{"openapi":"3.1.1","info":{"x-audience":"external-public","x-api-id":"7289b9c0-156b-4ab4-af9f-c4a3bf4e1367","version":"2.6.0","title":"Rösti API","summary":"This API provides access to all Rösti (*Repackaged Öpen Source Threat Intelligence*) data.","description":"This API provides access to all Rösti (*Repackaged Öpen Source Threat Intelligence*) data. To authenticate, get an API key from the [Rösti website](https://rosti.dev/api).\n\nCurrently, the presence and value of the `X-Api-Key` header are not being checked or validated. However, this will change soon as we implement stricter API key validation to prevent unauthorized access and potential abuse. To ensure uninterrupted access, **please start including a valid `X-Api-Key` header in all your requests now**. Once this feature is enforced, any requests **without a valid API key will be rejected**.\n","contact":{"name":"Johannes Bader","email":"rosti@bin.re","url":"https://bin.re"},"license":{"name":"MIT","url":"https://opensource.org/license/MIT"}},"externalDocs":{"description":"Documentation","url":"https://rosti.dev/api"},"servers":[{"url":"https://api.rosti.dev/v2","description":"production server"}],"security":[{"apiKeyHeader":[]}],"tags":[{"name":"Categories","description":"List IOC categories like `network_activity` or `artifacts_dropped`."},{"name":"Changelogs","description":"Access to the changelog entries of the Rösti project."},{"name":"Charts","description":"Access to pre-computed charts and visualizations."},{"name":"Correlations","description":"Access to the correlations between reports based on shared IOCs."},{"name":"Exports","description":"Get access to the exports of the Rösti threat intelligence corpus."},{"name":"Feeds","description":"Access to the feeds of the Rösti project, which are used to distribute threat intelligence data."},{"name":"File Types","description":"Get a list of all available file types, like `yara`, `feed`, `export`."},{"name":"IOC Types","description":"Get a complete list of all IOC types with their name, rank and ID."},{"name":"IOCs","description":"Get a list of Indicators of Compromise (IOCs) like IPs, domains, hashes, etc."},{"name":"Mitre IDs","description":"Get a list of all Mitre ATT&CK identifiers with their descriptions."},{"name":"CVE","description":"Get a Common Vulnerabilities and Exposures (CVE)."},{"name":"Reports","description":"Get a list of all reports in the Rösti corpus."},{"name":"Sources","description":"Get a list of all sources with their corresponding count of reports and most recent report."},{"name":"Statistics","description":"Get the statistics table contents as a dictionary mapping statistic names to values."},{"name":"Status","description":"Check if the API is online and which version is running."},{"name":"Yara Rules","description":"Get a list of all YARA rules associated with the Rösti corpus."}],"paths":{"/bulk-exports":{"get":{"summary":"List all bulk exports","description":"Get a list of all bulk exports. Optionally filter by tag using the `tag` query parameter.","operationId":"getBulkExports","parameters":[{"name":"tag","in":"query","description":"Filter bulk exports by tag","required":false,"schema":{"type":"string","examples":["cnc"]}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/File"}},"meta":{"$ref":"#/components/schemas/ListMeta"}}}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"tags":["Exports"],"security":[{"apiKeyHeader":[]}]}},"/bulk-exports/{filetype}":{"get":{"summary":"Get bulk export from storage","description":"Download a bulk export file from storage by export type.","operationId":"getBulkExport","parameters":[{"$ref":"#/components/parameters/filetype"}],"responses":{"200":{"$ref":"#/components/responses/FileDownload"},"302":{"$ref":"#/components/responses/RedirectToFile"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"tags":["Exports"],"security":[{"apiKeyHeader":[]}]}},"/categories":{"get":{"description":"Returns a list of all categories in the system","operationId":"listCategories","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Category"}},"meta":{"$ref":"#/components/schemas/ListMeta"}}}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"List all categories","tags":["Categories"],"security":[{"apiKeyHeader":[]}]}},"/changelogs":{"get":{"description":"Get a list of all changelog entries ordered by creation date (descending)","operationId":"getAllChangelogs","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/cursor"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Changelog"}},"meta":{"$ref":"#/components/schemas/PaginatedListMeta"}}}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"422":{"$ref":"#/components/responses/UnprocessableEntity"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"List all changelog entries","tags":["Changelogs"],"security":[{"apiKeyHeader":[]}]}},"/changelogs/latest":{"get":{"description":"Get the most recent changelog entry","operationId":"getLatestChangelog","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Changelog"}}},"description":"OK"},"401":{"$ref":"#/components/responses/Unauthorized"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"Get latest changelog entry","tags":["Changelogs"],"security":[{"apiKeyHeader":[]}]}},"/charts":{"get":{"summary":"List charts","description":"Returns the id, name and description of all charts.","operationId":"getCharts","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/ChartListItem"}},"example":[{"ID":"iocs-per-category","Name":"IOCs per Category","Description":"Number of IOCs per category (e.g., domain, ip, md5, etc.)"