Cyware Watchlist API

openapi: 3.2.0
info:
  title: Cyware Intel Exchange (CTIX) v3 Open Watchlist API
  version: 3.6.2
  description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.


    Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.


    This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
  contact:
    name: Cyware
    url: https://www.cyware.com/contact-us
  termsOfService: https://www.cyware.com/legal/terms-of-use
  x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
  x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
  description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
  variables:
    ctix_host:
      default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Watchlist
  description: Watchlist
paths:
  /ingestion/watchlist/:
    post:
      operationId: addKeywordToWatchlist
      summary: Add Keyword to Watchlist
      tags:
      - Watchlist
      description: Adds a keyword to the watchlist.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/watchlist/add-keyword-to-watchlist
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                is_email_alert:
                  type: boolean
                  description: Pass true to send an email alert about the watchlist occurrences; otherwise, pass false.
                  examples:
                  - 'false'
                external_recipients:
                  type: object
                  description: Pass a list of email addresses of the external recipients.
                  properties:
                    to:
                      type: array
                      description: Pass details of the external recipient of the report.
                      items:
                        type: string
                        description: This is an example email ID.
                        examples:
                        - abc@domain.com
                    cc:
                      type: array
                      description: Enter the cc email addresses for the external recipients.
                      items:
                        type: string
                        description: This is an example email ID.
                        examples:
                        - abc2@domain.com
                    bcc:
                      type: array
                      description: Enter the bcc email addresses for the external recipients.
                      items:
                        type: string
                        description: This is an example email ID.
                        examples:
                        - abc3@domain.com
                internal_recipients:
                  type: object
                  description: Pass a list of unique IDs and details of the internal recipients.
                  properties:
                    to:
                      type: array
                      description: Pass details of the internal recipient of the report
                      items:
                        type: object
                        properties:
                          id:
                            type: string
                            description: Pass the user ID.
                            examples:
                            - 48c1b826-c8c6-48a6-a1b2-f52faef1035d
                          first_name:
                            type: string
                            description: Pass the first name of the internal recipient.
                            examples:
                            - john
                          last_name:
                            type: string
                            description: Pass the last name of the internal recipient.
                            examples:
                            - doe
                          email:
                            type: string
                            description: Pass the email address.
                            examples:
                            - john.doe@domain.com
                    cc:
                      type: array
                      description: Pass the details for the internal recipients.
                      items:
                        type: object
                        properties:
                          id:
                            type: string
                            description: Pass the user ID.
                            examples:
                            - 74b34e52-a0e3-4277-915c-65096f8ceeba
                          first_name:
                            type: string
                            description: Pass the first name of the internal recipient.
                            examples:
                            - jane
                          last_name:
                            type: string
                            description: Pass the last name of the internal recipient.
                            examples:
                            - doe
                          email:
                            type: string
                            description: Pass the email address.
                            examples:
                            - jane.doe@cyware.com
                    bcc:
                      type: array
                      description: Pass the details for the internal recipients.
                      items:
                        type: object
                        properties:
                          id:
                            type: string
                            description: Pass the user ID.
                            examples:
                            - f2e42899-f13d-47b0-bf52-57b444f3c881
                          first_name:
                            type: string
                            description: Pass the first name of the internal recipient.
                            examples:
                            - sara
                          last_name:
                            type: string
                            description: Pass the last name of the internal recipient.
                            examples:
                            - taylor
                          email:
                            type: string
                            description: Pass the email address.
                            examples:
                            - sara.taylor@cyware.com
                name:
                  type: string
                  description: Pass the value of the keyword.
                  examples:
                  - sample keyword
            example:
              is_email_alert: 'false'
              external_recipients:
                to:
                - abc@domain.com
                cc:
                - abc2@domain.com
                bcc:
                - abc3@domain.com
              internal_recipients:
                to:
                - id: 48c1b826-c8c6-48a6-a1b2-f52faef1035d
                  first_name: john
                  last_name: doe
                  email: john.doe@domain.com
                cc:
                - id: 74b34e52-a0e3-4277-915c-65096f8ceeba
                  first_name: jane
                  last_name: doe
                  email: jane.doe@cyware.com
                bcc:
                - id: f2e42899-f13d-47b0-bf52-57b444f3c881
                  first_name: sara
                  last_name: taylor
                  email: sara.taylor@cyware.com
              name: sample keyword
      responses:
        '201':
          description: HTTP 201 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Returns the ID of the watchlist keyword.
