{"openapi":"3.1.0","info":{"title":"Threat Intelligence & Public Signals API","version":"1.0.0","description":"Aggregate verified key-free public threat feeds, enrich IoCs, analyze domain history, cluster certificate and phishing infrastructure, detect typosquats, review exposed-service inventory, and score indicator confidence—without API keys, paid providers, or intrusive scanning. Paid with x402 exact USDC on Base. No account is required.","contact":{"email":"support@brainiac.software"},"x-guidance":"BRAINIAC.software is a pay-per-call API for software agents. No account or API key is required.\nPayment uses the x402 protocol with exact USDC on Base (chain id 8453). Each POST operation has a fixed USD price.\nHow to call an operation:\n1. POST a JSON body matching the operation's requestBody schema to the operation path. Include an Idempotency-Key header (64 hex characters, 32 random bytes).\n2. If you have not paid, the server responds 402 with payment requirements in the body. Pay the exact amount to the payTo address on Base.\n3. Retry the identical request with the same Idempotency-Key and add a payment-signature header containing the x402 payment payload. On success (200) the operation result is returned.\n4. Reuse the same Idempotency-Key only for retries of the same operation and request body; it will not be charged twice.\nAll outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Verify time-sensitive or official data with the cited source before acting."},"servers":[{"url":"https://www.brainiac.software"}],"paths":{"/api/v1/threat-intelligence/public-threat-feed-aggregate":{"post":{"operationId":"aggregate_public_threat_feeds","summary":"Aggregate public threat feeds","description":"Aggregate caller-supplied and verified key-free public threat feeds (CISA KEV, OpenPhish, capped PhishTank). URLhaus/ThreatFox require auth and are not queried. Feed hits are not confirmed malice.","tags":["threat-intelligence"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"indicators":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","email","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"firstSeen":{"type":"string","maxLength":40},"lastSeen":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"confidenceHint":{"type":"string","enum":["low","medium","high"]},"relatedIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}}},"required":["value"],"additionalProperties":false}},"feeds":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"feed":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"observedAt":{"type":"string","maxLength":40},"tags":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200},"url":{"type":"string","maxLength":2000}},"required":["value"],"additionalProperties":false}},"domains":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","minLength":1,"maxLength":253},"brand":{"type":"string","maxLength":120},"registrar":{"type":"string","maxLength":200},"createdAt":{"type":"string","maxLength":40},"expiresAt":{"type":"string","maxLength":40},"nameservers":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":253}},"ips":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"asn":{"type":"string","maxLength":40},"hostingProvider":{"type":"string","maxLength":120},"certificateFingerprint":{"type":"string","maxLength":120},"source":{"type":"string","maxLength":200}},"required":["domain"],"additionalProperties":false}},"certificates":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","maxLength":253},"commonName":{"type":"string","maxLength":253},"issuer":{"type":"string","maxLength":200},"notBefore":{"type":"string","maxLength":40},"notAfter":{"type":"string","maxLength":40},"fingerprintSha256":{"type":"string","maxLength":120},"serialNumber":{"type":"string","maxLength":120},"sans":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":253}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"services":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"host":{"type":"string","maxLength":253},"ip":{"type":"string","maxLength":80},"port":{"type":"number","minimum":1,"maximum":65535},"protocol":{"type":"string","maxLength":40},"service":{"type":"string","maxLength":80},"product":{"type":"string","maxLength":120},"version":{"type":"string","maxLength":80},"banner":{"type":"string","maxLength":2000},"tls":{"type":"boolean"},"exposure":{"type":"string","enum":["public","internal","unknown"]},"cveIds":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":40}},"observedAt":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"brands":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"brand":{"type":"string","minLength":1,"maxLength":120},"domains":{"maxItems":40,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"source":{"type":"string","maxLength":200}},"required":["brand"],"additionalProperties":false}},"candidates":{"maxItems":2000,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"asOf":{"type":"string","maxLength":40},"fetchCisaKev":{"type":"boolean"},"fetchOpenPhish":{"type":"boolean"},"fetchPhishTank":{"type":"boolean"},"fetchCrtSh":{"type":"boolean"},"fetchRdap":{"type":"boolean"},"publicDns":{"type":"boolean"},"staleDays":{"type":"number","minimum":1,"maximum":365},"crtShQuery":{"type":"string","maxLength":253}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","feeds":[{"id":"F1","feed":"openphish","type":"url","value":"http://paypa1-secure.example/login","observedAt":"2026-11-04T18:00:00.000Z","source":"Caller-supplied OpenPhish-style row"},{"id":"F2","feed":"cisa-kev","type":"cve","value":"CVE-2024-1234","observedAt":"2026-10-01T00:00:00.000Z","source":"Caller-supplied KEV-style row"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"feedCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"},"source":{"type":"string"},"observedAt":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalicious":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"intrusiveScanPerformed":{"type":"boolean"},"singleWeakSignalMaliciousClaimed":{"type":"boolean"},"publicFetchesUsed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"sourceStatuses":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"status":{"type":"string"},"retrievedAt":{"type":"string"},"itemCount":{"type":"number"},"detail":{"type":"string"},"authenticated":{"type":"boolean"}},"additionalProperties":true}},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":2,"feedCount":2,"items":[{"id":"feed-openphish","detector":"public-threat-feed-aggregate","title":"Aggregated openphish feed rows","observedFacts":["1 row(s) from openphish","No stale timestamps detected among dated rows."],"inferredThreat":"Feed aggregation surfaces publicly reported indicators; individual rows are not confirmed malice.","confidence":"low","relatedIds":["F1"],"reasons":["feed_present"],"evidence":[{"subject":"F1","fact":"url=http://paypa1-secure.example/login","inference":"Copied from public/caller feed with source attribution.","confidence":"medium","source":"Caller-supplied OpenPhish-style row","observedAt":"2026-11-04T18:00:00.000Z"}],"source":"Caller-supplied OpenPhish-style row","status":"signal","confirmedMalicious":false},{"id":"feed-cisa_kev","detector":"public-threat-feed-aggregate","title":"Aggregated cisa-kev feed rows","observedFacts":["1 row(s) from cisa-kev","1 stale by >30d"],"inferredThreat":"Feed aggregation surfaces publicly reported indicators; individual rows are not confirmed malice.","confidence":"low","relatedIds":["F2"],"reasons":["feed_present","stale_rows"],"evidence":[{"subject":"F2","fact":"cve=CVE-2024-1234","inference":"Copied from public/caller feed with source attribution.","confidence":"medium","source":"Caller-supplied KEV-style row","observedAt":"2026-10-01T00:00:00.000Z"}],"source":"Caller-supplied KEV-style row","status":"signal","confirmedMalicious":false}],"paidProviderUsed":false,"apiKeyRequired":false,"intrusiveScanPerformed":false,"singleWeakSignalMaliciousClaimed":false,"publicFetchesUsed":false,"publicDnsQueried":false,"sourceStatuses":[{"id":"urlhaus","name":"URLhaus","url":"https://urlhaus.abuse.ch/","status":"AUTH_REQUIRED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.","authenticated":false},{"id":"cisa-kev","name":"CISA KEV","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCisaKev=true to load the free CISA KEV catalogue.","authenticated":false},{"id":"openphish","name":"OpenPhish community feed","url":"https://openphish.com/feed.txt","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchOpenPhish=true to load the free OpenPhish community feed.","authenticated":false},{"id":"phishtank","name":"PhishTank online-valid CSV","url":"https://data.phishtank.com/data/online-valid.csv","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).","authenticated":false},{"id":"rdap","name":"RDAP","url":"https://rdap.org/domain/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchRdap=true to query public RDAP for supplied domains.","authenticated":false},{"id":"crtsh","name":"crt.sh Certificate Transparency","url":"https://crt.sh/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).","authenticated":false}],"findings":[{"kind":"observation","code":"source_status","subject":"urlhaus","detail":"URLhaus: AUTH_REQUIRED — URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted."