Cyware Threat Investigation API

openapi: 3.2.0
info:
  title: Cyware Intel Exchange (CTIX) v3 Open Threat Investigation API
  version: 3.6.2
  description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.


    Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.


    This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
  contact:
    name: Cyware
    url: https://www.cyware.com/contact-us
  termsOfService: https://www.cyware.com/legal/terms-of-use
  x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
  x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
  description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
  variables:
    ctix_host:
      default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Threat Investigation
  description: Threat Investigation
paths:
  /ingestion/canvas/{canvas_id}/:
    get:
      operationId: canvasBasicDetails
      summary: Get Canvas Basic Details
      tags:
      - Threat Investigation
      description: Return the details of a canvas.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-investigation/canvas/canvas-basic-details
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve records.
          default: '1'
        description: Pass the page number to retrieve records.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve on each page.
          maxLength: 100
          default: '10'
        description: Pass the number of records to retrieve on each page.
      - name: canvas_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of a canvas
          examples:
          - 16bd0f9d-8ee5-4559-a632-8ffe4e687776
        description: Pass the unique ID of a canvas
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Returns the ID of the canvas.
                    examples:
                    - fc84c3cf-570d-48e0-91f0-d23cde141612
                  name:
                    type: string
                    description: Returns the name of the canvas.
                    examples:
                    - canvas
                  shared_type:
                    type: string
                    description: Returns the sharing type of the canvas, such as `shared`, `private`, or `received`.
                    examples:
                    - specific_users
                  shared_users:
                    type: array
                    description: Returns the users' list with whom the canvas is shared.
                    items:
                      type: string
                      description: This is an example value.
                      examples:
                      - '123456789'
                  created_by:
                    type: object
                    description: Returns the details of the creator of the canvas.
                    properties:
                      email:
                        type: string
                        description: Returns the email address of the user who created the canvas.
                        examples:
                        - John@gmail.com
                      first_name:
                        type: string
                        description: Returns the first name of the user who created the canvas.
                        examples:
                        - John
                      id:
                        type: string
                        description: Returns the ID of the user who created the canvas.
                        examples:
                        - 3a4d629c-3061-412b-9049-86d33704e608
                      last_name:
                        type: string
                        description: Returns the last name of the user who created the canvas.
                        examples:
                        - John
              example:
                id: fc84c3cf-570d-48e0-91f0-d23cde141612
                name: canvas
                shared_type: specific_users
                shared_users:
                - '123456789'
                created_by:
                  email: John@gmail.com
                  first_name: John
                  id: 3a4d629c-3061-412b-9049-86d33704e608
                  last_name: John
  /ingestion/canvas/nodes/{canvas_id}/:
    get:
      operationId: canvasNodesDetails
      summary: Get Canvas Nodes Details
      tags:
      - Threat Investigation
      description: Returns the node details of a threat investigation canvas.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-investigation/canvas/canvas-nodes-details
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve results.
          default: '1'
          examples:
          - '1'
        description: Pass the page number to retrieve results.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve on each page.
          maxLength: 100
          default: '10'
          examples:
          - '20'
        description: Pass the number of records to retrieve on each page.
      - name: canvas_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of a threat investigation canvas.
          examples:
          - 16bd0f9d-8ee5-4559-a632-8ffe4e687776
        description: Pass the unique ID of a threat investigation canvas.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  next:
                    type: object
                    description: Returns the pagination link to navigate to the next page.
                  previous:
                    type: object
                    description: Returns the pagination link to navigate to the previous page.
                  total:
                    type: number
                    description: Returns the total number of records the API returns.
                    examples:
                    - '1'
                  page_size:
                    type: number
                    description: Returns the number of elements present on a page.
                    examples:
                    - '10'
                  results:
                    type: array
                    description: Returns the node details.
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                          description: Returns the ID of the threat data element.
                          examples:
                          - indicator--3c1ed30a-659b-4a82-9d35-9328943aae23
                        prop:
                          type: object
                          description: Returns some additional information about the threat data element on the canvas.
                          properties:
                            tlp_data:
                              type: string
                              description: Returns the TLP of the data
                              examples:
                              - AMBER
                            first_seen:
                              type: number
                              description: Returns when the object was first observed.