                    examples:
                    - cd5acb44-506d-41ea-a347-54363c379b14
                  name:
                    type: string
                    description: Returns the value of the watchlist keyword.
                    examples:
                    - sample keyword
                  created:
                    type: number
                    description: Returns the date and time of the creation of a watchlist keyword.
                    examples:
                    - '1703679482'
                  modified:
                    type: number
                    description: Returns the date and time of modification of the watchlist keyword.
                    examples:
                    - '1703679482'
                  created_by:
                    type: string
                    description: Returns the ID of the user that created the watchlist keyword.
                    examples:
                    - a2b82e81-8e7d-4e68-8a36-3d2d9cd518ad
                  updated_by:
                    type: string
                    description: Returns the ID of the user that updated the watchlist keyword.
                    examples:
                    - a2b82e81-8e7d-4e68-8a36-3d2d9cd518ad
                  last_activity_on:
                    type: object
                    description: Returns the date and time at which the watchlist keyword was last active.
                  is_active:
                    type: boolean
                    description: Returns true if the watchlist keyword is active, else returns false.
                    examples:
                    - 'true'
                  is_removed:
                    type: boolean
                    description: Returns true if the watchlist keyword is removed, else returns false.
                    examples:
                    - 'false'
                  is_email_alert:
                    type: boolean
                    description: Returns true if an email alert is sent for the watchlist keyword, else returns false.
                    examples:
                    - 'false'
                  internal_recipients:
                    type: object
                    description: Returns the user details of the internal recipients.
                    properties:
                      to:
                        type: array
                        description: Returns details of the internal recipient of the report.
                        items:
                          type: object
                          properties:
                            id:
                              type: string
                              description: Returns the user ID.
                              examples:
                              - 48c1b826-c8c6-48a6-a1b2-f52faef1035d
                            first_name:
                              type: string
                              description: Returns the first name of the internal recipient.
                              examples:
                              - john
                            last_name:
                              type: string
                              description: Returns the last name of the internal recipients.
                              examples:
                              - doe
                            email:
                              type: string
                              description: Returns the email address.
                              examples:
                              - john.doe@domain.com
                      cc:
                        type: array
                        description: Returns details of the internal recipient of the report.
                        items:
                          type: object
                          properties:
                            id:
                              type: string
                              description: Returns the user ID.
                              examples:
                              - 74b34e52-a0e3-4277-915c-65096f8ceeba
                            first_name:
                              type: string
                              description: Returns the first name of the internal recipient.
                              examples:
                              - jane
                            last_name:
                              type: string
                              description: Returns the last name of the internal recipients.
                              examples:
                              - doe
                            email:
                              type: string
                              description: Returns the email address.
                              examples:
                              - jane.doe@cyware.com
                      bcc:
                        type: array
                        description: Returns details of the internal recipient of the report.
                        items:
                          type: object
                          properties:
                            id:
                              type: string
                              description: Returns the user ID.
                              examples:
                              - f2e42899-f13d-47b0-bf52-57b444f3c881
                            first_name:
                              type: string
                              description: Returns the first name of the internal recipient.
                              examples:
                              - sara
                            last_name:
                              type: string
                              description: Returns the last name of the internal recipients.
                              examples:
                              - taylor
                            email:
                              type: string
                              description: Returns the email address.
                              examples:
                              - sara.taylor@cyware.com
                  external_recipients:
                    type: object
                    description: Returns the list of email addresses of the external recipients.
                    properties:
                      to:
                        type: array
                        description: Returns the details of the external recipient of the report.
                        items:
                          type: string
                          description: This is an example email ID.
                          examples:
                          - abc@domain.com
                      cc:
                        type: array
                        description: Returns the cc email addresses for the external recipients.
                        items:
                          type: string
                          description: This is an example email ID.
                          examples:
                          - abc2@domain.com
                      bcc:
                        type: array
                        description: Returns the bcc email addresses for the external recipients.
                        items:
                          type: string
                          description: This is an example email ID.
