openapi: 3.0.3 info: title: Axur Platform API description: | Last edited on October 23, 2026. # Introduction **Axur** provides HTTP APIs that allow external scripts and applications to access and manipulate our services programmatically. This document describes the currently supported API operations within Axur Platform. If you have any questions or need help implementing specific use-cases, please contact support through [help@axur.com](mailto:help@axur.com) or [https://help.axur.com/en/](https://help.axur.com/en/). version: 1.0.87 contact: { } servers: - url: https://api.axur.com/gateway/1.0/api security: - bearerAuth: [ ] tags: - name: Customers description: | Customers helps you create and manage MSSP customer tenants. ## Before you start - You need a valid Bearer token (see [Authentication](#tag/Authentication)). - Your user must have `MSSP Partner Manager` permission. ## Quick start (3 calls) 1. List customers and keys: [Retrieve Customers](#operation/getCustomersLite) 2. Create customer: `POST /customers-api/customer` 3. Suspend/Resume tenant when needed ## Common integration flow - First integration: create customer with minimum payload (`customer.name`) and confirm returned `customerKey`. - Operational lifecycle: suspend and resume tenants based on billing or operational status. - Use [Retrieve Customers](#operation/getCustomersLite) whenever your flow needs a valid `customerKey`. ## Troubleshooting quick map - `400`: request payload format is invalid. - `401`: missing/invalid Bearer token. - `403`: user does not have required permission level. - `404`: tenant key not found. - name: Assets description: | Assets provides operations to create, retrieve and manage customer assets, including monitoring, properties, logos and deactivation flows. ## Before you start - You need a valid Bearer token (see [Authentication](#tag/Authentication)). - Confirm the target tenant (`customerKey`) before creating or editing assets. To find your `customerKey`, call `GET /customers-api/customers` (see [Retrieve Customers](#operation/getCustomersLite)). Alternatively, the `customerKey` is returned in the response of any asset creation or retrieval call. ## Choose the correct create endpoint - `POST /assets-api/asset`: use when the tenant is the authenticated user's main tenant. - `POST /assets-api/customers/{customerKey}/asset`: use when you explicitly manage a specific tenant. ## Common integration flow 1. Create asset 2. Validate available monitoring (`GET /assets-api/customers/{customerKey}/monitoring`) 3. Add or remove monitoring/properties 4. Upload or remove logos (brand only), or upload face pictures (VIP only) 5. Enable capabilities and upload brand registry files (brand only) or the takedown selfie holding document (VIP only) 6. Deactivate when needed ## Troubleshooting quick map - `400`: invalid payload, unsupported monitoring/property, or invalid query/path value. - `403`: missing/invalid Bearer token, or permission denied for this operation. - `404`: customer/asset not found. - `409`: conflict with current resource state. ## Supported asset types - `BRAND` - `DOMAIN` - `VIP` - `THIRD_PARTY_PAGE` - `APP` - `TRACKING_TOKEN` - `BIN` - `IP` - `CUSTOMER_VENDOR` ## Monitoring examples by type - `BRAND`: `phishing`, `malware`, `paid-search`, `fraudulent-brand-use`, `fake-social-media-profile`, `fake-mobile-app`, `similar-domain-name`, `unauthorized-distribution`, `unauthorized-sale`, `dw-activity`, `other-sensitive-data` - `DOMAIN`: `credentials:user`, `credentials:employee`, `code-secret-leak`, `mentions`, `cti:infrastructure` - `THIRD_PARTY_PAGE`: `credentials:employee` - `APP`: `credentials:user` - `TRACKING_TOKEN`: `database-exposure` - `BIN`: `credit-card-exposure` - `IP`: `cti:infrastructure` - `VIP`: `executives` - `CUSTOMER_VENDOR`: `supply-chain-intel` ## Monitoring prerequisites Some monitoring types require specific properties to be set on the asset **before** the monitoring can be added. Attempting to add the monitoring without the required property returns a `400` error. | Monitoring | Asset type | Required property | |---|---|---| | `fake-mobile-app` | `BRAND` | `appIdsGooglePlay` (array of Google Play application IDs) | ## Property examples by type Property keys use **camelCase**. - `BRAND`: `officialWebsite`, `brandSize`, `nameVariations`, `tins`, `appIdsGooglePlay`, `primaryLocale`, `additionalLocale` - `DOMAIN`: `employeeCredentialUniquenessCriteria`, `userCredentialUniquenessCriteria` - `THIRD_PARTY_PAGE`: `employeeCredentialUniquenessCriteria` - `APP`: `userCredentialUniquenessCriteria` - `TRACKING_TOKEN`: `tokenName` - `BIN`: `incompleteCreditCardEnabled`, `creditCardUniquenessCriteria` - `VIP`: `vipNameVariations`, `vipEmails`, `vipPhones`, `vipAssociatedBrand`, `vipLinkedinProfiles`, `vipInstagramProfiles`, `vipFacebookProfiles`, `vipTwitterProfiles`, `vipOtherSocialProfiles`, `vipNameSimilarityEnabled`, `vipCreditCardSlots`, `vipPassportNumbers`, `vipPersonalIdNumber`, `vipTaxpayerId`, `vipDriversLicenseNumber` Sensitive VIP values (credit cards and identity documents) are returned masked. ## Possible uniqueness criteria property values Uniqueness criteria properties (`employeeCredentialUniquenessCriteria`, `userCredentialUniquenessCriteria`, `creditCardUniquenessCriteria`) can be set for `DOMAIN`, `THIRD_PARTY_PAGE`, `APP`, and `BIN` assets. Below are the available choices for each: - For `DOMAIN` and `THIRD_PARTY_PAGE` assets, property value can be set to: - `username:password`: Creates a new detection only if the same username and password have never leaked before, regardless of where they appear. - `username:password:accessdomain`: Creates a new detection only when the leak originates from a different domain. - `username:password:accesshost`: Creates a new detection when the server (host) is different. The URL path does not affect detection. - `username:password:accessurl` (default): Creates a new detection for each distinct URL where the credentials were used. - For `APP` assets, property value can be set to: - `username:password`: Creates a new detection only if the same username and password have never leaked before, regardless of where they appear. - `username:password:appid`: Creates a new detection when the app ID is different. The URL path does not affect detection. - `username:password:appurl` (default): Creates a new detection for each distinct URL where the credentials were used. - For `BIN` assets, property value can be set to: - `none`: Creates a new detection every time. No deduplication is applied. - `card:number:cvv:exp`: Creates a new detection only if the card number, CVV, and expiration (month/year) together have never been seen before. - `card:number`: A new detection only if the same card number has never been seen before. > **Note:** `logos` and `brandRegistryFiles` are managed via their own dedicated endpoints (`POST /assets/{assetKey}/logos` and `POST /assets/{assetKey}/capabilities/takedown/brand-registry-files`) and should not be sent as properties in create or update requests. ## Required properties by type Some asset types require specific properties to be included in the `properties` object at creation time. Omitting required properties returns a `400` error. - **`BRAND`**: `nameVariations` (array of strings, at least one value) and `primaryLocale` (array of locale strings, e.g. `["BR:pt"]`) are **required**. - Other types: no required properties. ## Capabilities for BRAND Capabilities represent optional features that can be enabled on an asset. Currently, the only supported capability is `takedown`. **Note:** The customer must have the takedown capability licensed. Enabling takedown on an asset whose customer does not have this capability will return `403`. ### Takedown properties When enabling takedown on a BRAND asset, there are two scenarios depending on whether the brand has a formal registration or not: - **Brand with registration** — provide the registration details (`registrationNumber`, `registrationUrl`, etc.). This is the default behavior when `noBrandRegistration` is omitted. - **Brand without registration** — set `noBrandRegistration` to `true` and provide `legalExistenceDetails` instead of registration fields. **Always required (both scenarios):** - `country`: ISO 3166-1 alpha-2 country code (e.g., `BR`, `US`, `PT`). - `corporateName`: legal corporate name. Cannot be blank. **Required when the brand has a registration** (default — when `noBrandRegistration` is omitted or `false`)**:** - `registrationNumber`: brand registration number. Cannot be blank. - `registrationUrl`: URL of the registration authority record. Must be a valid URL with scheme and host (e.g., `https://busca.inpi.gov.br/pePI/servlet/MarcasServletController?Action=detail&CodPedido=900000000`). URLs without protocol are auto-prefixed with `https://`. - `registrationCategory`: registration category (e.g., `25`, `35`). Cannot be blank. - `registrationOffice`: name of the registration office (e.g., `INPI`). Cannot be blank. **Required when the brand has NO registration** (`noBrandRegistration: true`)**:** - `noBrandRegistration`: set to `true` to indicate the brand has no formal registration. - `legalExistenceDetails`: a text explaining the legal existence of the brand without a formal registration. Cannot be blank. **Note:** When `noBrandRegistration` is `true`, any registration fields sent in the request (`registrationNumber`, `registrationUrl`, `registrationCategory`, `registrationOffice`) are silently ignored and not stored. This is not an error — the API automatically discards them. **Optional (social media URLs):** - `instagram`: must be a valid Instagram URL matching `https://instagram.com/...` or `https://www.instagram.com/...`. URLs without protocol are auto-prefixed with `https://`. - `facebook`: must be a valid Facebook URL matching `https://facebook.com/...` or `https://fb.com/...` (subdomains accepted). URLs without protocol are auto-prefixed with `https://`. - `tiktok`: must be a valid TikTok URL matching `https://tiktok.com/...` or `https://www.tiktok.com/...`. URLs without protocol are auto-prefixed with `https://`. - `x`: must be a valid X/Twitter URL matching `https://x.com/...` or `https://twitter.com/...` (both domains accepted). URLs without protocol are auto-prefixed with `https://`. Additionally, brand registry files (PDF) can be uploaded and managed via dedicated endpoints. ## Capabilities for VIP `VIP` assets also support the `takedown` capability, enabled and disabled through the same capability endpoints. VIP takedown takes no takedown properties, so send an empty body (`{}`) when enabling it. **Note:** The customer must have the takedown capability licensed. Enabling takedown on an asset whose customer does not have this capability will return `403`. ### Required documents Takedowns for a VIP accepts two documents: - **Selfie holding a document**: a photo of the VIP holding an identity document. Upload it with `POST /assets-api/assets/{assetKey}/capabilities/takedown/selfie-holding-document`. - **Document signed in SafeShare**: the authorization form the VIP signs in SafeShare. Generate the signing link with `POST /assets-api/assets/{assetKey}/safeshare-form` and send it to the VIP. ## Countries and locales currently allowed Locale-related properties (`primaryLocale`, `additionalLocale`) are currently validated for `BRAND` assets with the format: - `country:language` - Examples: `BR:pt`, `US:en`, `PT:pt-PT`, `TW:zh-TW` Meaning: - `country`: market/country scope in ISO 3166-1 alpha-2 format (2 letters). - `language`: language or language variant used in that market. Examples and meaning: - `BR:pt` = Brazil + Portuguese - `US:en` = United States + English - `GB:en-GB` = United Kingdom + English (UK) - `CA:en-CA` = Canada + English (Canada) - `PT:pt-PT` = Portugal + Portuguese (Portugal) - `MX:es` = Mexico + Spanish - `TW:zh-TW` = Taiwan + Traditional Chinese - `CN:zh-CN` = China + Simplified Chinese Locale values are not mapped by the API. Use the raw codes exactly as configured in backend allowlists. Allowed country codes and descriptions (full list): - `AD`: Andorra - `AE`: United Arab Emirates - `AF`: Afghanistan - `AG`: Antigua & Barbuda - `AI`: Anguilla - `AL`: Albania - `AM`: Armenia - `AO`: Angola - `AR`: Argentina - `AS`: American Samoa - `AT`: Austria - `AU`: Australia - `AZ`: Azerbaijan - `BA`: Bosnia & Herzegovina - `BD`: Bangladesh - `BE`: Belgium - `BF`: Burkina Faso - `BG`: Bulgaria - `BH`: Bahrain - `BI`: Burundi - `BJ`: Benin - `BN`: Brunei - `BO`: Bolivia - `BR`: Brazil - `BS`: Bahamas - `BT`: Bhutan - `BW`: Botswana - `BY`: Belarus - `BZ`: Belize - `CA`: Canada - `CD`: Congo - Kinshasa - `CF`: Central African Republic - `CG`: Congo - Brazzaville - `CH`: Switzerland - `CI`: Côte d'Ivoire - `CK`: Cook Islands - `CL`: Chile - `CM`: Cameroon - `CO`: Colombia - `CR`: Costa Rica - `CU`: Cuba - `CV`: Cape Verde - `CY`: Cyprus - `CZ`: Czechia - `DE`: Germany - `DJ`: Djibouti - `DK`: Denmark - `DM`: Dominica - `DO`: Dominican Republic - `DZ`: Algeria - `EC`: Ecuador - `EE`: Estonia - `EG`: Egypt - `ES`: Spain - `ET`: Ethiopia - `FI`: Finland - `FJ`: Fiji - `FM`: Micronesia - `FR`: France - `GA`: Gabon - `GB`: United Kingdom - `GE`: Georgia - `GH`: Ghana - `GI`: Gibraltar - `GL`: Greenland - `GM`: Gambia - `GP`: Guadeloupe - `GR`: Greece - `GT`: Guatemala - `GY`: Guyana - `HK`: Hong Kong SAR China - `HN`: Honduras - `HR`: Croatia - `HT`: Haiti - `HU`: Hungary - `ID`: Indonesia - `IE`: Ireland - `IL`: Israel - `IN`: India - `IQ`: Iraq - `IS`: Iceland - `IT`: Italy - `JM`: Jamaica - `JO`: Jordan - `JP`: Japan - `KE`: Kenya - `KG`: Kyrgyzstan - `KH`: Cambodia - `KI`: Kiribati - `KR`: South Korea - `KW`: Kuwait - `KZ`: Kazakhstan - `LA`: Laos - `LB`: Lebanon - `LI`: Liechtenstein - `LK`: Sri Lanka - `LS`: Lesotho - `LT`: Lithuania - `LU`: Luxembourg - `LV`: Latvia - `LY`: Libya - `MA`: Morocco - `MD`: Moldova - `MG`: Madagascar - `MK`: North Macedonia - `ML`: Mali - `MM`: Myanmar (Burma) - `MN`: Mongolia - `MS`: Montserrat - `MT`: Malta - `MU`: Mauritius - `MV`: Maldives - `MW`: Malawi - `MX`: Mexico - `MY`: Malaysia - `MZ`: Mozambique - `NA`: Namibia - `NE`: Niger - `NG`: Nigeria - `NI`: Nicaragua - `NL`: Netherlands - `NO`: Norway - `NP`: Nepal - `NR`: Nauru - `NU`: Niue - `NZ`: New Zealand - `OM`: Oman - `PA`: Panama - `PE`: Peru - `PG`: Papua New Guinea - `PH`: Philippines - `PK`: Pakistan - `PL`: Poland - `PR`: Puerto Rico - `PS`: Palestinian Territories - `PT`: Portugal - `PY`: Paraguay - `QA`: Qatar - `RO`: Romania - `RS`: Serbia - `RU`: Russia - `RW`: Rwanda - `SA`: Saudi Arabia - `SB`: Solomon Islands - `SC`: Seychelles - `SE`: Sweden - `SG`: Singapore - `SH`: St. Helena - `SI`: Slovenia - `SK`: Slovakia - `SL`: Sierra Leone - `SM`: San Marino - `SN`: Senegal - `SO`: Somalia - `SR`: Suriname - `SV`: El Salvador - `TD`: Chad - `TG`: Togo - `TH`: Thailand - `TJ`: Tajikistan - `TK`: Tokelau - `TL`: Timor-Leste - `TM`: Turkmenistan - `TN`: Tunisia - `TO`: Tonga - `TR`: Turkey - `TT`: Trinidad & Tobago - `TW`: Taiwan - `TZ`: Tanzania - `UA`: Ukraine - `UG`: Uganda - `US`: United States - `UY`: Uruguay - `UZ`: Uzbekistan - `VC`: St. Vincent & Grenadines - `VE`: Venezuela - `VG`: British Virgin Islands - `VI`: U.S. Virgin Islands - `VN`: Vietnam - `VU`: Vanuatu - `WS`: Samoa - `ZA`: South Africa - `ZM`: Zambia - `ZW`: Zimbabwe Allowed language codes and descriptions (full list): - `af`: Afrikaans - `ar`: Arabic - `be`: Belarusian - `bg`: Bulgarian - `ca`: Catalan - `cs`: Czech - `da`: Danish - `de`: German - `el`: Greek - `en`: English - `en-CA`: English (Canada) - `en-GB`: English (United Kingdom) - `en-US`: English (United States) - `eo`: Esperanto - `es`: Spanish - `es-LATAM`: Spanish (Latin America) - `et`: Estonian - `fa`: Persian - `fi`: Finnish - `fr`: French - `hi`: Hindi - `hr`: Croatian - `hu`: Hungarian - `hy`: Armenian - `id`: Indonesian - `is`: Icelandic - `it`: Italian - `lt`: Lithuanian - `iv`: Invariant Language (legacy/system code) - `iw`: Hebrew (legacy code; modern code: he) - `ja`: Japanese - `ko`: Korean - `nl`: Dutch - `no`: Norwegian - `pl`: Polish - `pt`: Portuguese - `pt-PT`: Portuguese (Portugal) - `ro`: Romanian - `ru`: Russian - `sk`: Slovak - `sl`: Slovenian - `sr`: Serbian - `sv`: Swedish - `sw`: Swahili - `th`: Thai - `tl`: Tagalog - `tr`: Turkish - `uk`: Ukrainian - `vi`: Vietnamese - `zh-CN`: Chinese (China) - `zh-TW`: Chinese (Taiwan) Property quantity limits for `BRAND`: - `nameVariations`: up to **3** values. - `primaryLocale`: up to **2** values, all sharing the same country prefix. - `additionalLocale`: up to **4** values, max **2** per country prefix. Exceeding any of these limits returns `400` with code `asset.property.quantityExceeded`. ## Example payloads BRAND: ```json { "type": "BRAND", "name": "AXUR", "monitoring": ["phishing", "malware"], "properties": { "officialWebsite": "https://www.axur.com", "brandSize": "enterprise", "nameVariations": ["axur security"], "primaryLocale": ["BR:pt"], "additionalLocale": ["US:en"] } } ``` DOMAIN: ```json { "type": "DOMAIN", "name": "axur.com", "monitoring": [ "credentials:user", "credentials:employee", "code-secret-leak", "mentions", "cti:infrastructure" ] } ``` TRACKING_TOKEN: ```json { "type": "TRACKING_TOKEN", "monitoring": ["database-exposure"], "properties": { "tokenName": "MAIL" } } ``` ## Error codes All error responses use the `AssetsApiError` schema with fields `code` (string), `message` (string) and optional `context` (object). The `code` field allows programmatic error handling beyond HTTP status codes. ### 400 — Bad Request | Code | Meaning | Endpoints | |------|---------|-----------| | `asset.category.invalid` | The asset type is not supported or not recognized. **Known issue:** the `message` field may contain an unresolved `%s` placeholder instead of the actual invalid value (e.g., `"Invalid asset category: '%s'."`). Use the `code` field for programmatic error handling. | Create asset | | `asset.name.invalid` | The asset name is invalid for the given type (e.g., `TRACKING_TOKEN` does not accept a name). | Create asset | | `asset.monitoring.invalid_for_category` | The requested monitoring is not compatible with the asset type. | Create asset, Add monitoring | | `asset.property.invalid_for_category` | The requested property is not compatible with the asset type. | Add properties | | `asset.property.quantityExceeded` | A property exceeds the maximum allowed quantity for the asset type (e.g., more than 3 `nameVariations`, more than 2 `primaryLocale`, or more than 4 `additionalLocale` for `BRAND`). | Create asset, Add properties | | `asset.missingRequiredProperty` | A required property for the asset type is missing (e.g., `nameVariations` for `BRAND`). | Create asset | | `param.invalid` | A generic request parameter is invalid. | All endpoints | | `pagination.invalid` | Pagination parameters (`page`, `pageSize`) are out of range or malformed. | List assets | | `request.json.malformed` | The request body is not valid JSON. | All endpoints that accept a body | | `asset.logo.invalid` | The uploaded logo file is invalid (wrong format, size, etc.). | Upload logo | | `asset.capability.invalid` | The requested capability is not recognized. | Enable/Disable capability | ### 403 — Forbidden | Code | Meaning | Endpoints | |------|---------|-----------| | `asset.permission.denied` | The caller does not have permission to access or modify this asset. Also returned when an asset is not found (secure response to prevent enumeration). | All asset-specific endpoints | | `customer.key.not_found` | The specified `customerKey` was not found or the caller has no access to it. | Create asset (with customerKey), Get monitoring | ### 409 — Conflict | Code | Meaning | Endpoints | |------|---------|-----------| | `asset.already.deactivated` | The asset is already deactivated. | Deactivate asset | | `asset.monitoring.already_exists` | The monitoring is already active on this asset. | Add monitoring | | `asset.monitoring.not_found` | The monitoring to remove does not exist on this asset. | Remove monitoring | **Note:** The error codes listed above are the most commonly encountered codes. Other codes may be returned in edge cases. Always check the `message` field for additional details. - name: Credit Management description: | Credit Management provides operations to retrieve customer credit settings, adjust monthly limits and generate usage reports. ## Before you start - You need a valid Bearer token (see [Authentication](#tag/Authentication)). - You need the target `customerKey`. If needed, call [Retrieve Customers](#operation/getCustomersLite). - Use `year` and `month` in numeric format when requested. Permission Level Needed: MSSP Partner Manager ## Common integration flow 1. Read settings (`GET /credit-management-api/customers/{customerKey}/settings`) 2. Update limit if needed (`PATCH /credit-management-api/customers/{customerKey}/limit/{monthlyLimit}`) 3. Retrieve monthly reports ## Troubleshooting quick map - `400`: missing/invalid path or query parameter (for example invalid month). - `401`: missing/invalid Bearer token. - `403`: permission denied for this operation. - `404`: customer or credit assignment not found. - `500`: unexpected server error. - name: Axur Platform API description: | Axur Platform provides HTTP APIs that allow external scripts and applications to access and manipulate tickets programmatically. Supported operations are described below. - name: Authentication description: |- Each API request must be authenticated using the Bearer scheme with a valid token. Authentication tokens may be obtained by API KEY: - An API KEY can be created via the AXUR platform, in my preferences under the [API KEY tab](https://one.axur.com/preferences?tab=api-keys). The following HTTP header is required for all authenticated requests: ``` Authorization: Bearer ```` **Important:** The placeholder `` in descriptions and examples that follow must be replaced by a valid authentication token. ## 🔐 API Key Lifecycle API keys are user-scoped and linked to the account that created them. - API keys are generated through the AXUR platform under **My Preferences → API KEY**. - Each API key is associated with a specific user account. - If a user is deactivated, blocked, or removed, all API keys created by that user are automatically revoked. - Revoked or invalid API keys will result in a `401 Unauthorized` response. - API keys may also be manually revoked at any time through the platform. ### Security Considerations - API keys must be treated as sensitive credentials and stored securely. - API keys should not be shared between users. - If an API key is compromised, it must be revoked immediately and replaced with a new one. ## bearerAuth | Security Scheme Type | HTTP Authorization Scheme | Bearer format | | :------------------: | :-----------------------: | :-----------: | | HTTP | bearer | "JWT" | - name: Permission levels description: |- Depending on the authenticated user's permission level, some operations may be forbidden. **Viewers** are not allowed to perform any state-changing operations, such as adding comments or executing lifecycle actions. Read-only users may be restricted to certain assets and ticket types. **Practitioners** have all permissions of read-only users and additionally are allowed to perform basic state-changing operations, such as creating and discarding tickets. Practitioners may be restricted to certain assets and ticket types. **Experts** have all permissions of practitioners and additionally are allowed to perform advanced state-changing operations, such as requesting takedowns. Experts may be restricted to certain assets and ticket types. **Customs** have their permissions assigned by Managers and can only perform the actions related to the features they are assigned to. The features Custom users are allowed to access can be seen by Managers at [My Team](https://one.axur.com/userManagement). **Managers** have all permissions of experts and additionally are allowed to manage team users and view their activity history. Managers always have access to all assets and ticket types. - name: Tickets Api Operations description: |- ## Examples of usage Get all takedowns performed in the month of July using the Arizona (USA) time zone, with complete information of the tickets present in the response: ``` https://api.axur.com/gateway/1.0/api/tickets-api/tickets?type=phishing&takedown.request.date=ge:2024-07-01&takedown.request.date=le:2024-07-31&sortBy=takedown.request.date&page=1&pageSize=200&order=asc&timezone=-07:00 ``` Get all phishing tickets opened in the month of July using the Arizona (USA) time zone with only ticket fields and attachments ``` https://api.axur.com/gateway/1.0/api/tickets-api/tickets?type=phishing&open.date=ge:2024-07-01&open.date=le:2024-07-31&sortBy=open.date&page=1&pageSize=200&order=asc&timezone=-07:00&include=fields,attachments ``` ## Operators For date or numeric fields, you can use the following operators: - gt: - Greater than - lt: - Less than - ge: - Greater than or equal - le: - Less than or equal Operators should be used as prefixes for values ​​used in query parameters, for example: - takedown.request.date=ge:2024-07-01 - takedown.request.date=le:2024-07-31 For text fields, you can use the following operators: - contains: - Contains Text Operators should be used as prefixes for values ​​used in query parameters, for example: - ticket.reference=contains:instagram.com ## Fields supported by filters |Key|Type|Comments| |----------|-------------|----------| |ticket.key|string|| |ticket.customer|string|For user with access to multiple tenants, this parameter is required when searching for a child tenant's tickets| |ticket.reference|string|| |ticket.creation.collection|integer|| |ticket.creation.collector|string|| |ticket.creation.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |ticket.creation.originator|string|| |ticket.creation.user|integer|| |ticket.creation.customer|string|| |ticket.investigation|boolean|| |ticket.investigation.closed.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |ticket.investigation.interrupted.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |ticket.investigation.open.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |ticket.investigation.reopen.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |ticket.last-update.