Oracle Threatintel API

openapi: 3.2.0
info:
  description: Use the Threat Intelligence API to search for information about known threat indicators, including suspicious IP addresses, domain names, and other digital fingerprints. Threat Intelligence is a managed database of curated threat intelligence that comes from first party Oracle security insights, open source feeds, and vendor-procured data. For more information, see the [Threat Intelligence documentation](/iaas/Content/threat-intel/home.htm).
  title: Threat Intelligence Threatintel API
  version: '20220901'
  x-provenance:
    method: harvested
    first_party: true
    publisher: Oracle
    source: https://docs.oracle.com/en-us/iaas/api/specs/17d2201ee8fa40c5d12f2d532a9d279886d09cc2e7bcc6f6f8e8056519be9c01.yaml
    harvested: '2026-08-04'
    note: Published by Oracle as the contract for the Threat Intelligence API OCI service and stored verbatim; API Evangelist added only this provenance block.
  x-evidence:
  - url: https://docs.oracle.com/en-us/iaas/api/specs/index.json
    what: Oracle's own index of every OCI service specification
  - url: https://docs.oracle.com/en-us/iaas/api/specs/17d2201ee8fa40c5d12f2d532a9d279886d09cc2e7bcc6f6f8e8056519be9c01.yaml
    what: the harvested document for Threat Intelligence API
servers:
- url: http://127.0.0.1/20220901
- url: https://127.0.0.1/20220901
tags:
- name: threatintel
paths:
  /indicatorCounts:
    get:
      description: Get the current count of each threat indicator type. Indicator counts can be sorted in ascending or descending order.
      operationId: ListIndicatorCounts
      parameters:
      - $ref: '#/components/parameters/CompartmentIdQueryParam'
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/SortOrderQueryParam'
      responses:
        200:
          description: Successfully retrieved the number of indicators of each type.
          headers:
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact

                Oracle about a particular request, please provide the request ID.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IndicatorCountCollection'
        400:
          $ref: '#/components/responses/400'
        401:
          $ref: '#/components/responses/401'
        404:
          $ref: '#/components/responses/404'
        429:
          $ref: '#/components/responses/429'
        500:
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/default'
      summary: Get the current count of each threat indicator type. Indicator counts can be sorted in ascending or descending order.
      tags:
      - threatintel
      x-related-resource: '#/definitions/IndicatorCountCollection'
  /indicators:
    get:
      description: 'Get a list of threat indicator summaries based on the search criteria.

        '
      operationId: ListIndicators
      parameters:
      - $ref: '#/components/parameters/CompartmentIdQueryParam'
      - $ref: '#/components/parameters/ThreatTypeNameQueryParam'
      - $ref: '#/components/parameters/IndicatorTypeQueryParam'
      - $ref: '#/components/parameters/IndicatorValueQueryParam'
      - $ref: '#/components/parameters/ConfidenceGreaterThanOrEqualToQueryParam'
      - $ref: '#/components/parameters/TimeUpdatedGreaterThanOrEqualToQueryParam'
      - $ref: '#/components/parameters/TimeUpdatedLessThanQueryParam'
      - $ref: '#/components/parameters/TimeLastSeenGreaterThanOrEqualToQueryParam'
      - $ref: '#/components/parameters/TimeLastSeenLessThanQueryParam'
      - $ref: '#/components/parameters/TimeCreatedGreaterThanOrEqualToQueryParam'
      - $ref: '#/components/parameters/TimeCreatedLessThanQueryParam'
      - $ref: '#/components/parameters/PaginationLimitQueryParam'
      - $ref: '#/components/parameters/PaginationTokenQueryParam'
      - $ref: '#/components/parameters/SortOrderQueryParam'
      - $ref: '#/components/parameters/IndicatorSortByQueryParam'
      - $ref: '#/components/parameters/RequestIdHeader'
      responses:
        200:
          description: Successfully returns a page of IndicatorSummary objects.
          headers:
            opc-next-page:
              description: 'For pagination of a list of items. When paging through a list, if this header appears in the response,

                then a partial list might have been returned. Include this value as the `page` parameter for the

                subsequent GET request to get the next batch of items.