},{"ID":"key-metrics","Name":"Key Metrics","Description":"Key metrics about the Rosti dataset"},{"ID":"parsed-per-date","Name":"Reports per Date","Description":"Number of parsed reports per date"},{"ID":"reports-per-source","Name":"Reports per Source","Description":"Number of parsed reports per source (i.e., parser)"}]}}},"401":{"$ref":"#/components/responses/Unauthorized"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"tags":["Charts"],"security":[{"apiKeyHeader":[]}]}},"/charts/{id}":{"get":{"summary":"Get chart data by ID","description":"Returns the stored chart JSON for the given id.","operationId":"getChartById","parameters":[{"$ref":"#/components/parameters/chartId"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"$ref":"#/components/schemas/Chart"}}}]},"example":{"data":{"chart":{"reports":{"value":6689,"timestamp":"2026-04-08T21:04:07.141901"},"sources":{"value":303,"timestamp":"2026-04-08T21:04:07.141901"},"yara_rules":{"value":908,"timestamp":"2026-04-08T21:04:07.141901"},"mitre_ids":{"value":33281,"timestamp":"2026-04-08T21:04:07.141901"},"iocs":{"value":259929,"timestamp":"2026-04-08T21:04:07.141901"}},"name":"Key Metrics","description":"Key metrics about the Rosti dataset","timestamp":"2026-04-08T19:06:23.210264719Z"}}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"tags":["Charts"],"security":[{"apiKeyHeader":[]}]}},"/file-types":{"get":{"description":"Get a list of all file types that are used in Rösti exports and feeds.","operationId":"getAllFileTypes","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/FileType"}},"meta":{"$ref":"#/components/schemas/ListMeta"}}}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"List all file types","tags":["File Types","Exports"],"security":[{"apiKeyHeader":[]}]}},"/feeds":{"get":{"description":"Get a list of all feeds. Optionally filter by tag using the `tag` query parameter.","operationId":"getFeeds","parameters":[{"name":"tag","in":"query","description":"Filter feeds by tag","required":false,"schema":{"type":"string","examples":["cnc"]}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/File"}},"meta":{"$ref":"#/components/schemas/ListMeta"}}}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"List all feeds","tags":["Feeds"],"security":[{"apiKeyHeader":[]}]}},"/feeds/{id}":{"get":{"summary":"Get feed file from storage","description":"Download a feed file from storage by its ID.","operationId":"getFeedExport","parameters":[{"$ref":"#/components/parameters/feed"}],"responses":{"200":{"$ref":"#/components/responses/FileDownload"},"302":{"$ref":"#/components/responses/RedirectToFile"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"tags":["Feeds"],"security":[{"apiKeyHeader":[]}]}},"/ioc-types":{"get":{"description":"Get a complete list of all IOC types with their name, rank and ID","operationId":"getAllIocTypes","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/IOCType"}},"meta":{"$ref":"#/components/schemas/ListMeta"}}}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"List all IOC Types","tags":["IOC Types"],"security":[{"apiKeyHeader":[]}]}},"/iocs":{"get":{"description":"Get a list of Indicators of Compromise (IOCs)","operationId":"getIocs","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/cursor"},{"$ref":"#/components/parameters/iocsearch"},{"$ref":"#/components/parameters/iocdopatternmatch"},{"$ref":"#/components/parameters/ioctype"},{"$ref":"#/components/parameters/category"},{"$ref":"#/components/parameters/iocvalue"},{"$ref":"#/components/parameters/ioctimestamp"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/IOC"}},"meta":{"$ref":"#/components/schemas/PaginatedListMeta"}}}]}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"422":{"$ref":"#/components/responses/UnprocessableEntity"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"List all IOCs","tags":["IOCs"],"security":[{"apiKeyHeader":[]}]}},"/reports/{id}/correlations":{"get":{"description":"List all correlations based shared IOCs associated with a specific report","operationId":"getCorrelations","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/cursor"},{"$ref":"#/components/parameters/report"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Correlation"}},"meta":{"$ref":"#/components/schemas/PaginatedListMeta"}}}]}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"422":{"$ref":"#/components/responses/UnprocessableEntity"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"List all correlations of a report","tags":["Correlations","Reports"],"security":[{"apiKeyHeader":[]}]}},"/reports/{id}/iocs":{"get":{"description":"List all Indicators of Compromise (IOCs) associated with a specific report","operationId":"getReportIOCs","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/cursor"},{"$ref":"#/components/parameters/iocsearch"},{"$ref":"#/components/parameters/iocdopatternmatch"},{"$ref":"#/components/parameters/ioctype"},{"$ref":"#/components/parameters/category"},{"$ref":"#/components/parameters/iocvalue"},{"$ref":"#/components/parameters/report"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/IOC"}},"meta":{"$ref":"#/components/schemas/PaginatedListMeta"}}}]}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"422":{"$ref":"#/components/responses/UnprocessableEntity"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"List all IOCs of a report","tags":["IOCs","Reports"],"security":[{"apiKeyHeader":[]}]}},"/cve":{"get":{"summary":"List all CVEs","description":"List all Common Vulnerabilities and Exposures (CVEs) with their description and timestamp.","operationId":"listCve","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/cursor"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/CVE"}},"meta":{"$ref":"#/components/schemas/PaginatedListMeta"}}}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"422":{"$ref":"#/components/responses/UnprocessableEntity"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"tags":["CVE"],"security":[{"apiKeyHeader":[]}]}},"/reports/{id}/cve":{"get":{"description":"List all CVEs by report with their descriptions and timestamps.","operationId":"listCveByReport","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/cursor"},{"$ref":"#/components/parameters/report"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/CVE"}},"meta":{"$ref":"#/components/schemas/PaginatedListMeta"}}}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"422":{"$ref":"#/components/responses/UnprocessableEntity"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"List all CVE entries by report","tags":["CVE","Reports"],"security":[{"apiKeyHeader":[]}]}},"/mitre-ids":{"get":{"summary":"List all Mitre ids","description":"List all Mitre ATT&CK identifiers with their description and object