Filigran

OpenCTI GraphQL API

The OpenCTI platform exposes a full GraphQL API on the /graphql endpoint for programmatic access to cyber threat intelligence knowledge modeled on STIX 2.1. Authentication uses a per-user bearer API token. A GraphiQL-based playground is available on /public/graphql, and a native embedded MCP server is exposed for AI agents.

GitHub

Documentation

📖
Documentation
https://docs.opencti.io/latest/
📖
APIReference
https://docs.opencti.io/latest/reference/api/
📖
GettingStarted
https://docs.opencti.io/latest/usage/getting-started/

Other Resources

🔗
Webhooks
https://docs.opencti.io/latest/administration/notifiers/
🔗
APIsJSON
https://raw.githubusercontent.com/api-evangelist/filigran/refs/heads/main/apis.yml

API entry from apis.yml

apis.yml Raw ↑ 
name: OpenCTI GraphQL API
description: The OpenCTI platform exposes a full GraphQL API on the /graphql endpoint for programmatic
  access to cyber threat intelligence knowledge modeled on STIX 2.1. Authentication uses a per-user bearer
  API token. A GraphiQL-based playground is available on /public/graphql, and a native embedded MCP server
  is exposed for AI agents.
humanURL: https://docs.opencti.io/latest/reference/api/
baseURL: https://demo.opencti.io/graphql
tags:
- Threat Intelligence
- GraphQL
- STIX
- OpenCTI
properties:
- type: Documentation
  url: https://docs.opencti.io/latest/
- type: APIReference
  url: https://docs.opencti.io/latest/reference/api/
- type: GettingStarted
  url: https://docs.opencti.io/latest/usage/getting-started/
- type: Webhooks
  url: https://docs.opencti.io/latest/administration/notifiers/