docs/api/CyberService.openapi.yaml
Rama main · réplica de lectura del repositorio original.
openapi: 3.1.0
info:
title: CyberService API
version: 1.0.0
security:
- WorldMonitorKey: []
- ApiKeyHeader: []
servers:
- url: https://api.worldmonitor.app
paths:
/api/cyber/v1/get-network-info:
get:
tags:
- CyberService
summary: GetNetworkInfo
description: Look up passive ASN, routing prefix and reverse-DNS context for a public IP on demand. Requires an authorized RIPEstat integration.
operationId: GetNetworkInfo
parameters:
- name: ip
in: query
description: IPv4 or IPv6 indicator.
required: false
example: "example"
schema:
type: string
- name: jmespath
in: query
description: |-
Optional JMESPath expression applied server-side to project or reduce the JSON response before it is returned (mirrors the MCP jmespath argument). Invalid expressions, expressions larger than 1024 UTF-8 bytes, or projections that exceed the 256 KB output cap return HTTP 400 with a {_jmespath_error, original_keys} envelope. Grammar and worked examples: https://www.worldmonitor.app/docs/mcp-jmespath.
required: false
example: "keys(@)"
schema:
type: string
responses:
"200":
description: Successful response
content:
application/json:
example:
"asns":
- "asn": 1
"holder": "example"
"hostnames":
- "WorldMonitor Analyst"
"ip": "example"
"isLessSpecific": true
"lookupAt": "2026-01-15T12:00:00Z"
schema:
$ref: '#/components/schemas/GetNetworkInfoResponse'
"400":
description: Validation error
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/ValidationError'
- $ref: '#/components/schemas/JmespathProjectionError'
"401":
description: Missing or invalid API key.
content:
application/json:
schema:
$ref: '#/components/schemas/UnauthorizedError'
"403":
description: API access requires an active subscription (the API key's subscription is inactive or expired).
headers:
X-Billing-Verification:
description: Present when the 403 is a billing-provider-confirmed subscription lapse (value subscription_lapsed, matching the body `code`).
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/ForbiddenError'
"429":
description: Rate limit exceeded.
headers:
X-RateLimit-Limit:
description: Maximum requests allowed in the active rate-limit window.
schema:
type: string
X-RateLimit-Remaining:
description: Requests remaining in the active rate-limit window.
schema:
type: string
X-RateLimit-Reset:
description: Unix epoch milliseconds when the active rate-limit window resets.
schema:
type: string
Retry-After:
description: Seconds to wait before retrying the request.
schema:
type: string
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Error'
- $ref: '#/components/schemas/RateLimitError'
"503":
description: Service unavailable. Billing-verification responses include code and X-Billing-Verification; other gateway infrastructure failures use the generic GatewayError shape.
headers:
Retry-After:
description: Seconds to wait before retrying (1-60).
schema:
type: string
X-Billing-Verification:
description: Billing-verification state that produced this response (matches the body `code`).
schema:
type: string
X-Validation-Mode:
description: Present with value degraded when user API-key validation is temporarily unavailable.
schema:
type: string
X-RateLimit-Mode:
description: Present with value degraded when a fail-closed rate-limit dependency is unavailable.
schema:
type: string
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/BillingVerificationError'
- $ref: '#/components/schemas/GatewayError'
default:
description: Gateway or handler error response.
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Error'
- $ref: '#/components/schemas/GatewayError'
/api/cyber/v1/list-cyber-threats:
get:
tags:
- CyberService
summary: ListCyberThreats
description: Browse cached cyber threat indicators by type, source and minimum severity, with cursor pagination and indicator details for threat intelligence investigation.
operationId: ListCyberThreats
parameters:
- name: start
in: query
description: |-
Start of time range (inclusive), Unix epoch milliseconds.
Accepted but currently ignored; no-op until this handler supports the parameter.
required: false
example: "1717200000000"
schema:
type: string
format: int64
- name: end
in: query
description: |-
End of time range (inclusive), Unix epoch milliseconds.
