<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Building Threat Intelligence Platform

## OpenCTI GraphQL API

**Base URL:** `http://localhost:8080/graphql`

### Health Check
```bash
curl -H "Authorization: Bearer TOKEN" \
  -H "Content-Type: application/json" \
  http://localhost:8080/graphql \
  -d '{"query":"{ about { version } }"}'
```

### List Threat Actors
```bash
curl -H "Authorization: Bearer TOKEN" \
  -H "Content-Type: application/json" \
  http://localhost:8080/graphql \
  -d '{"query":"{ threatActors(first: 10) { edges { node { name description } } } }"}'
```

### Import STIX Bundle
```bash
curl -X POST -H "Authorization: Bearer TOKEN" \
  -H "Content-Type: application/json" \
  http://localhost:8080/graphql \
  -d '{"query":"mutation { stixBundleImport(file: ...) { id } }"}'
```

## pycti Python Library

```python
from pycti import OpenCTIApiClient

api = OpenCTIApiClient(url="http://localhost:8080", token="TOKEN")

# Create threat actor
api.threat_actor.create(name="APT-X", description="Description")

# List indicators
indicators = api.indicator.list(first=50)

# Import STIX bundle
api.stix2.import_bundle_from_json(bundle_json)

# Create relationship
api.stix_core_relationship.create(
    fromId=actor_id, toId=malware_id,
    relationship_type="uses",
)
```

## MISP REST API

**Base URL:** `https://misp.local/`

### Create Event
```bash
curl -X POST -H "Authorization: MISP_KEY" \
  -H "Content-Type: application/json" \
  https://misp.local/events \
  -d '{"Event":{"info":"Campaign Alpha","distribution":0,"threat_level_id":2}}'
```

### Add Attribute
```bash
curl -X POST -H "Authorization: MISP_KEY" \
  -H "Content-Type: application/json" \
  https://misp.local/attributes/add/EVENT_ID \
  -d '{"type":"ip-dst","value":"203.0.113.50","to_ids":true}'
```

### Search Attributes
```bash
curl -X POST -H "Authorization: MISP_KEY" \
  -H "Content-Type: application/json" \
  https://misp.local/attributes/restSearch \
  -d '{"value":"evil.com","type":"domain"}'
```

## pymisp Python Library

```python
from pymisp import PyMISP

misp = PyMISP("https://misp.local", "API_KEY", ssl=False)

# Create event
event = misp.new_event(info="Campaign Alpha", distribution=0)

# Add attributes
misp.add_attribute(event, {"type": "ip-dst", "value": "203.0.113.50"})

# Tag event
misp.tag(event, "tlp:amber")

# Search
results = misp.search(value="evil.com", type_attribute="domain")
```

## TAXII 2.1 Endpoints

### Discovery
```bash
curl -H "Accept: application/taxii+json;version=2.1" \
  https://cti-taxii.mitre.org/taxii2/
```

### List Collections
```bash
curl -H "Accept: application/taxii+json;version=2.1" \
  https://cti-taxii.mitre.org/taxii2/collections/
```

### Get Objects from Collection
```bash
curl -H "Accept: application/taxii+json;version=2.1" \
  "https://cti-taxii.mitre.org/stix/collections/enterprise-attack/objects/?match[type]=intrusion-set"
```

## STIX 2.1 Object Types

| SDO | Description |
|-----|------------|
| threat-actor | Named threat group or individual |
| malware | Malicious software family |
| attack-pattern | TTP mapped to ATT&CK |
| campaign | Time-bounded intrusion set |
| indicator | Pattern for detection (STIX patterning) |
| vulnerability | CVE or weakness |
| tool | Legitimate software abused by actors |

| SRO | Description |
|-----|------------|
| relationship | Links two SDOs (uses, targets, indicates) |
| sighting | Observed occurrence of an SDO |

| SCO | Description |
|-----|------------|
| ipv4-addr | IPv4 address observable |
| domain-name | Domain name observable |
| file | File with hash observables |
| url | URL observable |
