{"openapi":"3.1.0","info":{"title":"ThreatCluster Public API","description":"\n## ThreatCluster Public API\n\nProgrammatic access to threat intelligence data.\n\n### Authentication\n\nAll endpoints require an API key passed via the `X-API-Key` header:\n\n```\nX-API-Key: tc_live_your_api_key_here\n```\n\nEvery account — including **Free** — can mint a key in [Settings → API](/settings#api).\nNo card needed. Overview, quickstart and examples: [threatcluster.io/about/api](/about/api).\nClient examples and an OpenAPI snapshot: [github.com/Jam0k/threatcluster-api](https://github.com/Jam0k/threatcluster-api).\n\n### Plans, scopes and rate limits\n\nKeys carry scopes; each endpoint declares the scope it needs (a `403 insufficient_scope`\ntells you which). Budgets are per key.\n\n| Plan | Requests | Scopes on a new key |\n|------|----------|---------------------|\n| Free | 30 / min, **100 / day** | `threats:read` `iocs:read` `entities:read` `vulns:read` `darkweb:read` |\n| Researcher | 120 / min | + `feeds:read` `feeds:write` `alerts:read` `alerts:write` |\n| Analyst | 240 / min | same as Researcher |\n| Business / MSSP | 600 / min | all scopes (+ `inventory:*`, `mssp:*`, `compliance:read`) |\n\n**Free keys see a 7-day window.** Time filters are clamped to it (`time_filter` ≤ 7d, `hours` ≤ 168,\n`days` ≤ 7, `weeks` ≤ 1), by-id lookups of older records return `403 lookback_exceeded`, and rows are\ntrimmed: the short summary (not the enhanced one), threat score + urgency (not the sub-scores or\nseverity reasoning), a 3-event timeline, source links without article bodies, and secondary lists\ncapped at 10. Responses carry `\"tier\": \"free\"` and `\"lookback_days\": 7` so you can tell. Researcher\nand above get the full record and the full history.\n\n**Start with `GET /search?q=<term>`** — one call across clusters, entities and the dark web; chain the\n`short_id` / `entity_type` + `entity_value` it returns into the detail endpoints.\n\nOver budget returns `429` with a `Retry-After` header. Per-key overrides above the plan\nceiling are available for platform integrations — contact hello@threatcluster.io.\n\n### Base URL\n\n```\nhttps://threatcluster.io/api/public/v1\n```\n        ","version":"1.0.0"},"paths":{"/api/public/v1/inventory":{"post":{"tags":["inventory"],"summary":"Push asset inventory","description":"Push asset + installed-software inventory for your organization.\n\nEach row = one piece of software seen on one host. Re-pushes upsert by\n(org, source, host_id) — safe to call repeatedly. The threat overlay\n(`GET /api/public/v1/inventory/threats`) is recomputed asynchronously\nin the background and ready within a few seconds.\n\nAuth:\n  X-API-Key: tc_live_...   (scope: inventory:write)\n\nBody:\n  {\n    \"source\": \"manual\",   # manual | tenable | mde | crowdstrike\n    \"components\": [\n      {\n        \"host_id\":     \"laptop-jdoe-01\",                # required\n        \"hostname\":    \"laptop-jdoe-01.corp\",           # optional\n        \"os_platform\": \"Windows\",                       # optional\n        \"os_version\":  \"11 24H2\",                       # optional\n        \"vendor\":      \"Microsoft Corporation\",         # required\n        \"product\":     \"Microsoft Office\",              # required\n        \"version\":     \"16.0.18827\"                     # optional but improves matching\n      }\n    ]\n  }\n\nReturns asset/software counts plus a sample of unmatched rows so you\ncan spot-check the CPE normalizer.","operationId":"public_push_inventory_api_public_v1_inventory_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InventoryPushRequest"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InventoryPushResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/inventory/summary":{"get":{"tags":["inventory"],"summary":"Inventory summary","description":"Asset / software / CVE-exposure counts for one slice of your inventory.\n\nDefault = your own org's rows. MSSP analysts can pass\n`mssp_customer_id=N` to scope to one customer, or `all_customers=true`\nfor a roll-up across every managed customer.","operationId":"public_get_inventory_summary_api_public_v1_inventory_summary_get","parameters":[{"name":"mssp_customer_id","in":"query","required":false,"schema":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Mssp Customer Id"}},{"name":"all_customers","in":"query","required":false,"schema":{"type":"boolean","default":false,"title":"All Customers"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InventorySummary"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/inventory/threats":{"get":{"tags":["inventory"],"summary":"Your Threats — tiered exposure overlay","description":"Tiered \"Your Threats\" overlay against your pushed inventory.\n\nQuery:\n    strength:         'direct' | 'related' (omit for both)\n    limit:            max rows (default 200, max 500)\n    mssp_customer_id: scope to one MSSP-managed customer (analyst only)\n    all_customers:    true to roll-up across every MSSP customer (analyst only)\n\nSorting: KEV CVEs first, then CVSS, then cluster volume, then recency.\nRender `direct` and `related` in two sections.","operationId":"public_get_inventory_threats_api_public_v1_inventory_threats_get","parameters":[{"name":"strength","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Strength"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":200,"title":"Limit"}},{"name":"mssp_customer_id","in":"query","required":false,"schema":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Mssp Customer Id"}},{"name":"all_customers","in":"query","required":false,"schema":{"type":"boolean","default":false,"title":"All Customers"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InventoryThreatsResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/search":{"get":{"tags":["threats"],"summary":"Search clusters, entities and the dark web in one call","description":"One query across the corpus. Case-insensitive substring match on cluster\ntitles and summaries, entity names, and dark-web victims, groups, markets,\nbreaches and underground sites. The same fan-out the site's search box\nuses.\n\nQuery parameters:\n- q: Search term (min 2 characters)\n- limit: Max hits per bucket (default 10, max 20; free keys 10)\n- days: Only hits dated within the last N days (clusters, articles,\n  victims, breaches, underground). Default: no window. Free keys: 7.\n- include_articles: Also return individual articles whose title matches\n  (default false; clusters are the primary unit, articles are noisier)\n\nReturns buckets: clusters (same shape as GET /threats, chain the short_id\nto /threats/{id}), entities (pass entity_type + entity_value to\n/entities/{type}/{value}), darkweb (typed hits: victim, group, market,\nbreach, underground, underground_victim) and, on request, articles.\n\nResults are most-recent first within each bucket.\n\nFree keys: the window is fixed at 7 days and clusters are trimmed like\n/threats.","operationId":"public_search_api_public_v1_search_get","parameters":[{"name":"q","in":"query","required":false,"schema":{"type":"string","default":"","title":"Q"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":10,"title":"Limit"}},{"name":"days","in":"query","required":false,"schema":{"type":"integer","title":"Days"}},{"name":"include_articles","in":"query","required":false,"schema":{"type":"boolean","default":false,"title":"Include Articles"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SearchResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/threats":{"get":{"tags":["threats"],"summary":"List threat clusters","description":"Get threat clusters.\n\nQuery parameters:\n- limit: Max results (default: 50, max: 100)\n- offset: Pagination offset\n- time_filter: 1h, 24h, 7d, 30d (default: 7d)\n- sort_by: trending, new (default: trending)\n- keyword: Optional keyword filter\n\nReturns list of threat clusters with entities.","operationId":"public_get_threats_api_public_v1_threats_get","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":50,"title":"Limit"}},{"name":"offset","in":"query","required":false,"schema":{"type":"integer","default":0,"title":"Offset"}},{"name":"time_filter","in":"query","required":false,"schema":{"type":"string","default":"7d","title":"Time Filter"}},{"name":"sort_by","in":"query","required":false,"schema":{"type":"string","default":"trending","title":"Sort By"}},{"name":"keyword","in":"query","required":false,"schema":{"type":"string","title":"Keyword"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ThreatsListResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/threats/{identifier}":{"get":{"tags":["threats"],"summary":"Threat cluster detail","description":"Get a single threat cluster by ID.\n\nPath parameters:\n- identifier: Full UUID or 8-char short ID\n\nReturns threat cluster with articles and entities.","operationId":"public_get_threat_api_public_v1_threats__identifier__get","parameters":[{"name":"identifier","in":"path","required":true,"schema":{"type":"string","title":"Identifier"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ThreatDetailResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/threats/{identifier}/iocs":{"get":{"tags":["threats"],"summary":"Threat cluster IOCs","description":"Export IOCs from a threat cluster.\n\nPath parameters:\n- identifier: Cluster ID or short ID\n\nQuery parameters:\n- types: Comma-separated (ip, domain, url, hash, email, all) - default: all\n- format: json, csv, txt (default: json)\n\nReturns IOCs in requested format.","operationId":"public_export_threat_iocs_api_public_v1_threats__identifier__iocs_get","parameters":[{"name":"identifier","in":"path","required":true,"schema":{"type":"string","title":"Identifier"}},{"name":"types","in":"query","required":false,"schema":{"type":"string","default":"all","title":"Types"}},{"name":"format","in":"query","required":false,"schema":{"type":"string","default":"json","title":"Format"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ThreatIocsResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/iocs/export":{"get":{"tags":["iocs"],"summary":"Bulk IOC export (txt/csv/json)","description":"Export all IOCs across clusters, with confidence filtering.\n\nQuery parameters:\n- types: IOC types to include (ip, domain, hash, email, all) - default: all\n- format: Output format (txt, csv, json) - default: txt\n- confidence: Filter level - \"all\", \"high\", \"medium\", \"low\", \"confirmed\" (excludes false positives), \"false_positive\" - default: confirmed\n- hours: Time window in hours (default 720 = 30 days)\n\nReturns IOCs in requested format.","operationId":"public_export_bulk_iocs_api_public_v1_iocs_export_get","parameters":[{"name":"types","in":"query","required":false,"schema":{"type":"string","default":"all","title":"Types"}},{"name":"format","in":"query","required":false,"schema":{"type":"string","default":"txt","title":"Format"}},{"name":"confidence","in":"query","required":false,"schema":{"type":"string","default":"confirmed","title":"Confidence"}},{"name":"hours","in":"query","required":false,"schema":{"type":"integer","default":720,"title":"Hours"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/iocs/feed":{"get":{"tags":["iocs"],"summary":"Live IOC feed for SIEM polling","description":"Live IOC feed for automated polling by SIEMs, firewalls, and TIPs.\n\nReturns data inline (no download) with caching headers for efficient polling.\n\nQuery parameters:\n- types: IOC types (all, ip, domain, hash, email) - default: all\n- format: txt, csv, json, stix - default: txt\n- confidence: confirmed, high, medium, low, false_positive, all - default: confirmed\n- hours: Time window in hours (default 720 = 30 days)\n- enrich: (json only) attach the clusters + sources each IOC was seen in (up to 5 each)\n- threat_score: (requires enrich) include each cluster's threat-score breakdown\n- related_entities: (requires enrich) attach co-occurring attribution entities per IOC","operationId":"public_ioc_feed_api_public_v1_iocs_feed_get","parameters":[{"name":"types","in":"query","required":false,"schema":{"type":"string","default":"all","title":"Types"}},{"name":"format","in":"query","required":false,"schema":{"type":"string","default":"txt","title":"Format"}},{"name":"confidence","in":"query","required":false,"schema":{"type":"string","default":"confirmed","title":"Confidence"}},{"name":"hours","in":"query","required":false,"schema":{"type":"integer","default":720,"title":"Hours"}},{"name":"enrich","in":"query","required":false,"schema":{"type":"boolean","default":false,"title":"Enrich"}},{"name":"threat_score","in":"query","required":false,"schema":{"type":"boolean","default":false,"title":"Threat Score"}},{"name":"related_entities","in":"query","required":false,"schema":{"type":"boolean","default":false,"title":"Related Entities"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/entities/search":{"get":{"tags":["entities"],"summary":"Search entities","description":"Search entities.\n\nQuery parameters:\n- q: Search query\n- entity_type: Filter by type (optional)\n- limit: Max results (default: 20, max: 100)\n- offset: Skip N results for pagination (default: 0)\n- with_cve_count: Include a `cve_count` per entity (distinct CVEs co-occurring\n  with it). Adds a correlated subquery, so it's opt-in — leave off for\n  autocomplete/typeahead where latency matters.\n\nReturns matching entities with frequency data + pagination metadata\n(total, limit, offset) so consumers can page beyond the first 100.","operationId":"public_search_entities_api_public_v1_entities_search_get","parameters":[{"name":"q","in":"query","required":false,"schema":{"type":"string","default":"","title":"Q"}},{"name":"entity_type","in":"query","required":false,"schema":{"type":"string","title":"Entity Type"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":20,"title":"Limit"}},{"name":"offset","in":"query","required":false,"schema":{"type":"integer","default":0,"title":"Offset"}},{"name":"with_cve_count","in":"query","required":false,"schema":{"type":"boolean","default":false,"title":"With Cve Count"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EntitiesSearchResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/entities/{entity_type}/{entity_value}/related":{"get":{"tags":["entities"],"summary":"Related entities","description":"Get entities that co-occur in the same clusters as the target entity.\n\nPath parameters:\n- entity_type: Entity type (malware, apt-group, tool, campaign, etc.)