adctd-api-spec-v1.yaml

swagger: "3.0"
info:
  description: "Look up Malicious URI in Cyber Tactical Database"
  version: "1.0.0"
  title: "Cyber Tactical Database API"
  termsOfService: ""
  contact:
    email: "ctd@activedefense.co.jp"
    url: https://github.com/activedefense/adctd-api-spec
  license:
    name: "Commercial"
    url: ""

host: api.ctd.activedefense.co.jp
basePath: /v1
schemes:
  - http
  - https
consumes:
  - application/json
produces:
  - application/json


definitions:
  MaliciousUri:
    type: object
    properties:
      id:
        type: string
        format: uuid
        description: Unique id of ADCTD
        # readOnly: true
        # example: dd01da19-ef8a-4583-adbc-d7a47c76adcb
      type:
        type: string
        description: type of Indicator
        # readOnly: true
        # example: url
      is_infected:
        type: boolean
        description: estimate source subject infection status before uri access 
        # readOnly: true
        # example: false    
      url:
        type: string
        format: uri
        description: Malicious URL
        # readOnly: true
        # example: http://worth.lobelqq.sample/hummingbird.htm
      domain:
        type: string
        format: hostname
        description: Malicious resource contained domain
        # readOnly: true
        # example: worth.lobelqq.sample
      ip:
        type: string
        format: ipv4
        description: Malicious resource containted IP address
        # readOnly: true
        # example: 1.1.1.1
      description: 
        type: string
        description: Campaign, Tool Kit, or Species if indentified
        # readOnly: true
        # example: TIG Exploit Kit
      confidence:
        type: string
        description: high, medium, low
        # example: high
      created_at:
        type: string
        format: date-time
        description: created datetime of this entry 
        # readOnly: true
        # example: 2018-06-01T00:00:00Z
      updated_at:
        type: string
        format: date-time
        description: updated datetime of this entry 
        # readOnly: true
        # example: 2018-06-01T00:00:00Z
      expire_at:
        type: string
        format: date-time
        description: expire datetime of this entry 
        # readOnly: true
        # example: 2018-06-01T10:00:00Z

securityDefinitions:
   # X-API-Key: abcdef12345
   APIKeyHeader:
     type: apiKey
     in: header
     name: x-api-key

security:
  - APIKeyHeader: []
paths:
  # /malicious/uri/{id}:
    # parameters:
      # - name: id
        # in: path
        # description: Malicious Entry URI id
        # required: true
        # type: string
        # format: uuid
    # get:
      # tags: [MaliciousUri]
      # summary: Detail of Malicious Entry URI
      # description: 
      # operationId: GetMaliciousURIById
      # responses:
        # '200':
          # description: Malicious Entry URI
          # schema:
            # "$ref": '#/definitions/MaliciousUri'

  /malicious/uri:
    get:
      tags: [MaliciousUri]
      summary: List of Malicious Entry URI in Cyber Tactical Database
      description: Return list of Malicious Entry URI in Cyber Tactical Database
      produces:
      - application/json
      operationId: GetMaliciousURIs
      parameters:
        - in: query
          name: type
          schema:
            type: string
          description: \"ek\" or \"dl_malware\" is supported. If specified \"ek\", you can get Exploit Kit related uri lists. If specified \"dl_malware\", you can get malware related uri lists. 
      responses:
        '200':
          description: successful operation
          schema:
            type: array
            items:
              $ref: '#/definitions/MaliciousUri'