type","operationId":"listMitre","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/cursor"},{"$ref":"#/components/parameters/mitretype"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Mitre"}},"meta":{"$ref":"#/components/schemas/PaginatedListMeta"}}}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"422":{"$ref":"#/components/responses/UnprocessableEntity"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"tags":["Mitre IDs"],"security":[{"apiKeyHeader":[]}]}},"/reports/{id}/mitre-ids":{"get":{"description":"List all Mitre identifiers by report with their descriptions","operationId":"listMitreByReport","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/cursor"},{"$ref":"#/components/parameters/mitretype"},{"$ref":"#/components/parameters/report"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Mitre"}},"meta":{"$ref":"#/components/schemas/PaginatedListMeta"}}}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"422":{"$ref":"#/components/responses/UnprocessableEntity"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"List all Mitre entries by report","tags":["Mitre IDs","Reports"],"security":[{"apiKeyHeader":[]}]}},"/reports":{"get":{"description":"Get a paginated list of all reports ordered by date (descending)","operationId":"getAllReports","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/cursor"},{"$ref":"#/components/parameters/sources"},{"$ref":"#/components/parameters/reportsearch"},{"$ref":"#/components/parameters/reportdate"},{"$ref":"#/components/parameters/reporttimestamp"},{"name":"source_artwork","in":"query","description":"Whether to include the source artwork, which is only useful for the web UI","schema":{"type":"boolean","default":false,"example":true}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Report"}},"meta":{"$ref":"#/components/schemas/PaginatedListMeta"}}}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"422":{"$ref":"#/components/responses/UnprocessableEntity"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"List all reports","tags":["Reports"],"security":[{"apiKeyHeader":[]}]}},"/reports/{id}":{"get":{"description":"Get detailed information about a specific report by its ID","operationId":"getReportById","parameters":[{"$ref":"#/components/parameters/report"},{"name":"yara_rules","in":"query","description":"Whether to include YARA rules associated with the report","schema":{"type":"boolean","default":false,"example":true}},{"name":"iocs","in":"query","description":"Whether to include IOCs associated with the report","schema":{"type":"boolean","default":false,"example":true}},{"name":"mitre_ids","in":"query","description":"Whether to include Mitre ids associated with the report","schema":{"type":"boolean","default":false,"example":true}},{"name":"cve","in":"query","description":"Whether to include CVEs associated with the report","schema":{"type":"boolean","default":false,"example":true}},{"name":"notes","in":"query","description":"Whether to include notes associated with the report, which are only useful for the web UI.","schema":{"type":"boolean","default":false,"example":true}},{"name":"source_artwork","in":"query","description":"Whether to include the source artwork, which is only useful for the web UI.","schema":{"type":"boolean","default":false,"example":true}},{"name":"exports","in":"query","description":"Whether to include the available exports","schema":{"type":"boolean","default":false,"example":true}},{"name":"full","in":"query","description":"Whether to include all available information, overrides any of the other parameters","schema":{"type":"boolean","default":false,"example":true}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Report","description":"The report details"}}},"description":"OK"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"Get report by ID","tags":["Reports"],"security":[{"apiKeyHeader":[]}]}},"/reports/{id}/checksum":{"get":{"description":"Get the checksum of a report by its ID","operationId":"getReportChecksum","parameters":[{"$ref":"#/components/parameters/report"}],"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"checksum":{"type":"string","description":"The checksum of the report file","examples":["dc7f87d26850352a13cfc39c9fb8b02d"]}}}}},"description":"OK"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"Get checksum of a report","tags":["Reports"],"security":[{"apiKeyHeader":[]}]}},"/reports/{id}/date":{"get":{"description":"Get the date of a report by its ID","operationId":"getReportDate","parameters":[{"description":"Report ID","in":"path","name":"id","required":true,"schema":{"type":"string","description":"Report ID","example":"H34ytWAX"}}],"responses":{"200":{"content":{"application/json":{"schema":{"type":"object","properties":{"date":{"$ref":"#/components/schemas/Date"}}}}},"description":"OK"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"Get date of a report","tags":["Reports"],"security":[{"apiKeyHeader":[]}]}},"/reports/{id}/exports":{"get":{"description":"List all exports for a specific report","operationId":"getExportsByReport","parameters":[{"$ref":"#/components/parameters/report"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/File"}},"meta":{"$ref":"#/components/schemas/ListMeta"}}}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"List all exports of a report","tags":["Reports","Exports"],"security":[{"apiKeyHeader":[]}]}},"/reports/{id}/exports/{filetype}":{"get":{"description":"Get an export of a report by type","operationId":"getReportExport","parameters":[{"$ref":"#/components/parameters/filetype"},{"$ref":"#/components/parameters/report"}],"responses":{"200":{"$ref":"#/components/responses/FileDownload"},"302":{"$ref":"#/components/responses/RedirectToFile"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"Get report export from storage","tags":["Reports","Exports"],"security":[{"apiKeyHeader":[]}]}},"/reports/{id}/yara-rules":{"get":{"description":"Get a list of all YARA rules associated with a specific report","operationId":"getYaraRulesByReport","parameters":[{"$ref":"#/components/parameters/report"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Yara"}},"meta":{"$ref":"#/components/schemas/ListMeta"}}}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"List YARA rules