                          examples:
                          - abc3@domain.com
                  occurrences:
                    type: number
                    description: Returns the number of occurrences found for a watchlist keyword.
                    examples:
                    - '0'
              example:
                id: cd5acb44-506d-41ea-a347-54363c379b14
                name: sample keyword
                created: '1703679482'
                modified: '1703679482'
                created_by: a2b82e81-8e7d-4e68-8a36-3d2d9cd518ad
                updated_by: a2b82e81-8e7d-4e68-8a36-3d2d9cd518ad
                last_activity_on: {}
                is_active: 'true'
                is_removed: 'false'
                is_email_alert: 'false'
                internal_recipients:
                  to:
                  - id: 48c1b826-c8c6-48a6-a1b2-f52faef1035d
                    first_name: john
                    last_name: doe
                    email: john.doe@domain.com
                  cc:
                  - id: 74b34e52-a0e3-4277-915c-65096f8ceeba
                    first_name: jane
                    last_name: doe
                    email: jane.doe@cyware.com
                  bcc:
                  - id: f2e42899-f13d-47b0-bf52-57b444f3c881
                    first_name: sara
                    last_name: taylor
                    email: sara.taylor@cyware.com
                external_recipients:
                  to:
                  - abc@domain.com
                  cc:
                  - abc2@domain.com
                  bcc:
                  - abc3@domain.com
                occurrences: '0'
    get:
      operationId: listWatchlistKeywords
      summary: Get Watchlist Keywords List
      tags:
      - Watchlist
      description: Returns a list of keywords from the watchlist.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/watchlist/list-watchlist-keywords
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve watchlist keywords.
          default: '1'
          examples:
          - '1'
        description: Pass the page number to retrieve watchlist keywords.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of keywords to retrieve on each page.
          maxLength: 100
          default: '10'
          examples:
          - '10'
        description: Pass the number of keywords to retrieve on each page.
      - name: last_active_on_from
        in: query
        required: false
        schema:
          type: string
          description: Pass the last active from time in epoch format.
          examples:
          - '1702252800'
        description: Pass the last active from time in epoch format.
      - name: last_active_on_to
        in: query
        required: false
        schema:
          type: string
          description: Pass the last active to time in epoch format.
          examples:
          - '1703548799'
        description: Pass the last active to time in epoch format.
      - name: is_active
        in: query
        required: false
        schema:
          type: string
          description: Pass true to retrieve active keywords only. By default, both active and inactive keywords are retrieved.
          examples:
          - 'true'
        description: Pass true to retrieve active keywords only. By default, both active and inactive keywords are retrieved.
      - name: created_from
        in: query
        required: false
        schema:
          type: string
          description: Pass the created from time in epoch format.
          examples:
          - '1701648000'
        description: Pass the created from time in epoch format.
      - name: created_to
        in: query
        required: false
        schema:
          type: string
          description: Pass the created to time in epoch format.
          examples:
          - '1703721599'
        description: Pass the created to time in epoch format.
      - name: created_by
        in: query
        required: false
        schema:
          type: string
          description: Pass the ID of a creator to filter keywords.
          examples:
          - bff67ec3-c591-4ab7-8677-f23671e2a65a
        description: Pass the ID of a creator to filter keywords.
      responses:
        '200':
          description: HTTP 200 response
          content:
            json:
              schema:
                type: object
                properties:
                  next:
                    type: string
                    description: Returns a link to the next page of the response.
                    examples:
                    - watchlist/?page=2&page_size=10&sort=-created
                  page_size:
                    type: number
                    description: Returns the number of keywords retrieved.
                    examples:
                    - 10
                  previous:
                    type: string
                    description: Returns a link to the previous page of the response.
                  results:
                    type: array
                    items:
                      type: object
                      properties:
                        created:
                          type: number
                          description: Returns the creation time of the keyword in epoch format.
                          examples:
                          - 1649919675
                        created_by:
                          type: object
                          description: Returns the user details of the person who added the keyword to the watchlist
                          properties:
                            email:
                              type: string
                              description: Returns the email address of the user who created the report.
                              examples:
                              - test@cyware.com
                            first_name:
                              type: string
                              description: Returns the first name of the user who created the report.
                              examples:
                              - test
                            id:
                              type: string
                              description: Returns the ID of the user who created the report.
                              examples:
                              - 244e2320-dce9-457d-a59d-86ea4d681dfa
                            last_name:
                              type: string
                              description: Returns the last name of the user who created the report.
                              examples:
                              - ansari
                        external_recipients:
                          type: object
                          description: Returns the email addresses of the non-CTIX users who receive the watchlist information.
                          properties:
                            bcc:
                              type: array
                              description: Returns the bcc email addresses for the external recipients.