}],"limitations":["Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.","URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.","No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.","A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.","No paid threat-intel provider is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.05"},"protocols":[{"x402":{}}]}}},"/api/v1/threat-intelligence/ioc-context-enrich":{"post":{"operationId":"enrich_ioc_context","summary":"Enrich IoC context","description":"Enrich supplied IPs, domains, URLs, and hashes using caller context plus optional public DNS/feeds. A single weak feed hit is never classified as malicious.","tags":["threat-intelligence"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"indicators":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","email","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"firstSeen":{"type":"string","maxLength":40},"lastSeen":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"confidenceHint":{"type":"string","enum":["low","medium","high"]},"relatedIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}}},"required":["value"],"additionalProperties":false}},"feeds":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"feed":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"observedAt":{"type":"string","maxLength":40},"tags":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200},"url":{"type":"string","maxLength":2000}},"required":["value"],"additionalProperties":false}},"domains":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","minLength":1,"maxLength":253},"brand":{"type":"string","maxLength":120},"registrar":{"type":"string","maxLength":200},"createdAt":{"type":"string","maxLength":40},"expiresAt":{"type":"string","maxLength":40},"nameservers":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":253}},"ips":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"asn":{"type":"string","maxLength":40},"hostingProvider":{"type":"string","maxLength":120},"certificateFingerprint":{"type":"string","maxLength":120},"source":{"type":"string","maxLength":200}},"required":["domain"],"additionalProperties":false}},"certificates":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","maxLength":253},"commonName":{"type":"string","maxLength":253},"issuer":{"type":"string","maxLength":200},"notBefore":{"type":"string","maxLength":40},"notAfter":{"type":"string","maxLength":40},"fingerprintSha256":{"type":"string","maxLength":120},"serialNumber":{"type":"string","maxLength":120},"sans":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":253}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"services":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"host":{"type":"string","maxLength":253},"ip":{"type":"string","maxLength":80},"port":{"type":"number","minimum":1,"maximum":65535},"protocol":{"type":"string","maxLength":40},"service":{"type":"string","maxLength":80},"product":{"type":"string","maxLength":120},"version":{"type":"string","maxLength":80},"banner":{"type":"string","maxLength":2000},"tls":{"type":"boolean"},"exposure":{"type":"string","enum":["public","internal","unknown"]},"cveIds":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":40}},"observedAt":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"brands":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"brand":{"type":"string","minLength":1,"maxLength":120},"domains":{"maxItems":40,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"source":{"type":"string","maxLength":200}},"required":["brand"],"additionalProperties":false}},"candidates":{"maxItems":2000,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"asOf":{"type":"string","maxLength":40},"fetchCisaKev":{"type":"boolean"},"fetchOpenPhish":{"type":"boolean"},"fetchPhishTank":{"type":"boolean"},"fetchCrtSh":{"type":"boolean"},"fetchRdap":{"type":"boolean"},"publicDns":{"type":"boolean"},"staleDays":{"type":"number","minimum":1,"maximum":365},"crtShQuery":{"type":"string","maxLength":253}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","indicators":[{"id":"I1","type":"domain","value":"paypa1-secure.example","source":"Caller-supplied"}],"feeds":[{"id":"F1","feed":"openphish","type":"url","value":"http://paypa1-secure.example/login","observedAt":"2026-11-04T18:00:00.000Z","source":"Caller-supplied"}],"domains":[{"id":"D1","domain":"paypa1-secure.example","registrar":"Example Registrar","ips":["198.51.100.10"],"createdAt":"2026-10-20T00:00:00.000Z","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"source":{"type":"string"},"observedAt":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalicious":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"intrusiveScanPerformed":{"type":"boolean"},"singleWeakSignalMaliciousClaimed":{"type":"boolean"},"publicFetchesUsed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"sourceStatuses":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"status":{"type":"string"},"retrievedAt":{"type":"string"},"itemCount":{"type":"number"},"detail":{"type":"string"},"authenticated":{"type":"boolean"}},"additionalProperties":true}},"findings":{"type":"array","items":{}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"enrich-I1","detector":"ioc-context-enrich","title":"IoC context enrichment","observedFacts":["type=domain","value=paypa1-secure.example","Matched 1 public/caller feed row(s): openphish","Public/caller DNS A answers: 198.51.100.10","Registration/DNS metadata present from RDAP or caller."],"inferredThreat":"Corroborated public/caller context can support investigation; not a confirmed malicious verdict.","confidence":"medium","relatedIds":["I1","F1","D1"],"reasons":["feed_hit","dns_context","registration_context"],"evidence":[{"subject":"F1","fact":"openphish:http://paypa1-secure.example/login","source":"Caller-supplied","observedAt":"2026-11-04T18:00:00.000Z","confidence":"medium"},{"subject":"D1","fact":"registrar=Example Registrar; ips=198.51.100.10","source":"Caller-supplied","confidence":"medium"}],"source":"Caller-supplied","status":"signal","confirmedMalicious":false}],"paidProviderUsed":false,"apiKeyRequired":false,"intrusiveScanPerformed":false,"singleWeakSignalMaliciousClaimed":false,"publicFetchesUsed":false,"publicDnsQueried":false,"sourceStatuses":[{"id":"urlhaus","name":"URLhaus","url":"https://urlhaus.abuse.ch/","status":"AUTH_REQUIRED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.","authenticated":false},{"id":"cisa-kev","name":"CISA KEV","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCisaKev=true to load the free CISA KEV catalogue.","authenticated":false},{"id":"openphish","name":"OpenPhish community feed","url":"https://openphish.com/feed.txt","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchOpenPhish=true to load the free OpenPhish community feed.","authenticated":false},{"id":"phishtank","name":"PhishTank online-valid CSV","url":"https://data.phishtank.com/data/online-valid.csv","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).","authenticated":false},{"id":"rdap","name":"RDAP","url":"https://rdap.org/domain/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchRdap=true to query public RDAP for supplied domains.","authenticated":false},{"id":"crtsh","name":"crt.sh Certificate Transparency","url":"https://crt.sh/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).","authenticated":false}],"findings":[],"limitations":["Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.","URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.","No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.","A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.","No paid threat-intel provider is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/threat-intelligence/domain-threat-history":{"post":{"operationId":"analyze_domain_threat_history","summary":"Analyze domain threat history","description":"Analyze publicly accessible domain history and DNS/RDAP context from caller fields and optional key-free public lookups. History attributes alone are not