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |ticket.reup.expires|integer|| |ticket.reup.state|string|| |ticket.tags|string|| |ad.product.available-stock|integer|| |ad.product.currency|string|| |ad.product.location|string|| |ad.product.price|decimal|| |ad.seller.username|string|| |alleged.exposed.birthdate|integer|| |alleged.exposed.documents|string|| |assets|asset|| |category|string|| |close.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |creation.collection|integer|| |creation.collector|string|| |creation.customer|string|| |creation.originator|string|| |creation.user|integer|| |credential.first-seen|integer|| |credential.login-source|string|| |credential.password.type|string|| |credential.password.value|string|| |credential.password.value.masked|string|| |credential.username|string|| |criticality|enum|["high", "low", "medium"]| |document.type|string|| |document.value.masked|string|| |document.value.plain|string|| |documents.masked|string|| |documents.plain|string|| |documents.type|string|| |domain|string|| |domain.registrar|string|| |external-author-id|string|| |external-channel-id|string|| |group|string|| |host|string|| |incident.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |ip|string|| |isp|string|| |leak.sources|string|| |matched.resource|string|| |media.type|string|| |mention.uuid|string|| |message.group.name|string|| |open.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |platform|string|| |prediction.brand-logo|decimal|| |prediction.brand-name|decimal|| |prediction.has-authentication-form|boolean|| |prediction.languages|string|| |prediction.main-language|string|| |prediction.risk|decimal|| |prediction.threat-content|enum|["EXPOSED_CREDENTIAL", "CPF_CONSULT", "CVE", "BOT_MESSAGE", "BIN_CONSULT", "UNDEFINED", "SUSPICIOUS_MESSAGE", "FRAUD_TOOLS", "EXPOSED_CREDIT_CARD", "DATA_SALE"]| |profile|string|| |quarantine.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |quarantine.last.updated.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |quarantine.unread|boolean|| |resolution|string|| |resolution.reason|string|| |source.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |status|string|["open","quarantine","incident","treatment","closed"]| |takedown|boolean|| |takedown.cancel.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |takedown.close.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |takedown.close.type|enum|["auto", "manual"]| |takedown.first-notification.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |takedown.notification.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |takedown.notification.last.type|enum|["auto", "manual"]| |takedown.request.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |takedown.resolution|string|| |takedown.resolution.reason|string|| |takedown.reup|boolean|| |takedown.submission.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |takedown.uptime|integer|| |takedown.verification.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |takedown.verification.last.type|enum|["auto", "manual"]| |threat-content|enum|["EXPOSED_CREDENTIAL", "CPF_CONSULT", "CVE", "BOT_MESSAGE", "BIN_CONSULT", "UNDEFINED", "SUSPICIOUS_MESSAGE", "FRAUD_TOOLS", "EXPOSED_CREDIT_CARD", "DATA_SALE"]| |token.creation.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |treatment.date|date|Supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33".| |treatment.internal|boolean|| |treatment.type|enum|["internal", "axur"]| |treatment.uptime|integer|| |type|detection-type|["code-secret-leak", "other-sensitive-data", "database-exposure", "fraudulent-brand-use", "phishing", "paid-search", "malware", "fake-social-media-profile", "similar-domain-name", "fake-mobile-app", "unauthorized-sale", "unauthorized-distribution", "executive-fake-social-media-profile", "executive-personalinfo-leak", "executive-credential-leak", "executive-mobile-phone", "executive-card-leak", "dw-activity", "data-exposure-message", "data-sale-message", "fraud-tool-scheme-message", "suspicious-activity-message", "infrastructure-exposure", "data-exposure-website", "data-sale-website", "fraud-tool-scheme-website", "suspicious-activity-website", "ransomware-attack"]| ## CSV Ticket Extraction Example Simple example of extracting tickets to a csv file. Standard authentication is used and with date filters initially set to two hours ago. * Remember that the elements in the tickets_fields array are just examples. Feel free to change them to whatever fields suit your needs. __Python__ This example uses Python 3.7 as programming language. ``` import math import requests import json import datetime import csv API_KEY = "" ticket_fields = ['ticketKey', 'reference', 'type', 'assets', 'open.date', 'status', 'resolution', 'resolution.reason', 'close.date'] _TICKET_FILTERS_QUERY = "open.date=ge:{}&open.date=le:{}&sortBy={}&page={}&pageSize={}&order=asc&utc=-03:00" _TICKETS_API = "tickets-api/tickets?" CURRENT_TIME = datetime.datetime.now() ONE_HOUR_AGO = CURRENT_TIME - datetime.timedelta(seconds=3600) SORT_FIELD = "open.date" PAGES = 1 TICKET_PER_PAGE = 50 FILE_NAME = 'ticket_sheet' def endpoint_get(endpoint: str, headers: dict = None) -> dict: url = _get_url_for_endpoint(endpoint) out_headers = _get_headers(headers) response = requests.get(url, headers=out_headers) return _process_response(response) def _get_headers(input_headers: dict = None) -> dict: out_header = {} if input_headers: out_header = input_headers.copy() out_header["Content-Type"] = "application/json" if API_KEY: out_header["Authorization"] = str.format("Bearer {}", API_KEY) return out_header def _process_response(response) -> dict: if 200 <= response.status_code < 300: if response.text: return json.loads(response.text) else: return None response.raise_for_status() def _get_url_for_endpoint(endpoint: str): return str.format("https://api.axur.com/gateway/1.0/api/{}", endpoint) def get_ticket_fields(tickets_key: list): for ticket_key in tickets_key: print(f'DEBUG: AXUR: Fetch ticket {ticket_key} details') def get_ticket_filter(page: int, ticket_per_page: int): formated_initial_time = ONE_HOUR_AGO.strftime('%Y-%m-%dT%H:%M:%S') formated_final_time = CURRENT_TIME.strftime('%Y-%m-%dT%H:%M:%S') endpoint = str.format(_TICKETS_API + _TICKET_FILTERS_QUERY, formated_initial_time, formated_final_time, SORT_FIELD, page, ticket_per_page) return endpoint_get(endpoint) def tickets_to_csv(ticket: dict): with open(f'{FILE_NAME}.csv', 'a', encoding='UTF8', newline='') as f: writer = csv.writer(f) fields = [] for field in ticket_fields: fields.append(get_ticket_field_value(ticket, field)) writer.writerow(fields) def get_ticket_field_value(ticket: dict, field: str): for key, nested_dict in ticket.items(): if isinstance(nested_dict, dict) and field in nested_dict: return nested_dict[field] return None def main(): result = get_ticket_filter(PAGES, TICKET_PER_PAGE) total = result['pageable']['total'] total_pages = math.ceil(total/TICKET_PER_PAGE) print(f'DEBUG: AXUR: Total tickets {total} and total pages {total_pages}') get_all_tickets(total_pages) def get_all_tickets(total_pages: int): for page in range(1, total_pages+1): print(f'DEBUG: AXUR: Fetch page {page} from {total_pages}') result = get_ticket_filter(page, TICKET_PER_PAGE) process_tickets_key(result) tickets = result['tickets'] for ticket in tickets: tickets_to_csv(ticket) def process_tickets_key(result): tickets_key_list = [] for ticket_key in result['tickets']: tickets_key_list.append(ticket_key['ticket']['ticketKey']) get_ticket_fields(tickets_key_list) main() ``` __Bash cURL__ Example using bash script with cURL to extract ticket details ``` #!/bin/bash API_KEY='' ONE_HOUR_AGO=$(TZ='America/Sao_Paulo' date --date='-1 hour' +"%Y-%m-%dT%H:%M:%S") CURRENT_TIME=$(TZ='America/Sao_Paulo' date +"%Y-%m-%dT%H:%M:%S") SORT_FIELD="open.date" PAGES=1 TICKET_PER_PAGE=50 mkdir -p ./tickets sleep 3 GETQ=`curl --noproxy "*" \ -sLX GET "https://api.axur.com/gateway/1.0/api/tickets-api/tickets?open.date=ge${ONE_HOUR_AGO}&open.date=le${CURRENT_TIME}&sortBy=${SORT_FIELD}&page=${PAGES}&pageSize=${TICKET_PER_PAGE}&order=asc&utc=-03:00" \ -H "Authorization: Bearer ${API_KEY}"` echo "$GETQ" | tr -d '\000-\037' | jq -c '.tickets[]' | while read -r ticket; do key=$(echo $ticket | jq -r '.ticket.ticketKey') echo $ticket | jq '.' > "tickets/${key}.json" done ``` - name: Integration Feed description: |- ## Examples of usage Get feed by id ``` https://api.axur.com/gateway/1.0/api/integration-feed/feeds/feed/643e17a7-7d21-43d4-b24c-1a88d10a3114 ``` Get feed by id with dry-run. The difference in this case is that the dry-run approach does neither mark the page nor the last data retrieved. ``` https://api.axur.com/gateway/1.0/api/integration-feed/feeds/feed/643e17a7-7d21-43d4-b24c-1a88d10a3114?dry-run=true ``` ## Important information - The feed by id returns an object containing the feedData and the collectionData. For now, the collectionData is an object like the GET `tickets-api/tickets` endpoint; - There is a rate limit per feed Id set to 30s. - name: Filter Operations description: |- Filters allow users to specify queries and find existing tickets that match desired criteria. Filter results include only ticket keys, which must be used with valid ticket operations if additional information is needed. A filter is composed of one or multiple _queries_ and an _operation_ to combine them (such as _AND_ or _OR_). Each query is composed of one _field_, one or multiple _values_ and an _operation_ applied on the specified field or values. ## Supported operations - `AND` - `OR` - `NOT` - `GREATER_THAN` - `GREATER_THAN_OR_EQUAL` - `LESS_THAN` - `LESS_THAN_OR_EQUAL` - `BETWEEN` - `EXISTS` - `NOT_EXISTS` - `CONTAINS_TEXT` All ticket fields (see [Retrieve ticket fields](#operation/getFields) operation below) with preffix `ticket.` and `current.` are supported in search filters. ## Supported fields The following fields may be included in search queries: - `current.assets` - `current.close.date` - `current.creation.user` - `current.open.date` - `current.resolution.reason` - `current.resolution` - `current.status` - `current.takedown` - `current.type` - `ticket.creation.date` - `ticket.creation.user` - `ticket.tags` - `ticket.customer` Please note that some fields in the documentation, including the ones listed below, are subject to change or may become obsolete. There is no assurance that they will remain unchanged since fields are related to products in continuos improvement. Furthermore, this list may not contain all possible fields: - `current.ad.product.location` - `current.ad.product.price` - `current.ad.seller.username` - `current.alleged.exposed.birthdate` - `current.alleged.exposed.documents` - `current.creation.customer` - `current.credential.first-seen` - `current.credential.password.type` - `current.credential.password.value.masked` - `current.credential.password.value` - `current.credential.username` - `current.credential.login-source` - `current.criticality` - `current.document.type` - `current.document.value.masked` - `current.documents.masked` - `current.documents.plain` - `current.documents.type` - `current.domain.registrar` - `current.domain` - `current.host` - `current.incident.date` - `current.ip` - `current.isp` - `current.leak.sources` - `current.message.group.name` - `current.platform` - `current.prediction.brand-logo` - `current.prediction.brand-name` - `current.prediction.languages` - `current.prediction.main-language` - `current.prediction.risk` - `current.profile` - `current.quarantine.date` - `current.quarantine.last.updated.date` - `current.quarantine.unread` - `current.source.date` - `current.takedown.cancel.date` - `current.takedown.close.date` - `current.takedown.close.type` - `current.takedown.first-notification.date` - `current.takedown.notification.date` - `current.takedown.notification.last.type` - `current.takedown.request.date` - `current.takedown.resolution.reason` - `current.takedown.resolution` - `current.takedown.reup` - `current.takedown.submission.date` - `current.takedown.uptime` - `current.takedown.verification.date` - `current.takedown.verification.last.type` - `current.token.creation.date` - `current.treatment.date` - `current.treatment.internal` - `current.treatment.type` - `current.treatment.uptime` - `ticket.creation.customer` - `ticket.last-update.date` ## Examples A filter that matches tickets of type phishing with status incident or treatment: ```json { "queries": [ { "fieldName": "current.type", "values": [ "phishing" ], "operation": "AND" }, { "fieldName": "current.status", "values": [ "incident", "treatment" ], "operation": "OR" } ], "operation": "AND" } ``` A filter that matches closed deep & dark web activity tickets in Telegram or Whatsapp: ```json { "queries": [ { "fieldName": "current.status", "values": [ "closed" ], "operation": "AND" }, { "fieldName": "current.type", "values": [ "dw-activity", "data-exposure-message", "data-sale-message", "fraud-tool-scheme-message", "suspicious-activity-message" ], "operation": "AND" }, { "fieldName": "current.platform", "values": [ "telegram", "whatsapp" ], "operation": "OR" } ], "operation": "AND" } ``` A filter that matches tickets updated since July 1st, 2022 UTC (all dates are represented as timestamps in milliseconds): ```json { "queries": [ { "fieldName": "ticket.last-update.date", "values": [ 1656633600000 ], "operation": "GREATER_THAN_OR_EQUAL" } ], "operation": "AND" } ``` - name: Ticket Operations description: | ## Ticket Types - code-secret-leak - database-exposure - other-sensitive-data - dw-activity - data-exposure-website - data-sale-website - fraud-tool-scheme-website - suspicious-activity-website - data-exposure-message - data-sale-message - fraud-tool-scheme-message - suspicious-activity-message - infrastructure-exposure - fake-mobile-app - fake-social-media-profile - fraudulent-brand-use - malware - paid-search - phishing - similar-domain-name - unauthorized-distribution - unauthorized-sale - executive-card-leak - executive-credential-leak - executive-fake-social-media-profile - executive-personalinfo-leak - ransomware-attack - name: Axur Platform webhooks description: |- Webhooks are an advanced API feature that allows external applications to receive Axur events in almost real time, as they happen, through HTTP or HTTPS. To be able to receive webhook events, the external application must provide an unauthenticated HTTP or HTTPS endpoint accessible from the Internet. **Important**: In order to protect sensitive information it is recommended to use an HTTPS endpoint with a valid SSL/TLS certificate. These are the published event types: - `ticket.created` - `ticket.reference.changed` - `ticket.detection.opened` - `ticket.detection.reclassified` - `ticket.detection.closed` - `ticket.quarantine.updated` - `ticket.lifecycle.transition-applied` - `ticket.takedown.requested` - `ticket.takedown.notified` - `ticket.takedown.verified` - `ticket.takedown.done` - `ticket.snapshot.added` - `identity.session.refreshed` - `identity.session.created` - `identity.user.created` - `identity.user.deactivated` - `identity.user.reactivated` - `exposure.created` - `exposure.updated` ## Simple Integration Guide for Webhooks To integrate with the Webhooks feature, follow these basic steps: 1. **Prerequisites** - **HTTP Server**: You need an HTTP server with an exposed URL that accepts POST requests. - **Secure Endpoint**: Ensure your URL is HTTPS-enabled with a valid SSL/TLS certificate to protect sensitive information. 2. **Validating Requests** - **Signature Verification**: Every webhook request is signed using HMAC-SHA256 with a shared secret. - The signature is included in the **X-Axur-Signature** HTTP header. - Use the shared secret from your subscription to validate the authenticity of the request body. 3. **Filtering Events Programmatically** - To optimize processing, you can programmatically filter the types of events you want to handle. For example, you might focus on events like `ticket.created` or `ticket.takedown.requested` depending on your integration requirements. ## Signature Since the provided endpoint must be freely accessible from the Internet, the external application needs to verify the authenticity of incoming Axur requests. The body of every published webhook event is signed using HMAC-SHA256 with a shared secret. Each webhook subscription has a different randomly generated secret (see [Create subscription](#operation/createSubscription) operation, below). The signature's hexadecimal value is included in the custom HTTP header `X-Axur-Signature`. ## Requests All Webhook requests follow the same contract. Some information available is always present but others are event type specific. You can check out below some request examples according to some published event types, followed by the description of some particular details of each event: ### Example Request for `ticket.detection.opened` ``` { "event": { "type": "ticket.created", "date": 1660316140900, "sequence": 6424942 }, "ticket": { "key": "mc2c0p", "customer": "ACME", "reference": "https://www.test.com" } } ``` ### Example Request for `ticket.detection.opened` ``` { "event": { "type": "ticket.detection.opened", "date": 1733947747323, "sequence": 9744269 }, "ticket": { "key": "05vbhy", "customer": "ACME", "detection": 0, "reference": "https://www.test.com", "type": "phishing", "assets": [ "ACME" ] } } ``` ### Example Request for `ticket.lifecycle.transition-applied` ``` { "event": { "type": "ticket.lifecycle.transition-applied", "date": 1733947749776, "sequence": 1482475 }, "ticket": { "key": "05vbhy", "customer": "ACME", "detection": 0, "status": "incident" } } ``` ### Example Request for `ticket.takedown.requested` ``` { "event": { "type": "ticket.takedown.requested", "date": 1733948094085, "sequence": 2289797 }, "ticket": { "key": "3xpcn7", "customer": "ACME", "detection": 0, "resolution": "none" } } ``` All events with the **ticket** prefix follow the same pattern, ensuring a consistent approach to handling them. These events only indicate the ticket.key they belong to, which is why it is necessary to retrieve the full ticket details using the specified endpoint. ### Steps to Retrieve Ticket Information 1. **Extract the `ticket.key`:** Extract the `ticket.key` from the returned body. In the example above, the `ticket.key` is `mc2c0p`. 2. **Use the `ticket.key` to retrieve details:** Use the extracted `ticket.key` to make a request to the following endpoint: ``` https://api.axur.com/gateway/1.0/api/tickets-api/ticket/{ticketKey} ``` Replace `{ticketKey}` with the actual value of the `ticket.key`. For instance: ``` https://api.axur.com/gateway/1.0/api/tickets-api/ticket/mc2c0p ``` 3. **Retrieve ticket details:** This request will provide all the details related to the specific ticket associated with the `ticket.key`. ### Other events #### Example Request for `identity.user.created` ``` { "event": { "type": "identity.user.created", "date": 1733948640366, "author": 12575, "byAxur": true }, "user": { "email": "test@test.com", "customer": "ACME", "firstName": "John", "lastName": "ACme", "roles": [ "mng" ], "groups": [ "manager" ] } } ``` #### Example Request for `exposure.updated` (Credential) ``` { "event": { "type": "exposure.updated", "date": 1733948640366, "sequence": 62365 }, "detections": [ { "id": "2025052911574317566C29A490F30E33B", "status": "IN_TREATMENT", "category": "credential", "created": 1733948640366, "updated": 1752167332650, "customer": "ACME", "assets": [ "ACM" ], "tags": [ "Urgent" ], "credential": { "types": [ "employee", "user" ], "user": "john@acme.com", "user.type": "EMAIL", "password": "p@ssword", "password.type": "PLAIN", "access.url": "https://vazou.com/login", "source.name": "Deep/Dark Web - Telegram" } } ] } ``` #### Example Request for `exposure.updated` (Credit Card) ``` { "event": { "type": "exposure.updated", "date": 1733948640366, "sequence": 62365 }, "detections": [ { "id": "2025052911574317566C29A490F30E33B", "status": "IN_TREATMENT", "category": "credit-cards", "created": 1733948640366, "updated": 1752167332650, "customer": "ACME", "assets": [ "ACM" ], "tags": [ "Urgent" ], "card": { "number": "12345678901948312324", "cvv": "000", "month": "11", "year": "28", "bin" : "123456", "source.name" : "Deep/Dark Web - Telegram" } } ] } ``` Exposure event requests can include up to 1000 detections. These detections may be credentials or credit cards, differing only by the specific credential or card field. - name: Safelist operations description: A safelist item is a URL or host that will be ignored when the Axur platform analyzes potential threats. If Axur detects a URL that matches a safelist item, the URL is considered safe and a corresponding ticket will not be created. - name: Users description: | Users API requests allows customers to translate user_id information into name and last name. In the light of that, customers will be able to exactly identify the author of safelist submission or ticket creation, for instance. - name: API Fields Description description: |- Description of ticket API fields | Field | Description | |----------|-------------| | key | The unique identification code of a ticket. | | ticket.reference | The reference of what was detected. It can be a URL, IP, or domain depending on the ticket type. | | tickets-snapshots: referenceInfo.originalReference | If a detected website has a tracking URL, it will appear in this field. | | current.ip | The detected website's IP. | | current.isp | It is the Internet service provider where the URL is hosted. | | ticket.creation.date | Date when the ticket was created on the platform. | | ticket.creation.user | The user who created the ticket; it can be someone from Axur or someone from the customer's team. | | ticket.creation.originator | The means by which a ticket was created. It may be via the Axur Platform, Onepixel, or manual insertion via API. | | detection.open.date | The date when a URL was detected by the platform, typically the same as the creation date. | | current.incident.date | The date when a ticket was last moved to the Incidents tab. | | current.status | The tab (status) in which the ticket is, *i.e.* Potential threats, Incidents, Closed, Quarantine, Treatment. | | current.type | What the current ticket type is, like `Fake social media profile` or `Counterfeit or irregular sale`. | | current.treatment.internal | If internal treatment: `detection.treatment.internal = true`; if takedown `detection.treatment.internal = false` | | current.takedown.request.date | The date a Takedown was last requested in a ticket. | | current.resolution | What the ticket resolution was, whether it was Resolved, Unresolved, Interrupted or Discarded. If the ticket does not have a resolution yet, the value is empty. | | current.resolution.date | Date on which the ticket was resolved (either by takedown, internal treatment or discarded) | | current.resolution.reason | Resolution reason | | current.close.date | The date the ticket was closed, regardless of the solution. | | current.assets | Which assets are binded to a ticket. | | ticket.creation.collector | Collector/source that identified the threat. | | current.domain | The domain for the detected URL. | | current.host | The URL's full name without the directories. It is composed by `domain + subdomains`. Ex. sub.domain.com. | | tickets-snapshots: details.domainInfo.registrantEmail | The domain registrant's email, obtained from Whois. | | tickets-snapshots: details.domainInfo.registrantName | The domain registrant's name, also obtained from Whois. | | current.treatment.uptime | The time it took to close the ticket. On the CSV file, this number is in days, but the API shows it in milliseconds. | | tickets-snapshots: details.content.title | The page title that appears in the browser tab. | | tickets-snapshots: details.content.hash | When a web page becomes a ticket, a hash is generated from its content and it is used to validate integrity. | | tickets-snapshots: details.content.httpStatusCode.code | When a web page is accessed, it returns an HTTP code. This code represents information about the connection, for example, if the value is `200`, it means the connection was successful, but if it is `404`, it means there was a failure. | | current.tags | The tags currently present in a ticket. | | current.ad.seller.username | In irregular sale scenarios, some plataforms make available some information about what is being advertised. In this case, the information is the seller name. | | current.ad.product.price | In irregular sale scenarios, some plataforms make available some information about what is being advertised. In this case, the information is the product price. | | current.ad.product.location | In irregular sale scenarios, some plataforms make available some information about what is being advertised. In this case, the information is the product location. | | tickets-snapshots: details.content.ad.product.soldAmount | In irregular sale scenarios, some plataforms make available some information about what is being advertised. In this case, the information is the product amount available for sale. | | current.takedown.first-notification.date | Time in milliseconds between `detection.takedown.request.date` and `detection.treatment.date` | | current.takedown.notification.date | List of all the dates on which notifications were made. | | current.credential.username | Leaked email | | current.credential.password.value | Leaked password | | current.credential.password.type | Password type (hash, plain) | | current.platform | Activity platform | | current.profile | Profile of threat Actor | | detection.criticality | Degree of criticality of DW tickets | | current.message.group.name | Threat messaging group | | current.threat-content | Content of the threat | - name: CSV Ticket Extraction Sample description: |- Simple example of extracting tickets to a csv file. Standard authentication is used and with date filters initially set to two hours ago. * Remember to override the pre-set values in the code such as email and password. ## Python This example uses Python 3.7 as programming language. ``` import math import requests import json import datetime import csv API_KEY = '' ticket_fields = ['key', 'reference', 'current.type', 'current.assets', 'current.open.date', 'current.status', 'current.resolution', 'current.resolution.reason', 'current.close.date'] _TICKET_FILTERS = "tickets-filters/filters/tickets" _TICKET_FILTERS_QUERY = "tickets-filters/filters/tickets?q={}&page={}&pageSize={}&sortBy={}&order={}" _TICKETS_FIELDS = "tickets-core/tickets/{}" FILTER_JSON = '''{ "queries": [ { "fieldName": "ticket.last-update_date", "values": [ "$start_date" ], "operation": "GREATER_THAN" }, { "fieldName": "ticket.last-update_date", "values": [ "$end_date" ], "operation": "LESS_THAN" } ], "operation": "AND" }''' TICKET_PER_PAGE = 50 def endpoint_get(endpoint: str, headers: dict = None) -> dict: url = _get_url_for_endpoint(endpoint) out_headers = _get_headers(headers) response = requests.get(url, headers=out_headers) return _process_response(response) def endpoint_post(endpoint: str, data: dict, headers: dict = None) -> dict: url = _get_url_for_endpoint(endpoint) out_headers = _get_headers(headers) response = requests.post(url, json=data, headers=out_headers) return _process_response(response) def _get_headers(input_headers: dict = None) -> dict: out_header = {} if input_headers: out_header = input_headers.copy() out_header["Content-Type"] = "application/json" if API_KEY: out_header["Authorization"] = str.format("Bearer {}", API_KEY) return out_header def _process_response(response) -> dict: if response.status_code >= 200 and response.status_code < 300: if response.text: return json.loads(response.text) else: return None response.raise_for_status() def _get_url_for_endpoint(endpoint: str): return str.format("https://api.axur.com/gateway/1.0/api/{}", endpoint) def get_ticket_fields(tickets_key: list): tickets = [] for ticket_key in tickets_key: print(f'DEBUG: AXUR: Fetch ticket {ticket_key} details') tickets.append(endpoint_get( str.format(_TICKETS_FIELDS, ticket_key))['ticket']) return tickets def post_ticket_filter(filter: str, start: datetime, end: datetime): start_date = int(start.timestamp() * 1000) end_date = int(end.timestamp() * 1000) endpoint = _TICKET_FILTERS data = extract_query(filter, start_date, end_date) return endpoint_post(endpoint, data) def extract_query(filter, start_date, end_date): filter_query = filter.replace('\n', '') filter_query = filter_query.replace("$start_date", str( start_date)).replace("$end_date", str(end_date)) data = json.loads(filter_query) return data def get_ticket_filter(query_id: str, page: int, ticket_per_page: int): endpoint = str.format(_TICKET_FILTERS_QUERY, query_id, page, ticket_per_page, "ticket.last-update_date", "desc") return endpoint_get(endpoint) def tickets_to_csv(ticket: dict): with open('ticket_fields.csv', 'a', encoding='UTF8', newline='') as f: writer = csv.writer(f) fields = [] for field in ticket_fields: fields.append(get_ticket_field_value(ticket, field)) writer.writerow(fields) def get_ticket_field_value(ticket: dict, field: str): if (field.__eq__("key")) or (field.__eq__("customer")) or field.__eq__("reference"): return ticket[field] else: for ticket_field in ticket['fields']: if ticket_field['key'].__eq__(field): if (ticket_field['dimension'].__eq__('multi')): return ';'.join(ticket_field['values']) else: return ticket_field['value'] def main(): current_time = datetime.datetime.now() one_hour_ago = current_time - datetime.timedelta(seconds=3600) json_query = post_ticket_filter( FILTER_JSON, one_hour_ago, current_time) result = get_ticket_filter( json_query['queryId'], 1, TICKET_PER_PAGE) total = result['metadata']['total'] total_pages = math.ceil(total/TICKET_PER_PAGE) print(f'DEBUG: AXUR: Total tickets {total} and total pages {total_pages}') get_all_tickets(json_query['queryId'], total_pages) def get_all_tickets(query_id: str, total_pages: int): for page in range(1, total_pages+1): print(f'DEBUG: AXUR: Fetch page {page} from {total_pages}') result = get_ticket_filter(query_id, page, TICKET_PER_PAGE) process_tickets(result) def process_tickets(result): tickets_key_list = [] for ticket_key in result['tickets']: tickets_key_list.append(ticket_key['key']) tickets = get_ticket_fields(tickets_key_list) for ticket in tickets: tickets_to_csv(ticket) main() ``` ## Bash cURL Example using bash script with cURL to extract ticket details ``` #!/bin/bash API_KEY='' START_DATE=1701557092571 END_DATE=1716557092571 if ! [ -e ".base-tickets" ] ; then touch ".base-tickets" fi # CREATE QUERY SEARCH=`curl --noproxy "*" -sLX POST 'https://api.axur.com/gateway/1.0/api/tickets-filters/filters/tickets' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $API_KEY" \ --data '{ "queries": [ { "fieldName": "ticket.last-update_date", "values": [ "'$START_DATE'" ], "operation": "GREATER_THAN" }, { "fieldName": "ticket.last-update_date", "values": [ "'$END_DATE'" ], "operation": "LESS_THAN" } ], "operation": "AND" }'` QID=`echo $SEARCH | cut -d'"' -f4` sleep 3 # QUERY RESULTS GETQ=`curl --noproxy "*" \ -sLX GET 'https://api.axur.com/gateway/1.0/api/tickets-filters/filters/tickets?q='${QID}'&page=1&pageSize=50&sortBy=current.open.date&order=desc' \ -H "Authorization: Bearer $API_KEY"` TCKT=`echo $GETQ | grep -oP '(?<={"key":").*?(?=")'` echo "$TCKT" > tickets FOPEN=`grep -vxFf .base-tickets tickets` sleep 3 # RETRIEVE - TICKET DETAILS echo "$FOPEN" > .temp_tickets while IFS= read -r line; do echo "Text read from file: $line" GETRTV=`curl --noproxy "*" -sLX GET 'https://api.axur.com/gateway/1.0/api/tickets-core/tickets/'${line}'' \ -H "Authorization: Bearer $API_KEY"` echo "$GETRTV" > $line.json echo $line >> .base-tickets done < ".temp_tickets" ``` - name: Exposure Api Operations description: |+ The Exposure API provides operations to manage detections, such as reading detection data, filtering detections by their content, selecting specific fields to return, changing statuses, and adding or removing tags. Currently, three detection categories are supported: `credentials`, `credit-cards` and `infostealer`. The usage and syntax of this API are identical for all of them. The only differences are the endpoint's path parameter, which specifies the desired category, and the distinct data fields unique to each category. Infostealer detections also carry [record tables](#tag/Exposure-Api-Operations/Exposure-Search-Operations/Infostealer-Record-Tables), which are returned only on request. This API also supports [Multi-Tenant update operations (MSSP)](#tag/Exposure-Api-Operations/Exposure-Update-Operations/Multi-Tenant-Support-(MSSP)) by passing the child customer key on the request body. # Exposure Search Operations ## Examples of search usage Retrieve all credentials detected with specific criteria, such as their status and user information, and using the Arizona (USA) timezone: ```http request GET https://api.axur.com/gateway/1.0/api/exposure-api/credentials?status=NEW,DISCARDED&user=contains:admin&sortBy=created&page=1&pageSize=100&order=asc&timezone=-07:00 ``` Retrieve credentials filtered by detection date range, using the Brazil timezone, and retrieving only status, user, password, created, assets, password.hasLetter, and password.length fields: ```http request GET https://api.axur.com/gateway/1.0/api/exposure-api/credentials?created=ge:2024-07-01&updated=le:2024-07-31&sortBy=created&page=1&pageSize=1&order=desc&timezone=-03:00&fields=status,user,password,created,assets,password.hasLetter,password.length ``` The response for the request above will be `HTTP STATUS 200 OK` with the following body: ```json { "detections": [ { "password": "DtsKcJvlpM", "assets": [ "ANY_ASSET" ], "created": "2024-07-27T17:18:36", "password.hasLetter": true, "user": "test@example.com", "password.length": 10, "status": "DISCARDED" } ], "pageable": { "pageNumber": 1, "pageSize": 1, "total": 200 } } ``` ## Exposure api operators For date or numeric fields, you can use the following operators: - `gt:` - Greater than - `lt:` - Less than - `ge:` - Greater than or equal - `le:` - Less than or equal Operators should be used as prefixes for values in query parameters, for example: - `created=ge:2024-07-01` - `updated=le:2024-07-31` For text fields, you can use the following operators: - `contains:` - Contains Text Operators should be used as prefixes for values in query parameters, for example: - `user=contains:admin` To choose which fields to return, use the `fields` query parameter, separating the desired fields by commas, for example: - `fields=status,user,password,created,assets,password.hasLetter,password.length` - `fields=status,card.cvv,card.brand,card.bin,assets,card.month,card.year` For optional fields, use the `include` query parameter, for example: - `include=notes,history` - `include=notes` - `include=history` - `include=credentials,cookies` (infostealer only, see [Infostealer Record Tables](#tag/Exposure-Api-Operations/Exposure-Search-Operations/Infostealer-Record-Tables)) ## Common Detection Fields Selectable fields common to all detection categories. | Key | Type | Notes | |-------------------------------------|---------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------| | assets | LIST | A list containing the asset keys, needs to be separated by comma, e.g: "ASSET1,ASSET,ASSET 3" | | created | DATE | Creation date, supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33" | | customer | STRING | Customer Key identifier | | detectionDate | DATE | Detection date, supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33" | | document.id | STRING | Document ID | | document.links.originalFile | STRING | Source file | | document.links.originalFilePackage | STRING | Source file package | | document.links.parsedFrom | STRING | File chunk | | document.links.raw | STRING | Document of origin | | document.timestamp | DATE | Document creation date, supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33" | | downloadLink.source | STRING | Download link source | | downloadLink.value | STRING | Download link | | file.mimeType | STRING | File MIME type | | file.name | STRING | File name | | file.originalPath | STRING | File original path | | file.path | STRING | File path | | file.relativePath | STRING | File relative path | | file.sizeInBytes | INTEGER | File size (Bytes) | | file.timestamp | DATE | File processing date, supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33" | | id | STRING | Detection ID | | intelx.fileName | STRING | IntelX file Name | | intelx.fileType | STRING | IntelX file Type | | intelx.publishDate | DATE | IntelX publish date, supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33" | | leak.descriptions.en | STRING | Leak description | | leak.descriptions.es | STRING | Leak description (Spanish) | | leak.descriptions.pt | STRING | Leak description (Portuguese) | | leak.displayName | STRING | Leak display name | | leak.exposureDate | DATE | Leak exposure date, supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33" | | leak.format | STRING | Leak format, it can be "COMBOLIST", "TABLE" or "STEALER LOG" | | leak.forum | STRING | Leak forum | | leak.name | STRING | Leak name | | leak.source | STRING | Leak source | | leak.url | STRING | Leak URL | | message.author.identifier | INTEGER | Message Author Identifier | | message.author.type | STRING | Message author type | | message.autoDeleteIn | INTEGER | Message auto delete in | | message.chat.identifier | INTEGER | Message Chat Identifier | | message.chat.name | STRING | Message chat name | | message.chat.type | STRING | Message chat type | | message.identifier | INTEGER | Message identifier | | message.repliedTo.chatIdentifier | INTEGER | Replied Message Chat Identifier | | message.repliedTo.messageIdentifier | INTEGER | Replied Message Identifier | | message.selfDestructIn | INTEGER | Self-destruct in | | message.threadId | INTEGER | Conversation identifier | | message.timestamp | DATE | Message publication date, supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33" | | message.type | STRING | Message type | | paste.date | DATE | Paste publication date, supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33" | | paste.expire | DATE | Paste expiration date, supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33" | | paste.originLocation | STRING | Paste URL | | paste.source | STRING | Paste source | | paste.title | STRING | Paste title | | paste.user | STRING | Paste author | | source.name | STRING | Source name | | source.timestamp | DATE | Exposure date at the source, supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33" | | source.url | STRING | Source URL | | status | ENUM | Detection Status, it can be "NEW", "IN_TREATMENT", "SOLVED" or "DISCARDED" | | tags | LIST | Custom labels for organizing detections. | | updated | DATE | Detection update date, supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33" | ## Credential Specific Fields Selectable fields specific to credential detections. | Key | Type | Notes | |-------------------------------------|---------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------| | access.appId | STRING | Credential App ID | | access.domain | STRING | Credential access domain | | access.host | STRING | Credential access host | | access.tld | STRING | Credential access TLD | | access.url | STRING | Credential access URL | | credential.types | LIST | A list containing the Credential types, credential type is an enum, it can be "user" or "employee". The list needs to be separated by comma, e.g: "user,employee" | | password | STRING | Password | | password.hasLetter | BOOLEAN | Contains letter | | password.hasLowerCase | BOOLEAN | Contains lowercase letter | | password.hasNumber | BOOLEAN | Contains number | | password.hasSpecialChar | BOOLEAN | Contains special character | | password.hasUpperCase | BOOLEAN | Contains uppercase letter | | password.length | INTEGER | Password length | | password.type | ENUM | Password type, it can be "PLAIN", "MYSQL323", "MD5", "SHA512", "SHA256", "SHA1", "BCRYPT", "SHA384" or "PBKDF2" | | user | STRING | Username | | user.emailDomain | STRING | Email domain | | user.emailHost | STRING | Email host | | user.emailTld | STRING | Email TLD | | user.length | INTEGER | Username length | | user.type | ENUM | User type, it can be "EMAIL", "CPF", "USERNAME", "PHONE" or "CNPJ" | ## Credit Card Specific Fields Selectable fields specific to credit card detections. | Key | Type | Notes | |-------------------------------------|---------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------| | bin | STRING | Bank Identification Number with six digits | | bin8 | String | Bank Identification Number with eight digits | | card.brand | String | Brand of a given credit card | | card.currency | String | Card currency | | card.cvv | String | Card Verification Value | | card.isComplete | String | Card is complete or not. A card is complete if it has card number, security code (CVV) and also expiration date (month/year) | | card.level | String | Card level | | card.number | String | Card number | | card.month | String | Expiration month | | card.prepaid | String | Is the card prepaid (can be "TRUE" or "FALSE") | | card.type | String | Card type | | card.year | String | Expiration year | | issuer.name | TEXT | Issuer Name | | issuer.phone | TEXT | Issuer Phone | | issuer.website | TEXT | Issuer Website | | sha256CreditCardNumberHash | STRING | Credit Card Number Hash (SHA-256) | ### Notes: - Date fields support formats `yyyy-MM-dd` and `yyyy-MM-ddTHH:mm:ss`; - On date fields using `yyyy-MM-ddT00:00:00` is equivalent to `yyyy-MM-dd`. - Boolean fields are represented as `true`, `false`, `1` (for true value) or `0` (for false value). - Fields are case-insensitive unless explicitly stated otherwise. - pageSizes are limited to 1000, or to 5 when `include` names an infostealer record table. - The `timezone` parameter is optional and defaults to `UTC`. - The `fields` parameter is optional and defaults to all fields. - The `order` parameter is optional and defaults to `desc`. - The `sortBy` parameter is optional and defaults to `created`. - The `page` parameter is optional and defaults to 1. - The `pageSize` parameter is optional and defaults to 50 (5 when `include` names an infostealer record table). - The result of `pageSize` * `page` should not exceed 1000000. - Only date and integer fields are allowed in the `sortBy` parameter. - For user with access to multiple tenants, the `customer` parameter is required when searching for a child tenant's credentials. ## Infostealer Specific Fields An infostealer detection is a stealer log: everything an infostealer malware collected from one infected computer, found leaked inside a compressed file. Each detection describes the computer, its operating system and the stealer, and carries the collected records as [record tables](#tag/Exposure-Api-Operations/Exposure-Search-Operations/Infostealer-Record-Tables). Selectable fields specific to infostealer detections. | Key | Type | Notes | |---------------------------------|---------|---------------------------------------------------------------------------------------------------------------------------------| | computer.city | STRING | City of the infected computer | | computer.country | STRING | Country of the infected computer | | computer.cpu.architecture | STRING | CPU architecture | | computer.cpu.cores | INTEGER | Number of CPU cores | | computer.cpu.name | STRING | CPU model | | computer.disk.drive | STRING | Disk name | | computer.disk.sizeInBytes | INTEGER | Disk size (Bytes) | | computer.gpu.name | STRING | GPU model | | computer.hardwareId | STRING | Hardware ID of the infected computer | | computer.hostname | STRING | Computer hostname | | computer.ip | STRING | Computer IP address | | computer.logUploadDate | DATE | Date the stealer uploaded the log, supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33" | | computer.mac | STRING | Computer MAC address | | computer.memorySizeInBytes | INTEGER | RAM size (Bytes) | | computer.region | STRING | Region of the infected computer | | computer.screen.height | INTEGER | Screen height (pixels) | | computer.screen.width | INTEGER | Screen width (pixels) | | computer.stealerExecutablePath | STRING | Path of the stealer executable on the infected computer | | downloadLink.detectionDate | DATE | Download link detection date, supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33" | | folderName | STRING | Name of the stealer log folder inside the compressed file | | folderPath | STRING | Path of the stealer log folder inside the compressed file | | isHistory | BOOLEAN | `true` when the detection was found by a historical search over previously collected data instead of by live monitoring | | message.author.firstName | STRING | Message author first name | | message.author.lastName | STRING | Message author last name | | message.author.phone | STRING | Message author phone | | message.author.username | STRING | Message author username | | os.admin | BOOLEAN | Whether the operating system user has administrator privileges | | os.antivirus | LIST | Antiviruses installed on the infected computer | | os.installDate | DATE | Operating system installation date, supported formats "yyyy-MM-dd" and "yyyy-MM-ddTHH:mm:ss". Sample "2024-01-31T04:55:33" | | os.keyboard | STRING | Operating system keyboard layout | | os.language | STRING | Operating system language | | os.name | STRING | Operating system name, e.g. "Windows 10" | | os.servicePack | STRING | Operating system service pack | | os.timezone | STRING | Operating system timezone | | os.user | STRING | Operating system user | | os.version | STRING | Operating system version | | stats.autofill | INTEGER | Number of rows in the `autofill` record table | | stats.cookies | INTEGER | Number of rows in the `cookies` record table | | stats.credentials | INTEGER | Number of rows in the `credentials` record table | | stats.creditCards | INTEGER | Number of rows in the `creditCards` record table | | stats.files | INTEGER | Number of rows in the `files` record table | | stats.processes | INTEGER | Number of rows in the `processes` record table | | stats.software | INTEGER | Number of rows in the `software` record table | | stealerDistributor | STRING | Malware distributor: the actor or channel that spread the stealer log | | stealerFamily | STRING | Stealer malware family, e.g. "Vidar Stealer" | ### Notes: - `file.name`, `file.path` and `file.sizeInBytes` describe the compressed file the stealer log was found in. - `document.id` is the stealer log's Threat Hunting ID. - A stealer log can describe more than one computer, network interface, screen or disk. When a detection holds more than one value for a `computer.*` or `os.*` field, that field is returned as a list instead of a single value. `os.antivirus` is always returned as a list. - Fields the stealer did not collect are left out of the response. - The user must have access to infostealer detections; otherwise, requests to the `infostealer` category return `403`. ## Infostealer Record Tables Besides the fields above, a stealer log carries every record the stealer collected — credentials, cookies, credit cards and so on — as record tables. A single stealer log can hold thousands of records, so record tables are left out of the response by default and returned only when named in the `include` query parameter, separated by commas, for example `include=credentials,cookies`. The `stats.*` fields give the number of rows of each table without retrieving it. | Record table (`include` value) | Row count field | Columns | |--------------------------------|-------------------|------------------------------------------------------------------------------------------------------------------------------------------| | autofill | stats.autofill | `inputName`, `inputValue`, `fileId` | | cookies | stats.cookies | `name`, `domain`, `path`, `expires`, `fileId` | | credentials | stats.credentials | `user`, `password`, `accessUrl`, `accessHost`, `accessDomain`, `accessTld`, `emailHost`, `emailDomain`, `emailTld`, `appId`, `fileId` | | creditCards | stats.creditCards | `number`, `bin`, `bin8`, `month`, `year`, `cvv`, `holder`, `fileId` | | files | stats.files | `id`, `name`, `path`, `mimeType`, `sizeInBytes` | | processes | stats.processes | `name`, `fileId` | | software | stats.software | `name`, `version`, `installDate`, `fileId` | Each record table is returned as a list of objects keyed by the columns above: - `fileId` is the `id` of the row in the `files` table the record was extracted from. - `credentials`: `accessUrl`, `accessHost`, `accessDomain` and `accessTld` identify where the credential is used; `emailHost`, `emailDomain` and `emailTld` are filled when `user` is an email address; `appId` identifies a mobile app. - `creditCards`: `bin` and `bin8` are the card's six- and eight-digit Bank Identification Numbers; `month` and `year` are its expiration date; `holder` is the card holder name. - `autofill`: `inputName` is the name of the form input and `inputValue` the value the browser saved for it. - `cookies.expires` and `software.installDate` are epoch timestamps in milliseconds. ### Rules for record tables: - Record tables are returned only through `include`; naming them in `fields` does not return them. - When `include` names a record table, `pageSize` accepts 1 to 5 and defaults to 5. - Include only the tables you need: a single stealer log can return megabytes of records. - Record tables cannot be used as filters or in `sortBy`. To find stealer logs with a given kind of record, filter by its row count field, e.g. `stats.creditCards=gt:0`. - Record values are returned as collected: they are not converted by the `timezone` parameter, and a column the stealer did not collect may be missing or empty. - Responses that include record tables are streamed, so they have no `Content-Length` header. If an error happens after the response has started, the body ends truncated under `HTTP STATUS 200 OK`, so check that the body is complete JSON before processing it. ## Examples of infostealer search usage Retrieve the most recent stealer log of the Vidar family that contains credit cards, using the Brazil timezone and returning a selection of its fields: ```http request GET https://api.axur.com/gateway/1.0/api/exposure-api/infostealer?stealerFamily=Vidar&stats.creditCards=gt:0&created=ge:2026-08-01&sortBy=created&order=desc&page=1&pageSize=1&timezone=-03:00&fields=id,status,created,stealerFamily,stealerDistributor,folderName,file.name,computer.hostname,computer.country,os.name,os.user,stats.credentials,stats.creditCards,stats.cookies,stats.files,source.name,assets ``` The response for the request above will be `HTTP STATUS 200 OK` with the following body: ```json { "detections": [ { "id": "1786908068782E8A31C4D96F2B705", "status": "NEW", "created": "2026-08-16T16:21:08", "stealerFamily": "Vidar Stealer", "stealerDistributor": "link_cashflow", "folderName": "BR[8BFBF72F87564F3B]", "file.name": "Premium_Logs.part09.rar", "computer.hostname": "DESKTOP-D1LR0D2", "computer.country": "BR", "os.name": "Windows 10", "os.user": "john", "stats.credentials": 2, "stats.creditCards": 1, "stats.cookies": 1, "stats.files": 2, "source.name": "Deep/Dark Web - Telegram", "assets": [ "ACME" ] } ], "pageable": { "pageNumber": 1, "pageSize": 1, "total": 37 } } ``` Retrieve the credentials and cookies collected in that stealer log: ```http request GET https://api.axur.com/gateway/1.0/api/exposure-api/infostealer?id=1786908068782E8A31C4D96F2B705&fields=id,stealerFamily&include=credentials,cookies ``` The response for the request above will be `HTTP STATUS 200 OK` with the following body: ```json { "detections": [ { "id": "1786908068782E8A31C4D96F2B705", "stealerFamily": "Vidar Stealer", "credentials": [ { "user": "john@example.com", "password": "DtsKcJvlpM", "accessUrl": "https://accounts.example.com/signin", "accessHost": "accounts.example.com", "accessDomain": "example.com", "accessTld": "com", "emailHost": "example.com", "emailDomain": "example.com", "emailTld": "com", "fileId": "202608151333553083356937C47E3B8F4EC098817" }, { "user": "john.doe", "password": "LBHxSUUiZT", "accessUrl": "https://portal.acme.com/login", "accessHost": "portal.acme.com", "accessDomain": "acme.com", "accessTld": "com", "fileId": "202608151333553083356937C47E3B8F4EC098817" } ], "cookies": [ { "name": "_gid", "domain": ".acme.com", "path": "/", "expires": 1734964889000, "fileId": "202608151333530869426697C47E3B8F4EC012666" } ] } ], "pageable": { "pageNumber": 1, "pageSize": 5, "total": 1 } } ``` ## CSV Credential Extraction Example Extract credentials into a CSV file, filtering by the desired criteria. __Python__ This example uses Python 3.12 and standard authentication methods. ```python #!/bin/bash import csv import json import logging import time from logging import Logger import requests QUERY: str = "status=NEW,DISCARDED&user=contains:admin&sortBy=created&page=1&pageSize=50&order=asc&timezone=-07:00" BASE_URL: str = f"https://api.axur.com/gateway/1.0/api/exposure-api/credentials?