                              items:
                                type: string
                                description: This is an example bcc email ID.
                                examples:
                                - abc2@gmail.com
                            cc:
                              type: array
                              description: Returns the cc email addresses for the external recipients.
                              items:
                                type: string
                                description: This is an example cc email ID.
                                examples:
                                - abc1@gmail.com
                            to:
                              type: array
                              description: Returns details of the internal recipient of the report.
                              items:
                                type: string
                                description: This is an example email ID.
                                examples:
                                - abc@gmail.com
                        id:
                          type: string
                          description: Returns the ID of the keyword.
                          examples:
                          - 2fcb4f9c-541b-493e-afd5-643cfffb4c3f
                        internal_recipients:
                          type: object
                          description: Returns the list of internal recipients with whom to share the watchlist information.
                          properties:
                            to:
                              type: array
                              description: Pass details of the internal recipient of the report.
                              items:
                                type: object
                                properties:
                                  id:
                                    type: string
                                    description: Returns the user ID.
                                    examples:
                                    - 48c1b826-c8c6-48a6-a1b2-f52faef1035d
                                  first_name:
                                    type: string
                                    description: Returns the first name of the internal recipient.
                                    examples:
                                    - test
                                  last_name:
                                    type: string
                                    description: Returns the last name of the internal recipient.
                                    examples:
                                    - test
                                  email:
                                    type: string
                                    description: Returns the email address.
                                    examples:
                                    - test@cyware.com
                            cc:
                              type: array
                              description: Returns the cc email addresses for the internal recipients.
                              items:
                                type: object
                                properties:
                                  id:
                                    type: string
                                    description: Returns the user ID.
                                    examples:
                                    - 74b34e52-a0e3-4277-915c-65096f8ceeba
                                  first_name:
                                    type: string
                                    description: Returns the first name of the internal recipient.
                                    examples:
                                    - test2
                                  last_name:
                                    type: string
                                    description: Returns the last name of the internal recipient.
                                    examples:
                                    - test2
                                  email:
                                    type: string
                                    description: Returns the email address.
                                    examples:
                                    - test2@cyware.com
                            bcc:
                              type: array
                              description: Enter the bcc email addresses for the internal recipients.
                              items:
                                type: object
                                properties:
                                  id:
                                    type: string
                                    description: Returns the user ID.
                                    examples:
                                    - f2e42899-f13d-47b0-bf52-57b444f3c881
                                  first_name:
                                    type: string
                                    description: Returns the first name of the internal recipient.
                                    examples:
                                    - test4
                                  last_name:
                                    type: string
                                    description: Returns the last name of the internal recipient.
                                    examples:
                                    - test4
                                  email:
                                    type: string
                                    description: Returns the email address.
                                    examples:
                                    - test4@cyware.com
                        is_active:
                          type: boolean
                          description: Returns true if the keyword is active, else returns false.
                          examples:
                          - true
                        is_email_alert:
                          type: boolean
                          description: Returns true if the email alert is sent for the keyword, else returns false.
                          examples:
                          - true
                        is_removed:
                          type: boolean
                          description: Returns true if the keyword is removed, else returns false.
                          examples:
                          - false
                        last_activity_on:
                          type: number
                          description: Returns the time in epoch format at which the keyword was last active.
                          examples:
                          - 1649919675
                        modified:
                          type: number
                          description: Returns the time in epoch format at which the keyword was last modified.
                          examples:
                          - 1649919675
                        name:
                          type: string
                          description: Returns the value of the keyword.
                          examples:
                          - parker_peter.com
                        occurrences:
                          type: number
                          description: Returns the number of occurrences a keyword is observed in the platform.
                          examples:
                          - 0
                        updated_by:
                          type: object
                          description: Returns the user details the last updated keyword.
                          properties:
                            email:
                              type: string
                              description: Returns the email address of the user who updated the report.
                              examples:
                              - test@cyware.com
                            first_name:
                              type: string
                              description: Returns the first name of the user who updated the report.
                              examples:
                              - test
                            id:
                              type: string
                              description: Returns the ID of the user who updated the report.
                              examples:
                              - 244e2320-dce9-457d-a59d-86ea4d681dfa
                            last_name:
                              type: string
                              description: Returns the last name of the user who updated the report.
                              examples:
                              - ansari
                  total:
                    type: number
   

# --- truncated at 32 KB (59 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-watchlist-api-openapi.yml