malice.","tags":["threat-intelligence"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"indicators":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","email","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"firstSeen":{"type":"string","maxLength":40},"lastSeen":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"confidenceHint":{"type":"string","enum":["low","medium","high"]},"relatedIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}}},"required":["value"],"additionalProperties":false}},"feeds":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"feed":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"observedAt":{"type":"string","maxLength":40},"tags":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200},"url":{"type":"string","maxLength":2000}},"required":["value"],"additionalProperties":false}},"domains":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","minLength":1,"maxLength":253},"brand":{"type":"string","maxLength":120},"registrar":{"type":"string","maxLength":200},"createdAt":{"type":"string","maxLength":40},"expiresAt":{"type":"string","maxLength":40},"nameservers":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":253}},"ips":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"asn":{"type":"string","maxLength":40},"hostingProvider":{"type":"string","maxLength":120},"certificateFingerprint":{"type":"string","maxLength":120},"source":{"type":"string","maxLength":200}},"required":["domain"],"additionalProperties":false}},"certificates":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","maxLength":253},"commonName":{"type":"string","maxLength":253},"issuer":{"type":"string","maxLength":200},"notBefore":{"type":"string","maxLength":40},"notAfter":{"type":"string","maxLength":40},"fingerprintSha256":{"type":"string","maxLength":120},"serialNumber":{"type":"string","maxLength":120},"sans":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":253}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"services":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"host":{"type":"string","maxLength":253},"ip":{"type":"string","maxLength":80},"port":{"type":"number","minimum":1,"maximum":65535},"protocol":{"type":"string","maxLength":40},"service":{"type":"string","maxLength":80},"product":{"type":"string","maxLength":120},"version":{"type":"string","maxLength":80},"banner":{"type":"string","maxLength":2000},"tls":{"type":"boolean"},"exposure":{"type":"string","enum":["public","internal","unknown"]},"cveIds":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":40}},"observedAt":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"brands":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"brand":{"type":"string","minLength":1,"maxLength":120},"domains":{"maxItems":40,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"source":{"type":"string","maxLength":200}},"required":["brand"],"additionalProperties":false}},"candidates":{"maxItems":2000,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"asOf":{"type":"string","maxLength":40},"fetchCisaKev":{"type":"boolean"},"fetchOpenPhish":{"type":"boolean"},"fetchPhishTank":{"type":"boolean"},"fetchCrtSh":{"type":"boolean"},"fetchRdap":{"type":"boolean"},"publicDns":{"type":"boolean"},"staleDays":{"type":"number","minimum":1,"maximum":365},"crtShQuery":{"type":"string","maxLength":253}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","domains":[{"id":"D1","domain":"brand-login.example","registrar":"Cheap Domains LLC","createdAt":"2026-10-28T00:00:00.000Z","nameservers":["ns1.example.net","ns2.example.net"],"ips":["198.51.100.20"],"source":"Caller-supplied"}],"feeds":[{"id":"F1","feed":"openphish","type":"domain","value":"brand-login.example","observedAt":"2026-11-03T12:00:00.000Z","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"source":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"confirmedMalicious":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"intrusiveScanPerformed":{"type":"boolean"},"singleWeakSignalMaliciousClaimed":{"type":"boolean"},"publicFetchesUsed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"sourceStatuses":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"status":{"type":"string"},"retrievedAt":{"type":"string"},"itemCount":{"type":"number"},"detail":{"type":"string"},"authenticated":{"type":"boolean"}},"additionalProperties":true}},"findings":{"type":"array","items":{}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"domhist-D1","detector":"domain-threat-history","title":"Domain history risk indicators","status":"signal","observedFacts":["domain=brand-login.example","createdAt=2026-10-28T00:00:00.000Z","Domain registration age under 30 days.","NS=ns1.example.net, ns2.example.net","A=198.51.100.20","registrar=Cheap Domains LLC","Appears in 1 feed row(s)."],"inferredThreat":"Public domain history can support risk review; a single weak attribute is not malice.","confidence":"medium","relatedIds":["D1","F1"],"reasons":["registration_date","recently_registered","nameservers_present","dns_answers","registrar_present","feed_overlap"],"evidence":[{"subject":"D1","fact":"domain=brand-login.example; createdAt=2026-10-28T00:00:00.000Z; Domain registration age under 30 days.; NS=ns1.example.net, ns2.example.net; A=198.51.100.20; registrar=Cheap Domains LLC; Appears in 1 feed row(s).","source":"Caller-supplied","confidence":"medium"},{"subject":"F1","fact":"openphish hit","source":"Caller-supplied","observedAt":"2026-11-03T12:00:00.000Z","confidence":"medium"}],"source":"Caller-supplied","confirmedMalicious":false}],"paidProviderUsed":false,"apiKeyRequired":false,"intrusiveScanPerformed":false,"singleWeakSignalMaliciousClaimed":false,"publicFetchesUsed":false,"publicDnsQueried":false,"sourceStatuses":[{"id":"urlhaus","name":"URLhaus","url":"https://urlhaus.abuse.ch/","status":"AUTH_REQUIRED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.","authenticated":false},{"id":"cisa-kev","name":"CISA KEV","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCisaKev=true to load the free CISA KEV catalogue.","authenticated":false},{"id":"openphish","name":"OpenPhish community feed","url":"https://openphish.com/feed.txt","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchOpenPhish=true to load the free OpenPhish community feed.","authenticated":false},{"id":"phishtank","name":"PhishTank online-valid CSV","url":"https://data.phishtank.com/data/online-valid.csv","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).","authenticated":false},{"id":"rdap","name":"RDAP","url":"https://rdap.org/domain/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchRdap=true to query public RDAP for supplied domains.","authenticated":false},{"id":"crtsh","name":"crt.sh Certificate Transparency","url":"https://crt.sh/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).","authenticated":false}],"findings":[],"limitations":["Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.","URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.","No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.","A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.","No paid threat-intel provider is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/threat-intelligence/certificate-threat-cluster":{"post":{"operationId":"cluster_certificate_relationships","summary":"Cluster certificate relationships","description":"Identify relationships between domains using caller-supplied certificates and optional public crt.sh data. Shared certificate attributes are linkage evidence, not confirmed