5e95e-3889-42de-8280-1ebf5c7cb95a
                data:
                  type: object
                  description: Pass the relation data to pass with the request.
                  properties:
                    target:
                      type: object
                      description: Pass the details of the threat data object to add as a relation.
                      properties:
                        id:
                          type: string
                          description: Pass the ID of an object to add as a relation.
                          examples:
                          - 85830a15-3ae2-49f1-987c-f52ccf40a0e3
                        name:
                          type: string
                          description: Pass the value of the object.
                          examples:
                          - 5.205.20.175
                        sub_type:
                          type: string
                          description: Pass the sub type of the object.
                          examples:
                          - ipv4-addr
                        type:
                          type: string
                          description: Pass the object type. To get the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**.
                          examples:
                          - indicator
                      required:
                      - id
                      - type
                    relationship_type:
                      type: string
                      description: Pass the relationship type.
                      enum:
                      - related-to
                  required:
                  - target
                  - relationship_type
              required:
              - object_type
              - object_ids
              - data
            example:
              object_type: indicator
              object_ids:
              - 49d5e95e-3889-42de-8280-1ebf5c7cb95a
              data:
                target:
                  id: 85830a15-3ae2-49f1-987c-f52ccf40a0e3
                  name: 5.205.20.175
                  sub_type: ipv4-addr
                  type: indicator
                relationship_type: ''
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: Returns a success or failure message.
                    examples:
                    - Action Successfully Executed
              example:
                message: Action Successfully Executed
  /ingestion/threat-data/bulk-action/{action_type}/:
    post:
      operationId: bulkAddRemoveAllowedIndicators
      summary: Bulk Add/Remove Allowed Indicators
      tags:
      - Threat Data
      description: Add or remove multiple threat data objects from the Allowed Indicators list in the platform.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-add-remove-allowed-indicators
      parameters:
      - name: action_type
        in: path
        required: true
        schema:
          type: string
          description: Pass the action to be performed on the threat data objects.
          enum:
          - whitelist
          - un_whitelist
          examples:
          - whitelist
        description: Pass the action to be performed on the threat data objects.
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                object_type:
                  type: string
                  description: Pass the type of threat data objects. To get the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**.
                  examples:
                  - indicator
                object_ids:
                  type: array
                  description: Pass the list of threat data object IDs to perform the bulk action. To retrieve a list of object IDs, use the **List Threat Data API** under the Threat Data section.
                  items:
                    type: string
                    description: This is an example value.
                    examples:
                    - 49d5e95e-3889-42de-8280-1ebf5c7cb95a
            example:
              object_type: indicator
              object_ids:
              - 49d5e95e-3889-42de-8280-1ebf5c7cb95a
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: Returns the success message.
                    examples:
                    - Action Successfully Executed
              example:
                message: Action Successfully Executed
      x-alternate-documents:
      - title: Bulk Add Tags
        operationId: bulkAddRemoveTags
        url: https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-add-remove-tags/bulk-add-remove-tags
      - title: Bulk Remove Tags
        operationId: bulkRemoveTags
        url: https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-add-remove-tags/bulk-remove-tags
      - title: Bulk Add/Remove Watchlist
        operationId: bulkAddRemoveWatchlist
        url: https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-add-remove-watchlist
      - title: Bulk Deprecate/Undeprecate Objects
        operationId: bulkDeprecateUndeprecateObjects
        url: https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-deprecate-undeprecate-objects
      - title: Bulk Manual Review
        operationId: bulkManualReview
        url: https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-manual-review
      - title: Bulk Mark/Unmark False Positive
        operationId: bulkMarkUnmarkFalsePositive
        url: https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-mark-unmark-false-positive
  /ingestion/threat-data/bulk-action/analyst_tlp/:
    post:
      operationId: bulkAddTlp
      summary: Bulk Add TLP
      tags:
      - Threat Data
      description: Add an analyst TLP to multiple threat data objects.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-add-tlp
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                object_type:
                  type: string
                  description: Pass the type of threat data objects. To get the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**.
                  examples:
                  - indicator
                object_ids:
                  type: array
                  description: Pass the list of threat data object IDs to perform the bulk action. To retrieve a list of object IDs, use the **List Threat Data API** under the Threat Data section.
                  items:
                    type: string
                    description: This is an example value.