                              examples:
                              - '1626179839'
                            source_collections:
                              type: array
                              description: Returns the collections from which the indicator originated.
                              items:
                                type: object
                                properties:
                                  name:
                                    type: string
                                    description: Returns the name of the source collections.
                                    examples:
                                    - Bruteforce Web
                                  id:
                                    type: string
                                    description: Returns the unique identifier of the source collections.
                                    examples:
                                    - a9d46234-5948-4f88-8984-7d9701fd2c88
                            last_seen:
                              type: number
                              description: Returns the last time the indicator was observed.
                              examples:
                              - '1626179839'
                            sources:
                              type: array
                              description: Returns the details of the source.
                              items:
                                type: object
                                properties:
                                  created:
                                    type: number
                                    description: Returns the UNIX timestamp of the source creation.
                                    examples:
                                    - '1626179839'
                                  name:
                                    type: string
                                    description: Returns the name of the source.
                                    examples:
                                    - Volon
                                  source_type:
                                    type: string
                                    description: Returns the type of the source.
                                    examples:
                                    - API FEEDS
                                  id:
                                    type: string
                                    description: Returns the unique identifier of the source.
                                    examples:
                                    - e302863d-845d-4272-b0a9-13eebe5e0b40
                                  category:
                                    type: string
                                    description: Returns the source category.
                                    examples:
                                    - System Feeds
                            stix_object_id:
                              type: string
                              description: Returns the unique identifier of the STIX object.
                              examples:
                              - indicator--3c1ed30a-659b-4a82-9d35-9328943aae23
                            subscribers:
                              type: array
                              description: List of subscribers to this object.
                              items: {}
                            deprecated:
                              type: boolean
                              description: Returns a boolean indicating whether the indicator is deprecated.
                              examples:
                              - 'false'
                            intel_grading:
                              type: string
                              description: Returns the assessed accuracy and credibility of the intelligence.
                              examples:
                              - POSSIBLY TRUE | 3
                            indicator_type:
                              type: string
                              description: Returns the type of indicator.
                              examples:
                              - ipv4-addr
                            type:
                              type: string
                              description: Specifies the STIX type of the indicator object.
                              examples:
                              - ipv4-addr
                            labels:
                              type: array
                              description: Returns an array of labels associated with the indicator.
                              items: {}
                            source_grading:
                              type: string
                              description: Returns the grading of the source reliability.
                              examples:
                              - FAIRLY RELIABLE | C
                            score:
                              type: number
                              description: Returns a numeric score.
                              examples:
                              - '72.81'
                            name2:
                              type: string
                              description: Returns a secondary name or value for the node, usually the actual observable.
                              examples:
                              - 54.198.171.238
                            subscriber_collections:
                              type: array
                              description: Returns a list of collections subscribed to the indicator.
                              items: {}
                            parent_type:
                              type: string
                              description: Returns the parent object type in the system.
                              examples:
                              - indicator
                            followed:
                              type: boolean
                              description: Returns boolean indicating whether the user is following this indicator.
                              examples:
                              - 'false'
                            identifier:
                              type: string
                              description: Returns the source identifier.
                              examples:
                              - ctix
                            label:
                              type: string
                              description: Returns a human-readable tag or classification for the node.
                              examples:
                              - IP
                        type:
                          type: string
                          description: Returns one of the following values
                          enum:
                          - node
                          - link
                          examples:
                          - node
                        t:
                          type: string
                          description: Returns the value of the threat data object or the relationship type.
                          examples:
                          - 54.198.171.238
                        hi:
                          type: boolean
                          description: Returns `true` if the threat data element is hidden in the Threat investigation canvas, else returns `false`.
                          examples:
                          - 'false'
                        u:
                          type: string
                          description: Returns an endpoint to the image of a node.
                          examples:
                          - /ctix/images/graph/ipv4-addr.svg
                        x:
                          type: number
                          description: Returns the horizontal (X-axis) coordinate that determines the node’s position in a graphical threat investigation view.
                          examples:
                          - '511'
                        y:
                          type: number
                          description: Returns the vertical (Y-axis) coordinate that determines the node’s position in a graphical threat investigation view.
                          examples:
                          - '94'
                        added_node:
                          type: boolean
                          description: Indicates whether this node was newly created in the current session or action.