abuse.","tags":["threat-intelligence"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"indicators":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","email","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"firstSeen":{"type":"string","maxLength":40},"lastSeen":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"confidenceHint":{"type":"string","enum":["low","medium","high"]},"relatedIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}}},"required":["value"],"additionalProperties":false}},"feeds":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"feed":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"observedAt":{"type":"string","maxLength":40},"tags":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200},"url":{"type":"string","maxLength":2000}},"required":["value"],"additionalProperties":false}},"domains":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","minLength":1,"maxLength":253},"brand":{"type":"string","maxLength":120},"registrar":{"type":"string","maxLength":200},"createdAt":{"type":"string","maxLength":40},"expiresAt":{"type":"string","maxLength":40},"nameservers":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":253}},"ips":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"asn":{"type":"string","maxLength":40},"hostingProvider":{"type":"string","maxLength":120},"certificateFingerprint":{"type":"string","maxLength":120},"source":{"type":"string","maxLength":200}},"required":["domain"],"additionalProperties":false}},"certificates":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","maxLength":253},"commonName":{"type":"string","maxLength":253},"issuer":{"type":"string","maxLength":200},"notBefore":{"type":"string","maxLength":40},"notAfter":{"type":"string","maxLength":40},"fingerprintSha256":{"type":"string","maxLength":120},"serialNumber":{"type":"string","maxLength":120},"sans":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":253}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"services":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"host":{"type":"string","maxLength":253},"ip":{"type":"string","maxLength":80},"port":{"type":"number","minimum":1,"maximum":65535},"protocol":{"type":"string","maxLength":40},"service":{"type":"string","maxLength":80},"product":{"type":"string","maxLength":120},"version":{"type":"string","maxLength":80},"banner":{"type":"string","maxLength":2000},"tls":{"type":"boolean"},"exposure":{"type":"string","enum":["public","internal","unknown"]},"cveIds":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":40}},"observedAt":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"brands":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"brand":{"type":"string","minLength":1,"maxLength":120},"domains":{"maxItems":40,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"source":{"type":"string","maxLength":200}},"required":["brand"],"additionalProperties":false}},"candidates":{"maxItems":2000,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"asOf":{"type":"string","maxLength":40},"fetchCisaKev":{"type":"boolean"},"fetchOpenPhish":{"type":"boolean"},"fetchPhishTank":{"type":"boolean"},"fetchCrtSh":{"type":"boolean"},"fetchRdap":{"type":"boolean"},"publicDns":{"type":"boolean"},"staleDays":{"type":"number","minimum":1,"maximum":365},"crtShQuery":{"type":"string","maxLength":253}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","certificates":[{"id":"C1","domain":"a.phish.example","commonName":"a.phish.example","issuer":"Let's Encrypt","fingerprintSha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","sans":["a.phish.example"],"source":"Caller-supplied"},{"id":"C2","domain":"b.phish.example","commonName":"b.phish.example","issuer":"Let's Encrypt","fingerprintSha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","sans":["b.phish.example"],"source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"source":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalicious":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"intrusiveScanPerformed":{"type":"boolean"},"singleWeakSignalMaliciousClaimed":{"type":"boolean"},"publicFetchesUsed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"sourceStatuses":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"status":{"type":"string"},"retrievedAt":{"type":"string"},"itemCount":{"type":"number"},"detail":{"type":"string"},"authenticated":{"type":"boolean"}},"additionalProperties":true}},"findings":{"type":"array","items":{}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":2,"items":[{"id":"ct-fp_aaaaaaaaaaaaaaaa","detector":"certificate-threat-cluster","title":"Certificate fingerprint cluster","observedFacts":["2 certificate row(s)","2 related name(s): a.phish.example, b.phish.example"],"inferredThreat":"Shared certificate attributes can link infrastructure; linkage is not confirmed phishing/malware.","confidence":"low","relatedIds":["C1","C2"],"reasons":["shared_fingerprint","multi_domain"],"evidence":[{"subject":"C1","fact":"cn=a.phish.example; issuer=Let's Encrypt; fp=aaaaaaaaaaaaaaaa…","source":"Caller-supplied","confidence":"medium"},{"subject":"C2","fact":"cn=b.phish.example; issuer=Let's Encrypt; fp=aaaaaaaaaaaaaaaa…","source":"Caller-supplied","confidence":"medium"}],"source":"Caller-supplied certificates and/or public crt.sh","status":"signal","confirmedMalicious":false},{"id":"ct-san_phish_example","detector":"certificate-threat-cluster","title":"SAN/root certificate name cluster","observedFacts":["2 certificate row(s)","2 related name(s): a.phish.example, b.phish.example"],"inferredThreat":"Shared certificate attributes can link infrastructure; linkage is not confirmed phishing/malware.","confidence":"low","relatedIds":["C1","C2"],"reasons":["shared_san_root","multi_domain"],"evidence":[{"subject":"C1","fact":"cn=a.phish.example; issuer=Let's Encrypt; fp=aaaaaaaaaaaaaaaa…","source":"Caller-supplied","confidence":"medium"},{"subject":"C2","fact":"cn=b.phish.example; issuer=Let's Encrypt; fp=aaaaaaaaaaaaaaaa…","source":"Caller-supplied","confidence":"medium"}],"source":"Caller-supplied certificates and/or public crt.sh","status":"signal","confirmedMalicious":false}],"paidProviderUsed":false,"apiKeyRequired":false,"intrusiveScanPerformed":false,"singleWeakSignalMaliciousClaimed":false,"publicFetchesUsed":false,"publicDnsQueried":false,"sourceStatuses":[{"id":"urlhaus","name":"URLhaus","url":"https://urlhaus.abuse.ch/","status":"AUTH_REQUIRED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.","authenticated":false},{"id":"cisa-kev","name":"CISA KEV","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCisaKev=true to load the free CISA KEV catalogue.","authenticated":false},{"id":"openphish","name":"OpenPhish community feed","url":"https://openphish.com/feed.txt","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchOpenPhish=true to load the free OpenPhish community feed.","authenticated":false},{"id":"phishtank","name":"PhishTank online-valid CSV","url":"https://data.phishtank.com/data/online-valid.csv","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).","authenticated":false},{"id":"rdap","name":"RDAP","url":"https://rdap.org/domain/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchRdap=true to query public RDAP for supplied domains.","authenticated":false},{"id":"crtsh","name":"crt.sh Certificate Transparency","url":"https://crt.sh/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).","authenticated":false}],"findings":[],"limitations":["Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.","URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.","No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.","A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.","No paid threat-intel provider is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/threat-intelligence/typosquatting-domain-detect":{"post":{"operationId":"detect_typosquat_domains","summary":"Detect typosquat domains","description":"Identify domains resembling supplied brand or company domains using local string/keyboard heuristics. Resemblance alone is not confirmed phishing.","tags":["threat-intelligence"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"indicators":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","email","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"firstSeen":{"type":"string","maxLength":40},"lastSeen":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"confidenceHint":{"type":"string","enum":["low","medium","high"]},"relatedIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}}},"required":["value"],"additionalProperties":false}},"feeds":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"feed":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"observedAt":{"type":"string","maxLength":40},"tags":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200},"url":{"type":"string","maxLength":2000}},"required":["value"],"additionalProperties":false}},"domains":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","minLength":1,"maxLength":253},"brand":{"type":"string","maxLength":120},"registrar":{"type":"string","maxLength":200},"createdAt":{"type":"string","maxLength":40},"expiresAt":{"type":"string","maxLength":40},"nameservers":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":253}},"ips":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"asn":{"type":"string","maxLength":40},"hostingProvider":{"type":"string","maxLength":120},"certificateFingerprint":{"type":"string","maxLength":120},"source":{"type":"string","maxLength":200}},"required":["domain"],"additionalProperties":false}},"certificates":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","maxLength":253},"commonName":{"type":"string","maxLength":253},"issuer":{"type":"string","maxLength":200},"notBefore":{"type":"string","maxLength":40},"notAfter":{"type":"string","maxLength":40},"fingerprintSha256":{"type":"string","maxLength":120},"serialNumber":{"type":"string","maxLength":120},"sans":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":253}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"services":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"host":{"type":"string","maxLength":253},"ip":{"type":"string","maxLength":80},"port":{"type":"number","minimum":1,"maximum":65535},"protocol":{"type":"string","maxLength":40},"service":{"type":"string","maxLength":80},"product":{"type":"string","maxLength":120},"version":{"type":"string","maxLength":80},"banner":{"type":"string","maxLength":2000},"tls":{"type":"boolean"},"exposure":{"type":"string","enum":["public","internal","unknown"]},"cveIds":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":40}},"observedAt":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"brands":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"brand":{"type":"string","minLength":1,"maxLength":120},"domains":{"maxItems":40,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"source":{"type":"string","maxLength":200}},"required":["brand"],"additionalProperties":false}},"candidates":{"maxItems":2000,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"asOf":{"type":"string","maxLength":40},"fetchCisaKev":{"type":"boolean"},"fetchOpenPhish":{"type":"boolean"},"fetchPhishTank":{"type":"boolean"},"fetchCrtSh":{"type":"boolean"},"fetchRdap":{"type":"boolean"},"publicDns":{"type":"boolean"},"staleDays":{"type":"number","minimum":1,"maximum":365},"crtShQuery":{"type":"string","maxLength":253}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","brands":[{"id":"B1","brand":"paypal","domains":["paypal.com"],"source":"Caller-supplied"}],"candidates":["paypa1.com","paypal.com","totally-unrelated.example"]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"},"source":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"confirmedMalicious":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"intrusiveScanPerformed":{"type":"boolean"},"singleWeakSignalMaliciousClaimed":{"type":"boolean"},"publicFetchesUsed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"sourceStatuses":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"status":{"type":"string"},"retrievedAt":{"type":"string"},"itemCount":{"type":"number"},"detail":{"type":"string"},"authenticated":{"type":"boolean"}},"additionalProperties":true}},"findings":{"type":"array","items":{}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"typo-paypal_com_paypa1_com","detector":"typosquatting-domain-detect","title":"Possible typosquat / lookalike domain","status":"signal","observedFacts":["brand=paypal.com","candidate=paypa1.com","similarity=0.83","reason=high_string_similarity","reason=homoglyphish_digits"],"inferredThreat":"Lookalike domains can support phishing; resemblance alone is not confirmed abuse.","confidence":"medium","relatedIds":["B1"],"reasons":["high_string_similarity","homoglyphish_digits"],"evidence":[{"subject":"paypa1.com","fact":"Compared to paypal.com; similarity=0.83","inference":"Local string/keyboard heuristics only.","confidence":"medium","source":"Caller-supplied"}],"source":"Caller-supplied","confirmedMalicious":false}],"paidProviderUsed":false,"apiKeyRequired":false,"intrusiveScanPerformed":false,"singleWeakSignalMaliciousClaimed":false,"publicFetchesUsed":false,"publicDnsQueried":false,"sourceStatuses":[{"id":"urlhaus","name":"URLhaus","url":"https://urlhaus.abuse.ch/","status":"AUTH_REQUIRED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.","authenticated":false},{"id":"cisa-kev","name":"CISA KEV","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCisaKev=true to load the free CISA KEV catalogue.","authenticated":false},{"id":"openphish","name":"OpenPhish community feed","url":"https://openphish.com/feed.txt","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchOpenPhish=true to load the free OpenPhish community feed.","authenticated":false},{"id":"phishtank","name":"PhishTank online-valid CSV","url":"https://data.phishtank.com/data/online-valid.csv","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).","authenticated":false},{"id":"rdap","name":"RDAP","url":"https://rdap.org/domain/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchRdap=true to query public RDAP for supplied domains.","authenticated":false},{"id":"crtsh","name":"crt.sh Certificate Transparency","url":"https://crt.sh/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).","authenticated":false}],"findings":[],"limitations":["Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.","URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.","No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.","A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.","No paid threat-intel provider is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.03"},"protocols":[{"x402":{}}]}}},"/api/v1/threat-intelligence/phishing-infrastructure-cluster":{"post":{"operationId":"cluster_phishing_infrastructure","summary":"Cluster phishing infrastructure","description":"Group related phishing domains and infrastructure using caller evidence and optional public phishing feeds. Clusters are relationship hypotheses, not confirmed campaigns.","tags":["threat-intelligence"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"indicators":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","email","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"firstSeen":{"type":"string","maxLength":40},"lastSeen":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"confidenceHint":{"type":"string","enum":["low","medium","high"]},"relatedIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}}},"required":["value"],"additionalProperties":false}},"feeds":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"feed":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"observedAt":{"type":"string","maxLength":40},"tags":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200},"url":{"type":"string","maxLength":2000}},"required":["value"],"additionalProperties":false}},"domains":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","minLength":1,"maxLength":253},"brand":{"type":"string","maxLength":120},"registrar":{"type":"string","maxLength":200},"createdAt":{"type":"string","maxLength":40},"expiresAt":{"type":"string","maxLength":40},"nameservers":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":253}},"ips":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"asn":{"type":"string","maxLength":40},"hostingProvider":{"type":"string","maxLength":120},"certificateFingerprint":{"type":"string","maxLength":120},"source":{"type":"string","maxLength":200}},"required":["domain"],"additionalProperties":false}},"certificates":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","maxLength":253},"commonName":{"type":"string","maxLength":253},"issuer":{"type":"string","maxLength":200},"notBefore":{"type":"string","maxLength":40},"notAfter":{"type":"string","maxLength":40},"fingerprintSha256":{"type":"string","maxLength":120},"serialNumber":{"type":"string","maxLength":120},"sans":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":253}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"services":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"host":{"type":"string","maxLength":253},"ip":{"type":"string","maxLength":80},"port":{"type":"number","minimum":1,"maximum":65535},"protocol":{"type":"string","maxLength":40},"service":{"type":"string","maxLength":80},"product":{"type":"string","maxLength":120},"version":{"type":"string","maxLength":80},"banner":{"type":"string","maxLength":2000},"tls":{"type":"boolean"},"exposure":{"type":"string","enum":["public","internal","unknown"]},"cveIds":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":40}},"observedAt":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"brands":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"brand":{"type":"string","minLength":1,"maxLength":120},"domains":{"maxItems":40,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"source":{"type":"string","maxLength":200}},"required":["brand"],"additionalProperties":false}},"candidates":{"maxItems":2000,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"asOf":{"type":"string","maxLength":40},"fetchCisaKev":{"type":"boolean"},"fetchOpenPhish":{"type":"boolean"},"fetchPhishTank":{"type":"boolean"},"fetchCrtSh":{"type":"boolean"},"fetchRdap":{"type":"boolean"},"publicDns":{"type":"boolean"},"staleDays":{"type":"number","minimum":1,"maximum":365},"crtShQuery":{"type":"string","maxLength":253}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","feeds":[{"id":"F1","feed":"openphish","type":"url","value":"http://login-a.example/x","observedAt":"2026-11-04T12:00:00.000Z","source":"Caller-supplied"},{"id":"F2","feed":"openphish","type":"url","value":"http://login-b.example/y","observedAt":"2026-11-04T13:00:00.000Z","source":"Caller-supplied"}],"domains":[{"id":"D1","domain":"login-a.example","ips":["198.51.100.50"],"asn":"AS64500","registrar":"Example