Cyware Threat Mailbox API

openapi: 3.2.0
info:
  title: Cyware Intel Exchange (CTIX) v3 Open Threat Mailbox API
  version: 3.6.2
  description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.


    Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.


    This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
  contact:
    name: Cyware
    url: https://www.cyware.com/contact-us
  termsOfService: https://www.cyware.com/legal/terms-of-use
  x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
  x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
  description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
  variables:
    ctix_host:
      default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Threat Mailbox
  description: Threat Mailbox
paths:
  /conversion/feed-sources/{email_id}/stix/:
    put:
      operationId: createIntelFromEmail
      summary: Create Intel from Email
      tags:
      - Threat Mailbox
      description: Creates intel from Threat Mailbox emails in Intel Exchange.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-mailbox/create-intel-from-email
      parameters:
      - name: email_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of an email
          examples:
          - 1f429416-4467-43fb-96e0-708f64533f37
        description: Pass the unique ID of an email
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                source_type:
                  type: string
                  description: Pass the email accounts from which the intel is received.
                  examples:
                  - email_accounts
                content:
                  type: object
                  description: Pass the IOCs selected from the email content.
                  properties:
                    emails:
                      type: object
                      description: Pass the list of emails
                      properties:
                        all:
                          type: boolean
                          description: Returns a boolean flag indicating whether all email addresses extracted from the RSS feed should be included as IOCs.
                          examples:
                          - 'true'
                    domains:
                      type: object
                      description: Pass the list of domains
                      properties:
                        all:
                          type: boolean
                          description: Indicates whether all domains from the RSS feed should be included as IOCs.
                          examples:
                          - 'false'
                        negation:
                          type: boolean
                          description: Returns a boolean that determines whether the listed domain values should be excluded or included.
                          examples:
                          - 'true'
                        values:
                          type: array
                          description: Pass the values of domains.
                          items:
                            type: string
                            description: This is an example value.
                            examples:
                            - abc.com
                    ips:
                      type: object
                      description: Pass the list of IPs.
                      properties:
                        all:
                          type: boolean
                          description: Indicates whether all IP addresses parsed from the RSS feed should be added to the intel.
                          examples:
                          - 'false'
                        negation:
                          type: boolean
                          description: Determines whether the IP addresses listed in values should be excluded or included.
                          examples:
                          - 'false'
                        values:
                          type: array
                          description: Pass the value of the IPs.
                          items:
                            type: string
                            description: This is an example value.
                            examples:
                            - 1.1.1.1
                attached_content:
                  type: object
                  description: Pass the IOCs selected from email attachments.
                  properties:
                    b95fe110-8bdd-4274-8d80-7318c97732eb:
                      type: object
                      description: Returns the IOC extraction rules specific to the attachment with the above ID.
                      properties:
                        domains:
                          type: object
                          description: Specifies how domains should be extracted or ignored from the content of this specific attachment.
                          properties:
                            all:
                              type: boolean
                              description: Indicates whether all domains from the RSS feed should be included as IOCs.
                              examples:
                              - 'false'
                            negation:
                              type: boolean
                              description: A boolean that determines whether the listed domain values should be excluded or included.
                              examples:
                              - 'true'
                            values:
                              type: array
                              description: The listed domains will be excluded from the generated intel.
                              items:
                                type: string
                                description: This is an example value.
                                examples:
                                - def.com
                metadata:
                  type: object
                  description: Pass the additional details of the report.
                  properties:
                    title:
                      type: string
                      description: Pass the title of the report.
                      examples:
                      - sample
                    description:
                      type: string
                      description: Pass the description of the report.
                      examples:
                      - desc
                    confidence:
                      type: number
                      description: Pass the confidence of the report.
                      examples:
                      - '80'
                    tlp:
                      type: string
                      description: Pass the TLP marked for the report.
                      examples:
                      - GREEN
              required:
              - source_type
            example:
              source_type: email_accounts
              content:
                emails:
                  all: 'true'
                domains:
                  all: 'false'
                  negation: 'true'
                  values:
                  - abc.com
                ips:
                  all: 'false'
                  negation: 'false'
                  values:
                  - 1.1.1.1
              attached_content:
                b95fe110-8bdd-4274-8d80-7318c97732eb:
                  domains:
                    all: 'false'
                    negation: 'true'
                    values:
                    - def.com
              metadata:
                title: sample
                description: desc
                confidence: '80'
                tlp: GREEN
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  details:
                    type: string
                    description: Returns the success or failure message.
                    examples:
                    - you will be notified once stix get created.
              example:
                details: you will be notified once stix get created.