Accepted but currently ignored; no-op until this handler supports the parameter.
required: false
example: "1717200000000"
schema:
type: string
format: int64
- name: page_size
in: query
description: Maximum items per page (1-100).
required: false
example: 25
schema:
type: integer
format: int32
- name: cursor
in: query
description: Cursor for next page.
required: false
example: "next-page-token"
schema:
type: string
- name: type
in: query
description: Optional threat type filter.
required: false
example: "CYBER_THREAT_TYPE_C2_SERVER"
schema:
type: string
enum:
- 'CYBER_THREAT_TYPE_C2_SERVER'
- 'CYBER_THREAT_TYPE_MALWARE_HOST'
- 'CYBER_THREAT_TYPE_PHISHING'
- 'CYBER_THREAT_TYPE_MALICIOUS_URL'
- name: source
in: query
description: Optional source filter.
required: false
example: "CYBER_THREAT_SOURCE_FEODO"
schema:
type: string
enum:
- 'CYBER_THREAT_SOURCE_FEODO'
- 'CYBER_THREAT_SOURCE_URLHAUS'
- 'CYBER_THREAT_SOURCE_C2INTEL'
- 'CYBER_THREAT_SOURCE_OTX'
- 'CYBER_THREAT_SOURCE_ABUSEIPDB'
- name: min_severity
in: query
description: Optional minimum criticality filter.
required: false
example: "CRITICALITY_LEVEL_LOW"
schema:
type: string
enum:
- 'CRITICALITY_LEVEL_LOW'
- 'CRITICALITY_LEVEL_MEDIUM'
- 'CRITICALITY_LEVEL_HIGH'
- 'CRITICALITY_LEVEL_CRITICAL'
- name: jmespath
in: query
description: |-
Optional JMESPath expression applied server-side to project or reduce the JSON response before it is returned (mirrors the MCP jmespath argument). Invalid expressions, expressions larger than 1024 UTF-8 bytes, or projections that exceed the 256 KB output cap return HTTP 400 with a {_jmespath_error, original_keys} envelope. Grammar and worked examples: https://www.worldmonitor.app/docs/mcp-jmespath.
required: false
example: "keys(@)"
schema:
type: string
responses:
"200":
description: Successful response
content:
application/json:
example:
"pagination":
"nextCursor": "next-page-token"
"totalCount": 1
"threats":
- "country": "US"
"firstSeenAt": 1717200000000
"id": "example-id"
"indicator": "example"
"indicatorType": "CYBER_THREAT_INDICATOR_TYPE_IP"
"lastSeenAt": 1717200000000
schema:
$ref: '#/components/schemas/ListCyberThreatsResponse'
"400":
description: Validation error
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/ValidationError'
- $ref: '#/components/schemas/JmespathProjectionError'
"401":
description: Missing or invalid API key.
content:
application/json:
schema:
$ref: '#/components/schemas/UnauthorizedError'
"403":
description: API access requires an active subscription (the API key's subscription is inactive or expired).
headers:
X-Billing-Verification:
description: Present when the 403 is a billing-provider-confirmed subscription lapse (value subscription_lapsed, matching the body `code`).
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/ForbiddenError'
"429":
description: Rate limit exceeded.
headers:
X-RateLimit-Limit:
description: Maximum requests allowed in the active rate-limit window.
schema:
type: string
X-RateLimit-Remaining:
description: Requests remaining in the active rate-limit window.
schema:
type: string
X-RateLimit-Reset:
description: Unix epoch milliseconds when the active rate-limit window resets.
schema:
type: string
Retry-After:
description: Seconds to wait before retrying the request.
schema:
type: string
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Error'
- $ref: '#/components/schemas/RateLimitError'
"503":
description: Service unavailable. Billing-verification responses include code and X-Billing-Verification; other gateway infrastructure failures use the generic GatewayError shape.
headers:
Retry-After:
description: Seconds to wait before retrying (1-60).
schema:
type: string
X-Billing-Verification:
description: Billing-verification state that produced this response (matches the body `code`).
schema:
type: string
X-Validation-Mode:
description: Present with value degraded when user API-key validation is temporarily unavailable.
schema:
type: string
X-RateLimit-Mode:
description: Present with value degraded when a fail-closed rate-limit dependency is unavailable.
schema:
type: string
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/BillingVerificationError'
- $ref: '#/components/schemas/GatewayError'
default:
description: Gateway or handler error response.