\n- entity_value: Entity value (URL-encoded)\n\nQuery parameters:\n- limit: Max related entities (default 25, max 50)\n- sub: Include sub-relationships between related entities (default true)\n\nReturns related entities with shared cluster counts, plus pairwise sub-relationships.","operationId":"public_get_related_entities_api_public_v1_entities__entity_type___entity_value__related_get","parameters":[{"name":"entity_type","in":"path","required":true,"schema":{"type":"string","title":"Entity Type"}},{"name":"entity_value","in":"path","required":true,"schema":{"type":"string","title":"Entity Value"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":25,"title":"Limit"}},{"name":"sub","in":"query","required":false,"schema":{"type":"boolean","default":true,"title":"Sub"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RelatedEntitiesResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/entities/{entity_type}/{entity_value}/cooccurring-cves":{"get":{"tags":["entities"],"summary":"Co-occurring CVEs for an entity","description":"CVEs that co-occur with this entity in articles (mentioned alongside it),\nnewest-first and paginated. This is the full set the search endpoint's\n`cve_count` reports — use it to page through every co-occurring CVE, not the\ncapped co_entities bucket in the entity-detail response.\n\nQuery parameters:\n- page: Page number (default 1)\n- limit: Results per page (default 20, max 100)","operationId":"public_get_entity_cooccurring_cves_api_public_v1_entities__entity_type___entity_value__cooccurring_cves_get","parameters":[{"name":"entity_type","in":"path","required":true,"schema":{"type":"string","title":"Entity Type"}},{"name":"entity_value","in":"path","required":true,"schema":{"type":"string","title":"Entity Value"}},{"name":"page","in":"query","required":false,"schema":{"type":"integer","default":1,"title":"Page"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":20,"title":"Limit"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CooccurringCvesResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/entities/{category}/{entity_value}":{"get":{"tags":["entities"],"summary":"Entity detail","description":"Get entity details with related clusters.\n\nPath parameters:\n- category: Entity type (cve, malware, apt-group, etc.)\n- entity_value: Entity value (URL-encoded)\n\nReturns entity info, related clusters, and articles.","operationId":"public_get_entity_details_api_public_v1_entities__category___entity_value__get","parameters":[{"name":"category","in":"path","required":true,"schema":{"type":"string","title":"Category"}},{"name":"entity_value","in":"path","required":true,"schema":{"type":"string","title":"Entity Value"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EntityDetailsResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/entities/trending":{"get":{"tags":["entities"],"summary":"Trending entities by type","description":"Get trending entities across all types.\n\nQuery parameters:\n- time_filter: 7d, 30d (default: 7d)\n- limit: Max per type (default: 10, max: 50)\n\nReturns trending entities grouped by type with change indicators.","operationId":"public_get_trending_entities_api_public_v1_entities_trending_get","parameters":[{"name":"time_filter","in":"query","required":false,"schema":{"type":"string","default":"7d","title":"Time Filter"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":10,"title":"Limit"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EntitiesTrendingResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/stats/overview":{"get":{"tags":["stats"],"summary":"Global counts + 24h deltas","description":"Get threat database statistics.\n\nReturns total clusters, articles, average threat score, and last update time.","operationId":"public_get_stats_overview_api_public_v1_stats_overview_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StatsOverviewResponse"}}}}}}},"/api/public/v1/stats/entities/timeline":{"get":{"tags":["stats"],"summary":"Entity timeline (daily counts)","description":"Get timeline data for top entities of a specific type.\n\nQuery parameters:\n- entity_type: Type of entity (malware, apt_group, ransomware_group, etc.)\n- days: Number of days to include (default: 7, max: 30)\n- limit: Number of top entities to track (default: 5, max: 10)\n\nReturns daily mention counts for top entities.","operationId":"public_get_entity_timeline_api_public_v1_stats_entities_timeline_get","parameters":[{"name":"entity_type","in":"query","required":false,"schema":{"type":"string","default":"malware","title":"Entity Type"}},{"name":"days","in":"query","required":false,"schema":{"type":"integer","default":7,"title":"Days"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":5,"title":"Limit"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EntityTimelineResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/darkweb/stats":{"get":{"tags":["darkweb"],"summary":"Dark-web counts + last-sync timestamp","description":"Get dark web monitoring statistics.\n\nReturns ransomware group counts, victim counts, and known breaches.","operationId":"public_get_darkweb_stats_api_public_v1_darkweb_stats_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DarkwebStatsResponse"}}}}}}},"/api/public/v1/darkweb/ransomware/victims":{"get":{"tags":["darkweb"],"summary":"List ransomware victims","description":"Get ransomware victims.\n\nQuery parameters:\n- days: Filter to victims from last N days (default: 30, max: 90)\n- group: Filter by ransomware group name (optional)\n- country: Filter by country code (optional)\n- sector: Filter by victim sector/industry (optional). Use the values from\n  the /darkweb/ransomware/victims/facets endpoint. Turns this into a\n  per-client sector view for platform reports.\n- limit: Maximum results (default: 100, max: 500)\n\nReturns list of ransomware victims with group, date, and country info.","operationId":"public_get_ransomware_victims_api_public_v1_darkweb_ransomware_victims_get","parameters":[{"name":"days","in":"query","required":false,"schema":{"type":"integer","default":30,"title":"Days"}},{"name":"group","in":"query","required":false,"schema":{"type":"string","title":"Group"}},{"name":"country","in":"query","required":false,"schema":{"type":"string","title":"Country"}},{"name":"sector","in":"query","required":false,"schema":{"type":"string","title":"Sector"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":100,"title":"Limit"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RansomwareVictimsListResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/darkweb/ransomware/groups":{"get":{"tags":["darkweb"],"summary":"List ransomware groups","description":"Get ransomware groups.\n\nQuery parameters:\n- active_only: Only return currently active groups (default: false)\n\nReturns list of ransomware groups with victim counts and activity status.","operationId":"public_get_ransomware_groups_api_public_v1_darkweb_ransomware_groups_get","parameters":[{"name":"active_only","in":"query","required":false,"schema":{"type":"boolean","default":false,"title":"Active Only"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RansomwareGroupsListResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/darkweb/ransomware/group/{group_name}":{"get":{"tags":["darkweb"],"summary":"Ransomware group detail","description":"Get detailed information about a specific ransomware group.\n\nPath parameters:\n- group_name: Name of the ransomware group\n\nReturns group details, recent victims, and activity timeline.","operationId":"public_get_ransomware_group_detail_api_public_v1_darkweb_ransomware_group__group_name__get","parameters":[{"name":"group_name","in":"path","required":true,"schema":{"type":"string","title":"Group Name"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupDetailResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/darkweb/breaches":{"get":{"tags":["darkweb"],"summary":"List HIBP breaches","description":"Get data breaches.\n\nQuery parameters:\n- limit: Maximum results (default: 50, max: 100)\n- offset: Pagination offset (default: 0)\n- search: Search term for breach name (optional)\n\nReturns list of known data breaches with record counts.","operationId":"public_get_breaches_api_public_v1_darkweb_breaches_get","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":50,"title":"Limit"}},{"name":"offset","in":"query","required":false,"schema":{"type":"integer","default":0,"title":"Offset"}},{"name":"search","in":"query","required":false,"schema":{"type":"string","title":"Search"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BreachesListResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/darkweb/ransomware/victim/{victim_id}":{"get":{"tags":["darkweb"],"summary":"Victim detail","description":"Full enriched victim payload: base record + LLM-extracted fields\n(headquarters, revenue, data_size, publication_status, negotiation\nstate), mirrored entities, blurred+captioned leak images, and the\nfull-page site screenshot captured via our own Tor pipeline.\n\nPath parameters:\n- victim_id: Victim ID (16-char hex, returned by /ransomware/victims)\n\nReturns 404 if not found.","operationId":"public_get_ransomware_victim_detail_api_public_v1_darkweb_ransomware_victim__victim_id__get","parameters":[{"name":"victim_id","in":"path","required":true,"schema":{"type":"string","title":"Victim Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VictimEnrichmentResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/darkweb/market/{market_name}":{"get":{"tags":["darkweb"],"summary":"Market detail","description":"Market detail: basic metadata + tor/clearnet URLs + scrape enrichment\n(screenshot_url, ai_description, ai_category, ai_risk_tags,\ncaptcha_or_login_gate, observed entities).\n\nPath parameters:\n- market_name: Market name (case-insensitive)\n\nReturns 404 if the market is not tracked.","operationId":"public_get_market_detail_api_public_v1_darkweb_market__market_name__get","parameters":[{"name":"market_name","in":"path","required":true,"schema":{"type":"string","title":"Market Name"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MarketDetailResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/darkweb/keyword-hits":{"get":{"tags":["darkweb"],"summary":"Keyword match across victims, groups, markets, breaches","description":"Match one or more keywords against victim names, ransomware group\nnames, market names, and breach names/domains. Case-insensitive\nsubstring match — ideal for supply-chain / brand monitoring.\n\nQuery parameters:\n- keywords: Comma-separated list (required). Caller-provided; this\n  endpoint does NOT use the org's stored keywords list.\n- per_bucket_limit: Max hits per bucket (default 25, max 100).\n\nReturns: { keywords, hits: {victims, groups, markets, breaches}, total }","operationId":"public_get_keyword_hits_api_public_v1_darkweb_keyword_hits_get","parameters":[{"name":"keywords","in":"query","required":false,"schema":{"type":"string","title":"Keywords"}},{"name":"per_bucket_limit","in":"query","required":false,"schema":{"type":"integer","default":25,"title":"Per Bucket Limit"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/KeywordHitsResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/darkweb/ransomware/victims/facets":{"get":{"tags":["darkweb"],"summary":"Victim filter facets (countries, sectors, groups)","description":"Distinct values for victim filter fields (countries, sectors, groups)\nwith counts. For building filter dropdowns in customer integrations.\n\nQuery parameters:\n- days: Lookback window (default 365, max 3650 = 10 years)\n\nReturns: { countries, sectors, groups }  — each is [{value, count}, ...]","operationId":"public_get_ransomware_victim_facets_api_public_v1_darkweb_ransomware_victims_facets_get","parameters":[{"name":"days","in":"query","required":false,"schema":{"type":"integer","default":365,"title":"Days"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VictimFacetsResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/darkweb/trends":{"get":{"tags":["darkweb"],"summary":"Dark-web trends: weekly victims, top industries, group heatmap","description":"Time-series dark-web trends for dashboards: weekly victim counts,\ntop industries, and a group×week activity heatmap.\n\nQuery parameters:\n- weeks: Weekly-timeline window (default 52, max 156)\n- industry_days: Top-industries window in days (default 90, max 365)\n- heatmap_top_n: Number of groups in the heatmap (default 12, max 30)\n- heatmap_weeks: Heatmap weeks (default 12, max 52)\n- sector: Restrict the weekly timeline + group heatmap to one industry\n  (per-client sector view). top_industries is the sector breakdown itself\n  and is always returned in full. Values from /darkweb/ransomware/victims/facets.\n\nReturns: { victims_weekly, top_industries, group_heatmap }","operationId":"public_get_trends_api_public_v1_darkweb_trends_get","parameters":[{"name":"weeks","in":"query","required":false,"schema":{"type":"integer","default":52,"title":"Weeks"}},{"name":"industry_days","in":"query","required":false,"schema":{"type":"integer","default":90,"title":"Industry Days"}},{"name":"heatmap_top_n","in":"query","required":false,"schema":{"type":"integer","default":12,"title":"Heatmap Top N"}},{"name":"heatmap_weeks","in":"query","required":false,"schema":{"type":"integer","default":12,"title":"Heatmap Weeks"}},{"name":"sector","in":"query","required":false,"schema":{"type":"string","title":"Sector"}},{"name":"mssp_customer_id","in":"query","required":false,"schema":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Mssp Customer Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TrendsResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/vulnerabilities":{"get":{"tags":["vulnerabilities"],"summary":"List CVEs","description":"Get CVE/vulnerability feed.\n\nQuery parameters:\n- days: CVEs from last N days (default: 30, max: 730). Ignored if published_after is set.\n- published_after / published_before: ISO-8601 date bounds (absolute range; alternative to days).\n- severity: Filter by severity (CRITICAL, HIGH, MEDIUM, LOW) - comma-separated\n- kev_only: Only CISA KEV entries (default: false)\n- has_exploit: Only CVEs with known exploits (default: false)\n- vendor: Filter by affected vendor (matches affected_vendors)\n- product: Filter by affected product (matches affected_products)\n- page: Page number (default: 1)\n- limit: Results per page (default: 50, max: 100)\n\nReturns paginated CVE list with CVSS scores and exploit status.","operationId":"public_get_vulnerabilities_api_public_v1_vulnerabilities_get","parameters":[{"name":"days","in":"query","required":false,"schema":{"type":"integer","default":30,"title":"Days"}},{"name":"severity","in":"query","required":false,"schema":{"type":"string","title":"Severity"}},{"name":"kev_only","in":"query","required":false,"schema":{"type":"boolean","default":false,"title":"Kev Only"}},{"name":"has_exploit","in":"query","required":false,"schema":{"type":"boolean","default":false,"title":"Has Exploit"}},{"name":"vendor","in":"query","required":false,"schema":{"type":"string","title":"Vendor"}},{"name":"product","in":"query","required":false,"schema":{"type":"string","title":"Product"}},{"name":"published_after","in":"query","required":false,"schema":{"type":"string","title":"Published After"}},{"name":"published_before","in":"query","required":false,"schema":{"type":"string","title":"Published Before"}},{"name":"page","in":"query","required":false,"schema":{"type":"integer","default":1,"title":"Page"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":50,"title":"Limit"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CveListResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/vulnerabilities/stats":{"get":{"tags":["vulnerabilities"],"summary":"CVE counts + severity breakdown","description":"Get vulnerability statistics.