  /conversion/feed-sources/email/inbox/{email_id}/attachments/:
    get:
      operationId: listAttachments
      summary: Get Attachments List
      tags:
      - Threat Mailbox
      description: Returns a list of attachments of an email message.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-mailbox/list-attachments
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve records.
          default: '1'
        description: Pass the page number to retrieve records.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve on each page.
          maxLength: 100
          default: '10'
        description: Pass the number of records to retrieve on each page.
      - name: email_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of an email.
          examples:
          - b5b51b15-88ef-4683-a7fb-95c0318a6322
        description: Pass the unique ID of an email.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  '0':
                    type: object
                    properties:
                      id:
                        type: string
                        description: Returns the unique ID of the attachment.
                        examples:
                        - 761dfd0c-7a4d-4bb6-9fb4-995f954a0b8e
                      name:
                        type: string
                        description: Returns the name of the attachment.
                        examples:
                        - no_pwd_pdf.pdf
                      mime_type:
                        type: string
                        description: Returns the MIME type of the attachment, such as PDF.
                        examples:
                        - application/pdf
                      is_protected:
                        type: boolean
                        description: Returns true if the attachment is password protected, else returns false.L
                        examples:
                        - 'false'
                      parsing_status:
                        type: number
                        description: Indicates the current state of the attachment parsing process, which is used to extract meaningful data such as IOCs, metadata, or embedded content.
                        examples:
                        - '0'
                      error_message:
                        type: string
                        description: Returns the error message, if present.
              example:
                '0':
                  id: 761dfd0c-7a4d-4bb6-9fb4-995f954a0b8e
                  name: no_pwd_pdf.pdf
                  mime_type: application/pdf
                  is_protected: 'false'
                  parsing_status: '0'
                  error_message: ''
      x-alternate-documents:
      - title: Download All Threat Mail Attachments
        operationId: downloadAllAttachments
        url: https://ctixapiv3.cyware.com/threat-mailbox/download-all-attachments
  /conversion/feed-sources/email/inbox/{email_id}/attachments/{file_id}/:
    get:
      operationId: downloadSingleAttachment
      summary: Download Single Threat Mail Attachment
      tags:
      - Threat Mailbox
      description: Use this API to download one attachment of an email message.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-mailbox/download-single-attachment
      parameters:
      - name: email_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of an email.
          examples:
          - b5b51b15-88ef-4683-a7fb-95c0318a6322
        description: Pass the unique ID of an email.
      - name: file_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of an attachment.
          examples:
          - 869e2f40-1dfd-4856-939f-4e453746490a
        description: Pass the unique ID of an attachment.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: string
                    description: Returns an endpoint with a token to download the attachment.
                    examples:
                    - '"http://localhost:8000/feed_sources/email/inbox/b8945432-f1fd-4e05-9fbd-b1afe358f654/attachments/869e2f40-1dfd-4856-939f-4e453746490a/download/?token=40209101-7b18-4984-b5eb-4e4c1c65d346"'
              example:
                result: '"http://localhost:8000/feed_sources/email/inbox/b8945432-f1fd-4e05-9fbd-b1afe358f654/attachments/869e2f40-1dfd-4856-939f-4e453746490a/download/?token=40209101-7b18-4984-b5eb-4e4c1c65d346"'
  /conversion/feed-sources/email/inbox/{id}/:
    get:
      operationId: emailDetails
      summary: Get Email Details
      tags:
      - Threat Mailbox
      description: Returns the details of an email.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-mailbox/email-details
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve records.
          default: '1'
        description: Pass the page number to retrieve records.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve on each page.
          maxLength: 100
          default: '10'
        description: Pass the number of records to retrieve on each page.
      - name: id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of an email.
          examples:
          - b5b51b15-88ef-4683-a7fb-95c0318a6322
        description: Pass the unique ID of an email.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Returns the unique ID of the email message.
                    examples:
                    - 96979ada-1a74-4528-96cf-a7d83b579077
                  email_config:
                    type: string
                    description: Returns the unique ID of the email feed source.
                    examples:
                    - 5578d40e-90c7-4ec7-a63a-0a3244158444
                  to:
                    type: string
                    description: Returns the username of the receiver.
                    examples:
                    - john.doe@gmail.com
                  to_email:
                    type: string
                    description: Returns the email address of the receiver.
                    examples:
                    - john.doe@gmail.com
                  _from:
                    type: string
                    description: Returns the username of the sender.