                '
              schema:
                type: string
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact

                Oracle about a particular request, please provide the request ID.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IndicatorSummaryCollection'
        400:
          $ref: '#/components/responses/400'
        401:
          $ref: '#/components/responses/401'
        404:
          $ref: '#/components/responses/404'
        429:
          $ref: '#/components/responses/429'
        500:
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/default'
      summary: Get a list of threat indicator summaries based on the search criteria.
      tags:
      - threatintel
  /indicators/actions/summarize:
    post:
      description: Get indicator summaries based on advanced search criteria.
      operationId: SummarizeIndicators
      parameters:
      - $ref: '#/components/parameters/CompartmentIdQueryParam'
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/PaginationLimitQueryParam'
      - $ref: '#/components/parameters/PaginationTokenQueryParam'
      responses:
        200:
          description: The indicator with the given id was successfully retrieved.
          headers:
            opc-next-page:
              description: 'For pagination of a list of items. When paging through a list, if this header appears in the response,

                then a partial list might have been returned. Include this value as the `page` parameter for the

                subsequent GET request to get the next batch of items.

                '
              schema:
                type: string
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact

                Oracle about a particular request, please provide the request ID.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IndicatorSummaryCollection'
        400:
          $ref: '#/components/responses/400'
        401:
          $ref: '#/components/responses/401'
        404:
          $ref: '#/components/responses/404'
        429:
          $ref: '#/components/responses/429'
        500:
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/default'
      summary: Get indicator summaries based on advanced search criteria.
      tags:
      - threatintel
      x-example: "POST /20220901/indicators/actions/summarize?compartmentId=<compartment_OCID>&limit=1 \nHost: api-threatintel.us-ashburn-1.oci.oraclecloud.com\n<authorization and other headers>\n{\n    \"indicatorType\": \"IP_ADDRESS\",\n    \"confidenceGreaterThanOrEqualTo\": 25,\n    \"threatActor\": \"solarspider\",\n    \"malware\": \"jsoutprox\"\n}\n"
      x-related-resource: '#/definitions/Indicator'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SummarizeIndicatorsDetails'
        description: Query Parameters to search for indicators.
        required: true
  /indicators/{indicatorId}:
    get:
      description: Get detailed information about a threat indicator with a given identifier.
      operationId: GetIndicator
      parameters:
      - $ref: '#/components/parameters/IndicatorIdentifierPathParam'
      - $ref: '#/components/parameters/CompartmentIdQueryParam'
      - $ref: '#/components/parameters/RequestIdHeader'
      responses:
        200:
          description: The indicator with the given id was successfully retrieved.
          headers:
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact

                Oracle about a particular request, please provide the request ID.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Indicator'
        400:
          $ref: '#/components/responses/400'
        401:
          $ref: '#/components/responses/401'
        404:
          $ref: '#/components/responses/404'
        429:
          $ref: '#/components/responses/429'
        500:
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/default'
      summary: Get detailed information about a threat indicator with a given identifier
      tags:
      - threatintel
  /threatTypes:
    get:
      description: 'Gets a list of threat types that are available to use as parameters when querying indicators.

        The list is sorted by threat type name according to the sort order query param.

        '
      operationId: ListThreatTypes
      parameters:
      - $ref: '#/components/parameters/CompartmentIdQueryParam'
      - $ref: '#/components/parameters/PaginationLimitQueryParam'
      - $ref: '#/components/parameters/PaginationTokenQueryParam'
      - $ref: '#/components/parameters/SortOrderQueryParam'
      - $ref: '#/components/parameters/RequestIdHeader'
      responses:
        200:
          description: Successfully retrieved a list of threat types.
          headers:
            opc-next-page:
              description: 'For pagination of a list of items. When paging through a list, if this header appears in the response,

                then a partial list might have been returned. Include this value as the `page` parameter for the

                subsequent GET request to get the next batch of items.

