Juniper Networks Threat Intelligence API

openapi: 3.2.0
info:
  title: Juniper Networks Juniper Advanced Threat Prevention (ATP) Cloud Threat Intelligence API
  description: Juniper Advanced Threat Prevention (ATP) Cloud API provides access to threat intelligence, malware analysis, and security event management. The API enables querying threat feeds, submitting files for analysis, retrieving detection verdicts, managing allow/block lists, and accessing threat intelligence data for integration with SRX Series firewalls and other security infrastructure.
  version: 1.0.0
  contact:
    name: Juniper Support
    url: https://www.juniper.net/us/en/products/security/advanced-threat-prevention.html
    email: support@juniper.net
  license:
    name: Proprietary
    url: https://www.juniper.net/us/en/legal-notices.html
servers:
- url: https://{atp_server}/api/v1
  description: ATP Cloud Server
  variables:
    atp_server:
      default: atp.juniper.net
      description: ATP Cloud server hostname
security:
- apiKey: []
tags:
- name: Threat Intelligence
  description: Threat feed and intelligence data
paths:
  /threat-intelligence/feeds:
    get:
      operationId: listThreatFeeds
      summary: Juniper Networks List threat feeds
      description: Returns available threat intelligence feeds and their status.
      tags:
      - Threat Intelligence
      responses:
        '200':
          description: List of threat feeds
          content:
            application/json:
              schema:
                type: object
                properties:
                  feeds:
                    type: array
                    items:
                      $ref: '#/components/schemas/ThreatFeed'
  /threat-intelligence/ip-lookup:
    get:
      operationId: lookupIpReputation
      summary: Juniper Networks Look up IP reputation
      description: Returns the threat reputation score and details for an IP address.
      tags:
      - Threat Intelligence
      parameters:
      - name: ip
        in: query
        required: true
        description: IP address to look up
        schema:
          type: string
      responses:
        '200':
          description: IP reputation data
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IpReputation'
  /threat-intelligence/url-lookup:
    get:
      operationId: lookupUrlReputation
      summary: Juniper Networks Look up URL reputation
      description: Returns the threat reputation and category for a URL.
      tags:
      - Threat Intelligence
      parameters:
      - name: url
        in: query
        required: true
        description: URL to look up
        schema:
          type: string
      responses:
        '200':
          description: URL reputation data
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UrlReputation'
  /threat-intelligence/domain-lookup:
    get:
      operationId: lookupDomainReputation
      summary: Juniper Networks Look up domain reputation
      description: Returns the threat reputation for a domain name.
      tags:
      - Threat Intelligence
      parameters:
      - name: domain
        in: query
        required: true
        description: Domain name to look up
        schema:
          type: string
      responses:
        '200':
          description: Domain reputation data
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DomainReputation'
  /threat-intelligence/hash-lookup:
    get:
      operationId: lookupFileHash
      summary: Juniper Networks Look up file hash
      description: Returns the malware analysis verdict for a file hash.
      tags:
      - Threat Intelligence
      parameters:
      - name: hash
        in: query
        required: true
        description: File hash (MD5, SHA1, or SHA256)
        schema:
          type: string
      - name: hash_type
        in: query
        description: Hash type
        schema:
          type: string
          enum:
          - md5
          - sha1
          - sha256
      responses:
        '200':
          description: File hash verdict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FileVerdict'
components:
  schemas:
    DomainReputation:
      type: object
      properties:
        domain:
          type: string
        threat_score:
          type: integer
          minimum: 0
          maximum: 10
        categories:
          type: array
          items:
            type: string
        registrar:
          type: string
        created_date:
          type: string
          format: date-time
        last_seen:
          type: string
          format: date-time
    ThreatFeed:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        description:
          type: string
        enabled:
          type: boolean
        last_updated:
          type: string
          format: date-time
        entry_count:
          type: integer
        feed_type:
          type: string
          enum:
          - ip
          - domain
          - url
          - hash
    UrlReputation:
      type: object
      properties:
        url:
          type: string
        threat_score:
          type: integer
          minimum: 0
          maximum: 10
        categories:
          type: array
          items:
            type: string
        host:
          type: string
        last_seen:
          type: string
          format: date-time
    FileVerdict:
      type: object
      properties:
        sha256:
          type: string
        md5:
          type: string
        sha1:
          type: string
        verdict:
          type: string
          enum:
          - clean
          - malicious
          - suspicious
          - unknown
        malware_family:
          type: string
        threat_score:
          type: integer
          minimum: 0
          maximum: 10
        first_seen:
          type: string
          format: date-time
        last_seen:
          type: string
          format: date-time
    IpReputation:
      type: object
      properties:
        ip:
          type: string
        threat_score:
          type: integer
          minimum: 0
          maximum: 10
          description: Threat score from 0 (clean) to 10 (malicious)
        categories:
          type: array
          items:
            type: string
        country:
          type: string
        asn:
          type: integer
        last_seen:
          type: string
          format: date-time
        feeds:
          type: array
          items:
            type: string
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: X-Auth-Token
      description: API token obtained from the login endpoint
externalDocs:
  description: ATP Cloud Documentation
  url: https://www.juniper.net/documentation/us/en/software/atp/