                    examples:
                    - Google Community Team <googlecommunityteam-noreply@google.com>
                  _from_email:
                    type: string
                    description: Returns the email address of the sender.
                    examples:
                    - googlecommunityteam-noreply@google.com
                  subject:
                    type: string
                    description: Returns the subject of the email message.
                    examples:
                    - Threatmailbox, finish setting up your new Google Account
                  date:
                    type: number
                    description: Returns the date and time in epoch format when the email is received.
                    examples:
                    - '1616682859'
                  is_read:
                    type: boolean
                    description: Returns true if the email is read, else returns false.
                    examples:
                    - 'false'
                  is_starred:
                    type: boolean
                    description: Returns true if the email message is bookmarked, else returns false.
                    examples:
                    - 'false'
                  is_delete:
                    type: boolean
                    description: Returns true if the email message is trashed, else returns false.
                    examples:
                    - 'false'
                  stix_created:
                    type: boolean
                    description: Returns true if intel is created from this email message, else returns false.
                    examples:
                    - 'false'
                  tenant_id:
                    type: string
                    description: Returns the unique ID of the Intel Exchange instance.
                    examples:
                    - 27e7256e-edf9-41cc-a325-6fde16e793db
                  created:
                    type: number
                    description: Returns the date and time in epoch format when the email is received in Intel Exchange.
                    examples:
                    - '1621846793'
                  raw_body:
                    type: string
                    description: Returns the body of the email message.
                    examples:
                    - <sample html>
                  raw_header:
                    type: string
                    description: Returns the complete, unprocessed header section of the email, containing technical metadata and routing information.
                    examples:
                    - sample header
                  is_regulatory_email:
                    type: boolean
                    description: Returns true if the email is marked as a regulatory email, else returns false.
                    examples:
                    - 'false'
                  folder_id:
                    type: number
                    description: Returns the unique ID of the email folder.
                    examples:
                    - '142'
                  folder_name:
                    type: string
                    description: Returns the name of the email folder.
                    examples:
                    - INBOX
                  has_attachments:
                    type: boolean
                    description: Returns true if the email message includes attachments, else returns false.
                    examples:
                    - 'false'
              example:
                id: 96979ada-1a74-4528-96cf-a7d83b579077
                email_config: 5578d40e-90c7-4ec7-a63a-0a3244158444
                to: john.doe@gmail.com
                to_email: john.doe@gmail.com
                _from: Google Community Team <googlecommunityteam-noreply@google.com>
                _from_email: googlecommunityteam-noreply@google.com
                subject: Threatmailbox, finish setting up your new Google Account
                date: '1616682859'
                is_read: 'false'
                is_starred: 'false'
                is_delete: 'false'
                stix_created: 'false'
                tenant_id: 27e7256e-edf9-41cc-a325-6fde16e793db
                created: '1621846793'
                raw_body: <sample html>
                raw_header: sample header
                is_regulatory_email: 'false'
                folder_id: '142'
                folder_name: INBOX
                has_attachments: 'false'
  /conversion/feed-sources/email/inbox/{email_id}/iocs-count/:
    get:
      operationId: iocsCount
      summary: Get IOCs Count
      tags:
      - Threat Mailbox
      description: Returns the number of IOCs in the email body and email attachments.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-mailbox/iocs-count
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve records.
          default: '1'
        description: Pass the page number to retrieve records.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve on each page.
          maxLength: 100
          default: '10'
        description: Pass the number of records to retrieve on each page.
      - name: email_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of an email.
          examples:
          - 1f429416-4467-43fb-96e0-708f64533f37
        description: Pass the unique ID of an email.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  email:
                    type: object
                    description: Returns an object that represents the count of IOCs (Indicators of Compromise) extracted from emails.
                    properties:
                      total:
                        type: number
                        description: Returns the count of IOCs in the email body.
                        examples:
                        - '1'
                  attachments:
                    type: array
                    description: Returns a list of attachment objects, each representing a file analyzed for IOCs.
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                          description: Returns the Unique ID of the attachment.
                          examples:
                          - 07ae1961-1292-4c8b-aeb9-108beb32151f
                        name:
                          type: string
                          description: Returns the name of the attachment.
                          examples:
                          - CSV botnet and RF - recorded future (1).csv
                        total:
                          type: number
                          description: Returns the count of IOCs in the attachment.