                '
              schema:
                type: string
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact

                Oracle about a particular request, please provide the request ID.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatTypesCollection'
        400:
          $ref: '#/components/responses/400'
        401:
          $ref: '#/components/responses/401'
        404:
          $ref: '#/components/responses/404'
        429:
          $ref: '#/components/responses/429'
        500:
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/default'
      summary: List available threat types
      tags:
      - threatintel
      x-related-resource: '#/definitions/ThreatTypesCollection'
components:
  schemas:
    IndicatorCountCollection:
      description: A list of indicator counts by indicator type.
      properties:
        items:
          description: The list of aggregated indicator counts.
          items:
            $ref: '#/components/schemas/IndicatorCountSummary'
          type: array
      required:
      - items
      type: object
    ThreatType:
      description: A threat type along with attribution data that associates it to a threat indicator.
      properties:
        attribution:
          description: The list of supporting attribution information.
          items:
            $ref: '#/components/schemas/DataAttribution'
          type: array
        id:
          description: The OCID of the threat type.
          type: string
        name:
          description: The name of the threat type.
          type: string
      required:
      - id
      - name
      - attribution
      type: object
    IndicatorCountDimensions:
      description: The indicator dimension that was counted, such as the indicator type.
      properties:
        compartmentId:
          description: The compartment OCID that contains the indicator type.
          type: string
        type:
          description: The indicator type that was counted.
          enum:
          - DOMAIN_NAME
          - FILE_NAME
          - MD5_HASH
          - SHA1_HASH
          - SHA256_HASH
          - IP_ADDRESS
          - URL
          type: string
          x-obmcs-top-level-enum: '#/definitions/IndicatorType'
      type: object
    GeodataDetails:
      description: Geodata information for a given IP address
      properties:
        adminDiv:
          description: State/Province/subdivision within the country
          type: string
        city:
          description: City of origin
          type: string
        countryCode:
          description: Two-letter abbreviation for country of origin
          type: string
        geoId:
          description: Unique Identifier (optional)
          type: string
        label:
          description: Information on source providing the information
          type: string
        latitude:
          description: Latitude
          type: string
        longitude:
          description: Longitude
          type: string
        origin:
          description: ASN entry
          type: string
        routedPrefix:
          description: Encompassing assigned prefix for the IP
          type: string
      required:
      - origin
      - countryCode
      - adminDiv
      - city
      - latitude
      - longitude
      - label
      type: object
    Error:
      description: Error Information.
      properties:
        code:
          description: A short error code that defines the error, meant for programmatic parsing.
          type: string
        message:
          description: A human-readable error string.
          type: string
      required:
      - code
      - message
    IndicatorSourceSummary:
      description: Information about the source of threat indicator data.
      properties:
        name:
          description: The name of the source.
          type: string
      required:
      - name
      type: object
    ThreatTypeSummary:
      description: The name of a threat type and its ID.
      properties:
        id:
          description: The OCID of the threat type
          type: string
        name:
          description: The name of the threat type
          type: string
      required:
      - id
      - name
      type: object
    IndicatorCountSummary:
      description: A group of indicators with the same dimensions, such as the same indicator type.
      properties:
        count:
          description: The count of indicators in the group.
          type: integer
        dimensions:
          $ref: '#/components/schemas/IndicatorCountDimensions'
      required:
      - dimensions
      - count
      type: object
    SummarizeIndicatorsDetails:
      description: Query parameters to filter indicators
      properties:
        confidenceGreaterThanOrEqualTo:
          description: The minimum level of confidence to return
          maximum: 100
          minimum: 0
          type: integer
        indicatorSeenBy:
          description: Filter to include indicators that have been seen by the provided source.
          type: string
        indicatorType:
          description: The type of indicator this is
          enum:
          - DOMAIN_NAME
          - FILE_NAME