\n\nReturns total CVEs, KEV count, severity breakdown, and recent trends.","operationId":"public_get_vulnerability_stats_api_public_v1_vulnerabilities_stats_get","responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CveStatsResponse"}}}}}}},"/api/public/v1/vulnerabilities/{cve_id}":{"get":{"tags":["vulnerabilities"],"summary":"CVE detail","description":"Get detailed CVE information.\n\nPath parameters:\n- cve_id: CVE identifier (e.g., CVE-2024-1234)\n\nReturns full CVE details including CVSS, affected products, KEV status, and exploit info.","operationId":"public_get_cve_detail_api_public_v1_vulnerabilities__cve_id__get","parameters":[{"name":"cve_id","in":"path","required":true,"schema":{"type":"string","title":"Cve Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CveDetail"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/threats/{identifier}/stix":{"get":{"tags":["threats"],"summary":"Threat cluster as STIX 2.1 bundle","description":"Export threat cluster to STIX 2.1 format.\n\nPath parameters:\n- identifier: Cluster ID (full UUID or short ID)\n\nQuery parameters:\n- tlp: TLP marking (white, green, amber, red) - default: white\n\nReturns STIX 2.1 bundle with threat actors, malware, attack patterns, and indicators.","operationId":"public_export_threat_stix_api_public_v1_threats__identifier__stix_get","parameters":[{"name":"identifier","in":"path","required":true,"schema":{"type":"string","title":"Identifier"}},{"name":"tlp","in":"query","required":false,"schema":{"type":"string","default":"white","title":"Tlp"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/feeds":{"get":{"tags":["feeds"],"summary":"List your custom feeds","description":"List your custom feeds in the requested slice (defaults to personal).\n\nPass `?mssp_customer_id=N` to scope the read to a specific MSSP customer.","operationId":"public_list_feeds_api_public_v1_feeds_get","parameters":[{"name":"mssp_customer_id","in":"query","required":false,"schema":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Mssp Customer Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FeedsListResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"post":{"tags":["feeds"],"summary":"Create a custom feed on your account","description":"Create a personal custom feed seeded with keywords. Returns the feed_id you\nread back via GET /feeds. (MSSP partners: use /mssp/customers/{id}/feed.)","operationId":"public_create_feed_api_public_v1_feeds_post","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/FeedCreate"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/feeds/{feed_id}/entities":{"get":{"tags":["feeds"],"summary":"Entities tracked by a feed","description":"Get entities tracked in a custom feed.\n\nPass `?mssp_customer_id=N` to read a customer-scoped feed (default: personal).","operationId":"public_get_feed_entities_api_public_v1_feeds__feed_id__entities_get","parameters":[{"name":"feed_id","in":"path","required":true,"schema":{"type":"string","title":"Feed Id"}},{"name":"mssp_customer_id","in":"query","required":false,"schema":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Mssp Customer Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FeedEntitiesResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/feed":{"get":{"tags":["feeds"],"summary":"Threats matching your feed filters","description":"Query the threat feed with full filtering.\n\nQuery parameters:\n- limit: Max results (default: 50, max: 100)\n- offset: Pagination offset (default: 0)\n- time_filter: 1h, 24h, 7d, 30d (default: 7d)\n- sort_by: trending, latest, popular, threat_score (default: trending)\n- content_type: all, threats, articles (default: all)\n- feed_type: trending, popular, latest, my_feed, custom (default: trending)\n- feed_id: UUID of custom feed (required when feed_type=custom)\n- keyword: Optional keyword filter\n- urgency: \"hot\" for high-velocity only (optional)\n\nUse feed_type=my_feed to query your personal keyword feed.\nUse feed_type=custom with feed_id to query a specific custom feed.","operationId":"public_get_feed_api_public_v1_feed_get","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":50,"title":"Limit"}},{"name":"offset","in":"query","required":false,"schema":{"type":"integer","default":0,"title":"Offset"}},{"name":"time_filter","in":"query","required":false,"schema":{"type":"string","default":"7d","title":"Time Filter"}},{"name":"sort_by","in":"query","required":false,"schema":{"type":"string","default":"trending","title":"Sort By"}},{"name":"content_type","in":"query","required":false,"schema":{"type":"string","default":"all","title":"Content Type"}},{"name":"feed_type","in":"query","required":false,"schema":{"type":"string","default":"trending","title":"Feed Type"}},{"name":"feed_id","in":"query","required":false,"schema":{"type":"string","title":"Feed Id"}},{"name":"keyword","in":"query","required":false,"schema":{"type":"string","title":"Keyword"}},{"name":"urgency","in":"query","required":false,"schema":{"type":"string","title":"Urgency"}},{"name":"mssp_customer_id","in":"query","required":false,"schema":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Mssp Customer Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FeedResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/alerts/{alert_source}/{trigger_id}/disposition":{"post":{"tags":["compliance"],"summary":"Record a disposition on an alert (evidence of review/action)","description":"Disposition an alert trigger. This is the write that makes the compliance\nevidence real — configuration proves a tool runs; a disposition proves the\nintelligence was reviewed and acted upon (what an ISO 27001 A.5.7 auditor\nactually checks).\n\nA \"trigger\" is one recorded instance of an alert rule firing on a specific\nthreat. Discover triggers (and their `trigger_id` + `alert_source`) via\n**GET /api/public/v1/alerts**, then disposition the one you actioned here.\n\nBody: { \"state\": one of acknowledged|actioned|escalated|dismissed|false_positive,\n        \"note\": optional free text }","operationId":"public_set_alert_disposition_api_public_v1_alerts__alert_source___trigger_id__disposition_post","parameters":[{"name":"alert_source","in":"path","required":true,"schema":{"type":"string","description":"Which alert system the trigger came from: 'cluster' (news-cluster match) or 'cve' (vulnerability match). It's the `alert_source` field of a row from GET /api/public/v1/alerts.","title":"Alert Source"},"description":"Which alert system the trigger came from: 'cluster' (news-cluster match) or 'cve' (vulnerability match). It's the `alert_source` field of a row from GET /api/public/v1/alerts."},{"name":"trigger_id","in":"path","required":true,"schema":{"type":"integer","description":"The id of a specific alert firing — one row from GET /api/public/v1/alerts (its `trigger_id` field). NOT the rule id or the CVE/cluster id: a single rule produces many triggers, one per threat it matches. Disposition the individual firing you reviewed.","title":"Trigger Id"},"description":"The id of a specific alert firing — one row from GET /api/public/v1/alerts (its `trigger_id` field). NOT the rule id or the CVE/cluster id: a single rule produces many triggers, one per threat it matches. Disposition the individual firing you reviewed."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":true,"title":"Body"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/alerts":{"get":{"tags":["compliance"],"summary":"List alert triggers and their dispositions","description":"List alert triggers (cluster + CVE) with disposition state. The raw material\nbehind the compliance attestation.\n\nEach row's `trigger_id` + `alert_source` are what you pass to\nPOST /api/public/v1/alerts/{alert_source}/{trigger_id}/disposition to record\nthat you reviewed/actioned that specific alert firing.\n\nFilters: mssp_customer_id (scope to one client), state (incl. 'open' for\nundispositioned), alert_source (cluster|cve), since (ISO timestamp on\ntriggered_at). Rows are normalised across both alert systems.","operationId":"public_list_alerts_api_public_v1_alerts_get","parameters":[{"name":"mssp_customer_id","in":"query","required":false,"schema":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Mssp Customer Id"}},{"name":"state","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"State"}},{"name":"alert_source","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Alert Source"}},{"name":"since","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Since"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":100,"title":"Limit"}},{"name":"offset","in":"query","required":false,"schema":{"type":"integer","default":0,"title":"Offset"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/compliance/evidence":{"get":{"tags":["compliance"],"summary":"Capability-to-control attestation for a tenant + period","description":"The evidence product. Returns a machine-readable attestation that the\nthreat-intelligence capability was OPERATING for a tenant over a period:\ncollection (config in force), reception (alerts generated), analysis\n(dispositions recorded), production (reports delivered) — stamped against a\nnamed control. JSON now; a rendered PDF is a fast-follow.\n\nframework ∈ {iso27001, nistcsf, dora, nis2, soc2}.","operationId":"public_compliance_evidence_api_public_v1_compliance_evidence_get","parameters":[{"name":"framework","in":"query","required":false,"schema":{"type":"string","default":"iso27001","title":"Framework"}},{"name":"mssp_customer_id","in":"query","required":false,"schema":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Mssp Customer Id"}},{"name":"period_start","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Period Start"}},{"name":"period_end","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Period End"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/mssp/customers":{"get":{"tags":["mssp"],"summary":"List your MSSP managed customers (to discover mssp_customer_id)","description":"List the managed customers under your MSSP organisation. The `id` field is the\nvalue to pass as `mssp_customer_id` on the feeds, alerts, inventory and\ncompliance endpoints.","operationId":"public_list_mssp_customers_api_public_v1_mssp_customers_get","parameters":[{"name":"search","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Search"}},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","default":50,"title":"Limit"}},{"name":"offset","in":"query","required":false,"schema":{"type":"integer","default":0,"title":"Offset"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"post":{"tags":["mssp"],"summary":"Create a managed customer (programmatic onboarding)","description":"Create a managed customer under your MSSP organisation. The returned `id` is\nthe `mssp_customer_id` you pass to the feeds / alerts / inventory / compliance\nendpoints. This is the write path that lets a platform sync its client roster\nwithout manual UI setup.","operationId":"public_create_mssp_customer_api_public_v1_mssp_customers_post","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MsspCustomerCreate"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/mssp/customers/{customer_id}":{"patch":{"tags":["mssp"],"summary":"Update or deactivate a managed customer","description":"Update a managed customer (name / domain / contact_email / notes) or deactivate\nit (`\"is_active\": false`) for offboarding. `customer_id` is the integer id from\nthe customers list. Ownership is validated against your MSSP org. Send only the\nfields you want to change.","operationId":"public_update_mssp_customer_api_public_v1_mssp_customers__customer_id__patch","parameters":[{"name":"customer_id","in":"path","required":true,"schema":{"type":"integer","title":"Customer Id"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MsspCustomerUpdate"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/mssp/customers/{customer_id}/feed":{"post":{"tags":["mssp"],"summary":"Create a monitoring feed for a customer (with keywords)","description":"Create a monitoring feed scoped to one managed customer, seeded with keywords\nin a single call. Keywords cover the client's world for NEWS/CLUSTER matching —\ncompany names, brands, domains, supplier names, sector terms.