Securonix Object Relation Counts API

openapi: 3.2.0
info:
  title: ThreatQ Object Relation Counts API
  description: "&copy; 2025<br/><br/><b>The API doc you are viewing is a BETA version that provides an early look at ThreatQ’s new API documentation format. At the moment, it does not cover the entire application program interface. Additional API resources, including the current standard format as well as previous versions, are available on the ThreatQ Help Center.</b><br/><br/>Last Updated: 07/11/2025\n## Introduction\n\nThe ThreatQ API is built on REST principles and uses JSON as a data interchange format.\n\n<script type=\"text/javascript\" src=\"ga.js\"></script>\n\n\n### Base URI\n\nAll URIs referenced in this document use the following base: https://**hostname**/api/, where **hostname** is replaced with the hostname or ip address of your ThreatQ instance.\n\n\n### Request Format\n\nThe ThreatQ API supports the following HTTP verbs:\n\n| Verb          | Description                        |\n| :-------------| :----------------------------------|\n| GET           | GET requests retrieve resources.   |\n| POST          | POST requests create resources.    |\n| PUT           | PUT requests update resources.     |\n| DELETE        | DELETE requests delete resources.  |\n\n\n### Response Format\n\nAll responses are returned in JSON. The response is wrapped in a top level data envelope which is an object or array depending on whether a single item or a collection is returned. If a single item is returned, the data field will be an object. If a collection is returned, the field will be an array.\n\n\n### Response Codes\n\nThe ThreatQ API uses HTTP status codes to indicate the status of your request.\n\n| Code          | Description                                                                           |\n| :-------------| :-------------------------------------------------------------------------------------|\n| 200           |  Object was retrieved successfully.                                                   |\n| 201           |  Object was created successfully.                                                     |\n| 204           |  Object(s) were successfully deleted.                                                 |\n| 400           |  Validation failed (usually as the result of an incorrect request)                    |\n| 401           |  Access denied (authorization access token in the header was incorrect / out of date) |\n| 403           |  Access forbidden (usually as the result of a bad request)                            |\n| 404           |  Object not found                                                                     |\n\n<hr />\n\n### Authentication\n\nThreatQ uses OAuth 2.0 to authenticate end users. You must have a ThreatQ user account to retrieve an API token. The API token is required for all API requests. The token does time out; therefore, you must periodically refresh the token.\n\n\n#### Authorization workflow\n\n1. Run a GET request to retrieve your client ID using the following format:\n\thttps://**hostname**/assets/js/config.js\n2. Run a POST/token request to retrieve your authorization access token. See POST/token in the Authorization section of this reference for the correct format.\n\n    Include the following parameters:\n\t  * grant_type (password)\n\t  * client-id (retrieved in step 1)\n\n    **Example:** https://**hostname**/api/token?grant_type=password&client_id=ab20a55dd9ac779246210d7102a45ee37\n\n    In the request body, include your ThreatQ credentials:\n\t  * email\n\t  * password\n\n3. Enter the access token as the authorization key in the header for all subsequent api requests."
  license:
    name: null
    url: null
  version: 1.0.0
  x-logo:
    url: null
    backgroundColor: null
    altText: ThreatQuotient
servers:
- description: SwaggerHub API Auto Mocking
  url: https://virtserver.swaggerhub.com/securonix-b7a/ThreatQ/1.0.0
- url: https://threatq.com/api
  description: ThreatQ Server
security:
- BearerAuth: []
tags:
- name: Object Relation Counts
paths:
  /{object_type}/{object_type_id}/relation-counts:
    get:
      tags:
      - Object Relation Counts
      summary: List Relation Counts for an Object Type
      description: 'This path can be used for any object type installed on the system. <br><br>

        Examples: <br><br> Indicator Sources: <i>/indicators/:indicator_id/relation-counts</i> <br><br>

        Attack Pattern Sources: <i>/attack_pattern/:attack_pattern_id/relation-counts</i>'
      parameters:
      - $ref: '#/components/parameters/ObjectType'
      - $ref: '#/components/parameters/ObjectTypeId'
      responses:
        '200':
          description: Request Successful
          content:
            application/json:
              schema:
                properties:
                  data:
                    properties:
                      indicators:
                        description: Number of Indicators related to the object
                        type: integer
                        example: 51
                      adversaries:
                        description: Number of Adversaries related to the object
                        type: integer
                        example: 2
                      events:
                        description: Number of Events related to the object
                        type: integer
                        example: 7
                      attachments:
                        description: Number of Attachments (Files) related to the object
                        type: integer
                        example: 11
                      signatures:
                        description: Number of Signatures related to the object
                        type: integer
                        example: 3
                      investigations:
                        description: Number of Investigations related to the object
                        type: integer
                        example: 6
                      attack_pattern:
                        description: Number of Attack Patterns related to the object
                        type: integer
                        example: 17
                      campaign:
                        description: Number of Campaigns related to the object
                        type: integer
                        example: 1
                      course_of_action:
                        description: Number of Courses of Action related to the object
                        type: integer
                        example: 3
                      exploit_target:
                        description: Number of Exploit Targets related to the object
                        type: integer
                        example: 4
                      identity:
                        description: Number of Identities related to the object
                        type: integer
                        example: 2
                      incident:
                        description: Number of Incidents related to the object
                        type: integer
                        example: 512
                      intrusion_set:
                        description: Number of Intrusion Sets related to the object
                        type: integer
                        example: 5
                      malware:
                        description: Number of Malware related to the object
                        type: integer
                        example: 13
                      report:
                        description: Number of Reports related to the object
                        type: integer
                        example: 3
                      tool:
                        description: Number of Tools related to the object
                        type: integer
                        example: 2
                      ttp:
                        description: Number of TTP related to the object
                        type: integer
                        example: 10
                      vulnerability:
                        description: Number of Vulnerability related to the object
                        type: integer
                        example: 11
                    type: object
                type: object
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-visibility: public
components:
  responses:
    Unauthorized:
      description: Unauthorized
    NotFound:
      description: Object Not Found
  parameters:
    ObjectTypeId:
      name: object_type_id
      in: path
      description: The ID for the record of the specified Object Type whose context you would like to retrieve
      required: true
      schema:
        type: integer
        example: 6
    ObjectType:
      name: object_type
      in: path
      description: 'The collection identifier for the Object Type whose context you would like to retrieve. Options include:

        adversaries, attachments, attack_pattern, campaign, course_of_action, event, exploit_target, identity, incident,

        indicators, intrustion_set, malware, report, signature, tool, ttp, and vulnerability. If you have any additional custom

        objects installed on your system, use the value for the `collection` field associated with the object definition.'
      required: true
      schema:
        type: string
        example: indicators
  securitySchemes:
    BearerAuth:
      type: http
      description: "Once authorized, all subsequent requests must include an `Authorization` header\n with the granted `access_token`. See the OAuth2 Authentication path for more information on how to authorize a User.<br><br>\n Example Header: `Authorization: Bearer <access_token>`"
      name: Authorization
      in: header
      bearerFormat: Bearer `<access_token>`
      scheme: bearer