          - MD5_HASH
          - SHA1_HASH
          - SHA256_HASH
          - IP_ADDRESS
          - URL
          type: string
          x-obmcs-top-level-enum: '#/definitions/IndicatorType'
        indicatorValue:
          description: The value for the type of indicator this is
          type: string
        malware:
          description: Filter to include indicators associated with the provided malware.
          type: string
        sortBy:
          description: The field to sort by. Only one field to sort by may be provided
          enum:
          - CONFIDENCE
          - TIMECREATED
          - TIMEUPDATED
          - TIMELASTSEEN
          type: string
        sortOrder:
          description: The sort order to use, either 'ASC' or 'DESC'.
          enum:
          - ASC
          - DESC
          type: string
          x-obmcs-top-level-enum: '#/definitions/SortOrder'
        threatActor:
          description: Filter to included indicators associated with the provided threat actor.
          type: string
        threatTypes:
          description: The threat type of entites to be returned.
          items:
            type: string
          type: array
        timeCreatedGreaterThanOrEqualTo:
          description: The oldest creation time of entities to be returned.
          format: date-time
          type: string
        timeCreatedLessThan:
          description: The newest creation time of entities to be returned.
          format: date-time
          type: string
        timeLastSeenGreaterThanOrEqualTo:
          description: The oldest last seen time of entities to be returned.
          format: date-time
          type: string
        timeLastSeenLessThan:
          description: The newest last seen time of entities to be returned.
          format: date-time
          type: string
        timeUpdatedGreaterThanOrEqualTo:
          description: The oldest update time of entities to be returned.
          format: date-time
          type: string
        timeUpdatedLessThan:
          description: The newest update time of entities to be returned.
          format: date-time
          type: string
      type: object
      x-example: "{ \n  \"items\": [\n    {\n      \"attributes\": [\n        {\n          \"name\": \"MaliciousConfidence\",\n          \"value\": \"low\"\n        },\n        {\n          \"name\": \"CSD\",\n          \"value\": \"csa-220906\"\n        },\n        {\n          \"name\": \"ThreatActor\",\n          \"value\": \"solarspider\"\n        },\n        {\n          \"name\": \"Malware\",\n          \"value\": \"jsoutprox\"\n        }\n      ],\n\"compartmentId\": \"ocid1.compartment.oc1..uniqueID\",\n\"confidence\": 55,\n\"geodata\": {\n  \"adminDiv\": \"on\",\n  \"city\": \"toronto\",\n  \"countryCode\": \"ca\",\n  \"geoId\": \"\",\n  \"label\": \"globaltelehost corp.\",\n  \"latitude\": \"43.66\",\n  \"longitude\": \"-79.36\",\n  \"origin\": \"62563\",\n  \"routedPrefix\": \"\"\n},\n\"id\": \"ocid1.threatentity.oc1..uniqueID\",\n\"lifecycleState\": \"ACTIVE\",\n\"threatTypes\": [\n  \"Criminal\",\n  \"RAT\"\n],\n\"timeCreated\": \"2022-08-30T19:15:09.237Z\",\n\"timeLastSeen\": \"2022-08-30T19:07:13.000Z\",\n\"timeUpdated\": \"2022-09-06T07:11:23.503Z\",\n\"type\": \"IP_ADDRESS\",\n\"value\": \"192.168.10.10\"\n    }\n  ]\n} \n"
    DataVisibility:
      description: The visibility level of attribution data, including its [Traffic Light Protocol (TLP)](https://www.cisa.gov/tlp) color.
      properties:
        name:
          description: The name of the visibility level.
          type: string
        tlpName:
          description: The Traffic Light Protocol (TLP) color of the visibility level.
          enum:
          - TLP_INTERNAL_AUDIT
          - TLP_WHITE
          - TLP_GREEN
          - TLP_AMBER
          - TLP_RED
          type: string
      required:
      - name
      - tlpName
      type: object
    ThreatTypesCollection:
      description: List of threat types that can be associated with threat indicators.
      properties:
        items:
          description: The list of threat types that can be used to search for threat indicators.
          items:
            $ref: '#/components/schemas/ThreatTypeSummary'
          type: array
      required:
      - items
      type: object
    IndicatorAttributeSummary:
      description: An attribute name and list of values.
      properties:
        name:
          description: The name of the attribute.
          type: string
        value:
          description: The value of the attribute.
          type: string
      required:
      - name
      - value
    EntityReference:
      description: A reference to a resource or other entity.
      discriminator:
        propertyName: type
      properties:
        type:
          description: The type of the referenced entity.
          enum:
          - INDICATOR
          type: string
      required:
      - type
    IndicatorSummary:
      description: Summary of a data signature observed on a network or host that indicates a potential security threat.
      properties:
        attributes:
          description: 'A map of attributes with additional information about the indicator.