of a report","tags":["Yara Rules","Reports"],"security":[{"apiKeyHeader":[]}]}},"/sources":{"get":{"description":"Get a list of all sources with their corresponding count of reports and most recent report date","operationId":"getSources","parameters":[{"$ref":"#/components/parameters/limit"},{"$ref":"#/components/parameters/cursor"},{"$ref":"#/components/parameters/sourcesearch"},{"$ref":"#/components/parameters/artwork"}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"allOf":[{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Source"}},"meta":{"$ref":"#/components/schemas/PaginatedListMeta"}}}]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"422":{"$ref":"#/components/responses/UnprocessableEntity"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"List all sources","tags":["Sources"],"security":[{"apiKeyHeader":[]}]}},"/sources/{id}":{"get":{"description":"Get detailed information about a specific source by its ID","operationId":"getSource","parameters":[{"$ref":"#/components/parameters/source"}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Source"}}},"description":"OK"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"Get a source","tags":["Sources"],"security":[{"apiKeyHeader":[]}]}},"/statistics":{"get":{"deprecated":true,"description":"Get a summary statistics. **Deprecated**: Use `/v2/charts/key-metrics` instead.","operationId":"getStatistics","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Statistics"}}},"description":"OK"},"401":{"$ref":"#/components/responses/Unauthorized"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"Get statistics","tags":["Statistics"],"security":[{"apiKeyHeader":[]}]}},"/status":{"get":{"description":"Check if the API is online and which version is running. Also checks if the database connection is working.","operationId":"status","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Status"}}},"description":"OK"},"401":{"$ref":"#/components/responses/Unauthorized"},"429":{"$ref":"#/components/responses/TooManyRequests"},"500":{"$ref":"#/components/responses/InternalServerError"}},"summary":"Check the status of the API","tags":["Status"],"security":[{"apiKeyHeader":[]}]}}},"components":{"parameters":{"artwork":{"name":"artwork","in":"query","description":"Whether to include the source artwork, which is only useful for the web UI.","schema":{"type":"boolean","default":false,"example":true}},"chartId":{"name":"id","in":"path","description":"Chart identifier","required":true,"schema":{"description":"Chart identifier","examples":["key-metrics"],"type":"string"}},"feed":{"name":"id","in":"path","description":"Identifier of feed","required":true,"schema":{"description":"Identifier of feed","examples":["crowdstrike-csv.csv"],"type":"string"}},"report":{"name":"id","in":"path","description":"Identifier of report","required":true,"schema":{"description":"Identifier of report","examples":["zY1R3WGG"],"type":"string"}},"filetype":{"name":"filetype","description":"Corresponds to the `id` of the *File Type* model.","in":"path","required":true,"schema":{"type":"string","examples":["csv","ecs","yara-zip"]}},"limit":{"name":"limit","description":"Number of items to return","in":"query","explode":false,"schema":{"description":"Number of results to return","examples":[50],"format":"int64","maximum":1000,"default":100,"minimum":0,"type":"integer"}},"cursor":{"description":"Pagination cursor for the next page of results, if available. This value must not be created or modified by clients. It is not a user-editable string and is only valid if issued by the server.","explode":false,"in":"query","name":"cursor","schema":{"description":"Pagination cursor, if available","examples":["dXNlcjpVMEc5V0ZYTlo"],"type":"string","format":"opaque-cursor"}},"sources":{"description":"Filter by sources","example":["asec","crowdstrike"],"explode":false,"in":"query","name":"source","schema":{"description":"Filter by source","examples":[["asec","crowdstrike"]],"items":{"$ref":"#/components/schemas/SourceID"},"type":"array"}},"source":{"description":"Source id","required":true,"explode":false,"in":"path","name":"id","example":"asec","schema":{"type":"string"}},"sourcesearch":{"description":"Search term to filter sources by name","explode":false,"in":"query","name":"q","schema":{"description":"Search term to filter sources by name","examples":["CrowdStrike"],"type":"string"}},"iocsearch":{"description":"Search term to find in IOC values or comments","explode":false,"in":"query","name":"q","schema":{"description":"Search term to find in IOC values or comments","examples":["mcrosoft.com","C2 server"],"type":"string"}},"reportsearch":{"description":"Search reports by title or authors","explode":false,"in":"query","name":"q","schema":{"description":"Search term","examples":["lumma"],"type":"string"}},"reportdate":{"description":"Filter reports from or after this date (format: YYYY-MM-DD)","explode":false,"in":"query","name":"after","schema":{"$ref":"#/components/schemas/Date"}},"ioctimestamp":{"description":"Restrict IOCs results by last 'timestamp' (newer than), only return IOCs that were created or updated *after* the provided timestamp. Format is YYYY-MM-DDTHH:MM:SSZ or YYYY-MM-DDTHH:MM:SS+02:00.","explode":false,"in":"query","name":"timestamp","schema":{"$ref":"#/components/schemas/Timestamp"}},"reporttimestamp":{"description":"Restrict report results by last 'timestamp' (newer than), only return reports that were created or updated *after* the provided timestamp. Format is YYYY-MM-DDTHH:MM:SSZ or YYYY-MM-DDTHH:MM:SS+02:00.","explode":false,"in":"query","name":"timestamp","schema":{"$ref":"#/components/schemas/Timestamp"}},"iocdopatternmatch":{"description":"Whether to use pattern matching. If set to false, the IOC or comment must match the provided search term exactly, otherwise any of the two just need to include the search term. *This only applies when a search term is provided.