Reg","source":"Caller-supplied"},{"id":"D2","domain":"login-b.example","ips":["198.51.100.50"],"asn":"AS64500","registrar":"Example Reg","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"source":{"type":"string"},"confidence":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"status":{"type":"string"},"confirmedMalicious":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"intrusiveScanPerformed":{"type":"boolean"},"singleWeakSignalMaliciousClaimed":{"type":"boolean"},"publicFetchesUsed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"sourceStatuses":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"status":{"type":"string"},"retrievedAt":{"type":"string"},"itemCount":{"type":"number"},"detail":{"type":"string"},"authenticated":{"type":"boolean"}},"additionalProperties":true}},"findings":{"type":"array","items":{}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":3,"items":[{"id":"phish-shared_ip_198_51_100_50","detector":"phishing-infrastructure-cluster","title":"Phishing domains sharing IP","observedFacts":["2 domains share shared_ip=198.51.100.50","examples=login-a.example, login-b.example"],"inferredThreat":"Shared infrastructure can indicate related phishing campaigns; clustering is not confirmation.","confidence":"low","relatedIds":["F1","F2","D1","D2"],"reasons":["shared_ip","multi_domain"],"evidence":[{"subject":"F1","fact":"domain=login-a.example","source":"Caller-supplied","confidence":"medium"},{"subject":"F2","fact":"domain=login-b.example","source":"Caller-supplied","confidence":"medium"},{"subject":"D1","fact":"domain=login-a.example","source":"Caller-supplied","confidence":"medium"},{"subject":"D2","fact":"domain=login-b.example","source":"Caller-supplied","confidence":"medium"}],"source":"Caller-supplied domains/feeds plus optional public phishing feeds","status":"signal","confirmedMalicious":false},{"id":"phish-shared_asn_as64500","detector":"phishing-infrastructure-cluster","title":"Phishing domains sharing ASN","observedFacts":["2 domains share shared_asn=AS64500","examples=login-a.example, login-b.example"],"inferredThreat":"Shared infrastructure can indicate related phishing campaigns; clustering is not confirmation.","confidence":"low","relatedIds":["F1","F2","D1","D2"],"reasons":["shared_asn","multi_domain"],"evidence":[{"subject":"F1","fact":"domain=login-a.example","source":"Caller-supplied","confidence":"medium"},{"subject":"F2","fact":"domain=login-b.example","source":"Caller-supplied","confidence":"medium"},{"subject":"D1","fact":"domain=login-a.example","source":"Caller-supplied","confidence":"medium"},{"subject":"D2","fact":"domain=login-b.example","source":"Caller-supplied","confidence":"medium"}],"source":"Caller-supplied domains/feeds plus optional public phishing feeds","status":"signal","confirmedMalicious":false},{"id":"phish-shared_registrar_example_reg","detector":"phishing-infrastructure-cluster","title":"Phishing domains sharing registrar","observedFacts":["2 domains share shared_registrar=Example Reg","examples=login-a.example, login-b.example"],"inferredThreat":"Shared infrastructure can indicate related phishing campaigns; clustering is not confirmation.","confidence":"low","relatedIds":["F1","F2","D1","D2"],"reasons":["shared_registrar","multi_domain"],"evidence":[{"subject":"F1","fact":"domain=login-a.example","source":"Caller-supplied","confidence":"medium"},{"subject":"F2","fact":"domain=login-b.example","source":"Caller-supplied","confidence":"medium"},{"subject":"D1","fact":"domain=login-a.example","source":"Caller-supplied","confidence":"medium"},{"subject":"D2","fact":"domain=login-b.example","source":"Caller-supplied","confidence":"medium"}],"source":"Caller-supplied domains/feeds plus optional public phishing feeds","status":"signal","confirmedMalicious":false}],"paidProviderUsed":false,"apiKeyRequired":false,"intrusiveScanPerformed":false,"singleWeakSignalMaliciousClaimed":false,"publicFetchesUsed":false,"publicDnsQueried":false,"sourceStatuses":[{"id":"urlhaus","name":"URLhaus","url":"https://urlhaus.abuse.ch/","status":"AUTH_REQUIRED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.","authenticated":false},{"id":"cisa-kev","name":"CISA KEV","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCisaKev=true to load the free CISA KEV catalogue.","authenticated":false},{"id":"openphish","name":"OpenPhish community feed","url":"https://openphish.com/feed.txt","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchOpenPhish=true to load the free OpenPhish community feed.","authenticated":false},{"id":"phishtank","name":"PhishTank online-valid CSV","url":"https://data.phishtank.com/data/online-valid.csv","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).","authenticated":false},{"id":"rdap","name":"RDAP","url":"https://rdap.org/domain/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchRdap=true to query public RDAP for supplied domains.","authenticated":false},{"id":"crtsh","name":"crt.sh Certificate Transparency","url":"https://crt.sh/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).","authenticated":false}],"findings":[],"limitations":["Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.","URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.","No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.","A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.","No paid threat-intel provider is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/threat-intelligence/exposed-service-risk-analyze":{"post":{"operationId":"analyze_exposed_service_risk","summary":"Analyze exposed service risk","description":"Analyze caller-supplied external service inventory and scan results for exposure risk. Never initiates intrusive network scanning.","tags":["threat-intelligence"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"indicators":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","email","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"firstSeen":{"type":"string","maxLength":40},"lastSeen":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"confidenceHint":{"type":"string","enum":["low","medium","high"]},"relatedIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}}},"required":["value"],"additionalProperties":false}},"feeds":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"feed":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"observedAt":{"type":"string","maxLength":40},"tags":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200},"url":{"type":"string","maxLength":2000}},"required":["value"],"additionalProperties":false}},"domains":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","minLength":1,"maxLength":253},"brand":{"type":"string","maxLength":120},"registrar":{"type":"string","maxLength":200},"createdAt":{"type":"string","maxLength":40},"expiresAt":{"type":"string","maxLength":40},"nameservers":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":253}},"ips":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"asn":{"type":"string","maxLength":40},"hostingProvider":{"type":"string","maxLength":120},"certificateFingerprint":{"type":"string","maxLength":120},"source":{"type":"string","maxLength":200}},"required":["domain"],"additionalProperties":false}},"certificates":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","maxLength":253},"commonName":{"type":"string","maxLength":253},"issuer":{"type":"string","maxLength":200},"notBefore":{"type":"string","maxLength":40},"notAfter":{"type":"string","maxLength":40},"fingerprintSha256":{"type":"string","maxLength":120},"serialNumber":{"type":"string","maxLength":120},"sans":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":253}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"services":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"host":{"type":"string","maxLength":253},"ip":{"type":"string","maxLength":80},"port":{"type":"number","minimum":1,"maximum":65535},"protocol":{"type":"string","maxLength":40},"service":{"type":"string","maxLength":80},"product":{"type":"string","maxLength":120},"version":{"type":"string","maxLength":80},"banner":{"type":"string","maxLength":2000},"tls":{"type":"boolean"},"exposure":{"type":"string","enum":["public","internal","unknown"]},"cveIds":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":40}},"observedAt":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"brands":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"brand":{"type":"string","minLength":1,"maxLength":120},"domains":{"maxItems":40,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"source":{"type":"string","maxLength":200}},"required":["brand"],"additionalProperties":false}},"candidates":{"maxItems":2000,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"asOf":{"type":"string","maxLength":40},"fetchCisaKev":{"type":"boolean"},"fetchOpenPhish":{"type":"boolean"},"fetchPhishTank":{"type":"boolean"},"fetchCrtSh":{"type":"boolean"},"fetchRdap":{"type":"boolean"},"publicDns":{"type":"boolean"},"staleDays":{"type":"number","minimum":1,"maximum":365},"crtShQuery":{"type":"string","maxLength":253}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","services":[{"id":"S1","host":"db.example","ip":"198.51.100.60","port":27017,"protocol":"tcp","service":"mongodb","exposure":"public","banner":"MongoDB