                    examples:
                    - 49d5e95e-3889-42de-8280-1ebf5c7cb95a
                data:
                  type: object
                  description: Pass the TLP to be added to the specified threat data objects.
                  properties:
                    analyst_tlp:
                      type: string
                      description: Pass the analyst TLP value to be added to the threat data objects.
                      enum:
                      - WHITE
                      - GREEN
                      - AMBER
                      - ' RED'
                      examples:
                      - AMBER
            example:
              object_type: indicator
              object_ids:
              - 49d5e95e-3889-42de-8280-1ebf5c7cb95a
              data:
                analyst_tlp: AMBER
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: Returns the success or failure message.
                    examples:
                    - Action Successfully Executed
              example:
                message: Action Successfully Executed
  /ingestion/openapi/bulk-lookup/{object_type}/:
    post:
      operationId: bulkIocLookupAdvanced
      summary: Bulk IOC Lookup (Advanced)
      tags:
      - Threat Data
      description: Performs a lookup for threat data objects in Intel Exchange and retrieves the details of the objects, such as basic details, enriched data, and relations.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-data/bulk-actions/bulk-ioc-lookup-advanced
      parameters:
      - name: enrichment_data
        in: query
        required: false
        schema:
          type: boolean
          description: Pass true to retrieve the latest five enrichment data objects.
          default: 'false'
          examples:
          - 'true'
        description: Pass true to retrieve the latest five enrichment data objects.
      - name: relation_data
        in: query
        required: false
        schema:
          type: boolean
          description: Pass true to retrieve the latest 100 relations details.
          default: 'false'
          examples:
          - 'true'
        description: Pass true to retrieve the latest 100 relations details.
      - name: enrichment_tools
        in: query
        required: false
        schema:
          type: string
          description: Pass the name of up to five enrichment tools separated by a comma. To retrieve a list of enrichment tools, use the **GET Enrichment Tools API** under **Administration** > **Enrichment Management** > **Enrichment Tools**.
          examples:
          - AbuseIPDB
        description: Pass the name of up to five enrichment tools separated by a comma. To retrieve a list of enrichment tools, use the **GET Enrichment Tools API** under **Administration** > **Enrichment Management** > **Enrichment Tools**.
      - name: fields
        in: query
        required: false
        schema:
          type: string
          description: Pass a comma-separated list of field names to retrieve specific details of the objects. By default, all fields are retrieved.
          examples:
          - relations,enrichment_data
        description: Pass a comma-separated list of field names to retrieve specific details of the objects. By default, all fields are retrieved.
      - name: page
        in: query
        required: false
        schema:
          type: integer
          description: Pass the page number to retrieve details from.
          default: '1'
        description: Pass the page number to retrieve details from.
      - name: page_size
        in: query
        required: false
        schema:
          type: integer
          description: Pass the number of records to be retrieved per page.
          default: '10'
        description: Pass the number of records to be retrieved per page.
      - name: object_type
        in: path
        required: true
        schema:
          type: string
          description: Pass the object type to lookup. For the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**.
          examples:
          - indicator
        description: Pass the object type to lookup. For the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                value:
                  type: array
                  description: Pass the values of the IOCs you want to lookup.
                  items:
                    type: string
                    description: This is an example value.
                    examples:
                    - 76.77.23.225
              required:
              - value
            example:
              value:
              - 76.77.23.225
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  next:
                    type: object
                    description: Returns the URL for the next page.
                  previous:
                    type: object
                    description: Returns the URL for the previous page. Returns null if the page parameter is 1.
                  total:
                    type: number
                    description: Returns the total number of valid IOCs in the payload.
                    examples:
                    - 1
                  results:
                    type: array
                    description: Returns the details of threat data objects.
                    items:
                      type: object
                      properties:
                        analyst_score:
                          type: object
                          description: Returns the score assigned to the threat data object by an analyst.
                        analyst_tlp:
                          type: object
                          description: Returns the TLP assigned to the threat data object by an analyst.
                        country:
                          type: string
                          description: Returns the country name where the threat data object was seen.
                          examples:
                          - China
                        created:
                          type: string
                          description: Returns the date and time of when the object was created in the source.
                          examples:
                          - '2023-05-29T09:30:51Z'
                        ctix_created:
                          type: string
                          description: Returns the date and time of when the object was created in Intel Exchange.
                          examples:
                          - '2023-05-29T09:38:35.482Z'
                        ctix_modified:
                          type: string
                          description: Returns the date and time of when the object was modified in Intel Exchange.
