openapi: 3.2.0
info:
title: Cyware Intel Exchange (CTIX) v3 Open Threat Data Objects API
version: 3.6.2
description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.
Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.
This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
contact:
name: Cyware
url: https://www.cyware.com/contact-us
termsOfService: https://www.cyware.com/legal/terms-of-use
x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
variables:
ctix_host:
default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Threat Data Objects
description: Threat Data Objects
paths:
/ingestion/actions/:
get:
operationId: listActions
summary: Get Actions List
tags:
- Threat Data Objects
description: Retrieves a list of actions performed on a threat data object.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/threat-data-objects/actions/list-actions
parameters:
- name: page
in: query
required: false
schema:
type: integer
description: Pass the page number to retrieve actions.
default: '1'
description: Pass the page number to retrieve actions.
- name: page_size
in: query
required: false
schema:
type: integer
description: Pass the number of actions to retrieve on each page.
default: '10'
description: Pass the number of actions to retrieve on each page.
- name: app_type
in: query
required: false
schema:
type: string
description: Pass the app type that performed the action. Example, *ctix*.
description: Pass the app type that performed the action. Example, *ctix*.
- name: object_id
in: query
required: true
schema:
type: string
description: Pass the threat data object ID. To retrieve the object ID, use the **List Threat Data API** under the Threat Data section. Example, *c39cbf92-1ae6-4952-958a-3f48a90d55f6*.
description: Pass the threat data object ID. To retrieve the object ID, use the **List Threat Data API** under the Threat Data section. Example, *c39cbf92-1ae6-4952-958a-3f48a90d55f6*.
- name: object_type
in: query
required: false
schema:
type: string
description: Pass the type of threat data object. To get the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**. Example, *indicator*.
description: Pass the type of threat data object. To get the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**. Example, *indicator*.
- name: action_type
in: query
required: false
schema:
type: string
description: Pass the type of actions to retrieve.
enum:
- manual
- automatic
default: automatic
examples:
- manual
description: Pass the type of actions to retrieve.
responses:
'200':
description: HTTP 200 response
content:
json:
schema:
type: object
properties:
next:
type: string
description: Returns the URL for the next page.
examples:
- actions/?page=2&page_size=10&object_id=2ba4f90f-5827-431a-8e38-740c0f3fe647&object_type=indicator
page_size:
type: number
description: Returns the number of records in the response.
examples:
- 10
previous:
type: object
description: Returns the URL of the previous page.
results:
type: array
description: Returns the details of the action performed.
items:
type: object
properties:
action_name:
type: string
description: Returns the action name.
examples:
- Update Indicators Allowed (Add)
action_type:
type: string
description: Returns the action type.
enum:
- automatic
- manual
examples:
- automatic
actioned_by:
type: object
description: Returns the details of the user who performed the action.
properties:
email:
type: string
description: Returns the email address.
examples:
- john.doe@example.com
first_name:
type: string
description: Returns the first name.
examples:
- John
id:
type: string
description: Returns the user ID.
examples:
- f5b3d63c-8bb5-44c5-9699-7e82d3810d6d
last_name:
type: string
description: Returns the last name.
examples:
- Doe
actioned_on:
type: number
description: Returns the epoch timestamp of the actioning date and time.
examples:
- 1744974108
app_name:
type: string
description: Returns the name of the application, such as Pfense, QRadar, and more.
examples:
- CTIX
app_type:
type: string
description: Returns the application type.
examples:
- ctix
id:
type: string
description: Returns the action ID.
examples:
- d4261c1e-f2f3-4487-89f7-8775d78dc43c
object_id:
type: string
description: Returns the object ID.
examples:
- 2ba4f90f-5827-431a-8e38-740c0f3fe647
object_type:
type: string
description: Returns the object type.
examples:
- indicator
rule_id:
type: object
description: Returns the ID of the automation rule run on the object.
rule_name:
type: object
description: Returns the name of the automation rule run on the object.
source_id:
type: object
description: Returns the ID of the source.
status:
type: string
description: Returns the status of the action.
examples:
- UNKNOWN
tool:
type: object
description: Returns the details of the tool.
total:
type: number
description: Returns the total number of actions performed on the specified threat data object.