*","explode":false,"in":"query","name":"pattern","schema":{"description":"Whether to use pattern matching.","examples":[true],"type":"boolean"}},"ioctype":{"description":"Filter by IOC types","example":["domain","ip-dst"],"explode":false,"in":"query","name":"type","schema":{"type":"array","items":{"$ref":"#/components/schemas/IOCType"}}},"category":{"description":"Filter by categories","example":["network_activity","payload_delivery"],"explode":false,"in":"query","name":"category","schema":{"type":"array","items":{"$ref":"#/components/schemas/Category"}}},"iocvalue":{"description":"Filter by IOC value","explode":false,"in":"query","name":"value","schema":{"description":"Filter by IOC value","examples":["malware.com"],"type":"string"}},"mitretype":{"description":"Object type of Mitre entry","example":"tactics","explode":false,"in":"query","name":"object_type","schema":{"$ref":"#/components/schemas/MitreObjectType"}}},"responses":{"FileDownload":{"description":"OK - Returns the file content","content":{"application/octet-stream":{"schema":{"type":"string","format":"binary"}},"text/plain":{"schema":{"type":"string"},"examples":{"yara_rule":{"summary":"YARA rule content","value":"rule Example_Rule {\n    strings:\n        $a = \"suspicious string\"\n    condition:\n        $a\n}\n"}}},"application/json":{"schema":{"type":"object","additionalProperties":true},"examples":{"json_export":{"summary":"JSON formatted export","value":{"indicators":[{"type":"ip","value":"192.168.1.1"},{"type":"domain","value":"malicious.example.com"}]}}}},"text/csv":{"schema":{"type":"string"},"examples":{"csv_export":{"summary":"CSV formatted export","value":"type,value,confidence\nip,192.168.1.1,high\ndomain,malicious.example.com,medium\n"}}}},"headers":{"Content-Disposition":{"description":"The Content-Disposition header to suggest a filename for the download.","schema":{"type":"string","example":"attachment; filename=\"export_2025-04-29.zip\""}}}},"RedirectToFile":{"description":"Found - Redirects to the actual file location","headers":{"Location":{"description":"URL of the actual file","schema":{"type":"string","format":"uri"},"examples":{"example1":{"value":"https://storage.example.com/exports/export_2025-04-29.zip","summary":"Example file location"}}}}},"Unauthorized":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnauthorizedError"}}}},"NotFound":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundError"}}}},"UnprocessableEntity":{"description":"Unprocessable Entity","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UnprocessableEntityError"}}}},"TooManyRequests":{"description":"Too Many Requests","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TooManyRequestsError"}}}},"InternalServerError":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InternalServerError"}}}},"BadRequest":{"description":"Unprocessable Entity","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BadRequest"}}}}},"schemas":{"BaseError":{"x-scalar-ignore":true,"description":"RFC 7807 (https://datatracker.ietf.org/doc/html/rfc7807)","type":"object","properties":{"title":{"type":"string"},"status":{"type":"integer","format":"int64"},"detail":{"type":"string"},"errors":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"}}}}},"required":["title","status","detail"]},"UnauthorizedError":{"x-scalar-ignore":true,"allOf":[{"$ref":"#/components/schemas/BaseError"},{"type":"object","properties":{"title":{"const":"Unauthorized","examples":["Unauthorized"]},"status":{"const":401,"examples":[401]},"detail":{"examples":["You are not authorized to access this resource. Please check your API key or authentication method."]},"errors":{"items":{"type":"object","properties":{"message":{"type":"string","examples":["Invalid API key provided.","Missing API key in request headers."]}}}}}}]},"NotFoundError":{"x-scalar-ignore":true,"allOf":[{"$ref":"#/components/schemas/BaseError"},{"type":"object","properties":{"title":{"const":"Not Found","examples":["Not Found"]},"status":{"const":404,"examples":[404]},"detail":{"examples":["The report with id 'H34ytWAX' was not found."]},"errors":{"items":{"type":"object","properties":{"message":{"type":"string","examples":["The requested resource was not found."]}}}}}}]},"UnprocessableEntityError":{"x-scalar-ignore":true,"allOf":[{"$ref":"#/components/schemas/BaseError"},{"type":"object","properties":{"title":{"const":"Unprocessable Entity","examples":["Unprocessable Entity"]},"status":{"const":422,"examples":[422]},"detail":{"examples":["The provided cursor is invalid or malformed."]},"errors":{"items":{"type":"object","properties":{"message":{"type":"string","examples":["Could not decode the provided cursor, please only use server provided cursors."]}}}}}}]},"TooManyRequestsError":{"x-scalar-ignore":true,"allOf":[{"$ref":"#/components/schemas/BaseError"},{"type":"object","properties":{"title":{"const":"Too Many Requests","examples":["Too Many Requests"]},"status":{"const":429,"examples":[429]},"detail":{"examples":["You have exceeded the rate limit for this API endpoint, try again in a few minutes."]},"errors":{"items":{"type":"object","properties":{"message":{"type":"string","examples":["Used up your rate limit for this endpoint, try again later."]}}}}}}]},"InternalServerError":{"x-scalar-ignore":true,"allOf":[{"$ref":"#/components/schemas/BaseError"},{"type":"object","properties":{"title":{"const":"Internal Server Error","examples":["Internal Server Error"]},"status":{"const":500,"examples":[500]},"detail":{"examples":["Failed to connect to the database."]},"errors":{"items":{"type":"object","properties":{"message":{"type":"string","examples":["Timeout while connecting to the database."]}}}}}}]},"BadRequest":{"x-scalar-ignore":true,"allOf":[{"$ref":"#/components/schemas/BaseError"},{"type":"object","properties":{"title":{"const":"BadRequest","examples":["BadRequest"]},"status":{"const":400,"examples":[400]},"detail":{"examples":["Failed to parse the provided date."]},"errors":{"items":{"type":"object","properties":{"message":{"type":"string","examples":["Could not parse the provided date, please use the format YYYY-MM-DD."]