\n\n(Product/CPE inventory for the exposure overlay is a separate concern — push\nit via POST /api/public/v1/inventory with the same mssp_customer_id.)","operationId":"public_create_mssp_customer_feed_api_public_v1_mssp_customers__customer_id__feed_post","parameters":[{"name":"customer_id","in":"path","required":true,"schema":{"type":"integer","title":"Customer Id"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MsspCustomerFeedCreate"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/mssp/customers/{customer_id}/feed/{feed_uuid}":{"patch":{"tags":["mssp"],"summary":"Rename / update a customer's monitoring feed","description":"Update a customer feed's name / description. Manage its keywords via the\n/keywords sub-resource. `feed_uuid` is the `feed_id` returned on create.","operationId":"public_update_mssp_customer_feed_api_public_v1_mssp_customers__customer_id__feed__feed_uuid__patch","parameters":[{"name":"customer_id","in":"path","required":true,"schema":{"type":"integer","title":"Customer Id"}},{"name":"feed_uuid","in":"path","required":true,"schema":{"type":"string","title":"Feed Uuid"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MsspFeedUpdate"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/mssp/customers/{customer_id}/feed/{feed_uuid}/keywords":{"get":{"tags":["mssp"],"summary":"List a customer feed's keywords","description":"List the keywords currently on a customer feed.","operationId":"public_get_mssp_feed_keywords_api_public_v1_mssp_customers__customer_id__feed__feed_uuid__keywords_get","parameters":[{"name":"customer_id","in":"path","required":true,"schema":{"type":"integer","title":"Customer Id"}},{"name":"feed_uuid","in":"path","required":true,"schema":{"type":"string","title":"Feed Uuid"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"put":{"tags":["mssp"],"summary":"Set a customer feed's keywords (declarative sync)","description":"Declaratively set a feed's keywords to EXACTLY the provided set — adds new\nones, removes any not listed. This is the \"re-sync when the client's world\nchanges\" endpoint (new supplier added, product retired). Send the full\ndesired list each time; the diff is computed server-side.","operationId":"public_set_mssp_feed_keywords_api_public_v1_mssp_customers__customer_id__feed__feed_uuid__keywords_put","parameters":[{"name":"customer_id","in":"path","required":true,"schema":{"type":"integer","title":"Customer Id"}},{"name":"feed_uuid","in":"path","required":true,"schema":{"type":"string","title":"Feed Uuid"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MsspFeedKeywords"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/mssp/vendors/suggest":{"get":{"tags":["mssp"],"summary":"Autocomplete canonical vendor slugs","description":"Find the canonical vendor slugs (as used in CVE data) matching `q`, so you\ncan map a client's tech stack to slugs the risk score can match against CVEs.","operationId":"public_suggest_vendor_slugs_api_public_v1_mssp_vendors_suggest_get","parameters":[{"name":"q","in":"query","required":true,"schema":{"type":"string","title":"Q"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/mssp/customers/{customer_id}/vendors":{"get":{"tags":["mssp"],"summary":"List a customer's tech-stack vendors","description":"The vendor slugs pinned for this customer (their attack surface for the\nstack-exposure part of the risk score).","operationId":"public_get_customer_vendors_api_public_v1_mssp_customers__customer_id__vendors_get","parameters":[{"name":"customer_id","in":"path","required":true,"schema":{"type":"integer","title":"Customer Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}},"put":{"tags":["mssp"],"summary":"Set a customer's tech-stack vendors (declarative)","description":"Declaratively set the customer's vendor list to EXACTLY the provided slugs.\nSlugs are validated against the CVE vendor catalog; unknown slugs are dropped\nand returned in `rejected` (use /mssp/vendors/suggest to find canonical names).\nThese vendors drive the stack-exposure modifier of the client risk score.","operationId":"public_set_customer_vendors_api_public_v1_mssp_customers__customer_id__vendors_put","parameters":[{"name":"customer_id","in":"path","required":true,"schema":{"type":"integer","title":"Customer Id"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MsspCustomerVendors"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/mssp/customers/{customer_id}/risk":{"get":{"tags":["mssp"],"summary":"Client threat-exposure score (tc-risk-v1)","description":"The client's threat-exposure score — a deterministic 0-100 index of how much\nlive, severity-weighted threat activity bears on their world (sector + country\n+ tech-stack vendors), computed from the cluster entity graph + CVE catalog.\n\nThis is the FAIR Loss-Event-Frequency / exposure component — NOT a breach\nprobability, NOT a dollar figure. CVE weighting uses the NIST composite\nmax(EPSS, KEV). Every score carries `evidence` (the driving threats) and a\n`confidence` (from profile completeness). Set the profile via\nPATCH /mssp/customers/{id} (sector, country) + PUT …/vendors.\n\nReturns: { score, subscores{sector_pressure, geographic, stack_exposure},\n           confidence, evidence, methodology, profile }","operationId":"public_get_customer_risk_api_public_v1_mssp_customers__customer_id__risk_get","parameters":[{"name":"customer_id","in":"path","required":true,"schema":{"type":"integer","title":"Customer Id"}}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/alert-rules":{"post":{"tags":["alerts"],"summary":"Create an alert rule (personal or MSSP-customer scoped)","description":"Create a personal alert rule that fires when its conditions match a new threat\ncluster. Tier-capped conditions (5 most tiers, 50 Business). Delivery via your\nwebhook(s) and/or email. Omit `mssp_customer_id` for a personal rule, or set it\nto scope the rule to one of your managed customers (MSSP).","operationId":"public_create_alert_rule_api_public_v1_alert_rules_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AlertRuleCreate"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/api/public/v1/cve-alerts":{"post":{"tags":["alerts"],"summary":"Create a CVE alert rule (personal or MSSP-customer scoped)","description":"Create a personal CVE alert rule. Fires when a CVE matches the filters\n(vendor/product/CWE/severity/CVSS/EPSS/KEV/exploit/ransomware/keywords),\ncombined by match_logic. Shares the alert-rule tier quota.","operationId":"public_create_cve_alert_rule_api_public_v1_cve_alerts_post","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CveAlertRuleCreate"}}},"required":true},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}}},"components":{"schemas":{"AlertCondition":{"properties":{"entity_type":{"type":"string","title":"Entity Type","description":"Entity type to match, e.g. 'country', 'attack_type', 'apt_group', 'malware', 'cve', 'company', 'platform'."},"entity_value":{"type":"string","title":"Entity Value","description":"Value to match, e.g. 'United Kingdom', 'Ransomware', 'LockBit'."},"match_type":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Match Type","description":"'exact' or 'contains'.","default":"exact"}},"type":"object","required":["entity_type","entity_value"],"title":"AlertCondition"},"AlertRuleCreate":{"properties":{"name":{"type":"string","maxLength":100,"minLength":1,"title":"Name","description":"Rule name (required)."},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description","description":"Optional description."},"logic_operator":{"type":"string","title":"Logic Operator","description":"'AND' (all conditions) or 'OR' (any).","default":"AND"},"conditions":{"items":{"$ref":"#/components/schemas/AlertCondition"},"type":"array","minItems":1,"title":"Conditions","description":"1+ conditions. Tier-capped (5 for most, 50 for Business)."},"notify_webhook":{"type":"boolean","title":"Notify Webhook","description":"Deliver matches to your webhook(s).","default":true},"notify_email":{"type":"boolean","title":"Notify Email","description":"Deliver matches by email.","default":false},"notify_email_address":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Notify Email Address","description":"Custom email (must be your domain). Defaults to your account email."},"webhook_id":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Webhook Id","description":"Specific webhook id to route to (must be yours). Omit to use all."},"mssp_customer_id":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Mssp Customer Id","description":"Scope this rule to one of your managed customers (MSSP). Omit for a personal rule. If set, any webhook_id must be scoped to the same customer or be unscoped."}},"type":"object","required":["name","conditions"],"title":"AlertRuleCreate","description":"Body for POST /api/public/v1/alert-rules — a personal cluster/news alert\nrule. Fires when the conditions match a new threat cluster.","example":{"conditions":[{"entity_type":"country","entity_value":"United Kingdom"},{"entity_type":"attack_type","entity_value":"Ransomware"}],"logic_operator":"AND","name":"UK Ransomware","notify_email":false,"notify_webhook":true}},"Body_cancel_subscription_api_subscription_cancel_post":{"properties":{"at_period_end":{"type":"boolean","title":"At Period End","default":true}},"type":"object","title":"Body_cancel_subscription_api_subscription_cancel_post"},"Body_community_add_file_attachment_api_community_posts__post_id__attachments_file_post":{"properties":{"file":{"type":"string","format":"binary","title":"File"},"note":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Note"}},"type":"object","required":["file"],"title":"Body_community_add_file_attachment_api_community_posts__post_id__attachments_file_post"},"Body_community_upload_post_hero_api_community_posts__post_id__hero_post":{"properties":{"file":{"type":"string","format":"binary","title":"File"}},"type":"object","required":["file"],"title":"Body_community_upload_post_hero_api_community_posts__post_id__hero_post"},"Body_create_checkout_session_api_subscription_checkout_post":{"properties":{"tier":{"type":"string","title":"Tier"},"referral_id":{"type":"string","title":"Referral Id"},"promotion_code":{"type":"string","title":"Promotion Code"}},"type":"object","required":["tier"],"title":"Body_create_checkout_session_api_subscription_checkout_post"},"Body_upload_mssp_customer_logo_api_mssp_customers__customer_uuid__logo_post":{"properties":{"file":{"type":"string","format":"binary","title":"File"}},"type":"object","required":["file"],"title":"Body_upload_mssp_customer_logo_api_mssp_customers__customer_uuid__logo_post"},"Body_upload_mssp_org_logo_api_mssp_organization_logo_post":{"properties":{"file":{"type":"string","format":"binary","title":"File"}},"type":"object","required":["file"],"title":"Body_upload_mssp_org_logo_api_mssp_organization_logo_post"},"Body_upload_org_logo_api_org_logo_post":{"properties":{"file":{"type":"string","format":"binary","title":"File"}},"type":"object","required":["file"],"title":"Body_upload_org_logo_api_org_logo_post"},"Body_upload_user_avatar_api_user_avatar_post":{"properties":{"file":{"type":"string","format":"binary","title":"File"}},"type":"object","required":["file"],"title":"Body_upload_user_avatar_api_user_avatar_post"},"Body_upload_user_logo_api_user_logo_post":{"properties":{"file":{"type":"string","format":"binary","title":"File"}},"type":"object","required":["file"],"title":"Body_upload_user_logo_api_user_logo_post"},"BreachListItem":{"properties":{"id":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Id"},"name":{"type":"string","title":"Name"},"domain":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Domain"},"breach_date":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Breach Date"},"added_date":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Added Date"},"pwn_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Pwn Count"},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description"},"logo_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Logo Url"},"data_classes":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Data Classes"},"is_verified":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Is Verified"},"is_sensitive":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Is Sensitive"}},"additionalProperties":true,"type":"object","required":["name"],"title":"BreachListItem"},"BreachesListResponse":{"properties":{"breaches":{"items":{"$ref":"#/components/schemas/BreachListItem"},"type":"array","title":"Breaches"},"count":{"type":"integer","title":"Count"}},"additionalProperties":true,"type":"object","required":["breaches","count"],"title":"BreachesListResponse"},"CIExchangeBody":{"properties":{"oidc_token":{"type":"string","title":"Oidc Token"},"session_id":{"anyOf":[{"type":"string","maxLength":128},{"type":"null"}],"title":"Session Id"},"max_requests":{"anyOf":[{"type":"integer","maximum":100000.0,"minimum":1.0},{"type":"null"}],"title":"Max Requests"}},"type":"object","required":["oidc_token"],"title":"CIExchangeBody"},"CVEAlertRuleCreate":{"properties":{"name":{"type":"string","maxLength":100,"minLength":1,"title":"Name"},"description":{"anyOf":[{"type":"string","maxLength":500},{"type":"null"}],"title":"Description"},"is_active":{"type":"boolean","title":"Is Active","default":true},"match_logic":{"type":"string","enum":["AND","OR"],"title":"Match Logic","default":"AND"},"vendors":{"anyOf":[{"items":{"type":"string"},"type":"array","maxItems":50},{"type":"null"}],"title":"Vendors"},"products":{"anyOf":[{"items":{"type":"string"},"type":"array","maxItems":50},{"type":"null"}],"title":"Products"},"cwe_ids":{"anyOf":[{"items":{"type":"string"},"type":"array","maxItems":50},{"type":"null"}],"title":"Cwe Ids"},"severity":{"anyOf":[{"items":{"type":"string"},"type":"array","maxItems":4},{"type":"null"}],"title":"Severity"},"cvss_min":{"anyOf":[{"type":"number","maximum":10.0,"minimum":0.0},{"type":"null"}],"title":"Cvss Min"},"cvss_max":{"anyOf":[{"type":"number","maximum":10.0,"minimum":0.0},{"type":"null"}],"title":"Cvss Max"},"epss_min":{"anyOf":[{"type":"number","maximum":1.0,"minimum":0.0},{"type":"null"}],"title":"Epss Min"},"epss_percentile_min":{"anyOf":[{"type":"number","maximum":1.0,"minimum":0.0},{"type":"null"}],"title":"Epss Percentile Min"},"require_kev":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Require Kev"},"require_exploit":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Require Exploit"},"ransomware_use":{"anyOf":[{"items":{"type":"string"},"type":"array","maxItems":5},{"type":"null"}],"title":"Ransomware Use"},"keywords":{"anyOf":[{"items":{"type":"string"},"type":"array","maxItems":20},{"type":"null"}],"title":"Keywords"},"notify_email":{"type":"boolean","title":"Notify Email","default":false},"notify_webhook":{"type":"boolean","title":"Notify Webhook","default":true},"webhook_id":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Webhook Id"}},"type":"object","required":["name"],"title":"CVEAlertRuleCreate","description":"Validation model for CVE alert-rule creation."},"CVEAlertRuleUpdate":{"properties":{"name":{"anyOf":[{"type":"string","maxLength":100},{"type":"null"}],"title":"Name"},"description":{"anyOf":[{"type":"string","maxLength":500},{"type":"null"}],"title":"Description"},"is_active":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Is Active"},"match_logic":{"anyOf":[{"type":"string","enum":["AND","OR"]},{"type":"null"}],"title":"Match Logic"},"vendors":{"anyOf":[{"items":{"type":"string"},"type":"array","maxItems":50},{"type":"null"}],"title":"Vendors"},"products":{"anyOf":[{"items":{"type":"string"},"type":"array","maxItems":50},{"type":"null"}],"title":"Products"},"cwe_ids":{"anyOf":[{"items":{"type":"string"},"type":"array","maxItems":50},{"type":"null"}],"title":"Cwe Ids"},"severity":{"anyOf":[{"items":{"type":"string"},"type":"array","maxItems":4},{"type":"null"}],"title":"Severity"},"cvss_min":{"anyOf":[{"type":"number","maximum":10.0,"minimum":0.0},{"type":"null"}],"title":"Cvss Min"},"cvss_max":{"anyOf":[{"type":"number","maximum":10.0,"minimum":0.0},{"type":"null"}],"title":"Cvss Max"},"epss_min":{"anyOf":[{"type":"number","maximum":1.0,"minimum":0.0},{"type":"null"}],"title":"Epss Min"},"epss_percentile_min":{"anyOf":[{"type":"number","maximum":1.0,"minimum":0.0},{"type":"null"}],"title":"Epss Percentile Min"},"require_kev":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Require Kev"},"require_exploit":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Require Exploit"},"ransomware_use":{"anyOf":[{"items":{"type":"string"},"type":"array","maxItems":5},{"type":"null"}],"title":"Ransomware Use"},"keywords":{"anyOf":[{"items":{"type":"string"},"type":"array","maxItems":20},{"type":"null"}],"title":"Keywords"},"notify_email":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Notify Email"},"notify_webhook":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Notify Webhook"},"webhook_id":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Webhook Id"}},"type":"object","title":"CVEAlertRuleUpdate","description":"Validation model for CVE alert-rule updates. All fields optional."