without authentication","cveIds":["CVE-2024-1234"],"source":"Caller-supplied inventory"}],"feeds":[{"id":"F1","feed":"cisa-kev","type":"cve","value":"CVE-2024-1234","observedAt":"2026-09-01T00:00:00.000Z","source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"},"source":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"confirmedMalicious":{"type":"boolean"}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"intrusiveScanPerformed":{"type":"boolean"},"singleWeakSignalMaliciousClaimed":{"type":"boolean"},"publicFetchesUsed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"sourceStatuses":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"status":{"type":"string"},"retrievedAt":{"type":"string"},"itemCount":{"type":"number"},"detail":{"type":"string"},"authenticated":{"type":"boolean"}},"additionalProperties":true}},"findings":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"code":{"type":"string"},"subject":{"type":"string"},"detail":{"type":"string"}},"additionalProperties":true}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"svc-S1","detector":"exposed-service-risk-analyze","title":"Exposed service risk indicators","status":"signal","observedFacts":["host=db.example","port=27017/tcp","service=mongodb","exposure=public","Public exposure on commonly abused port 27017.","Public exposure of service mongodb.","Caller-linked CVE(s): CVE-2024-1234","KEV overlap: CVE-2024-1234","Banner contains authentication-risk wording."],"inferredThreat":"Publicly exposed risky services can expand attack surface; inventory analysis is not an exploit or scan result.","confidence":"medium","relatedIds":["S1"],"reasons":["risky_public_port","risky_public_service","cve_linked","kev_overlap","banner_risk_words"],"evidence":[{"subject":"S1","fact":"host=db.example; port=27017/tcp; service=mongodb; exposure=public; Public exposure on commonly abused port 27017.; Public exposure of service mongodb.; Caller-linked CVE(s): CVE-2024-1234; KEV overlap: CVE-2024-1234; Banner contains authentication-risk wording.","inference":"No intrusive scanning performed; evidence is from caller inventory and optional KEV overlap.","confidence":"medium","source":"Caller-supplied inventory"}],"source":"Caller-supplied inventory","confirmedMalicious":false}],"paidProviderUsed":false,"apiKeyRequired":false,"intrusiveScanPerformed":false,"singleWeakSignalMaliciousClaimed":false,"publicFetchesUsed":false,"publicDnsQueried":false,"sourceStatuses":[{"id":"urlhaus","name":"URLhaus","url":"https://urlhaus.abuse.ch/","status":"AUTH_REQUIRED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.","authenticated":false},{"id":"cisa-kev","name":"CISA KEV","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCisaKev=true to load the free CISA KEV catalogue.","authenticated":false},{"id":"openphish","name":"OpenPhish community feed","url":"https://openphish.com/feed.txt","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchOpenPhish=true to load the free OpenPhish community feed.","authenticated":false},{"id":"phishtank","name":"PhishTank online-valid CSV","url":"https://data.phishtank.com/data/online-valid.csv","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).","authenticated":false},{"id":"rdap","name":"RDAP","url":"https://rdap.org/domain/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchRdap=true to query public RDAP for supplied domains.","authenticated":false},{"id":"crtsh","name":"crt.sh Certificate Transparency","url":"https://crt.sh/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).","authenticated":false}],"findings":[{"kind":"conflict","code":"exposed_service","subject":"S1","detail":"Exposure indicators: risky_public_port, risky_public_service, cve_linked, kev_overlap, banner_risk_words (confirmedMalicious=false)."}],"limitations":["Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.","URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.","No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.","A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.","No paid threat-intel provider is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.04"},"protocols":[{"x402":{}}]}}},"/api/v1/threat-intelligence/threat-indicator-confidence-score":{"post":{"operationId":"score_threat_indicator_confidence","summary":"Score threat-indicator confidence","description":"Calculate explainable confidence scores for supplied threat indicators using multi-source corroboration. Single weak signals are capped and never claimed as confirmed malice.","tags":["threat-intelligence"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"text":{"type":"string","maxLength":200000},"json":{"type":"string","maxLength":200000},"csv":{"type":"string","maxLength":200000},"file":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false},"files":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"filename":{"type":"string","minLength":1,"maxLength":180},"mediaType":{"type":"string","enum":["text/plain","text/csv","application/json","application/octet-stream"]},"fileBase64":{"type":"string","minLength":1,"maxLength":12000000},"role":{"type":"string","maxLength":80}},"required":["fileBase64"],"additionalProperties":false}},"indicators":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","email","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"firstSeen":{"type":"string","maxLength":40},"lastSeen":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200},"labels":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"confidenceHint":{"type":"string","enum":["low","medium","high"]},"relatedIds":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":80}}},"required":["value"],"additionalProperties":false}},"feeds":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"feed":{"type":"string","maxLength":80},"type":{"type":"string","enum":["ip","domain","url","hash","cve","other"]},"value":{"type":"string","minLength":1,"maxLength":2000},"observedAt":{"type":"string","maxLength":40},"tags":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"source":{"type":"string","maxLength":200},"url":{"type":"string","maxLength":2000}},"required":["value"],"additionalProperties":false}},"domains":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","minLength":1,"maxLength":253},"brand":{"type":"string","maxLength":120},"registrar":{"type":"string","maxLength":200},"createdAt":{"type":"string","maxLength":40},"expiresAt":{"type":"string","maxLength":40},"nameservers":{"maxItems":20,"type":"array","items":{"type":"string","maxLength":253}},"ips":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":80}},"asn":{"type":"string","maxLength":40},"hostingProvider":{"type":"string","maxLength":120},"certificateFingerprint":{"type":"string","maxLength":120},"source":{"type":"string","maxLength":200}},"required":["domain"],"additionalProperties":false}},"certificates":{"maxItems":2000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"domain":{"type":"string","maxLength":253},"commonName":{"type":"string","maxLength":253},"issuer":{"type":"string","maxLength":200},"notBefore":{"type":"string","maxLength":40},"notAfter":{"type":"string","maxLength":40},"fingerprintSha256":{"type":"string","maxLength":120},"serialNumber":{"type":"string","maxLength":120},"sans":{"maxItems":100,"type":"array","items":{"type":"string","maxLength":253}},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"services":{"maxItems":5000,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"host":{"type":"string","maxLength":253},"ip":{"type":"string","maxLength":80},"port":{"type":"number","minimum":1,"maximum":65535},"protocol":{"type":"string","maxLength":40},"service":{"type":"string","maxLength":80},"product":{"type":"string","maxLength":120},"version":{"type":"string","maxLength":80},"banner":{"type":"string","maxLength":2000},"tls":