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/Error'
- $ref: '#/components/schemas/GatewayError'
components:
securitySchemes:
WorldMonitorKey:
type: apiKey
in: header
name: X-WorldMonitor-Key
description: User-issued WorldMonitor API key.
ApiKeyHeader:
type: apiKey
in: header
name: X-Api-Key
description: Alias header for the WorldMonitor API key (X-WorldMonitor-Key).
schemas:
JmespathProjectionError:
description: Returned when a REST jmespath projection is invalid or exceeds the expression/output byte limits.
properties:
_jmespath_error:
description: Projection error discriminator and details.
type: string
original_keys:
description: Top-level keys or shape of the unprojected response.
items:
type: string
type: array
required:
- _jmespath_error
- original_keys
type: object
UnauthorizedError:
type: object
properties:
error:
type: string
description: Human-readable error message.
required:
- error
description: Returned when the API key is missing, malformed, or lacks current API access.
Error:
type: object
properties:
message:
type: string
description: Error message (e.g., 'user not found', 'database connection failed')
description: Error is returned when a handler encounters an error. It contains a simple error message that the developer can customize.
BillingVerificationError:
type: object
description: "Returned with HTTP 503 when paid access cannot be confirmed right now: the billing provider is re-verifying a recently expired subscription, or the entitlement backend is unreachable. Retryable — honor Retry-After."
properties:
error:
type: string
description: Human-readable billing-verification failure reason.
code:
type: string
enum:
- renewal_verification_pending
- renewal_verification_failed
- entitlement_verification_unavailable
description: Machine-readable billing-verification state, mirrored in the X-Billing-Verification response header.
requiredTier:
type: integer
format: int32
description: Minimum entitlement tier required for this endpoint, when the denial came from a tier gate.
required:
- error
- code
InvalidRequestBodyError:
type: object
description: Returned when a JSON POST request body is empty or malformed.
properties:
message:
type: string
description: Invalid request body
required:
- message
GatewayError:
type: object
description: Returned by gateway infrastructure errors before an RPC handler runs, such as origin, routing, method, authentication, or quota checks.
properties:
error:
oneOf:
- type: string
- type: object
additionalProperties: true
description: Gateway error reason or structured gateway failure details.
required:
- error
RateLimitError:
type: object
description: Returned when a gateway or handler rate limit rejects the request.
properties:
error:
type: string
description: Human-readable rate-limit failure reason.
required:
- error
ForbiddenError:
type: object
properties:
error:
type: string
description: Human-readable entitlement failure reason.
code:
type: string
enum:
- subscription_lapsed
description: Machine-readable denial code, present when the 403 is a billing-provider-confirmed subscription lapse (mirrored in the X-Billing-Verification response header).
requiredTier:
type: integer
format: int32
description: Minimum entitlement tier required for this endpoint.
currentTier:
type: integer
format: int32
description: Caller entitlement tier when known.
planKey:
type: string
description: Caller plan key when known.
required:
- error
description: Returned when a PRO-gated endpoint denies access because the caller has no resolved authenticated user, entitlements cannot be verified, or the caller lacks the required entitlement tier.
FieldViolation:
type: object
properties:
field:
type: string
description: The field path that failed validation (e.g., 'user.email' for nested fields). For header validation, this will be the header name (e.g., 'X-API-Key')
description:
type: string
description: Human-readable description of the validation violation (e.g., 'must be a valid email address', 'required field missing')
required:
- field
- description
description: FieldViolation describes a single validation error for a specific field.