            Each attribute has a name (string), value (string), and attribution (supporting data).

            '
          items:
            $ref: '#/components/schemas/IndicatorAttributeSummary'
          type: array
        compartmentId:
          description: The OCID of the compartment that contains this indicator.
          type: string
        confidence:
          description: An integer from 0 to 100 that represents how certain we are that the indicator is malicious and a potential threat if it is detected communicating with your cloud resources. This confidence value is aggregated from the confidence in the threat types, attributes, and relationships to create an overall value for the indicator.
          maximum: 100
          minimum: 0
          type: integer
        geodata:
          $ref: '#/components/schemas/GeodataDetails'
        id:
          description: The OCID of the indicator.
          type: string
        lifecycleState:
          description: The state of the indicator. It will always be `ACTIVE`.
          enum:
          - ACTIVE
          - DELETED
          type: string
          x-obmcs-top-level-enum: '#/definitions/LifecycleState'
        threatTypes:
          description: Characteristics of the threat indicator based on previous observations or behavior. May include related tactics, techniques, and procedures.
          items:
            type: string
          type: array
        timeCreated:
          description: The date and time that the indicator was first detected. An RFC3339 formatted string.
          format: date-time
          type: string
        timeLastSeen:
          description: The date and time that this indicator was last seen. The value is the same as `timeCreated` for a new indicator. An RFC3339 formatted string.
          format: date-time
          type: string
        timeUpdated:
          description: The date and time that this indicator was last updated by the system.  Updates can include new reports or regular updates in confidence. The value is the same as `timeCreated` for a new indicator. An RFC3339 formatted string.
          format: date-time
          type: string
        type:
          description: The type of indicator.
          enum:
          - DOMAIN_NAME
          - FILE_NAME
          - MD5_HASH
          - SHA1_HASH
          - SHA256_HASH
          - IP_ADDRESS
          - URL
          type: string
          x-obmcs-top-level-enum: '#/definitions/IndicatorType'
        value:
          description: The indicator data value.
          type: string
      required:
      - id
      - type
      - value
      - threatTypes
      - attributes
      - geodata
      - timeCreated
      - timeUpdated
      - timeLastSeen
      type: object
    IndicatorAttribute:
      description: An attribute name and list of values with attribution.
      properties:
        attribution:
          description: The array of attribution data that support this attribute.
          items:
            $ref: '#/components/schemas/DataAttribution'
          type: array
        name:
          description: The name of the attribute.
          type: string
        value:
          description: The value of the attribute.
          type: string
      required:
      - name
      - value
      - attribution
    DataAttribution:
      description: The confidence, source information, and visibility for a particular sighting or observation of some data associated with a threat indicator. This associated data can be the indicator's threat type, attribute, or relationship.
      properties:
        confidence:
          description: An integer from 0 to 100 that provides a measure of our certainty in the maliciousness of data attributed to an indicator. For example, if the source of the data being attributed is the Tor Project, our confidence that the associated indicator is a tor exit node would be 100.
          maximum: 100
          minimum: 0
          type: integer
        source:
          $ref: '#/components/schemas/IndicatorSourceSummary'
        timeFirstSeen:
          description: The date and time the attribution data was first seen for this entity. If the data source does not provide this information, it is set to the last time it was seen. An RFC3339 formatted string.
          format: date-time
          type: string
        timeLastSeen:
          description: The last date and time the attribution data was seen for this entity. An RFC3339 formatted string.
          format: date-time
          type: string
        visibility:
          $ref: '#/components/schemas/DataVisibility'
      required:
      - confidence
      - source
      - visibility
      - timeLastSeen
      type: object
    Indicator:
      description: A data signature observed on a network or host that indicates a potential security threat. Indicators can be plain text or computed (hashed) values.
      properties:
        attributes:
          description: 'A map of attributes with additional information about the indicator.

            Each attribute has a name (string), value (string), and attribution (supporting data).

            '
          items:
            $ref: '#/components/schemas/IndicatorAttribute'
          type: array
        compartmentId:
          description: The OCID of the compartment that contains this indicator.
          type: string
        confidence:
          description: An integer from 0 to 100 that represents how certain we are that the indicator is malicious and a potential threat if it is detected communicating with your cloud resources. This confidence value is aggregated from the confidence in the threat types, attributes, and relationships to create an overall value for the indicator.
          maximum: 100
          minimum: 0
          type: integer
        geodata:
          $ref: '#/components/schemas/GeodataDetails'
        id:
          description: The OCID of the indicator.
          type: string
        lifecycleState:
          description: The state of the indicator. It will always be `ACTIVE`.
          enum:
          - ACTIVE
          - DELETED
          type: string
          x-obmcs-top-level-enum: '#/definitions/LifecycleState'
        relationships:
          description: 'A map of relationships between the indicator and other entities.