{QUERY}" API_KEY: str = "" MAX_RETRIES: int = 3 INITIAL_WAIT: float = 1.0 WAIT_INCREMENT: float = 0.5 logging.basicConfig(format='%(asctime)s %(levelname)s %(name)s.%(funcName)s - %(message)s', level=logging.INFO) LOGGER: Logger = logging.getLogger(__name__) def make_request(retries: int = 0, wait_time: float = INITIAL_WAIT) -> list[dict[str, any]] | None: headers = get_headers(API_KEY) response = requests.get(BASE_URL, headers=headers) return process_response(response, retries, wait_time) def get_headers(api_key: str) -> dict[str, str]: out_header = {"Content-Type": "application/json"} if api_key: out_header["Authorization"] = str.format("Bearer {}", api_key) return out_header def process_response(response: requests.Response, retries: int, wait_time: float) -> list[dict[str, any]] | None: if 200 <= response.status_code < 300: if response.text: return json.loads(response.text)["detections"] elif response.status_code == 429: if retries >= MAX_RETRIES: response.raise_for_status() retries += 1 time.sleep(wait_time) wait_time += WAIT_INCREMENT return make_request(retries, wait_time) else: response.raise_for_status() def write_to_csv(data: list[dict[str, any]], filename: str) -> None: if not data: LOGGER.warning("No data to write.") return with open(filename, mode='w', newline='', encoding='utf-8') as file: fieldnames: set[str] = set([key for item in data for key in item.keys()]) writer = csv.DictWriter(file, fieldnames=fieldnames) writer.writeheader() for item in data: writer.writerow(item) def main() -> None: response = make_request() write_to_csv(response, "data.csv") if __name__ == "__main__": main() ``` __Bash cURL__ Use a bash script to extract credential details: ```bash #!/bin/bash API_KEY='' BASE_URL='https://api.axur.com/gateway/1.0/api/exposure-api/credentials' ONE_HOUR_AGO=$(TZ='America/Sao_Paulo' date --date='-24 hour' +"%Y-%m-%dT%H:%M:%S") CURRENT_TIME=$(TZ='America/Sao_Paulo' date +"%Y-%m-%dT%H:%M:%S") SORT_FIELD="created" PAGES=1 DETECTIONS_PER_PAGE=50 TIMEZONE='-03:00' DESIRED_FIELDS='id,status,user,password,created,assets,password.hasLetter,password.length' mkdir -p ./detections sleep 3 GETQ=$(curl --noproxy "*" \ -sLX GET "${BASE_URL}?created=ge:${ONE_HOUR_AGO}&created=le:${CURRENT_TIME}&sortBy=${SORT_FIELD}&page=${PAGES}&pageSize=${DETECTIONS_PER_PAGE}&timezone=${TIMEZONE}&fields=${DESIRED_FIELDS}" \ -H "Authorization: Bearer ${API_KEY}") # Check if the response is a valid JSON if echo "$GETQ" | jq . > /dev/null 2>&1; then echo "$GETQ" | tr -d '\000-\037' | jq -c '.detections[]' | while read -r detection; do id=$(echo "$detection" | jq -r '.id') echo "$detection" | jq '.' > "detections/${id}.json" done else echo "Error: The server response is not a valid JSON." fi ``` # Exposure Update Operations This section describes the available operations for updating detections, including status changes and tag management. ## Status Update Operations ### Update Single Detection Status Update the status of a specific detection by providing its ID: ```http request PATCH https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}/:id ``` **Request Body:** ```json { "field": "status", "value": "DISCARDED" } ``` ### Bulk Update Detection Status Update the status of multiple detections simultaneously: ```http request PATCH https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory} ``` **Request Body:** ```json { "field": "status", "value": "DISCARDED", "ids": [ "202411271319565002EF35C72F8C5C298", "202411271319565002EF35C72F8C5C299" ] } ``` **Response:** All status update operations return `HTTP STATUS 204 NO CONTENT`. --- ## Tag Management Operations ### Single Detection Tag Management #### Add Tags to a Single Detection Add new tags to a specific detection: ```http request POST https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}/:id/tags ``` **Request Body:** ```json { "values": [ "my tag", "tag2" ] } ``` ##### Remove Tags from a Single Detection Remove specific tags from a detection: ```http request POST https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}/delete/:id/tags ``` **Request Body:** ```json { "values": [ "tag3", "tag4" ] } ``` ### Bulk Tag Management #### Add Tags to Multiple Detections Add tags to several detections at once: ```http request POST https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}/tags ``` **Request Body:** ```json { "values": [ "my tag", "tag2" ], "ids": [ "202411271319565002EF35C72F8C5C298", "202411271319565002EF35C72F8C5C299" ] } ``` #### Remove Tags from Multiple Detections Remove tags from several detections simultaneously: ```http request POST https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}/delete/tags ``` **Request Body:** ```json { "values": [ "tag3", "tag4" ], "ids": [ "202411271319565002EF35C72F8C5C298", "202411271319565002EF35C72F8C5C299" ] } ``` **Response:** All tag operations return `HTTP STATUS 204 NO CONTENT`. --- ## Notes Management Operations ### Add Notes to a Single Detection Add new notes to a specific detection: ```http request POST https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}/:id/notes ``` **Request Body:** ```json { "values": [ "my note" ] } ``` ### Add Notes to Multiple Detections Add notes to several detections at once: ```http request POST https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}/notes ``` **Request Body:** ```json { "values": [ "my note" ], "ids": [ "202411271319565002EF35C72F8C5C298", "202411271319565002EF35C72F8C5C299" ] } ``` **Response:** All notes operations return `HTTP STATUS 204 NO CONTENT`. --- ## Multi-Tenant Support (MSSP) For users with access to multiple tenants, include the `customer` parameter when managing a child tenant's exposures: ### Status Update Example (MSSP) ```json { "field": "status", "value": "DISCARDED", "ids": [ "202411271319565002EF35C72F8C5C298", "202411271319565002EF35C72F8C5C299" ], "customer": "CHILD_KEY" } ``` ### Tag Management Example (MSSP) ```json { "values": [ "my tag", "tag2" ], "ids": [ "202411271319565002EF35C72F8C5C298", "202411271319565002EF35C72F8C5C299" ], "customer": "CHILD_KEY" } ``` --- ## Supported Fields | Field | Type | Operations | Notes | |--------|------|--------------|-------------------------------------------------------------------| | status | ENUM | `PATCH` only | Detection status: "NEW", "IN_TREATMENT", "SOLVED", or "DISCARDED" | | tags | LIST | `POST` only | Custom labels for organizing detections. Tags are case-sensitive. | --- ## Important Notes ### General Guidelines - **Maximum bulk operations:** 1000 IDs per request - **Field case sensitivity:** Fields are case-insensitive unless explicitly stated otherwise - **Detection ID retrieval:** Use the [Exposure Search Operations](#tag/Exposure-Api-Operations/Exposure-Search-Operations/Examples-of-search-usage) to obtain detection IDs ### Method-Specific Rules - **PATCH operations:** Only the `status` field is supported - **POST/DELETE operations:** Only the `tags` field is currently supported - **Field parameter:** The `:field` URL parameter currently supports only `tags`, but may be extended in the future ### Multi-Tenant Requirements - **MSSP users:** Must include the `customer` parameter when managing child tenant exposures - **Applies to:** All update operations (`PATCH`, `POST`) - **Customer value:** Use the child tenant's customer key (e.g., "CHILD_KEY") ### Response Codes - **Success:** `204 NO CONTENT` for all successful operations - **Error codes:** `400` (Bad Request), `429` (Rate Limit Exceeded) # Exposures Count Operations ## Examples of count usage Count exposures detected with specific criteria, such as their status, date offset, and using the Brazil timezone: ```http request GET https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}/total?status=NEW&timezone=-03:00&created=ge:2024-01-01&created=le:2024-01-25 ``` The response for the request above will be `HTTP STATUS 200 OK` with the following body: ```json { "total": 1234 } ``` ## Fields supported by exposure API (count) All the fields and operations used for [search](#tag/Exposure-Api-Operations/Exposure-Search-Operations) can also be used in the count API. ### Notes: - Date fields support formats `yyyy-MM-dd` and `yyyy-MM-ddTHH:mm:ss`; - On date fields using `yyyy-MM-ddT00:00:00` is equivalent to `yyyy-MM-dd`. - Boolean fields are represented as `true`, `false`, `1` (for true value) or `0` (for false value). - Fields are case-insensitive unless explicitly stated otherwise. - The `timezone` parameter is optional and defaults to `UTC`. - For user with access to multiple tenants, the `customer` parameter is required when searching for a child tenant's credentials. - name: Web complaints API description: |+ Provides operations to retrieve web complaint data reported by customers. Use this API to query complaints based on date ranges and other criteria. - name: Credit Card Exposure for Application description: | Credit Card Exposure for Application is responsible for monitoring internet activities in search of leaked credit cards. Axur provides an HTTP API for Credit Card Exposure for Application, allowing external applications, like ecommerces and payment gateways, to access information programmatically. Therefore, ecommerces can check if a customer's credit card has been compromised. This document describes the currently supported API operations. - name: Getting started with Credit Card Exposure for Application description: | For you to have access to the API you must hire a plan with our sales team. We also have free trials and Proof of Concepts. The API has a rate limit per IP Address of maximal **120 request per minute** To make an API query, you must generate a sha256 hash with the desired credit card number. - name: Supported operations on Credit Card Exposure for Application description: '' - name: Cyber Threat Intel (CTI) TAXII Server description: |- This section outlines the supported API operations within the Cyber Threat Intel (CTI) TAXII Server. This API was developed following TAXII and STIX 2.1 specifications. All endpoints, headers, requests, responses, and filters are defined by this specification. The official documentation of TAXII and STIX can be found here: https://oasis-open.github.io/cti-documentation/resources.html#taxii-21-specification - name: Supported operations on Cyber Threat Intel (CTI) TAXII Server description: '' - name: IoC Collection description: |- This section introduces the **CTI IoC data collection** available on the Cyber Threat Intel (CTI) TAXII Server. The collection stores **Indicators of Compromise (IOCs)** in the form of STIX 2.1 Indicator objects. All [supported TAXII operations](#tag/Cyber-Threat-Intel-(CTI)-TAXII-Server) (discovery, collection access, object retrieval, and filtering) apply to this IOC Collection. This allows clients to query, fetch, and manage indicators such as IP addresses, domain names, file hashes and other observables. ### Example STIX Indicator Object ```json { "type": "indicator", "spec_version": "2.1", "id": "indicator--b7a8d32f-9c9a-4b1f-8e6e-1f82a5c7f4b5", "created": "2025-09-08T12:00:00.000Z", "modified": "2025-09-08T12:00:00.000Z", "name": "Suspicious IP address", "pattern": "[ipv4-addr:value = '166.0.184.127']", "pattern_type": "stix", "valid_from": "2025-09-08T12:00:00.000Z", "confidence": 15 } ``` - name: Threat Hunting description: |- Threat Hunting is responsible for creating asynchronous searches on our data lake. You can query terabytes of data to find detections such as fraudulent websites, credit cards and credential leaks For you to have access to the API you must hire a plan with our sales team. - name: Automations description: |- Automations enable you to define rules that automatically update detections — changing their status, applying tags, or adding notes — without requiring analysts to manually review and triage each detection. - name: Supported operations on Automations description: |- This section provides operations to retrieve, manage, and test platform Automations. - name: Investigations description: |- Investigations is responsible for managing CTI/ART Investigations, as well as their status and attachments. For you to have access to the API you must hire a plan with our sales team. - name: Supported operations on Investigations description: '' - name: Open Data description: | The product enables Axur's clients to access detailed datasets of their platform interactions through API, adhering to the OpenData data exchange standard. This data can be plugged into their Business Intelligence software to generate dashboards and insights, helping them to better understand the health of their operations and sell the value of Axur's services to their executives. Additionally, the data can be used to fine-tune Axur's platform detection, such as identifying which collector is bringing more false positives, allowing for adjustments and reducing time spent on triage. Initially (in V1), only managers will have access to the service and will be responsible for creating API keys. These API keys can then be shared with other users at the managers' discretion. - name: Supported operations on Open Data