ValidationError:
type: object
properties:
violations:
type: array
items:
$ref: '#/components/schemas/FieldViolation'
description: List of validation violations
required:
- violations
description: ValidationError is returned when request validation fails. It contains a list of field violations describing what went wrong.
GetNetworkInfoRequest:
type: object
properties:
ip:
type: string
description: IPv4 or IPv6 indicator.
description: GetNetworkInfoRequest selects a literal public IP; domains and URLs are not resolved.
GetNetworkInfoResponse:
type: object
properties:
status:
type: string
description: available, partial, no_data, unavailable, disabled, invalid, or rate_limited.
ip:
type: string
description: Canonical queried IP address.
asns:
type: array
items:
$ref: '#/components/schemas/NetworkAsn'
prefix:
type: string
description: Reported routing prefix, not an allocated/registered network.
isLessSpecific:
type: boolean
description: True if RIPEstat aligned the result to a broader prefix.
hostnames:
type: array
items:
type: string
description: Reverse-DNS hostnames, not proof of ownership.
lookupAt:
type: string
description: Time the enrichment was retrieved, ISO 8601; preserved on cache hits.
routingAt:
type: string
description: Provider routing-data time, ISO 8601, if supplied.
description: GetNetworkInfoResponse separates passive network context from threat observations.
NetworkAsn:
type: object
properties:
asn:
type: integer
minimum: 0
format: int32
description: Autonomous system number.
holder:
type: string
description: RIPEstat-reported holder; empty when unavailable.
description: NetworkAsn is a routing origin and its reported ASN holder, not an attacker identity.
ListCyberThreatsRequest:
type: object
properties:
start:
type: integer
format: int64
description: |-
Start of time range (inclusive), Unix epoch milliseconds.
Accepted but currently ignored; no-op until this handler supports the parameter.. Warning: Values > 2^53 may lose precision in JavaScript
end:
type: integer
format: int64
description: |-
End of time range (inclusive), Unix epoch milliseconds.
Accepted but currently ignored; no-op until this handler supports the parameter.. Warning: Values > 2^53 may lose precision in JavaScript
pageSize:
type: integer
format: int32
description: Maximum items per page (1-100).
cursor:
type: string
description: Cursor for next page.
type:
type: string
enum:
- CYBER_THREAT_TYPE_UNSPECIFIED
- CYBER_THREAT_TYPE_C2_SERVER
- CYBER_THREAT_TYPE_MALWARE_HOST
- CYBER_THREAT_TYPE_PHISHING
- CYBER_THREAT_TYPE_MALICIOUS_URL
description: |-
CyberThreatType represents the classification of a cyber threat.
Maps to TS union: 'c2_server' | 'malware_host' | 'phishing' | 'malicious_url'.
source:
type: string
enum:
- CYBER_THREAT_SOURCE_UNSPECIFIED
- CYBER_THREAT_SOURCE_FEODO
- CYBER_THREAT_SOURCE_URLHAUS
- CYBER_THREAT_SOURCE_C2INTEL
- CYBER_THREAT_SOURCE_OTX
- CYBER_THREAT_SOURCE_ABUSEIPDB
description: |-
CyberThreatSource represents the intelligence source of a cyber threat.
Maps to TS union: 'feodo' | 'urlhaus' | 'c2intel' | 'otx' | 'abuseipdb'.
minSeverity:
type: string
enum:
- CRITICALITY_LEVEL_UNSPECIFIED
- CRITICALITY_LEVEL_LOW
- CRITICALITY_LEVEL_MEDIUM
- CRITICALITY_LEVEL_HIGH
- CRITICALITY_LEVEL_CRITICAL
description: |-
CriticalityLevel represents a four-tier criticality classification for cyber and risk domains.
Maps to existing TS union: 'low' | 'medium' | 'high' | 'critical'.
description: ListCyberThreatsRequest specifies filters for retrieving cyber threat indicators.