                          examples:
                          - '2023-05-29T09:38:35.482Z'
                        custom_attributes:
                          type: object
                          description: Returns custom attributes associated with the object.
                        confidence_score:
                          type: number
                          description: Returns the confidence score of the object.
                          examples:
                          - 81
                        description:
                          type: object
                          description: Returns the source description of the object.
                        enrichment_data:
                          type: array
                          description: Returns a list of enrichment objects retrieved from the enrichment tools.
                          items:
                            type: object
                            properties:
                              tool:
                                type: string
                                description: Returns the enrichment tool name.
                                examples:
                                - AbuseIPDB
                              tool_response:
                                type: string
                                description: Returns the enrichment details.
                                examples:
                                - '{"data": {"data": {"ipAddress": "47.92.78.238", "isPublic": "True", "ipVersion": "4", "isWhitelisted": null, "abuseConfidenceScore": "0", "countryCode": "CN", "usageType": "Data Center/Web Hosting/Transit", "isp": "Aliyun Computing Co. Ltd", "domain": "aliyun.com", "hostnames": [], "isTor": "False", "totalReports": "0", "numDistinctUsers": "0", "lastReportedAt": null}}, "execution_status": "SUCCESS", "updated": 1685528188}'
                        first_seen:
                          type: object
                          description: Returns the first seen date and time of the threat data object.
                        id:
                          type: string
                          description: Returns the ID of the threat data object.
                          examples:
                          - c39cbf92-1ae6-4952-958a-3f48a90d55f6
                        ioc_type:
                          type: string
                          description: 'Returns the IOC type.

                            Returns null if the threat data object is not an indicator.

                            Returns hash type for hashes and the indicator type key for other indicators.'
                          examples:
                          - ipv4-addr
                        is_deprecated:
                          type: boolean
                          description: Returns true if the IOC is marked as deprecated in Intel Exchange. Else, returns false.
                          examples:
                          - false
                        is_false_positive:
                          type: boolean
                          description: Returns true if the IOC is marked as a false positive in Intel Exchange. Else, returns false.
                          examples:
                          - false
                        is_reviewed:
                          type: boolean
                          description: Returns true if the threat data object is manually reviewed. Else, returns false.
                          examples:
                          - false
                        is_whitelisted:
                          type: boolean
                          description: Returns true if the IOC is marked as an allowed indicator. Else, returns false.
                          examples:
                          - false
                        last_seen:
                          type: object
                          description: Returns the last seen date and time of the threat data object.
                        modified:
                          type: string
                          description: Returns the source modified date and time of the threat data object.
                          examples:
                          - '2023-05-29T09:31:02Z'
                        name:
                          type: string
                          description: Returns the value of the threat data object.
                          examples:
                          - 47.92.78.238
                        object_type:
                          type: string
                          description: Returns the SDO type of the threat data object
                          examples:
                          - indicator
                        published_collections:
                          type: array
                          description: Returns a list of JSON objects for the collections in which the IOC is published.
                          items:
                            type: object
                            properties:
                              name:
                                type: string
                                description: Returns the name of the collection.
                                examples:
                                - default
                              id:
                                type: string
                                description: Returns the unique identifier of the collection.
                                examples:
                                - 8c9e459f-5164-4f56-9a65-6a3004977cef
                        relations:
                          type: object
                          description: Returns a list of related threat data objects.
                          properties:
                            malware:
                              type: array
                              description: Returns the details of the malware.
                              items:
                                type: string
                                description: This is an example value.
                                examples:
                                - Piccoload
                        sources:
                          type: array
                          description: Returns the list of sources that reported the threat data object.
                          items:
                            type: object
                            properties:
                              id:
                                type: string
                                description: Returns the unique identifier of the source.
                                examples:
                                - 99740a47-fb33-4610-90e5-155e1dece960
                              name:
                                type: string
                                description: Returns the name of the source.
                                examples:
                                - CrowdStrike
                              type:
                                type: string
                                description: Returns the type of the source.
                                examples:
                                - API_FEEDS
                        sub_type:
                          type: object
                          description: Returns the sub-type of an indicator. Returns null if the threat data object is not an indicator. Returns hash type for hashes and value for other indicators.
                        tags:
                          type: array
                          

# --- truncated at 32 KB (167 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-threat-data-api-openapi.yml