                          examples:
                          - 'false'
              example:
                next: {}
                previous: {}
                total: '1'
                page_size: '10'
                results:
                - id: indicator--3c1ed30a-659b-4a82-9d35-9328943aae23
                  prop:
                    tlp_data: AMBER
                    first_seen: '1626179839'
                    source_collections:
                    - name: Bruteforce Web
                      id: a9d46234-5948-4f88-8984-7d9701fd2c88
                    last_seen: '1626179839'
                    sources:
                    - created: '1626179839'
                      name: Volon
                      source_type: API FEEDS
                      id: e302863d-845d-4272-b0a9-13eebe5e0b40
                      category: System Feeds
                    stix_object_id: indicator--3c1ed30a-659b-4a82-9d35-9328943aae23
                    subscribers: []
                    deprecated: 'false'
                    intel_grading: POSSIBLY TRUE | 3
                    indicator_type: ipv4-addr
                    type: ipv4-addr
                    labels: []
                    source_grading: FAIRLY RELIABLE | C
                    score: '72.81'
                    name2: 54.198.171.238
                    subscriber_collections: []
                    parent_type: indicator
                    followed: 'false'
                    identifier: ctix
                    label: IP
                  type: node
                  t: 54.198.171.238
                  hi: 'false'
                  u: /ctix/images/graph/ipv4-addr.svg
                  x: '511'
                  y: '94'
                  added_node: 'false'
  /ingestion/canvas/:
    get:
      operationId: listCanvases
      summary: Get Canvases List
      tags:
      - Threat Investigation
      description: Returns a list of canvases.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-investigation/canvas/list-canvases
      parameters:
      - name: created_by_id
        in: query
        required: false
        schema:
          type: string
          description: Pass the ID of the creator.
          examples:
          - '1234'
        description: Pass the ID of the creator.
      - name: q
        in: query
        required: false
        schema:
          type: string
          description: Pass the query text to search for threat investigations by the title.
          examples:
          - canvas
        description: Pass the query text to search for threat investigations by the title.
      - name: shared_type
        in: query
        required: false
        schema:
          type: string
          description: Pass the sharing type to filter.
          enum:
          - private
          - shared
          - received
          examples:
          - private
        description: Pass the sharing type to filter.
      - name: created_from
        in: query
        required: false
        schema:
          type: string
          description: Pass the created time in epoch format to filter results.
          examples:
          - '1633067201'
        description: Pass the created time in epoch format to filter results.
      - name: created_to
        in: query
        required: false
        schema:
          type: string
          description: Pass the created time in epoch format to filter results.
          examples:
          - '1633067253'
        description: Pass the created time in epoch format to filter results.
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve records.
          default: '1'
        description: Pass the page number to retrieve records.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve on each page.
          maxLength: 100
          default: '10'
        description: Pass the number of records to retrieve on each page.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  next:
                    type: object
                    description: Returns the pagination link to the next page.
                  previous:
                    type: object
                    description: Returns the pagination link to the previous page.
                  total:
                    type: number
                    description: Returns the total number of canvases created.
                    examples:
                    - 4
                  page_size:
                    type: number
                    description: Returns the number of results per page.
                    examples:
                    - 10
                  results:
                    type: array
                    description: Returns the details of the canvas.
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                          description: Returns the ID of a canvas.
                          examples:
                          - fc84c3cf-570d-48e0-91f0-d23cde141612
                        name:
                          type: string
                          description: Returns the name of a canvas.
                          examples:
                          - canvas
                        created:
                          type: number
                          description: Returns the date and time when the canvas is created.
                          examples:
                          - 1633081533
                        modified:
                          type: number
                          description: Returns the date and time when the canvas is last modified.
                          examples:
                          - 1633081533
                        created_by:
                          type: string
                          description: Returns the details of the user who created the canvas.
                          examples:
                          - (unknown)
                        shared_type:
                          type: string
                          description: Returns the sharing type of the canvas, such as `shared`, `private`, or `received`.