examples:
- 27
example:
next: actions/?page=2&page_size=10&object_id=2ba4f90f-5827-431a-8e38-740c0f3fe647&object_type=indicator
page_size: 10
previous: {}
results:
- action_name: Update Indicators Allowed (Add)
action_type: automatic
actioned_by:
email: john.doe@example.com
first_name: John
id: f5b3d63c-8bb5-44c5-9699-7e82d3810d6d
last_name: Doe
actioned_on: 1744974108
app_name: CTIX
app_type: ctix
id: d4261c1e-f2f3-4487-89f7-8775d78dc43c
object_id: 2ba4f90f-5827-431a-8e38-740c0f3fe647
object_type: indicator
rule_id: {}
rule_name: {}
source_id: {}
status: UNKNOWN
tool: {}
total: 27
x-alternate-documents:
- title: Get Action Overview
operationId: actionOverview
url: https://ctixapiv3.cyware.com/threat-data-objects/actions/action-overview
/ingestion/actions/{object_type}/{object_id}/stats/:
get:
operationId: actionStatistics
summary: Get Action Statistics
tags:
- Threat Data Objects
description: Retrieves the statistics of the actions performed by third-party tools and Intel Exchange on a threat data object.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/threat-data-objects/actions/action-statistics
parameters:
- name: is_third_action
in: query
required: false
schema:
type: boolean
description: Pass true to retrieve third-party action statistics only.
default: 'false'
examples:
- 'True'
description: Pass true to retrieve third-party action statistics only.
- name: is_ctix_action
in: query
required: false
schema:
type: boolean
description: Pass true to retrieve Intel Exchange (CTIX) action statistics only.
default: 'false'
examples:
- 'True'
description: Pass true to retrieve Intel Exchange (CTIX) action statistics only.
- name: page
in: query
required: false
schema:
type: string
description: Pass the page number to retrieve records.
default: '1'
description: Pass the page number to retrieve records.
- name: page_size
in: query
required: false
schema:
type: string
description: Pass the number of records to retrieve on each page.
maxLength: 100
default: '10'
description: Pass the number of records to retrieve on each page.
- name: object_type
in: path
required: true
schema:
type: string
description: Pass the type of threat data object. To get the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**.
examples:
- indicator
description: Pass the type of threat data object. To get the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**.
- name: object_id
in: path
required: true
schema:
type: string
description: Pass the threat data object ID. To retrieve the object ID, use the **List Threat Data API** under the Threat Data section.
examples:
- 916e0c84-61a6-412b-a25c-e65d6bcdc96b
description: Pass the threat data object ID. To retrieve the object ID, use the **List Threat Data API** under the Threat Data section.
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
action_stats:
type: array
description: Returns the number of actions performed by the Intel Exchange (CTIX) and third-party applications.
items:
type: object
properties:
label:
type: string
description: Returns the label or name of the key (3rd Party Actions or CTIX).
examples:
- 3rd Party Actions
key:
type: string
description: Returns the key of the action.
examples:
- third_party
value:
type: number
description: Returns the number of actions.
examples:
- '114'
ctix_actions:
type: array
description: Returns the list of Intel Exchange actions with the action name, action type, and the action time in epoch format.
items:
type: object
properties:
label:
type: string
description: Returns the label of the action.
examples:
- Manual Review
type:
type: string
description: Returns the type of the action.
examples:
- automatic
value:
type: number
description: Returns the value of the action.
examples:
- '1641555728'
third_party_actions:
type: array
description: Returns the list of third-party actions with the action name, third-party tool name, and the action time in epoch format.
items:
type: object
properties:
name:
type: string
description: Returns the name of the action.
examples:
- Update Context Table
tool:
type: string
description: Returns the tool used for the action.
examples:
- starttemplate {{ marshal (index .tools "29d9638d-ccb1-400b-8d7a-2f163a3eae1d") }} endtemplate
value:
type: number
description: Returns the value of the action.