{"type":"boolean"},"exposure":{"type":"string","enum":["public","internal","unknown"]},"cveIds":{"maxItems":40,"type":"array","items":{"type":"string","maxLength":40}},"observedAt":{"type":"string","maxLength":40},"source":{"type":"string","maxLength":200}},"additionalProperties":false}},"brands":{"maxItems":100,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","maxLength":80},"brand":{"type":"string","minLength":1,"maxLength":120},"domains":{"maxItems":40,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"source":{"type":"string","maxLength":200}},"required":["brand"],"additionalProperties":false}},"candidates":{"maxItems":2000,"type":"array","items":{"type":"string","minLength":1,"maxLength":253}},"asOf":{"type":"string","maxLength":40},"fetchCisaKev":{"type":"boolean"},"fetchOpenPhish":{"type":"boolean"},"fetchPhishTank":{"type":"boolean"},"fetchCrtSh":{"type":"boolean"},"fetchRdap":{"type":"boolean"},"publicDns":{"type":"boolean"},"staleDays":{"type":"number","minimum":1,"maximum":365},"crtShQuery":{"type":"string","maxLength":253}},"additionalProperties":false},"example":{"asOf":"2026-11-04T21:00:00.000Z","indicators":[{"id":"I1","type":"domain","value":"paypa1-secure.example","labels":["phish"],"source":"Caller-supplied"}],"feeds":[{"id":"F1","feed":"openphish","type":"url","value":"http://paypa1-secure.example/login","observedAt":"2026-11-04T18:00:00.000Z","source":"Caller-supplied"},{"id":"F2","feed":"phishtank","type":"url","value":"http://paypa1-secure.example/login","observedAt":"2026-11-04T17:00:00.000Z","source":"Caller-supplied"}],"domains":[{"id":"D1","domain":"paypa1-secure.example","createdAt":"2026-10-20T00:00:00.000Z","ips":["198.51.100.10"],"source":"Caller-supplied"}]}}}},"parameters":[{"name":"Idempotency-Key","in":"header","required":true,"description":"Fresh random 32-byte value encoded as 64 hexadecimal characters. Reuse unchanged only for retries of the same operation and request.","schema":{"type":"string","pattern":"^[0-9a-fA-F]{64}$"}}],"responses":{"200":{"description":"Illustrative endpoint-specific JSON response shape. Conditional fields depend on the result and data-source availability.","content":{"application/json":{"schema":{"type":"object","properties":{"checkedAt":{"type":"string"},"status":{"type":"string"},"itemCount":{"type":"number"},"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"detector":{"type":"string"},"title":{"type":"string"},"status":{"type":"string"},"observedFacts":{"type":"array","items":{"type":"string"}},"inferredThreat":{"type":"string"},"confidence":{"type":"string"},"relatedIds":{"type":"array","items":{"type":"string"}},"reasons":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"fact":{"type":"string"},"inference":{"type":"string"},"confidence":{"type":"string"},"source":{"type":"string"}},"additionalProperties":true}},"source":{"type":"string"},"confirmedMalicious":{"type":"boolean"},"score":{"type":"number"},"scoreBand":{"type":"string"},"components":{"type":"array","items":{"type":"object","properties":{"code":{"type":"string"},"points":{"type":"number"},"detail":{"type":"string"}},"additionalProperties":true}}},"additionalProperties":true}},"paidProviderUsed":{"type":"boolean"},"apiKeyRequired":{"type":"boolean"},"intrusiveScanPerformed":{"type":"boolean"},"singleWeakSignalMaliciousClaimed":{"type":"boolean"},"publicFetchesUsed":{"type":"boolean"},"publicDnsQueried":{"type":"boolean"},"sourceStatuses":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"url":{"type":"string"},"status":{"type":"string"},"retrievedAt":{"type":"string"},"itemCount":{"type":"number"},"detail":{"type":"string"},"authenticated":{"type":"boolean"}},"additionalProperties":true}},"findings":{"type":"array","items":{}},"limitations":{"type":"array","items":{"type":"string"}}},"additionalProperties":true},"example":{"checkedAt":"2026-11-04T21:00:00.000Z","status":"detected","itemCount":1,"items":[{"id":"score-I1","detector":"threat-indicator-confidence-score","title":"Threat indicator confidence score","status":"signal","observedFacts":["score=70","band=high","multi_feed_corroboration:35","recent_registration:15","dns_rdap_context:10","caller_malicious_label:10"],"inferredThreat":"Explainable confidence for investigation priority only; not a confirmed malicious verdict.","confidence":"high","relatedIds":["I1","F1","F2"],"reasons":["multi_feed_corroboration","recent_registration","dns_rdap_context","caller_malicious_label"],"evidence":[{"subject":"I1","fact":"Listed by 2 independent feeds: openphish, phishtank.","inference":"Contribution 35 points.","confidence":"high","source":"Caller-supplied"},{"subject":"I1","fact":"Domain registration age under 30 days.","inference":"Contribution 15 points.","confidence":"high","source":"Caller-supplied"},{"subject":"I1","fact":"DNS/RDAP context available.","inference":"Contribution 10 points.","confidence":"high","source":"Caller-supplied"},{"subject":"I1","fact":"Caller supplied a malicious-category label.","inference":"Contribution 10 points.","confidence":"high","source":"Caller-supplied"}],"source":"Caller-supplied","confirmedMalicious":false,"score":70,"scoreBand":"high","components":[{"code":"multi_feed_corroboration","points":35,"detail":"Listed by 2 independent feeds: openphish, phishtank."},{"code":"recent_registration","points":15,"detail":"Domain registration age under 30 days."},{"code":"dns_rdap_context","points":10,"detail":"DNS/RDAP context available."},{"code":"caller_malicious_label","points":10,"detail":"Caller supplied a malicious-category label."}]}],"paidProviderUsed":false,"apiKeyRequired":false,"intrusiveScanPerformed":false,"singleWeakSignalMaliciousClaimed":false,"publicFetchesUsed":false,"publicDnsQueried":false,"sourceStatuses":[{"id":"urlhaus","name":"URLhaus","url":"https://urlhaus.abuse.ch/","status":"AUTH_REQUIRED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"URLhaus public API/downloads require authentication or are gone; not queried. Caller-supplied URLhaus-like rows are still accepted.","authenticated":false},{"id":"cisa-kev","name":"CISA KEV","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCisaKev=true to load the free CISA KEV catalogue.","authenticated":false},{"id":"openphish","name":"OpenPhish community feed","url":"https://openphish.com/feed.txt","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchOpenPhish=true to load the free OpenPhish community feed.","authenticated":false},{"id":"phishtank","name":"PhishTank online-valid CSV","url":"https://data.phishtank.com/data/online-valid.csv","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchPhishTank=true to fetch a capped PhishTank CSV sample (full file is large).","authenticated":false},{"id":"rdap","name":"RDAP","url":"https://rdap.org/domain/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchRdap=true to query public RDAP for supplied domains.","authenticated":false},{"id":"crtsh","name":"crt.sh Certificate Transparency","url":"https://crt.sh/","status":"SKIPPED","retrievedAt":"2026-11-04T21:00:00.000Z","itemCount":0,"detail":"Set fetchCrtSh=true to query public crt.sh (may be intermittently unavailable).","authenticated":false}],"findings":[],"limitations":["Threat indicators, feeds, domains, certificates, and service inventory are copied from caller-supplied fields and/or verified key-free public sources when explicitly requested.","URLhaus and ThreatFox require authentication and are not queried. PhishTank live CSV is capped/truncated when fetched; prefer caller-supplied PhishTank rows when possible.","No intrusive network scanning is performed. Public DNS/RDAP/crt.sh lookups are read-only and may be unavailable, stale, or conflicting.","A single weak feed hit is never treated as confirmed malice. Observed facts are separated from inferred threat hypotheses.","No paid threat-intel provider is used and no API key is required."]}}}},"400":{"description":"Invalid JSON or request schema."},"402":{"description":"Payment Required"},"409":{"description":"Idempotency conflict, in-progress payment, or expired result cache. Reusing the key cannot trigger a second charge."},"413":{"description":"Request body exceeds the 24 MB limit."},"500":{"description":"Operation failed. With upfront settlement this may occur after payment; reuse the same idempotency key to retrieve the stored result."},"503":{"description":"Payment or retry-safe result storage is unavailable; the operation is not run."}},"x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.03"},"protocols":[{"x402":{}}]}}}},"components":{"schemas":{"ApiError":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"string"},"message":{"type":"string"},"details":{}}}}}}}}