ListCyberThreatsResponse:
type: object
properties:
threats:
type: array
items:
$ref: '#/components/schemas/CyberThreat'
pagination:
$ref: '#/components/schemas/PaginationResponse'
description: ListCyberThreatsResponse contains cyber threats matching the request.
CyberThreat:
type: object
properties:
id:
type: string
minLength: 1
description: Unique threat identifier.
type:
type: string
enum:
- CYBER_THREAT_TYPE_UNSPECIFIED
- CYBER_THREAT_TYPE_C2_SERVER
- CYBER_THREAT_TYPE_MALWARE_HOST
- CYBER_THREAT_TYPE_PHISHING
- CYBER_THREAT_TYPE_MALICIOUS_URL
description: |-
CyberThreatType represents the classification of a cyber threat.
Maps to TS union: 'c2_server' | 'malware_host' | 'phishing' | 'malicious_url'.
source:
type: string
enum:
- CYBER_THREAT_SOURCE_UNSPECIFIED
- CYBER_THREAT_SOURCE_FEODO
- CYBER_THREAT_SOURCE_URLHAUS
- CYBER_THREAT_SOURCE_C2INTEL
- CYBER_THREAT_SOURCE_OTX
- CYBER_THREAT_SOURCE_ABUSEIPDB
description: |-
CyberThreatSource represents the intelligence source of a cyber threat.
Maps to TS union: 'feodo' | 'urlhaus' | 'c2intel' | 'otx' | 'abuseipdb'.
indicator:
type: string
description: Threat indicator value (IP, domain, or URL).
indicatorType:
type: string
enum:
- CYBER_THREAT_INDICATOR_TYPE_UNSPECIFIED
- CYBER_THREAT_INDICATOR_TYPE_IP
- CYBER_THREAT_INDICATOR_TYPE_DOMAIN
- CYBER_THREAT_INDICATOR_TYPE_URL
description: |-
CyberThreatIndicatorType represents the type of threat indicator.
Maps to TS union: 'ip' | 'domain' | 'url'.
location:
$ref: '#/components/schemas/GeoCoordinates'
country:
type: string
description: Country of origin (ISO 3166-1 alpha-2).
severity:
type: string
enum:
- CRITICALITY_LEVEL_UNSPECIFIED
- CRITICALITY_LEVEL_LOW
- CRITICALITY_LEVEL_MEDIUM
- CRITICALITY_LEVEL_HIGH
- CRITICALITY_LEVEL_CRITICAL
description: |-
CriticalityLevel represents a four-tier criticality classification for cyber and risk domains.
Maps to existing TS union: 'low' | 'medium' | 'high' | 'critical'.
malwareFamily:
type: string
description: Associated malware family, if known.
tags:
type: array
items:
type: string
description: Descriptive tags.
firstSeenAt:
type: integer
format: int64
description: 'First seen time, as Unix epoch milliseconds.. Warning: Values > 2^53 may lose precision in JavaScript'
lastSeenAt:
type: integer
format: int64
description: 'Last seen time, as Unix epoch milliseconds.. Warning: Values > 2^53 may lose precision in JavaScript'
required:
- id
description: |-
CyberThreat represents a cyber threat indicator aggregated from multiple sources.
Sources include Feodo Tracker, URLhaus, OTX, AbuseIPDB, and C2Intel.
GeoCoordinates:
type: object
properties:
latitude:
type: number
maximum: 90
minimum: -90
format: double
description: Latitude in decimal degrees (-90 to 90).
longitude:
type: number
maximum: 180
minimum: -180
format: double
description: Longitude in decimal degrees (-180 to 180).
description: GeoCoordinates represents a geographic location using WGS84 coordinates.
PaginationResponse:
type: object
properties:
nextCursor:
type: string
description: Cursor for fetching the next page. Empty string indicates no more pages.
totalCount:
type: integer
format: int32
description: Total count of items matching the query, if known. Zero if the total is unknown.
description: PaginationResponse contains pagination metadata returned alongside list results.