},"CooccurringCveItem":{"properties":{"cve_id":{"type":"string","title":"Cve Id"},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description"},"cvss_v3_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Cvss V3 Score"},"cvss_v3_severity":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cvss V3 Severity"},"affected_vendors":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Affected Vendors"},"affected_products":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Affected Products"},"cpe_configurations":{"anyOf":[{"items":{"additionalProperties":true,"type":"object"},"type":"array"},{"type":"null"}],"title":"Cpe Configurations"},"in_kev":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"In Kev"},"has_exploit":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Has Exploit"},"epss_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Epss Score"},"epss_percentile":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Epss Percentile"},"published_date":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Published Date"},"last_modified":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Last Modified"},"co_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Co Count"}},"additionalProperties":true,"type":"object","required":["cve_id"],"title":"CooccurringCveItem"},"CooccurringCvesResponse":{"properties":{"entity_type":{"type":"string","title":"Entity Type"},"entity_value":{"type":"string","title":"Entity Value"},"cves":{"items":{"$ref":"#/components/schemas/CooccurringCveItem"},"type":"array","title":"Cves"},"total":{"type":"integer","title":"Total"},"page":{"type":"integer","title":"Page"},"limit":{"type":"integer","title":"Limit"},"pages":{"type":"integer","title":"Pages"}},"additionalProperties":true,"type":"object","required":["entity_type","entity_value","cves","total","page","limit","pages"],"title":"CooccurringCvesResponse"},"CveAlertRuleCreate":{"properties":{"name":{"type":"string","maxLength":100,"minLength":1,"title":"Name","description":"Rule name (required)."},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description"},"match_logic":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Match Logic","description":"'AND' or 'OR' across the filters set.","default":"AND"},"vendors":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Vendors","description":"Affected vendor names to match."},"products":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Products","description":"Affected product names."},"cwe_ids":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Cwe Ids","description":"CWE ids, e.g. 'CWE-79'."},"severity":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Severity","description":"CVSS severities: CRITICAL/HIGH/MEDIUM/LOW."},"cvss_min":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Cvss Min","description":"Minimum CVSS v3 base score."},"cvss_max":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Cvss Max","description":"Maximum CVSS v3 base score."},"epss_min":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Epss Min","description":"Minimum EPSS probability (0-1)."},"epss_percentile_min":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Epss Percentile Min","description":"Minimum EPSS percentile (0-1)."},"require_kev":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Require Kev","description":"Only CVEs on CISA KEV."},"require_exploit":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Require Exploit","description":"Only CVEs with a public exploit/PoC."},"ransomware_use":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Ransomware Use","description":"CISA ransomware-use flag values (e.g. ['Known'])."},"keywords":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Keywords","description":"Free-text keyword filters on the CVE."},"notify_webhook":{"type":"boolean","title":"Notify Webhook","default":true},"notify_email":{"type":"boolean","title":"Notify Email","default":false},"webhook_id":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Webhook Id","description":"Specific webhook id (must be yours)."},"mssp_customer_id":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Mssp Customer Id","description":"Scope this CVE rule to one of your managed customers (MSSP). Omit for a personal rule."}},"type":"object","required":["name"],"title":"CveAlertRuleCreate","description":"Body for POST /api/public/v1/cve-alerts — a personal CVE alert rule.\nFires when a CVE matches the filters (vendor/product/severity/CVSS/EPSS/KEV/exploit).","example":{"cvss_min":8.0,"name":"Critical Fortinet KEV","notify_webhook":true,"require_kev":true,"severity":["CRITICAL","HIGH"],"vendors":["Fortinet"]}},"CveDetail":{"properties":{"cve_id":{"type":"string","title":"Cve Id"},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description"},"cvss_v3_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Cvss V3 Score"},"cvss_v3_severity":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cvss V3 Severity"},"affected_vendors":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Affected Vendors"},"affected_products":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Affected Products"},"cpe_configurations":{"anyOf":[{"items":{"additionalProperties":true,"type":"object"},"type":"array"},{"type":"null"}],"title":"Cpe Configurations"},"in_kev":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"In Kev"},"has_exploit":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Has Exploit"},"epss_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Epss Score"},"epss_percentile":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Epss Percentile"},"published_date":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Published Date"},"last_modified":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Last Modified"},"id":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Id"},"cvss_v3_vector":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cvss V3 Vector"},"cwe_ids":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Cwe Ids"},"reference_urls":{"anyOf":[{"items":{"anyOf":[{"type":"string"},{"additionalProperties":true,"type":"object"}]},"type":"array"},{"type":"null"}],"title":"Reference Urls"},"kev_added_date":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Kev Added Date"},"kev_due_date":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Kev Due Date"},"ransomware_use":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Ransomware Use"},"exploit_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Exploit Count"},"first_exploit_date":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"First Exploit Date"},"fetched_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Fetched At"}},"additionalProperties":true,"type":"object","required":["cve_id"],"title":"CveDetail"},"CveListItem":{"properties":{"cve_id":{"type":"string","title":"Cve Id"},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description"},"cvss_v3_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Cvss V3 Score"},"cvss_v3_severity":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cvss V3 Severity"},"affected_vendors":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Affected Vendors"},"affected_products":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Affected Products"},"cpe_configurations":{"anyOf":[{"items":{"additionalProperties":true,"type":"object"},"type":"array"},{"type":"null"}],"title":"Cpe Configurations"},"in_kev":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"In Kev"},"has_exploit":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Has Exploit"},"epss_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Epss Score"},"epss_percentile":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Epss Percentile"},"published_date":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Published Date"},"last_modified":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Last Modified"}},"additionalProperties":true,"type":"object","required":["cve_id"],"title":"CveListItem"},"CveListResponse":{"properties":{"cves":{"items":{"$ref":"#/components/schemas/CveListItem"},"type":"array","title":"Cves"},"total":{"type":"integer","title":"Total"},"page":{"type":"integer","title":"Page"},"limit":{"type":"integer","title":"Limit"},"pages":{"type":"integer","title":"Pages"}},"additionalProperties":true,"type":"object","required":["cves","total","page","limit","pages"],"title":"CveListResponse"},"CveSeverityBreakdown":{"properties":{"CRITICAL":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Critical","default":0},"HIGH":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"High","default":0},"MEDIUM":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Medium","default":0},"LOW":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Low","default":0},"NONE":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"None","default":0}},"additionalProperties":true,"type":"object","title":"CveSeverityBreakdown"},"CveStatsResponse":{"properties":{"total_cves":{"type":"integer","title":"Total Cves"},"kev_count":{"type":"integer","title":"Kev Count"},"with_exploits":{"type":"integer","title":"With Exploits"},"last_7_days":{"type":"integer","title":"Last 7 Days"},"severity_breakdown":{"$ref":"#/components/schemas/CveSeverityBreakdown"}},"additionalProperties":true,"type":"object","required":["total_cves","kev_count","with_exploits","last_7_days","severity_breakdown"],"title":"CveStatsResponse"},"DarkwebStatsResponse":{"properties":{"ransomware_groups":{"type":"integer","title":"Ransomware Groups"},"total_victims":{"type":"integer","title":"Total Victims"},"victims_last_7d":{"type":"integer","title":"Victims Last 7D"},"victims_last_30d":{"type":"integer","title":"Victims Last 30D"},"breaches_known":{"type":"integer","title":"Breaches Known"},"last_updated":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Last Updated"},"data_source":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Data Source"}},"additionalProperties":true,"type":"object","required":["ransomware_groups","total_victims","victims_last_7d","victims_last_30d","breaches_known"],"title":"DarkwebStatsResponse"},"EntitiesSearchResponse":{"properties":{"entities":{"items":{"$ref":"#/components/schemas/EntitySearchItem"},"type":"array","title":"Entities"},"count":{"type":"integer","title":"Count"},"total":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Total"},"limit":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Limit"},"offset":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Offset"},"query":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Query"},"entity_type":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Entity Type"}},"additionalProperties":true,"type":"object","required":["entities","count"],"title":"EntitiesSearchResponse"},"EntitiesTrendingResponse":{"properties":{"trending":{"additionalProperties":{"items":{"$ref":"#/components/schemas/TrendingEntity"},"type":"array"},"type":"object","title":"Trending","description":"Keyed by entity type (apt_group, malware, ...)"},"time_filter":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Time Filter"},"limit_per_type":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Limit Per Type"}},"additionalProperties":true,"type":"object","required":["trending"],"title":"EntitiesTrendingResponse"},"EntityDetailsResponse":{"properties":{"entity":{"$ref":"#/components/schemas/EntityInfo"},"overview":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Overview"},"recent_events":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Recent Events"},"clusters":{"anyOf":[{"items":{"additionalProperties":true,"type":"object"},"type":"array"},{"type":"null"}],"title":"Clusters"},"articles":{"anyOf":[{"items":{"additionalProperties":true,"type":"object"},"type":"array"},{"type":"null"}],"title":"Articles"},"co_entities":{"anyOf":[{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"},{"type":"null"}],"title":"Co Entities"},"co_entities_with_counts":{"anyOf":[{"additionalProperties":{"items":{"additionalProperties":true,"type":"object"},"type":"array"},"type":"object"},{"type":"null"}],"title":"Co Entities With Counts"},"aliases":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Aliases"}},"additionalProperties":true,"type":"object","required":["entity"],"title":"EntityDetailsResponse"},"EntityInfo":{"properties":{"entity_type":{"type":"string","title":"Entity Type"},"entity_value":{"type":"string","title":"Entity Value"},"frequency":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Frequency"},"first_seen":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"First Seen"},"last_seen":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Last Seen"},"confidence":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Confidence"},"reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Reason"}},"additionalProperties":true,"type":"object","required":["entity_type","entity_value"],"title":"EntityInfo"},"EntitySearchItem":{"properties":{"entity_type":{"type":"string","title":"Entity Type"},"entity_value":{"type":"string","title":"Entity Value"},"article_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Article Count"},"cluster_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Cluster Count"},"cve_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Cve Count"}},"additionalProperties":true,"type":"object","required":["entity_type","entity_value"],"title":"EntitySearchItem"},"EntityTimelineResponse":{"properties":{"entity_type":{"type":"string","title":"Entity Type"},"days":{"type":"integer","title":"Days"},"timeline":{"title":"Timeline","description":"Shape TBD: dict of entity_value → daily counts"}},"additionalProperties":true,"type":"object","required":["entity_type","days","timeline"],"title":"EntityTimelineResponse"},"FacetValue":{"properties":{"value":{"type":"string","title":"Value"},"count":{"type":"integer","title":"Count"}},"additionalProperties":true,"type":"object","required":["value","count"],"title":"FacetValue"},"FeedCreate":{"properties":{"name":{"type":"string","maxLength":100,"minLength":1,"title":"Name","description":"Feed name (required)."