                          examples:
                          - shared
              example:
                next: {}
                previous: {}
                total: 4
                page_size: 10
                results:
                - id: fc84c3cf-570d-48e0-91f0-d23cde141612
                  name: canvas
                  created: 1633081533
                  modified: 1633081533
                  created_by: (unknown)
                  shared_type: shared
  /ingestion/investigation/ctix-enrichment/:
    post:
      operationId: analyzeRelations
      summary: Analyze Relations
      tags:
      - Threat Investigation
      description: Returns relationship details of threat data objects within Intel Exchange.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-investigation/enrichment/analyze-relations
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                ids:
                  type: array
                  description: Pass a list of threat object IDs.
                  items:
                    type: string
                    description: This is an example ID.
                    examples:
                    - ff8fcc0f-4efb-4492-9145-230317fea9c4
              required:
              - ids
            example:
              ids:
              - ff8fcc0f-4efb-4492-9145-230317fea9c4
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  next:
                    type: object
                    description: Returns the pagination link to the next page.
                  page_size:
                    type: number
                    description: Returns the number of results retrieved per page.
                    examples:
                    - '10'
                  previous:
                    type: object
                    description: Returns the pagination link to the previous page.
                  results:
                    type: array
                    description: Returns the relationship details of threat data object
                    items:
                      type: object
                      properties:
                        hi:
                          type: boolean
                          description: Returns `true` if the threat data object is hidden in the threat investigation canvas, else returns `false`.
                          examples:
                          - 'false'
                        id:
                          type: string
                          description: Returns the ID of the threat data object or the relationship type.
                          examples:
                          - ff8fcc0f-4efb-4492-9145-230317fea9c4
                        prop:
                          type: object
                          description: Returns additional information about the threat data object or the relationship type.
                          properties:
                            analyst_score:
                              type: object
                              description: Returns the analyst-assigned score.
                            analyst_tlp:
                              type: object
                              description: Returns the analyst-assigned score.
                            confidence_score:
                              type: number
                              description: Returns the confidence score of the object.
                              examples:
                              - '40'
                            confidence_type:
                              type: string
                              description: Returns the confidence type of the object.
                              examples:
                              - ctix
                            country:
                              type: object
                              description: Returns the geographic information about the object source.
                            created:
                              type: number
                              description: Returns the Unix timestamp when the indicator was created.
                              examples:
                              - '1634636796'
                            first_seen:
                              type: object
                              description: Returns when the object was first observed.
                            id:
                              type: string
                              description: Returns the unique identifier for the threat object.
                              examples:
                              - ff8fcc0f-4efb-4492-9145-230317fea9c4
                            identifier:
                              type: string
                              description: Returns the internal system identifier for the threat object.
                              examples:
                              - ctix
                            indicator_type:
                              type: string
                              description: Returns the type of the object.
                              examples:
                              - url
                            is_actioned:
                              type: boolean
                              description: Boolean indicating if the threat has been actioned.
                              examples:
                              - 'false'
                            is_deprecated:
                              type: boolean
                              description: Boolean indicating whether the object is outdated.
                              examples:
                              - 'false'
                            is_false_positive:
                              type: boolean
                              description: Boolean indicating if this was marked as a false positive.
                              examples:
                              - 'false'
                            is_reviewed:
                              type: boolean
                              description: Boolean indicating whether this threat has been reviewed by an analyst.
                              examples:
                              - 'false'
                            is_revoked:
                              type: boolean
                              description: Boolean indicating whether this threat has been reviewed by an analyst.
                              examples:
                              - 'false'
                            is_whitelisted:
                              type: boolean
                              description: Boolean indicating the indicator is allowed/safe.
                              examples:
                              - 'false'
                            label:
                              type: string
                              description: Returns the label for the object type.
                              examples:
                              - Url
                            last_seen:
                              type: object
                              description: Returns the last time the indicator was observed
                            modified:
                              type: number
                              description: Returns the Unix timestamp for the last modification of the object.
                              examples:
                              - '1634636796'
                            name:
                              type: string
                              description: Returns the name of the object.
                              examples:
                              - http://mailservicenow.com/GYfIjwS9bd1nqxSiU1LPb2jcFvhZSBVOjCM1AAAAXGbXCckzcpTILveooC0FGTR%2F8vtVn7gDOIAvF6Tce0TICkadNQh%2BSQYWw6iT6QA5o5nvQzg%3D
                            'null':
               

# --- truncated at 32 KB (107 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-threat-investigation-api-openapi.yml