examples:
- '1641555731'
example:
action_stats:
- label: 3rd Party Actions
key: third_party
value: '114'
ctix_actions:
- label: Manual Review
type: automatic
value: '1641555728'
third_party_actions:
- name: Update Context Table
tool: starttemplate {{ marshal (index .tools "29d9638d-ccb1-400b-8d7a-2f163a3eae1d") }} endtemplate
value: '1641555731'
/ingestion/threat-data/threat-actor/{object_id}/basic/:
post:
operationId: addCustomAliases
summary: Add Custom Aliases to Threat Actors
tags:
- Threat Data Objects
description: Add custom aliases to threat actors in Intel Exchange.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/threat-data-objects/basic-details/add-custom-aliases
parameters:
- name: object_id
in: path
required: true
schema:
type: string
description: Pass the threat data object ID. To retrieve the object ID, use the **List Threat Data API** under the Threat Data section.
examples:
- 903f519f-feb1-49b8-8c80-18ff8de99e8c
description: Pass the threat data object ID. To retrieve the object ID, use the **List Threat Data API** under the Threat Data section.
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
aliases:
type: object
description: Pass the list of strings that specify the also-known names for the threat actors.
properties:
custom:
type: array
description: Pass a list of custom aliases of the threat actor.
items:
type: string
description: This is an example value.
examples:
- sample alias 1
example:
aliases:
custom:
- sample alias 1
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
message:
type: string
description: Returns the success message.
examples:
- Custom aliases added successfully.
example:
message: Custom aliases added successfully.
/ingestion/threat-data/kill_chain_phases/{kill_chain_id}/:
get:
operationId: killChainDetails
summary: Get Kill Chain Details
tags:
- Threat Data Objects
description: Retrieves the details of a STIX kill chain phase.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/threat-data-objects/basic-details/kill-chain-details
parameters:
- name: page
in: query
required: false
schema:
type: string
description: Pass the page number to retrieve records.
default: '1'
description: Pass the page number to retrieve records.
- name: page_size
in: query
required: false
schema:
type: string
description: Pass the number of records to retrieve on each page.
maxLength: 100
default: '10'
description: Pass the number of records to retrieve on each page.
- name: kill_chain_id
in: path
required: true
schema:
type: string
description: Pass the ID of a kill chain phase to retrieve the details. You can retrieve this ID using the **List Kill Chain Phases API**.
examples:
- ae78301c-4378-4348-b83e-2e7b4dd8438b
description: Pass the ID of a kill chain phase to retrieve the details. You can retrieve this ID using the **List Kill Chain Phases API**.
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
id:
type: string
description: Returns the kill chain ID.
examples:
- 1f950806-c2a7-4612-bd09-18a69366584f
name:
type: string
description: Returns the name of the kill chain, such as Mandiant, Lockhead, and more.
examples:
- mandiant-attack-lifecycle-model
phase_name:
type: string
description: Returns the name of the phase based on the kill chain.
examples:
- initial-compromise
example:
id: 1f950806-c2a7-4612-bd09-18a69366584f
name: mandiant-attack-lifecycle-model
phase_name: initial-compromise
/ingestion/threat-data/{object_type}/{object_id}/kill_chain_phases/:
get:
operationId: listKillChainPhases
summary: Get Kill Chain Phases List
tags:
- Threat Data Objects
description: Retrieves kill chain phases associated with a threat data object.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/threat-data-objects/basic-details/list-kill-chain-phases
parameters:
- name: page
in: query
required: false
schema:
type: integer
description: Pass the page number to retrieve the kill chain phases.
default: '1'
description: Pass the page number to retrieve the kill chain phases.
- name: page_size
in: query
required: false
schema:
type: integer
description: Pass the number of records to retrieve in each page.
default: '10'
description: Pass the number of records to retrieve in each page.
- name: object_type
in: path
required: true
schema:
type: string
description: Pass the type of threat data object. To get the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**.
examples:
- indicator
description: Pass the type of threat data object. To get the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**.
- name: object_id
in: path
required: true
schema:
type: string
description: Pass the ID of the threat data object. To retrieve a list of object IDs, use the **List Threat Data API** under the Threat Data section.
examples:
- 09730695-2f63-4a1c-a0fb-a042689588d5
description: Pass the ID of the threat data object. To retrieve a list of object IDs, use the **List Threat Data API** under the Threat Data section.