},"keywords":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Keywords","description":"Keywords to seed the feed — vendors, products, actors, sectors. Matched against news clusters."},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description","description":"Optional feed description."}},"type":"object","required":["name"],"title":"FeedCreate","description":"Body for POST /api/public/v1/feeds — create a feed on your OWN account.","example":{"description":"Kit I run + ransomware chatter","keywords":["Fortinet","FortiGate","ransomware"],"name":"Fortinet + ransomware"}},"FeedEntitiesResponse":{"properties":{"feed_id":{"type":"string","title":"Feed Id"},"entities":{"items":{"$ref":"#/components/schemas/FeedEntity"},"type":"array","title":"Entities"},"count":{"type":"integer","title":"Count"}},"additionalProperties":true,"type":"object","required":["feed_id","entities","count"],"title":"FeedEntitiesResponse"},"FeedEntity":{"properties":{"keyword":{"type":"string","title":"Keyword"},"entity_type":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Entity Type"},"is_custom":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Is Custom"}},"additionalProperties":true,"type":"object","required":["keyword"],"title":"FeedEntity"},"FeedResponse":{"properties":{"items":{"items":{"$ref":"#/components/schemas/ThreatListItem"},"type":"array","title":"Items"},"count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Count"},"total":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Total"},"limit":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Limit"},"offset":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Offset"},"time_filter":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Time Filter"},"sort_by":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Sort By"},"content_type":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Content Type"},"feed_type":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Feed Type"}},"additionalProperties":true,"type":"object","required":["items"],"title":"FeedResponse"},"FeedSummary":{"properties":{"id":{"type":"string","title":"Id"},"name":{"type":"string","title":"Name"},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description"},"entity_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Entity Count"},"is_shared":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Is Shared"},"is_owner":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Is Owner"},"created_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Created At"}},"additionalProperties":true,"type":"object","required":["id","name"],"title":"FeedSummary"},"FeedsListResponse":{"properties":{"feeds":{"items":{"$ref":"#/components/schemas/FeedSummary"},"type":"array","title":"Feeds"},"count":{"type":"integer","title":"Count"}},"additionalProperties":true,"type":"object","required":["feeds","count"],"title":"FeedsListResponse"},"GroupDetailResponse":{"properties":{"name":{"type":"string","title":"Name"},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description"},"active":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Active","description":"Computed from recent victim activity, not upstream flag"},"has_captcha":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Has Captcha"},"first_seen":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"First Seen"},"last_seen":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Last Seen"},"victim_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Victim Count"},"recent_victim_count_30d":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Recent Victim Count 30D"},"tools":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Tools"},"urls":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Urls","description":"Tor leak-site URLs"},"profile_links":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Profile Links","description":"Analyst write-ups / research blogs"},"recent_victims":{"anyOf":[{"items":{"$ref":"#/components/schemas/GroupRecentVictim"},"type":"array"},{"type":"null"}],"title":"Recent Victims"},"screenshot_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Screenshot Url"},"page_title":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Page Title"},"ai_description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Ai Description"},"ai_risk_tags":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Ai Risk Tags"},"ai_language":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Ai Language"},"captcha_or_login_gate":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Captcha Or Login Gate"},"scraped_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Scraped At"},"entities":{"anyOf":[{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"},{"type":"null"}],"title":"Entities"}},"additionalProperties":true,"type":"object","required":["name"],"title":"GroupDetailResponse"},"GroupHeatmap":{"properties":{"groups":{"items":{"type":"string"},"type":"array","title":"Groups","description":"Group names, row order in the heatmap"},"weeks":{"items":{"type":"string"},"type":"array","title":"Weeks","description":"Week-start dates, column order"},"cells":{"additionalProperties":{"items":{"type":"integer"},"type":"array"},"type":"object","title":"Cells","description":"group_name → weekly victim counts (aligned with `weeks`)"}},"additionalProperties":true,"type":"object","required":["groups","weeks","cells"],"title":"GroupHeatmap"},"GroupRecentVictim":{"properties":{"id":{"type":"string","title":"Id"},"name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Name"},"discovered":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Discovered"},"country":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Country"},"sector":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Sector"}},"additionalProperties":true,"type":"object","required":["id"],"title":"GroupRecentVictim"},"HTTPValidationError":{"properties":{"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"type":"array","title":"Detail"}},"type":"object","title":"HTTPValidationError"},"InventoryComponent":{"properties":{"host_id":{"type":"string","title":"Host Id","description":"Stable per-host identifier (Tenable asset uuid, MDE DeviceId, Falcon AID, or your own)."},"hostname":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Hostname","description":"Best known hostname."},"fqdn":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Fqdn"},"os_platform":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Os Platform","description":"Windows | Linux | macOS"},"os_version":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Os Version"},"vendor":{"type":"string","title":"Vendor","description":"Software vendor as reported by your tool."},"product":{"type":"string","title":"Product","description":"Product name as reported."},"version":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Version","description":"Version string. Optional but improves CVE matching."},"install_path":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Install Path"}},"additionalProperties":true,"type":"object","required":["host_id","vendor","product"],"title":"InventoryComponent"},"InventoryPushRequest":{"properties":{"source":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Source","description":"manual | tenable | mde | crowdstrike. Identifies the connector.","default":"manual"},"components":{"items":{"$ref":"#/components/schemas/InventoryComponent"},"type":"array","title":"Components","description":"Up to 50,000 (host, software) rows per request. Re-pushes upsert by host_id."},"mssp_customer_id":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Mssp Customer Id","description":"MSSP-only. Set to push inventory for a specific managed customer. Caller must own the MSSP org that owns the customer. Omit (or null) for the caller's own org inventory — the default."}},"additionalProperties":true,"type":"object","required":["components"],"title":"InventoryPushRequest"},"InventoryPushResponse":{"properties":{"asset_count":{"type":"integer","title":"Asset Count"},"software_count":{"type":"integer","title":"Software Count"},"cpe_matched":{"type":"integer","title":"Cpe Matched","description":"How many software rows resolved to a known CPE 2.3 vendor/product. Unmatched rows are stored but won't appear in the threats overlay until aliases are extended."},"cpe_match_rate":{"type":"number","title":"Cpe Match Rate"},"unmatched_samples":{"items":{"additionalProperties":true,"type":"object"},"type":"array","title":"Unmatched Samples","description":"First 10 unmatched rows so you can spot-check the normalizer."},"note":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Note"}},"additionalProperties":true,"type":"object","required":["asset_count","software_count","cpe_matched","cpe_match_rate"],"title":"InventoryPushResponse"},"InventorySummary":{"properties":{"asset_count":{"type":"integer","title":"Asset Count","default":0},"manual_assets":{"type":"integer","title":"Manual Assets","default":0},"tenable_assets":{"type":"integer","title":"Tenable Assets","default":0},"mde_assets":{"type":"integer","title":"Mde Assets","default":0},"crowdstrike_assets":{"type":"integer","title":"Crowdstrike Assets","default":0},"software_count":{"type":"integer","title":"Software Count","default":0},"cpe_matched":{"type":"integer","title":"Cpe Matched","default":0},"direct":{"type":"integer","title":"Direct","description":"Direct-exposure matches (CVEs + tightly-scoped entity hits).","default":0},"kev_count":{"type":"integer","title":"Kev Count","description":"Of the direct matches, how many CVEs are on the CISA KEV catalog.","default":0}},"additionalProperties":true,"type":"object","title":"InventorySummary"},"InventoryThreatsResponse":{"properties":{"direct":{"items":{"$ref":"#/components/schemas/ThreatMatch"},"type":"array","title":"Direct","description":"High-confidence matches: CVEs against your installed software, plus product entities co-mentioned with their vendor in the same TC cluster."},"related":{"items":{"$ref":"#/components/schemas/ThreatMatch"},"type":"array","title":"Related","description":"Vendor-only and loose product-name matches. Useful situational awareness; lower confidence than direct."},"total":{"type":"integer","title":"Total"}},"additionalProperties":true,"type":"object","required":["total"],"title":"InventoryThreatsResponse"},"KeywordHitBreach":{"properties":{"name":{"type":"string","title":"Name"},"domain":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Domain"},"pwn_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Pwn Count"},"breach_date":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Breach Date"},"added_date":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Added Date"},"logo_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Logo Url"},"is_verified":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Is Verified"},"is_sensitive":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Is Sensitive"}},"additionalProperties":true,"type":"object","required":["name"],"title":"KeywordHitBreach"},"KeywordHitGroup":{"properties":{"group_name":{"type":"string","title":"Group Name"},"victim_count":{"type":"integer","title":"Victim Count"},"last_seen":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Last Seen"}},"additionalProperties":true,"type":"object","required":["group_name","victim_count"],"title":"KeywordHitGroup"},"KeywordHitMarket":{"properties":{"name":{"type":"string","title":"Name"},"category":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Category"},"status":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Status"},"screenshot_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Screenshot Url"},"ai_category":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Ai Category"},"captcha_or_login_gate":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Captcha Or Login Gate"}},"additionalProperties":true,"type":"object","required":["name"],"title":"KeywordHitMarket"},"KeywordHitVictim":{"properties":{"id":{"type":"string","title":"Id"},"victim_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Victim Name"},"group_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Group Name"},"country":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Country"},"sector":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Sector"},"discovered":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Discovered"}},"additionalProperties":true,"type":"object","required":["id"],"title":"KeywordHitVictim"},"KeywordHitsBucket":{"properties":{"victims":{"items":{"$ref":"#/components/schemas/KeywordHitVictim"},"type":"array","title":"Victims","default":[]},"groups":{"items":{"$ref":"#/components/schemas/KeywordHitGroup"},"type":"array","title":"Groups","default":[]},"markets":{"items":{"$ref":"#/components/schemas/KeywordHitMarket"},"type":"array","title":"Markets","default":[]},"breaches":{"items":{"$ref":"#/components/schemas/KeywordHitBreach"},"type":"array","title":"Breaches","default":[]}},"additionalProperties":true,"type":"object","title":"KeywordHitsBucket"},"KeywordHitsResponse":{"properties":{"keywords":{"items":{"type":"string"},"type":"array","title":"Keywords","description":"Echo of the keywords matched against"},"hits":{"$ref":"#/components/schemas/KeywordHitsBucket"},"total":{"type":"integer","title":"Total","description":"Sum across all buckets"}},"additionalProperties":true,"type":"object","required":["keywords","hits","total"],"title":"KeywordHitsResponse"},"MarketDetailResponse":{"properties":{"name":{"type":"string","title":"Name"},"category":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Category"},"status":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Status"},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description"},"meta":{"anyOf":[{},{"type":"null"}],"title":"Meta"},"tor_urls":{"items":{"type":"string"},"type":"array","title":"Tor Urls","default":[]},"clearnet_urls":{"items":{"type":"string"},"type":"array","title":"Clearnet Urls","default":[]},"available":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Available"},"screenshot_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Screenshot Url"},"page_title":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Page Title"},"ai_description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Ai Description"},"ai_category":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Ai Category"},"ai_risk_tags":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Ai Risk Tags"},"ai_language":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Ai Language"},"captcha_or_login_gate":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Captcha Or Login Gate"},"scraped_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Scraped At"},"scrape_error":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Scrape Error"},"entities":{"anyOf":[{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"},{"type":"null"}],"title":"Entities","description":"Entities observed on the market homepage, grouped by type"}},"additionalProperties":true,"type":"object","required":["name"],"title":"MarketDetailResponse"},"MintBearerBody":{"properties":{"session_id":{"anyOf":[{"type":"string","maxLength":128},{"type":"null"}],"title":"Session Id"},"max_requests":{"anyOf":[{"type":"integer","maximum":100000.0,"minimum":1.0},{"type":"null"}],"title":"Max Requests"},"scopes":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Scopes"}},"type":"object","title":"MintBearerBody"},"MsspCustomerCreate":{"properties":{"name":{"type":"string","maxLength":255,"minLength":1,"title":"Name","description":"Customer display name (required)."