                          examples:
                          - '5'
              example:
                email:
                  total: '1'
                attachments:
                - id: 07ae1961-1292-4c8b-aeb9-108beb32151f
                  name: CSV botnet and RF - recorded future (1).csv
                  total: '5'
  /conversion/feed-sources/{email_id}/iocs/:
    get:
      operationId: iocsListing
      summary: Get IOCs Listing
      tags:
      - Threat Mailbox
      description: Returns a list of IOCs and attachments in an email.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-mailbox/iocs-listing
      parameters:
      - name: type
        in: query
        required: false
        schema:
          type: string
          description: Entity type (value will be `email_accounts_attachment` or `email_accounts`)
          examples:
          - email_accounts
        description: Entity type (value will be `email_accounts_attachment` or `email_accounts`)
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve records.
          default: '1'
        description: Pass the page number to retrieve records.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve on each page.
          maxLength: 100
          default: '10'
        description: Pass the number of records to retrieve on each page.
      - name: email_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of an email.
          examples:
          - 1f429416-4467-43fb-96e0-708f64533f37
        description: Pass the unique ID of an email.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  results:
                    type: object
                    description: Returns the list of IOCs.
                    properties:
                      urls:
                        type: array
                        description: Returns the list of URLs.
                        items: {}
                      registry_key_path:
                        type: array
                        items: {}
                      ips:
                        type: array
                        description: Returns the list of IPs
                        items:
                          type: object
                          properties:
                            value:
                              type: string
                              description: Returns the value of the IP.
                              examples:
                              - 1.1.1.1
                            is_previously_created:
                              type: boolean
                              description: Returns true is the value was previously created.
                              examples:
                              - 'false'
                      ipv6:
                        type: array
                        description: Returns the list of IPv6 addresses.
                        items: {}
                      emails:
                        type: array
                        description: Returns the list of emails.
                        items: {}
                      domains:
                        type: array
                        description: Returns the list of domains.
                        items: {}
                      file_paths:
                        type: array
                        description: Returns the list of file paths.
                        items: {}
                      sha512:
                        type: array
                        description: Returns the list of SHA512.
                        items: {}
                      sha256:
                        type: array
                        description: Returns the list of SHA256.
                        items: {}
                      sha1:
                        type: array
                        description: Returns the list of SHA1
                        items:
                          type: object
                          properties:
                            value:
                              type: string
                              description: Returns the value of SHA1
                              examples:
                              - 751a9cbffec28b22105cdcaf073a371de255f176
                            is_previously_created:
                              type: boolean
                              description: Returns true, if the value was previously created.
                              examples:
                              - 'false'
                      md5:
                        type: array
                        description: Returns the list of MD5.
                        items: {}
                      sha224:
                        type: array
                        description: Returns the list of SHA224.
                        items: {}
                      sha384:
                        type: array
                        description: Returns the list of SHA384.
                        items: {}
                      ssdeeps:
                        type: array
                        description: Returns the list of SSDEEPS.
                        items: {}
                      cve_ids:
                        type: array
                        description: Returns the list of CVE IDs.
                        items: {}
                      asn:
                        type: array
                        description: Returns the list of ASN.
                        items: {}
                      mutex:
                        type: array
                        description: Returns the list of mutexes.
                        items: {}
                      as:
                        type: array
                        description: Returns the list of AS.
                        items: {}
                      cidrs:
                        type: array
                        description: Returns the list of CIDRS.
                        items: {}
              example:
                results:
                  urls: []
                  registry_key_path: []
                  ips:
                  - value: 1.1.1.1
                    is_previously_created: 'false'
                  ipv6: []
                  emails: []
                  domains: []
                  file_paths: []
                  sha512: []
                  sha256: []
                  sha1:
                  - value: 751a9cbffec28b22105cdcaf073a371de255f176
                    is_previously_created: 'false'
                  md5: []
                  sha224: []
                  sha384: []
                  ssdeeps: []
                  cve_ids: []
                  asn: []
                  mutex: []
                  as: []
                  cidrs: []
  /conversion/feed-sources/email/inbox/:
    get:
      operationId: listEmails
      summary: Get Emails List
      tags:
      - Threat Mailbox
      description: Returns a list of email messages received from email feed sources.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/threat-mailbox/list-emails
      parameters:
      - name: email_config
        in: query
        required: false
        schema:
          type: string
          description: Pass the ID of the email feed source to retrieve emails from a specific source. By default, emails from all email sources are retrieved. To retrieve the email source ID, use the **GET Email Sour

# --- truncated at 32 KB (154 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-threat-mailbox-api-openapi.yml