}}}}}}]},"ListMeta":{"title":"List Metadata","description":"Metadata for a list response that is not paginated.","type":"object","properties":{"count":{"description":"Number of items returned in this response, which is also the total number of items in the list.","examples":[50],"format":"uint64","minimum":0,"type":"integer"},"paginated":{"description":"Indicates that the response is not paginated, i.e., always set to `false`.","type":"boolean","const":false,"example":false}},"required":["paginated","count"]},"PaginatedListMeta":{"title":"Paginated List Metadata","description":"Metadata for a paginated list response.","type":"object","properties":{"count":{"description":"Number of items returned in this response, which might be less than the total number of items in the list, see `paginated` if there are more and use the `cursor` if so to access the next page.","examples":[50],"format":"uint64","minimum":0,"type":"integer"},"paginated":{"description":"Indicates that the response is paginated, i.e., always set to `true`.","type":"boolean","const":true,"example":true},"has_more":{"description":"Whether there are more results available","examples":[true],"type":"boolean"},"limit":{"default":100,"description":"Number of results you asked for","examples":[50],"format":"int64","minimum":0,"type":"integer"},"next_cursor":{"description":"Pagination cursor for the next page of results, if available.","examples":["dXNlcjpVMEc5V0ZYTlo"],"type":"string"},"total":{"description":"Total number or results available in the database, not just the ones returned in this response.","examples":[2838],"format":"int64","minimum":0,"type":"integer"}},"required":["paginated","count","has_more","limit","total"]},"File":{"title":"File","description":"Metadata for a file, such as an export or feed file","additionalProperties":false,"properties":{"id":{"description":"Unique identifier for the file","examples":["zY1R3WGG-export-csv.csv"],"type":"string"},"timestamp":{"$ref":"#/components/schemas/Timestamp","description":"When the bulk export was created"},"filename":{"description":"Name of the file. *Please do not use this to directly access the file, as the storage solution might change. There are specific endpoints to download files.*","examples":["export_2025-04-29.zip"],"type":"string"},"path":{"description":"Path to the file. *Please do not use this to directly access the file, as the storage solution might change. There are specific endpoints to download files.*","examples":["/reports/34985a/export_2025-04-29.zip"],"type":"string"},"bucket":{"description":"Bucket that contains the file. *Please do not use this to directly access the file, as the storage solution might change. There are specific endpoints to download files.*","examples":["feeds","bulk-exports"],"type":"string"},"tags":{"description":"Tags associated with the file","examples":[["cnc"]],"type":"array","items":{"type":"string"}},"size":{"description":"Size of the export file","examples":[139293],"format":"int64","minimum":0,"type":"integer"},"type":{"$ref":"#/components/schemas/FileType"},"category":{"description":"Category of the file","examples":["feed","export","bulk-export"],"type":"string","enum":["feed","report-export","bulk-export"]}},"required":["id","filename","path","bucket","size","timestamp","type","category"],"type":"object"},"Category":{"title":"IOC Category","description":"Name indicating the IOC category, e.g., `network_activity` or `artifacts_dropped`","type":"string","examples":["network_activity","artifacts_dropped"]},"Chart":{"title":"Chart","description":"Chart data with metadata","type":"object","properties":{"chart":{"description":"The values of the chart, format depends on the chart type","examples":[null]},"description":{"description":"Description of the chart","type":"string","examples":["Shows the top 10 most common IOC types in the last month"]},"name":{"description":"Name of the chart","type":"string","examples":["Top 10 IOC Types"]},"timestamp":{"description":"When the data was last updated","type":"string","format":"date-time","examples":["2025-05-06T10:00:00Z"]}},"required":["chart","description","name","timestamp"]},"ChartListItem":{"title":"Chart List Item","description":"Chart identifier with name and description","type":"object","properties":{"Description":{"description":"Description of the chart","type":"string","examples":["string"]},"ID":{"description":"Chart identifier","type":"string","examples":["string"]},"Name":{"description":"Name of the chart","type":"string","examples":["string"]}},"required":["Description","ID","Name"]},"Correlation":{"title":"Correlation","description":"Correlation between two reports based on shared IOC value","properties":{"id":{"description":"Unique identifier for the correlation entry","examples":[5],"type":"number"},"report_a":{"description":"ID of the first report","examples":["H34ytWAX"],"type":"string"},"report_b":{"description":"ID of the second report","examples":["r7WOm0tG"],"type":"string"},"ioc":{"description":"IOC value shared by both reports","examples":["www.malware.com"],"type":"string"},"type":{"description":"Type of the IOC, e.g., `ip`, `domain`, `md5`","$ref":"#/components/schemas/IOCType"}},"required":["id","report_a","report_b","ioc"],"type":"object"},"IOCType":{"title":"IOC Type","description":"Type of the IOC, e.g., `ip`, `domain`, `md5`","type":"string","examples":["md5","url","email","sha1"]},"Changelog":{"title":"Changelog Entry","description":"A single entry in the changelog","additionalProperties":false,"properties":{"id":{"description":"Unique identifier for the changelog entry","examples":["KwSysDpxcBU9FNhGkn2dCf"],"type":"string"},"message":{"description":"Detailed message for the changelog entry","examples":["Added a new endpoint for getting all feeds"],"type":"string","format":"markdown"},"timestamp":{"$ref":"#/components/schemas/Timestamp","description":"Timestamp for the changelog entry"},"title":{"description":"Title of the changelog entry","examples":["New API feature added"],"type":"string","format":"markdown"}},"required":["id","title","message","timestamp"],"type":"object"},"IOC":{"title":"IOC (Indicator of Compromise)","description":"An IOC is a piece of information that can be used to identify malicious activity","additionalProperties":false,"properties":{"category":{"$ref":"#/components/schemas/Category"},"comment":{"description":"Comment about the IOC","examples":["Malicious IP used for C2"],"type":"string"},"date":{"$ref":"#/components/schemas/Date","description":"Date