},"domain":{"anyOf":[{"type":"string","maxLength":255},{"type":"null"}],"title":"Domain","description":"Primary domain, e.g. acme.com. Used for matching/branding."},"contact_email":{"anyOf":[{"type":"string","maxLength":255},{"type":"null"}],"title":"Contact Email","description":"Contact address for this customer (optional)."},"sector":{"anyOf":[{"type":"string","maxLength":120},{"type":"null"}],"title":"Sector","description":"Client industry/sector. When set, the dark-web trends widgets auto-scope to it for this client (use values from /darkweb/ransomware/victims/facets)."},"country":{"anyOf":[{"type":"string","maxLength":80},{"type":"null"}],"title":"Country","description":"Client country/region (ISO-2 or name)."},"notes":{"anyOf":[{"type":"string","maxLength":1000},{"type":"null"}],"title":"Notes","description":"Free-text notes (optional)."}},"type":"object","required":["name"],"title":"MsspCustomerCreate","description":"Body for POST /api/public/v1/mssp/customers.","example":{"contact_email":"soc@acme.com","country":"GB","domain":"acme.com","name":"Acme Ltd","notes":"Onboarded via platform sync","sector":"Financial Services"}},"MsspCustomerFeedCreate":{"properties":{"name":{"type":"string","maxLength":100,"minLength":1,"title":"Name","description":"Feed name (required)."},"keywords":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Keywords","description":"Keywords to seed the feed with — company names, brands, domains, supplier names, sector terms. Matched against news clusters."},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description","description":"Optional feed description."}},"type":"object","required":["name"],"title":"MsspCustomerFeedCreate","description":"Body for POST /api/public/v1/mssp/customers/{customer_id}/feed.","example":{"description":"News/cluster monitoring for Acme + suppliers","keywords":["Acme","acme.com","Acme Payroll"],"name":"Acme monitoring"}},"MsspCustomerUpdate":{"properties":{"name":{"anyOf":[{"type":"string","maxLength":255,"minLength":1},{"type":"null"}],"title":"Name","description":"New display name."},"domain":{"anyOf":[{"type":"string","maxLength":255},{"type":"null"}],"title":"Domain","description":"New primary domain."},"contact_email":{"anyOf":[{"type":"string","maxLength":255},{"type":"null"}],"title":"Contact Email","description":"New contact address."},"sector":{"anyOf":[{"type":"string","maxLength":120},{"type":"null"}],"title":"Sector","description":"New sector/industry (auto-scopes trends widgets)."},"country":{"anyOf":[{"type":"string","maxLength":80},{"type":"null"}],"title":"Country","description":"New country/region."},"notes":{"anyOf":[{"type":"string","maxLength":1000},{"type":"null"}],"title":"Notes","description":"New notes."},"is_active":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Is Active","description":"Set false to deactivate/offboard the customer (soft-delete; cascades to its scoped feeds/rules). Reactivation is not available via the API."}},"type":"object","title":"MsspCustomerUpdate","description":"Body for PATCH /api/public/v1/mssp/customers/{customer_id}. Send only the\nfields you want to change. `is_active: false` offboards the customer.","example":{"is_active":false,"name":"Acme Ltd (renamed)"}},"MsspCustomerVendors":{"properties":{"vendors":{"items":{"type":"string"},"type":"array","title":"Vendors","description":"Canonical vendor slugs (lowercase). The complete desired set; replaces the existing list."}},"type":"object","required":["vendors"],"title":"MsspCustomerVendors","description":"Body for PUT …/vendors — the client's tech-stack vendors (declarative).\nSlugs are validated against cves.affected_vendors; unknown ones are dropped\nand reported. Use GET /mssp/vendors/suggest?q= to find canonical slugs.","example":{"vendors":["fortinet","cisco","microsoft","ivanti"]}},"MsspFeedKeywords":{"properties":{"keywords":{"items":{"type":"string"},"type":"array","title":"Keywords","description":"The complete desired keyword set for this feed. Missing keywords are removed; new ones are added."}},"type":"object","required":["keywords"],"title":"MsspFeedKeywords","description":"Body for PUT …/feed/{feed_uuid}/keywords — declarative keyword sync. The\nfeed's keywords become EXACTLY this set (adds new, removes any not listed).\nIdeal for a platform re-syncing a client's suppliers/stack when it changes.","example":{"keywords":["Acme","acme.com","Acme Payroll","NewSupplier Ltd"]}},"MsspFeedUpdate":{"properties":{"name":{"anyOf":[{"type":"string","maxLength":100,"minLength":1},{"type":"null"}],"title":"Name","description":"New feed name."},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description","description":"New description."}},"type":"object","title":"MsspFeedUpdate","description":"Body for PATCH …/feed/{feed_uuid} — rename / re-describe a feed.","example":{"name":"Acme monitoring (updated)"}},"RansomwareGroupListItem":{"properties":{"name":{"type":"string","title":"Name"},"active":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Active"},"victim_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Victim Count"},"recent_victim_count_30d":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Recent Victim Count 30D"},"last_seen":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Last Seen"},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description"},"has_captcha":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Has Captcha"},"profile_links":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Profile Links"},"tools":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Tools"}},"additionalProperties":true,"type":"object","required":["name"],"title":"RansomwareGroupListItem"},"RansomwareGroupsListResponse":{"properties":{"groups":{"items":{"$ref":"#/components/schemas/RansomwareGroupListItem"},"type":"array","title":"Groups"},"count":{"type":"integer","title":"Count"}},"additionalProperties":true,"type":"object","required":["groups","count"],"title":"RansomwareGroupsListResponse"},"RansomwareVictimsListResponse":{"properties":{"victims":{"items":{"$ref":"#/components/schemas/VictimListItem"},"type":"array","title":"Victims"},"count":{"type":"integer","title":"Count","description":"Items returned in this response (not total)"}},"additionalProperties":true,"type":"object","required":["victims","count"],"title":"RansomwareVictimsListResponse"},"RelatedEntitiesResponse":{"properties":{"entity_type":{"type":"string","title":"Entity Type"},"entity_value":{"type":"string","title":"Entity Value"},"related":{"items":{"$ref":"#/components/schemas/RelatedEntity"},"type":"array","title":"Related"},"sub_relationships":{"anyOf":[{},{"type":"null"}],"title":"Sub Relationships"}},"additionalProperties":true,"type":"object","required":["entity_type","entity_value","related"],"title":"RelatedEntitiesResponse"},"RelatedEntity":{"properties":{"entity_type":{"type":"string","title":"Entity Type"},"entity_value":{"type":"string","title":"Entity Value"},"shared_clusters":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Shared Clusters"},"co_occurrences":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Co Occurrences"}},"additionalProperties":true,"type":"object","required":["entity_type","entity_value"],"title":"RelatedEntity"},"SearchArticleHit":{"properties":{"title":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Title"},"source":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Source"},"url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Url"},"pub_date":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Pub Date"}},"additionalProperties":true,"type":"object","title":"SearchArticleHit"},"SearchDarkwebHit":{"properties":{"type":{"type":"string","title":"Type","description":"victim | group | market | breach | underground | underground_victim"},"name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Name"},"id":{"anyOf":[{"type":"integer"},{"type":"string"},{"type":"null"}],"title":"Id"},"date":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Date","description":"Event date where the hit has one (victims, breaches, underground)"}},"additionalProperties":true,"type":"object","required":["type"],"title":"SearchDarkwebHit"},"SearchEntityHit":{"properties":{"entity_type":{"type":"string","title":"Entity Type"},"entity_value":{"type":"string","title":"Entity Value"},"cluster_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Cluster Count"},"article_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Article Count"},"last_seen":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Last Seen"},"is_new":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Is New"}},"additionalProperties":true,"type":"object","required":["entity_type","entity_value"],"title":"SearchEntityHit"},"SearchResponse":{"properties":{"query":{"type":"string","title":"Query"},"clusters":{"items":{"additionalProperties":true,"type":"object"},"type":"array","title":"Clusters","description":"Clusters in the same shape as GET /threats"},"entities":{"items":{"$ref":"#/components/schemas/SearchEntityHit"},"type":"array","title":"Entities"},"darkweb":{"items":{"$ref":"#/components/schemas/SearchDarkwebHit"},"type":"array","title":"Darkweb"},"articles":{"anyOf":[{"items":{"$ref":"#/components/schemas/SearchArticleHit"},"type":"array"},{"type":"null"}],"title":"Articles","description":"Only present when include_articles=true"},"include_articles":{"type":"boolean","title":"Include Articles","default":false},"limit":{"type":"integer","title":"Limit"},"days":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Days","description":"Window applied, when one was (free keys: always 7)"},"total":{"type":"integer","title":"Total","description":"Sum across the returned buckets"},"tier":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Tier"},"lookback_days":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Lookback Days"}},"additionalProperties":true,"type":"object","required":["query","limit","total"],"title":"SearchResponse"},"StatsOverviewResponse":{"properties":{"total_clusters":{"type":"integer","title":"Total Clusters"},"total_articles":{"type":"integer","title":"Total Articles"},"total_entities":{"type":"integer","title":"Total Entities"},"clusters_24h":{"type":"integer","title":"Clusters 24H"},"articles_24h":{"type":"integer","title":"Articles 24H"}},"additionalProperties":true,"type":"object","required":["total_clusters","total_articles","total_entities","clusters_24h","articles_24h"],"title":"StatsOverviewResponse"},"ThreatDetailResponse":{"properties":{"cluster_id":{"type":"string","title":"Cluster Id"},"title":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Title"},"ai_title":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Ai Title"},"ai_summary":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Ai Summary"},"image_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Image Url"},"timeline":{"anyOf":[{"type":"string"},{"items":{"additionalProperties":true,"type":"object"},"type":"array"},{"type":"null"}],"title":"Timeline"},"article_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Article Count"},"threat_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Threat Score"},"recency_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Recency Score"},"coverage_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Coverage Score"},"severity_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Severity Score"},"sentiment_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Sentiment Score"},"geopolitical_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Geopolitical Score"},"actionability_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Actionability Score"},"severity_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Severity Reason"},"credibility_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Credibility Score"},"urgency_level":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Urgency Level"},"ranking_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Ranking Score"},"keywords":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Keywords"},"sources":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Sources"},"severity_indicators":{"anyOf":[{"items":{},"type":"array"},{"type":"null"}],"title":"Severity Indicators"},"date_range_earliest":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Date Range Earliest"},"date_range_latest":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Date Range Latest"},"created_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Created At"},"updated_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Updated At"},"recent_article_count_12h":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Recent Article Count 12H"},"recent_article_count_6h":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Recent Article Count 6H"},"insights_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Insights Count"},"articles":{"anyOf":[{"items":{"additionalProperties":true,"type":"object"},"type":"array"},{"type":"null"}],"title":"Articles"},"entities":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"Entities"}},"additionalProperties":true,"type":"object","required":["cluster_id"],"title":"ThreatDetailResponse","description":"Threat detail response — same shape as a list item but clients\ntypically expect the full row. Kept as a separate model so Swagger\ncan annotate it independently (summary, example)."},"ThreatIocsResponse":{"properties":{"iocs":{"items":{"additionalProperties":true,"type":"object"},"type":"array","title":"Iocs","description":"Each entry: {type, value, confidence, reason, ...