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
next:
type: string
description: Returns the URL of the next page.
examples:
- threat-data/malware/fbfee712-7661-451b-98ef-5df850cd1894/kill_chain_phases/?page=2&page_size=10
previous:
type: object
description: Returns the URL of the previous page. Returns null if the page number is 1.
total:
type: number
description: Returns the total number of kill chain phases associated with the threat data object.
examples:
- '10'
page_size:
type: number
description: Returns the number of records in a page.
examples:
- '10'
results:
type: array
description: Returns details of the kill chain phase
items:
type: object
properties:
id:
type: string
description: Returns the ID of the kill chain phase.
examples:
- 0a07b1c8-c975-4ea8-b346-802405179e2c
name:
type: string
description: Returns the name of the kill chain, such as Mandiant, Lockhead, and more.
examples:
- lockheed-martin-cyber-kill-chain
phase_name:
type: string
description: Returns the name of the phase as per the used kill chain.
examples:
- reconnaissance
example:
next: threat-data/malware/fbfee712-7661-451b-98ef-5df850cd1894/kill_chain_phases/?page=2&page_size=10
previous: {}
total: '10'
page_size: '10'
results:
- id: 0a07b1c8-c975-4ea8-b346-802405179e2c
name: lockheed-martin-cyber-kill-chain
phase_name: reconnaissance
/ingestion/published-collections/{object_type}/{object_id}/:
get:
operationId: listPublishedCollectionsOfAThreatObject
summary: Get Published Collections of a Threat Object List
tags:
- Threat Data Objects
description: Retrieves the collections to which a threat data object is published.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/threat-data-objects/basic-details/list-published-collections-of-a-threat-object
parameters:
- name: page_size
in: query
required: false
schema:
type: integer
description: Pass the number of records to retrieve in each page.
default: '10'
description: Pass the number of records to retrieve in each page.
- name: page
in: query
required: false
schema:
type: string
description: Pass the page number to retrieve records.
default: '1'
description: Pass the page number to retrieve records.
- name: object_type
in: path
required: true
schema:
type: string
description: Pass the type of the threat data object. To get the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**.
examples:
- indicator
description: Pass the type of the threat data object. To get the list of supported object types, see **Supported SDO Types** in **Threat Data** > **Miscellaneous**.
- name: object_id
in: path
required: true
schema:
type: string
description: Pass the threat data object ID. To retrieve the object IDs, use the **List Threat Data API** under the Threat Data section.
examples:
- 09730695-2f63-4a1c-a0fb-a042689588d5
description: Pass the threat data object ID. To retrieve the object IDs, use the **List Threat Data API** under the Threat Data section.
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
results:
type: object
description: Returns the details of published collections.
properties:
next:
type: object
description: Returns the URL for the next page.
previous:
type: object
description: Returns the URL of the previous page.
total:
type: number
description: Returns the total number of published collections associated with the threat data object.
examples:
- '2'
page_size:
type: number
description: Returns the page size.
examples:
- '10'
results:
type: array
description: Returns the details of the collections.
items:
type: object
properties:
id:
type: string
description: Returns the unique ID of the published collection record.
examples:
- af242086-e126-44aa-b71c-b290c65e359f
collection:
type: object
description: Returns the collection details
properties:
id:
type: string
description: Returns the ID of the collection.
examples:
- a1751d0f-5346-47b2-aeea-d6f0531fd290
name:
type: string
description: Returns the name of the collection.
examples:
- MISP
action_type:
type: string
description: Returns the action that triggered the publishing, such as Rules or Manual.
examples:
- Rules
published:
type: number
description: Returns the epoch timestamp of when the threat data object was published to the collection.
examples:
- 1627992933
example:
results:
next: {}
previous: {}
total: '2'
page_size: '10'
results:
- id: af242086-e126-44aa-b71c-b290c65e359f
collection:
id: a1751d0f-5346-47b2-aeea-d6f0531fd290
name: MISP
action_type: Rules
published: 1627992933
/ingestion/threat-data/{object_type}/{object_id}/source_details/:
get:
operationId: listSourceDetails
summary: Get Source Details List
tags:
- Threat Data Objects
description: Retrieves source information for a threat data object.
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/threat-data-objects/basic-details/list-source-details
parameters:
- name: page
in: query
required: false
schema:
type: integer
description: Pass the page number to retrieve sources.
description: Pass the page number to retrieve sources.
- name: page_size
in: query
required: false
# --- truncated at 32 KB (154 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-threat-data-objects-api-openapi.yml