associated with the IOC"},"id":{"description":"IOC identifier","examples":["buej849x"],"type":"string"},"ids":{"description":"Whether the IOC is suitable for intrusion detection systems","examples":[false],"type":"boolean"},"report":{"description":"ID of the report this IOC belongs to","examples":["dq13KaQv"],"type":"string"},"risk":{"$ref":"#/components/schemas/Risk","description":"False Positive Risk score if available"},"type":{"$ref":"#/components/schemas/IOCType"},"value":{"description":"IOC value","examples":["192.168.1.1"],"type":"string"},"tags":{"description":"Tags associated with the IOC","examples":[["c2"]],"type":"array","items":{"type":"string"}},"timestamp":{"$ref":"#/components/schemas/Timestamp","description":"When the IOC was created or last updated","examples":["2023-10-05T14:48:00Z","2025-04-29T15:34:56+03:00"]}},"required":["id","category","value","date","type","ids","report"],"type":"object"},"Risk":{"title":"False Positive Risk","description":"False positive risk score for an IOC, indicating its potential false positives","additionalProperties":false,"properties":{"level":{"description":"False positive risk level of the IOC","examples":[3],"format":"int64","maximum":5,"minimum":-1,"type":"integer"},"meaning":{"description":"Meaning of the false positive risk level","examples":["moderate"],"enum":["informational","small","moderate","medium","high","very high"],"type":"string"},"msg":{"description":"Message describing the false positive risk","examples":["Rank 4738 on Alexa"],"type":"string"},"disclaimer":{"description":"Disclaimer for the false positive risk","examples":["The higher the risk, the more likely it is that this IOC might produce false positive."],"type":"string"}},"required":["meaning","level","msg"],"type":"object"},"MitreObjectType":{"title":"Mitre Object Type","description":"Object type of Mitre entry, e.g., `techniques` or `tactics`","enum":["techniques","tactics","datasources","groups","software","campaigns","mitigations"],"examples":["tactics"],"type":"string"},"CVE":{"title":"CVE","description":"A single CVE","additionalProperties":false,"properties":{"id":{"description":"CVE identifier","examples":["CVE-2025-55315"],"type":"string"},"description":{"description":"Description of the CVE","examples":["Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network."],"type":"string"},"timestamp":{"$ref":"#/components/schemas/Timestamp","description":"When the CVE was published"}},"required":["id","description","timestamp"],"type":"object"},"Mitre":{"title":"Mitre Entry","description":"A single entry of the Mitre framework","additionalProperties":false,"properties":{"object_type":{"$ref":"#/components/schemas/MitreObjectType"},"description":{"description":"Description of the Mitre entry","examples":["OS Credential Dumping"],"type":"string"},"id":{"description":"Created Mitre ID","examples":["T1003"],"type":"string"}},"required":["id","description","object_type"],"type":"object"},"ReportNote":{"title":"Report Note","description":"A note associated a report","type":"object","additionalProperties":false,"properties":{"action":{"description":"Additional action to be taken","type":"string","enum":["hide_yara"],"examples":["hide_yara"]},"comment":{"description":"Comment or note text","examples":["The Yara rule needs to be hidden due to a request from any.run"],"type":"string"}},"required":["action"]},"SourceID":{"title":"Source Identifier","description":"Source identifier, e.g., `asec`, `crowdstrike`","type":"string","examples":["asec","crowdstrike"]},"Count":{"title":"Count","description":"Counts of IOCs, Yara rules and Mitre ids in a report","additionalProperties":false,"properties":{"iocs":{"description":"Number of IOCs in the report","examples":[42],"format":"int64","minimum":0,"type":"integer"},"yara_rules":{"description":"Number of Yara rules in the report","examples":[3],"format":"int64","minimum":0,"type":"integer"},"mitre_ids":{"description":"Number of Mitre ids in the report","examples":[5],"format":"int64","minimum":0,"type":"integer"}},"required":["iocs","yara_rules","mitre_ids"],"type":"object"},"Report":{"title":"Report","description":"Metadata of a report","additionalProperties":false,"properties":{"authors":{"description":"Authors of the report","examples":[["John Doe","Jane Smith"]],"items":{"type":"string"},"type":["array","null"]},"checksum":{"description":"Checksum of the report","examples":["a1b2c3d4e5f6"],"type":"string"},"count":{"$ref":"#/components/schemas/Count","description":"Counts of IOCs, Yara rules and Mitre ids"},"date":{"$ref":"#/components/schemas/Date","description":"Date of the report"},"id":{"description":"ID of the report this IOC belongs to","examples":["H34ytWAX"],"type":"string"},"last_updated":{"$ref":"#/components/schemas/Timestamp","description":"Last updated timestamp of the report"},"source":{"$ref":"#/components/schemas/Source"},"tags":{"description":"Tags associated with the report","items":{"type":"string"},"type":"array"},"title":{"description":"Title of the report","examples":["Threat Analysis Report"],"type":"string"},"url":{"description":"URL of the report","examples":["https://example.com/report"],"type":"string"},"iocs":{"description":"List of IOCs associated with the report","items":{"$ref":"#/components/schemas/IOC"},"type":["array","null"]},"yara_rules":{"description":"List of Yara rules associated with the report","items":{"$ref":"#/components/schemas/Yara"},"type":["array","null"]},"mitre_ids":{"description":"List of Mitre ids associated with the report","items":{"$ref":"#/components/schemas/Mitre"},"type":["array","null"]},"cve":{"description":"List of CVE associated with the report","items":{"$ref":"#/components/schemas/CVE"},"type":["array","null"]},"artwork":{"$ref":"#/components/schemas/SourceArtwork","description":"Artwork for the report, such as a logo or image"},"exports":{"description":"List of exports associated with the report","items":{"$ref":"#/components/schemas/File"},"type":["array","null"]},"notes":{"description":"List of notes associated with the