}"},"count":{"type":"integer","title":"Count"},"cluster_id":{"type":"string","title":"Cluster Id"}},"additionalProperties":true,"type":"object","required":["iocs","count","cluster_id"],"title":"ThreatIocsResponse"},"ThreatListItem":{"properties":{"cluster_id":{"type":"string","title":"Cluster Id"},"title":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Title"},"ai_title":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Ai Title"},"ai_summary":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Ai Summary"},"image_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Image Url"},"timeline":{"anyOf":[{"type":"string"},{"items":{"additionalProperties":true,"type":"object"},"type":"array"},{"type":"null"}],"title":"Timeline"},"article_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Article Count"},"threat_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Threat Score"},"recency_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Recency Score"},"coverage_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Coverage Score"},"severity_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Severity Score"},"sentiment_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Sentiment Score"},"geopolitical_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Geopolitical Score"},"actionability_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Actionability Score"},"severity_reason":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Severity Reason"},"credibility_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Credibility Score"},"urgency_level":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Urgency Level"},"ranking_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Ranking Score"},"keywords":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Keywords"},"sources":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Sources"},"severity_indicators":{"anyOf":[{"items":{},"type":"array"},{"type":"null"}],"title":"Severity Indicators"},"date_range_earliest":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Date Range Earliest"},"date_range_latest":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Date Range Latest"},"created_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Created At"},"updated_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Updated At"},"recent_article_count_12h":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Recent Article Count 12H"},"recent_article_count_6h":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Recent Article Count 6H"},"insights_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Insights Count"},"articles":{"anyOf":[{"items":{"additionalProperties":true,"type":"object"},"type":"array"},{"type":"null"}],"title":"Articles"},"entities":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"Entities"}},"additionalProperties":true,"type":"object","required":["cluster_id"],"title":"ThreatListItem"},"ThreatMatch":{"properties":{"entity_type":{"type":"string","title":"Entity Type","description":"cve | product | tool | platform | vulnerability | company"},"entity_value":{"type":"string","title":"Entity Value"},"match_strength":{"type":"string","title":"Match Strength","description":"direct | related"},"matched_via":{"type":"string","title":"Matched Via","description":"cpe | cpe_product | cpe_vendor"},"asset_count":{"type":"integer","title":"Asset Count"},"software_count":{"type":"integer","title":"Software Count"},"sample_software":{"anyOf":[{"items":{"additionalProperties":true,"type":"object"},"type":"array"},{"type":"null"}],"title":"Sample Software"},"cluster_count":{"type":"integer","title":"Cluster Count","default":0},"latest_cluster_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Latest Cluster At"},"has_kev":{"type":"boolean","title":"Has Kev","default":false},"has_exploit":{"type":"boolean","title":"Has Exploit","default":false},"cvss_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Cvss Score"},"epss_score":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Epss Score"},"computed_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Computed At"}},"additionalProperties":true,"type":"object","required":["entity_type","entity_value","match_strength","matched_via","asset_count","software_count"],"title":"ThreatMatch"},"ThreatsListResponse":{"properties":{"threats":{"items":{"$ref":"#/components/schemas/ThreatListItem"},"type":"array","title":"Threats"},"count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Count"},"total":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Total"},"limit":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Limit"},"offset":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Offset"}},"additionalProperties":true,"type":"object","required":["threats"],"title":"ThreatsListResponse"},"TopIndustry":{"properties":{"industry":{"type":"string","title":"Industry"},"count":{"type":"integer","title":"Count"}},"additionalProperties":true,"type":"object","required":["industry","count"],"title":"TopIndustry"},"TrendingEntity":{"properties":{"value":{"type":"string","title":"Value"},"frequency":{"type":"integer","title":"Frequency"},"change":{"anyOf":[{"type":"number"},{"type":"null"}],"title":"Change","description":"% change vs prior window"},"is_new":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Is New"}},"additionalProperties":true,"type":"object","required":["value","frequency"],"title":"TrendingEntity"},"TrendsResponse":{"properties":{"victims_weekly":{"items":{"$ref":"#/components/schemas/WeeklyVictimPoint"},"type":"array","title":"Victims Weekly"},"top_industries":{"items":{"$ref":"#/components/schemas/TopIndustry"},"type":"array","title":"Top Industries"},"group_heatmap":{"$ref":"#/components/schemas/GroupHeatmap"}},"additionalProperties":true,"type":"object","required":["victims_weekly","top_industries","group_heatmap"],"title":"TrendsResponse"},"ValidationError":{"properties":{"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"type":"array","title":"Location"},"msg":{"type":"string","title":"Message"},"type":{"type":"string","title":"Error Type"}},"type":"object","required":["loc","msg","type"],"title":"ValidationError"},"VictimEnrichmentResponse":{"properties":{"id":{"type":"string","title":"Id"},"victim_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Victim Name"},"group_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Group Name"},"discovered":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Discovered"},"country":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Country"},"sector":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Sector"},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description"},"website":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Website"},"post_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Post Url"},"screenshot_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Screenshot Url","description":"ransomware.live screenshot (external)"},"scraped_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Scraped At"},"extracted_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Extracted At"},"scrape_ok":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Scrape Ok"},"scrape_error":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Scrape Error"},"legal_name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Legal Name"},"legal_form":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Legal Form"},"headquarters":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"Headquarters"},"revenue":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"Revenue"},"employee_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Employee Count"},"founded_year":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Founded Year"},"victim_description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Victim Description","description":"AI-generated victim description"},"domains":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Domains"},"people":{"anyOf":[{"items":{"additionalProperties":true,"type":"object"},"type":"array"},{"type":"null"}],"title":"People"},"platforms":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Platforms"},"data_size":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"Data Size"},"data_size_bytes":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Data Size Bytes"},"file_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"File Count"},"view_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"View Count"},"data_categories":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Data Categories"},"group_tags":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Group Tags"},"publication_status":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Publication Status","description":"listed | countdown | partial_leak | fully_leaked | removed"},"victim_status_raw":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Victim Status Raw"},"countdown":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"Countdown"},"countdown_ends_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Countdown Ends At"},"posted_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Posted At"},"publication_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Publication At"},"ransom_amount":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"Ransom Amount"},"sample_files":{"anyOf":[{"items":{"additionalProperties":true,"type":"object"},"type":"array"},{"type":"null"}],"title":"Sample Files"},"file_types":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"File Types"},"negotiation_contacts":{"anyOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}],"title":"Negotiation Contacts"},"negotiation_state":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Negotiation State"},"negotiation_chat_excerpts":{"anyOf":[{"items":{},"type":"array"},{"type":"null"}],"title":"Negotiation Chat Excerpts"},"page_language":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Page Language"},"victim_tld":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Victim Tld"},"is_sea_hit":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Is Sea Hit"},"image_count":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Image Count"},"image_bytes":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Image Bytes"},"images":{"anyOf":[{"items":{"$ref":"#/components/schemas/VictimImage"},"type":"array"},{"type":"null"}],"title":"Images"},"site_screenshot_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Site Screenshot Url"},"site_screenshot_at":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Site Screenshot At"},"site_screenshot_error":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Site Screenshot Error"},"entities":{"anyOf":[{"additionalProperties":{"items":{"additionalProperties":true,"type":"object"},"type":"array"},"type":"object"},{"type":"null"}],"title":"Entities","description":"Entities extracted from the leak post, keyed by entity_type (company, country, industry, ...) → [{value, confidence}]"}},"additionalProperties":true,"type":"object","required":["id"],"title":"VictimEnrichmentResponse"},"VictimFacetsResponse":{"properties":{"countries":{"items":{"$ref":"#/components/schemas/FacetValue"},"type":"array","title":"Countries","default":[]},"sectors":{"items":{"$ref":"#/components/schemas/FacetValue"},"type":"array","title":"Sectors","default":[]},"groups":{"items":{"$ref":"#/components/schemas/FacetValue"},"type":"array","title":"Groups","default":[]}},"additionalProperties":true,"type":"object","title":"VictimFacetsResponse"},"VictimImage":{"properties":{"url":{"type":"string","title":"Url","description":"DO Spaces URL of the blurred, watermarked thumbnail"},"hash":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Hash"},"bytes":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Bytes"},"mime":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Mime"},"source":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Source","description":"Original onion URL the image was scraped from"},"caption":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Caption","description":"GPT-4o-mini factual caption (no PII reproduced)"},"blurred":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Blurred","description":"Always true for customer-facing images","default":true}},"additionalProperties":true,"type":"object","required":["url"],"title":"VictimImage"},"VictimListItem":{"properties":{"id":{"type":"string","title":"Id","description":"16-char victim id; stable primary key"},"group":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Group","description":"Ransomware group short name (e.g. 'qilin')"},"name":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Name","description":"Victim organisation name as posted on the leak site"},"discovered":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Discovered","description":"ISO-8601 timestamp we first saw this victim"},"country":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Country","description":"ISO-2 country code or full name"},"sector":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Sector"},"description":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Description"},"website":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Website"},"screenshot_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Screenshot Url","description":"ransomware.live screenshot (not ours)"},"post_url":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Post Url","description":"Onion URL of the original leak post"}},"additionalProperties":true,"type":"object","required":["id"],"title":"VictimListItem"},"WebhookCreate":{"properties":{"webhook_url":{"type":"string","maxLength":500,"minLength":10,"title":"Webhook Url"},"webhook_type":{"type":"string","enum":["json","discord","slack","teams"],"title":"Webhook Type","default":"json"},"secret_key":{"anyOf":[{"type":"string","maxLength":256},{"type":"null"}],"title":"Secret Key"},"name":{"anyOf":[{"type":"string","maxLength":100},{"type":"null"}],"title":"Name"}},"type":"object","required":["webhook_url"],"title":"WebhookCreate","description":"Validation model for webhook creation."},"WebhookUpdate":{"properties":{"webhook_url":{"anyOf":[{"type":"string","maxLength":500,"minLength":10},{"type":"null"}],"title":"Webhook Url"},"webhook_type":{"anyOf":[{"type":"string","enum":["json","discord","slack","teams"]},{"type":"null"}],"title":"Webhook Type"},"secret_key":{"anyOf":[{"type":"string","maxLength":256},{"type":"null"}],"title":"Secret Key"},"is_active":{"anyOf":[{"type":"boolean"},{"type":"null"}],"title":"Is Active"},"name":{"anyOf":[{"type":"string","maxLength":100},{"type":"null"}],"title":"Name"}},"type":"object","title":"WebhookUpdate","description":"Validation model for webhook updates."},"WeeklyVictimPoint":{"properties":{"week":{"type":"string","title":"Week","description":"ISO date of the week-start (Monday)"},"count":{"type":"integer","title":"Count"}},"additionalProperties":true,"type":"object","required":["week","count"],"title":"WeeklyVictimPoint"}},"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-API-Key","description":"API key for authentication. Get yours from Settings."}}},"servers":[{"url":"https://threatcluster.io","description":"Production"}],"security":[{"ApiKeyAuth":[]}]}