            Each relationship has a name (string), related entity, and attribution (supporting data).

            '
          items:
            $ref: '#/components/schemas/IndicatorRelationship'
          type: array
        threatTypes:
          description: Characteristics of the threat indicator based on previous observations or behavior. May include related tactics, techniques, and procedures.
          items:
            $ref: '#/components/schemas/ThreatType'
          type: array
        timeCreated:
          description: The date and time that the indicator was first detected. An RFC3339 formatted string.
          format: date-time
          type: string
        timeLastSeen:
          description: The date and time that this indicator was last seen. The value is the same as `timeCreated` for a new indicator. An RFC3339 formatted string.
          format: date-time
          type: string
        timeUpdated:
          description: The date and time that this indicator was last updated. The value is the same as `timeCreated` for a new indicator. An RFC3339 formatted string.
          format: date-time
          type: string
        type:
          description: The type of indicator.
          enum:
          - DOMAIN_NAME
          - FILE_NAME
          - MD5_HASH
          - SHA1_HASH
          - SHA256_HASH
          - IP_ADDRESS
          - URL
          type: string
          x-obmcs-top-level-enum: '#/definitions/IndicatorType'
        value:
          description: 'The value for this indicator.

            The value''s format is dependent upon its `type`. Examples:


            DOMAIN_NAME "evil.example.com"


            MD5_HASH "44d88612fea8a8f36de82e1278abb02f"


            IP_ADDRESS "2001:db8::1"

            '
          type: string
      required:
      - id
      - type
      - value
      - threatTypes
      - attributes
      - relationships
      - geodata
      - timeCreated
      - timeUpdated
      - timeLastSeen
      type: object
    IndicatorSummaryCollection:
      description: List of indicator summary objects.
      properties:
        items:
          description: The list of indicator summaries.
          items:
            $ref: '#/components/schemas/IndicatorSummary'
          type: array
      required:
      - items
      type: object
    IndicatorRelationship:
      description: A relationship name and list of releated entities.
      properties:
        attribution:
          description: The array of attribution data that support this relationship.
          items:
            $ref: '#/components/schemas/DataAttribution'
          type: array
        name:
          description: The name of the attribute.
          type: string
        relatedEntity:
          $ref: '#/components/schemas/EntityReference'
      required:
      - name
      - relatedEntity
      - attribution
  parameters:
    PaginationTokenQueryParam:
      description: A token representing the position at which to start retrieving results. This must come from the `opc-next-page` header field of a previous response.
      in: query
      name: page
      x-default-description: When absent, the response will be the first page of the result set.
      schema:
        type: string
        minLength: 1
    ConfidenceGreaterThanOrEqualToQueryParam:
      description: The minimum confidence score of entities to be returned.
      in: query
      name: confidenceGreaterThanOrEqualTo
      required: false
      x-default-description: When absent, the response will not be filtered by confidence.
      schema:
        type: integer
        default: 0
        maximum: 100
        minimum: 0
    TimeUpdatedLessThanQueryParam:
      description: Return indicators updated before the provided time.
      in: query
      name: timeUpdatedLessThan
      required: false
      x-default-description: When absent, the response will not be filtered by update time.
      schema:
        type: string
        format: date-time
    TimeUpdatedGreaterThanOrEqualToQueryParam:
      description: The oldest update time of entities to be returned.
      in: query
      name: timeUpdatedGreaterThanOrEqualTo
      required: false
      x-default-description: When absent, the response will not be filtered by update time.
      schema:
        type: string
        format: date-time
    TimeLastSeenLessThanQueryParam:
      description: Return indicators last seen before the provided time.
      in: query
      name: timeLastSeenLessThan
      required: false
      x-default-description: When absent, the response will not be filtered by last seen time.
      schema:
        type: string
        format: date-time
    TimeLastSeenGreaterThanOrEqualToQueryParam:
      description: The oldest last seen time of entities to be returned.
      in: query
      name: timeLastSeenGreaterThanOrEqualTo
      required: false
      x-default-description: When absent, the response will not be filtered by last seen time.
      schema:
        type: string
        format: date-time
    Compa

# --- truncated at 32 KB (36 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/oracle/refs/heads/main/openapi/oracle-threatintel-api-openapi.yml