report","items":{"$ref":"#/components/schemas/ReportNote"},"type":["array","null"]}},"required":["id","date","title","url","authors","count","tags","checksum"],"type":"object"},"Yara":{"title":"YARA Rule","description":"A single YARA rule","additionalProperties":false,"properties":{"filename":{"description":"Filename of the YARA rule","examples":["dridex.yara"],"type":"string"},"id":{"description":"ID of the YARA rule","examples":["bef12345"],"type":"string"},"hash":{"description":"Hash of the YARA rule","examples":["28c7580b266a467f4d07670f09e4d043"]},"keyword":{"description":"rule keyword","enum":["global","private"],"examples":["private"],"type":"string"},"name":{"description":"Name of the YARA rule","examples":["Suspicious_Behavior"],"type":"string"},"report":{"description":"ID of the report to associate with this rule","examples":["H34ytWAX"],"type":"string"},"rule":{"description":"Content of the YARA rule","examples":["rule Suspicious_Behavior { ... }"],"type":"string"},"tags":{"description":"Tags associated with the YARA rule","examples":[["malware","dridex"]],"items":{"type":"string"},"type":["array","null"]}},"required":["report","id","name","filename","rule"],"type":"object"},"Source":{"title":"Source","description":"Metadata for a source, such as a blog or news site that publishes reports","additionalProperties":false,"properties":{"artwork":{"$ref":"#/components/schemas/SourceArtwork","description":"Artwork for the source"},"id":{"$ref":"#/components/schemas/SourceID"},"name":{"description":"Source name","examples":["CrowdStrike Blog"],"maxLength":100,"type":"string"},"stats":{"$ref":"#/components/schemas/SourceStats","description":"Statistics for the source"},"status":{"$ref":"#/components/schemas/SourceStatus","description":"Status of the source"},"url":{"description":"Source URL","examples":["https://www.crowdstrike.com/blog/"],"maxLength":255,"type":"string"}},"required":["id","name","stats","status","url"],"type":"object"},"SourceArtwork":{"title":"Source Artwork","description":"Images for the source, i.e., the logo and the smaller favicon","additionalProperties":false,"properties":{"favicon":{"description":"Favicon URL","examples":["iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAA"],"type":"string"},"logo":{"description":"Logo URL","examples":["iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAA"],"type":"string"}},"required":["favicon","logo"],"type":"object"},"SourceStats":{"title":"Source Statistics","description":"Statistics for a source, such as the number of reports","additionalProperties":false,"properties":{"count":{"description":"Number of reports for this source","examples":[42],"format":"int64","type":"integer"},"most_recent_date":{"description":"Date of the most recent report for this source","$ref":"#/components/schemas/Date"}},"required":["count"],"type":"object"},"SourceStatus":{"title":"Source Status","description":"Status of the source, indicating if it is active or deactivated and why","additionalProperties":false,"properties":{"active":{"description":"Whether the source is currently active","examples":[false],"type":"boolean"},"deactivated_at":{"$ref":"#/components/schemas/Timestamp","description":"When the source was deactivated, if applicable"},"reason":{"description":"Reason for deactivation, if applicable","examples":["Deactivated due to inactivity"],"type":"string"}},"required":["active"],"type":"object"},"Statistics":{"title":"Statistics","description":"Statistics for the Rösti database","type":"object","properties":{"counts":{"description":"Counts of various items in the database","type":"object","properties":{"reports":{"$ref":"#/components/schemas/CountWithTimestamp","description":"Number of reports"},"iocs":{"$ref":"#/components/schemas/CountWithTimestamp","description":"Number of IOCs"},"yara_rules":{"$ref":"#/components/schemas/CountWithTimestamp","description":"Number of Yara rules"},"sources":{"$ref":"#/components/schemas/CountWithTimestamp","description":"Number of sources"},"mitre_ids":{"$ref":"#/components/schemas/CountWithTimestamp","description":"Number of Mitre entries"}}}},"required":["counts"]},"CountWithTimestamp":{"x-scalar-ignore":true,"title":"Count with Timestamp","description":"Count of items with a timestamp","additionalProperties":false,"properties":{"value":{"description":"Value of the statistic","examples":[100],"format":"int64","minimum":0,"type":"integer"},"timestamp":{"$ref":"#/components/schemas/Timestamp","description":"Timestamp when the count was last updated"}},"required":["value","timestamp"],"type":"object"},"Status":{"title":"Status","description":"Status of the API, indicating if it is online and which version is running","additionalProperties":false,"properties":{"deprecated":{"description":"Indicates if the API is deprecated","examples":[false],"type":"boolean"},"status":{"description":"Status of the API","enum":["ok","db_down"],"examples":["ok"],"type":"string"},"version":{"description":"Version of the API","examples":["2.0.2"],"type":"string"}},"required":["status","version","deprecated"],"type":"object"},"Date":{"title":"Date","description":"Date in ISO 8601 format YYYY-MM-DD","type":"string","format":"date","examples":["2024-12-27"]},"Timestamp":{"title":"Timestamp","description":"Timestamp in ISO 8601 format YYYY-MM-DDTHH:MM:SSZ","type":"string","format":"date-time","examples":["2025-04-29T15:34:56Z"]},"FileType":{"title":"File Type","description":"Metadata for a specific file type, such as an export or feed file","type":"object","properties":{"id":{"description":"Unique identifier for the file type","examples":["csv","jsonl","misp"],"type":"string"},"description":{"description":"Description of the file type","examples":["Comma separated values with headers and"],"type":"string"},"extension":{"description":"File extension of the export","examples":[".csv"],"type":"string"},"mime_type":{"description":"MIME type of the export","examples":["text/csv"],"type":"string"},"name":{"description":"Name of the file type","examples":["CSV","JSON Lines","MISP Feed"],"type":"string"}},"required":["id","description","extension","mime_type","name"]}},"securitySchemes":{"apiKeyHeader":{"type":"apiKey","in":"header","name":"X-API-Key","description":"API key request header"}}}}