description: '' - name: IoC Feed description: | DEPRECATION NOTICE: IoC Feed operations are deprecated and will be discontinued. Please refer to the [TAXII Server IOC collection](#tag/IoC-Collection). The IoC Feed is an on-demand feed of indicators from Axur sources, including our MISP. Its main purpose is to be a database of IoCs that can be retrieved at any time, with support for filtering by type, date, and more. To access the API, you must purchase a plan from our sales team. We also offer free trials and proofs of concept. - name: Supported operations on IoC Feed description: | ⚠️ Deprecated - name: Supply Chain Intel description: | ## Summary External APIs for retrieving Supply Chain Intel vendor data. It is possible to get all customer's vendors or filter by asset key. History APIs allow you to gather information on past events for the vendors. It is possible to get all customer's vendors or filter by asset keys. These APIs split into Vendor-wide history and Asset-specific history. The difference is that Asset-specific history comprises only information related to your custom monitoring settings for a particular vendor. On the other hand, Vendor-wide, as the name suggests, includes history information that is relevant regardless of vendor monitoring details. At the present, "critical bulletins" is an example of Asset-specific history. Users must have access to Supply Chain Intel in order to use these APIs. - name: EASM operations (Introduction) description: | EASM helps you manage resources in the new EASM. ## Before you start - You need a valid Bearer token (see [Authentication](#tag/Authentication)). - The `axur_tenant_key` path parameter is optional and is used to indicate the tenant in which the operation will be executed. A user may have access to more than one tenant; if this parameter is not sent, the operation will be executed in the user's primary tenant. ## Quick start (finding your customer key) 1. List customers and keys: [Retrieve Customers](#operation/getCustomersLite) - name: Account description: | It is possible to retrieve data related to discovery and scan dates. - name: EASM Assets description: | It is possible to retrieve data related to the account's assets, as well as perform actions such as scanning. - name: EASM Exposures description: | It is possible to retrieve data related to the account's exposures, as well as perform actions. - name: EASM Policies description: | It is possible to retrieve data related to the account's policies, as well as perform actions. - name: EASM Filters description: | It is possible to retrieve data in order to construct filters. - name: EASM API Version description: | It is possible to retrieve EASM API version. - name: EASM Users description: | It is possible to retrieve current user data, as well as perform actions. - name: EASM Seeds description: | It is possible to retrieve data related to the account's seeds, as well as perform actions. - name: Changelog description: | ### 1.0.0 | 2022-12-20 - Initial version ### 1.0.1 | 2023-01-20 - Added attachment actions in ticket operations - Added translation of platform terms into API language ### 1.0.2 | 2023-02-02 - Add some request sample in pyhton and cURL ### 1.0.3 | 2023-02-28 - Better description of supported fields - Added documentation for Cardcast API and Leakstream™ ### 1.0.4 | 2023-03-09 - Added documentation for Cardstream™ ### 1.0.5 | 2023-03-24 - Removed "executive-mobile-phone" from Ticket Types in Ticket Operation ### 1.0.6 | 2023-06-15 - Added “Customs” from Permission levels ### 1.0.7 | 2023-06-29 - Added GET Retrive subscriptions example - Added POST Create subscription example - Added DEL Remove subscription example - Added POST Ping subscription example ### 1.0.8 | 2023-07-05 - Added documentation for API Keys ### 1.0.9 | 2023-07-19 - Added new ticket type "infostealer-credential" ### 1.0.10 | 2023-07-31 - Added new route to get infostealer credential leaks ### 1.0.11 | 2023-08-09 - Added new ticket type "ransomware-attack" ### 1.0.12 | 2023-08-16 - Added documentation for IoC Search ### 1.0.13 | 2023-09-13 - Added documentation for Credit Card Exposure ### 1.0.14 | 2023-10-11 - Added documentation for Customer Credential Exposure ### 1.0.15 | 2023-10-13 - Added documentation for Investigations ### 1.0.16 | 2023-10-17 - Added documentation for IoC Core ### 1.0.17 | 2023-10-30 - Removed ticket type "infostealer-credential" from ticket creation ### 1.0.18 | 2023-11-17 - Removed unsupported ticket types from ticket creation ### 1.0.19 | 2023-11-22 - Added documentation for Open Data ### 1.0.20 | 2024-02-19 - Removed deprecated Cardcast and Leakstream™ endpoints ### 1.0.21 | 2024-03-04 - Added sourceType field to Cardcast endpoints ### 1.0.22 | 2024-03-07 - Fixed users endpoint ### 1.0.23 | 2024-03-21 - Updated ticket extraction examples to use API KEY. - Removed Create Session by username and password - Removed Api Keys session - Updated authentication session with API KEY information - Updated translation of platform terms into API language ### 1.0.24 | 2024-04-22 - Added documentation for Customer/Asset ### 1.0.25 | 2024-04-26 - Updated documentation for Cardstream™ to include the incomplete flag ### 1.0.26 | 2024-06-17 - Added permissioning for each endpoint ### 1.0.27 | 2024-08-19 - Added documentation for Ticket API ### 1.0.28 | 2024-08-22 - Removed LeakStream documentation - Added Ticket API creation ### 1.0.29 | 2024-09-16 - Added Ticket API field text operator ### 1.0.30 | 2024-12-17 - Removal of the requirement to enter the customer key when creating tickets using [Ticket API](#operation/createTicket) ### 1.0.31 | 2024-12-20 - Possibility of selecting the composition of the ticket response when using the [Ticket API](#operation/retrieveTicketApi) ### 1.0.32 | 2025-01-29 - Added Exposure API documentation - Added Credential search operations - Added Credential update operations ### 1.0.33 | 2025-02-04 - Addeed MSSP options to Exposure API documentation ### 1.0.34 | 2025-02-14 - Addeed MSSP options to Fields supported by filters ### 1.0.35 | 2025-03-07 - Added Ticket Stats to Ticket Api Operations - Added Credential Count Operations ### 1.0.36 | 2025-03-11 - Added CardHash Check Endpoint ### 1.0.37 | 2025-03-14 - Improved the descriptions for query parameters in the exposure API's credentials and total endpoints, clarifying their usage and defaults. - Added Python and cURL code samples for better developer guidance. - Replaced a detailed field list in count API docs with a reference to the search API documentation for consistency and brevity. ### 1.0.38 | 2025-04-07 - Add 'user.length' field to exposure API search documentation ### 1.0.39 | 2025-04-16 - Add Credit Card Exposure - For Issuers webhook signature ### 1.0.40 | 2025-05-08 - Deprecate infostealer credential tickets details endpoint. ### 1.0.41 | 2025-05-09 - Add Phishing URL Feed information. ### 1.0.42 | 2025-05-15 - Add URL Feed API information. ### 1.0.43 | 2025-05-23 - Add Threat & Exposure Intelligence TAXII Server information. ### 1.0.44 | 2025-06-13 - Add documentation for credential tag management operations ### 1.0.45 | 2025-06-16 - Add endpoints for removing field data in credential detections ### 1.0.46 | 2025-06-30 - Adjusted multiple endpoint response schemas to ensure full compatibility with OpenAPI 3.0 specifications. ### 1.0.47 | 2025-07-10 - Added webhooks for exposure events ### 1.0.48 | 2025-07-11 - Adjusted descriptions of Retrieve Tickets and Retrieve Bulk by Key ### 1.0.49 | 2025-07-30 - Added Python code sample for TAXII2 client with Bearer authentication ### 1.0.50 | 2025-08-22 - Adjusted Python code sample for TAXII2 client with Bearer authentication ### 1.0.51 | 2025-09-08 - Deprecated IOC Feed operations - Highlighted the Threat & Exposure Intelligence TAXII Server IoC collection ### 1.0.52 | 2025-09-23 - Add Web Complaints documentation ### 1.0.53 | 2025-09-25 - Update Web Complaints documentation ### 1.0.54 | 2025-09-30 - Remove Phishing URL Feed section ### 1.0.55 | 2025-10-04 - Update Web Complaints documentation ### 1.0.56 | 2025-10-23 - Add 'leak.format' field to exposure API search documentation ### 1.0.57 | 2025-11-12 - Add 'warnings' field to ticket create endpoint ### 1.0.58 | 2025-12-15 - Renaming 'Threat & Exposure Intelligence' to 'Cyber Threat Intel (CTI)' ### 1.0.59 | 2025-02-18 - Add webhooks for credit cards exposure events ### 1.0.60 | 2026-02-23 - Add Customers, Assets and Credit Management documentation and operations - Improve integration guidance for Customers, Assets and Credit Managements (simple language, quick start and troubleshooting) ### 1.0.61 | 2026-03-09 - Fix Web Complaints documentation ### 1.0.62 | 2026-03-13 - Added support for credit card detections to the Exposure API. ### 1.0.63 | 2026-03-20 - Added information for credential uniqueness criteria properties. ### 1.0.64 | 2026-03-23 - Expanded information on credential uniqueness criteria properties with possible values. ### 1.0.65 | 2026-04-07 - Added cURL and Payload code samples to all API endpoints. ### 1.0.66 | 2026-04-08 - Added support for 'notes' and 'history' fields in the Exposure API through the 'include' query parameter. ### 1.0.67 | 2026-04-09 - Removed references to deprecated ticket types 'infostealer-credential' and 'corporate-credential-leak'. ### 1.0.68 | 2026-05-06 - Add web complaints endpoints. ### 1.0.69 | 2026-06-02 - Added support for bulk and individual 'notes' additions in the Exposure API. ### 1.0.70 | 2026-06-08 - Mapped the ticket history operation to the Ticket API and deprecated the legacy Ticket Operations endpoint in the documentation. ### 1.0.71 | 2026-06-12 - Added billing country mapping for Customers and Credit Management API's. ### 1.0.72 | 2026-06-15 - Added threat hunting documentation for infostealers. ### 1.0.73 | 2026-06-16 - Added EASM API documentation. ### 1.0.74 | 2026-06-18 - Added Supply Chain Intel Beta API documentation. ### 1.0.75 | 2026-06-19 - Add product limits to Credit Management operations. ### 1.0.76 | 2026-06-25 - Add Supply Chain Intel Beta history endpoints API documentations. ### 1.0.77 | 2026-06-30 - Update Exposure API credentials access fields. ### 1.0.78 | 2026-07-01 - Added the MSSP tenant consumption report download endpoint to Credit Management. ### 1.0.79 | 2026-07-16 - Added information for credit card uniqueness criteria properties. ### 1.0.80 | 2026-07-29 - Removed Beta tags from Supply Chain Intel (vendor-monitor) endpoints. ### 1.0.81 | 2026-07-30 - Added EASM API documentation. ### 1.0.82 | 2026-08-26 - Added Automations API documentation. ### 1.0.83 | 2026-09-11 - Removed stale "sources" field from customer-credentials documentation. - Added documentation for the lookalike-domains endpoint. ### 1.0.84 | 2026-10-08 - Added VIP face picture upload and removal, VIP selfie holding document upload and VIP SafeShare form link generation endpoints to the Assets API. - Documented `VIP` asset support in the Assets API: `executives` monitoring, VIP property keys and capabilities. ### 1.0.85 | 2026-10-14 - Removed the legacy Credit Card Exposure - For Issuers API documentation (`GET /cardcast/credit-card-exposures` and its webhooks). Use the Exposure API and the Axur Platform webhooks instead. ### 1.0.86 | 2026-10-23 - Added the `infostealer` category to the Exposure API documentation: stealer log fields, record tables retrieved through the `include` parameter, and request and response examples. ### 1.0.87 | 2026-11-03 - Removed the retired HTTP Feed API documentation (`POST /http-feed/1.0/content-feed`). To submit suspicious URLs, use the Web complaints API instead. paths: /assets-api/customers/{customerKey}/asset: post: operationId: createAssetForCustomer summary: Create Asset by Customer tags: - Assets description: | **What this does:** creates a new asset for a specific customer tenant. **When to use:** when you already know the exact `customerKey`. **Minimum required data:** `type` and valid fields for that type (`name` is required for most types). > **Note:** in this endpoint, `properties` is a flat JSON object (e.g. `{"brandSize": "enterprise"}`). This differs from the `PATCH /properties/add` and `PATCH /properties/remove` endpoints, which use an array of `{"key": "...", "value": "..."}` objects. > **Important:** for `TRACKING_TOKEN`, do not send `name`. It is auto-generated by the backend. **Most common errors and how to fix:** - `400`: invalid asset type/monitoring/property. Validate payload against allowed values. - `409`: duplicated or conflicting asset data. Check if asset already exists. parameters: - name: customerKey in: path required: true description: Customer identifier. Use [Retrieve Customers](#operation/getCustomersLite) to list valid keys. schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AssetsApiCreateAssetRequest' examples: brand: summary: BRAND with monitoring and brand properties value: type: BRAND name: AXUR monitoring: - phishing - malware - fake-social-media-profile properties: officialWebsite: https://www.axur.com brandSize: enterprise nameVariations: - axur security tins: - '12345678000190' primaryLocale: - BR:pt additionalLocale: - US:en brandWithTakedown: summary: BRAND with takedown capability enabled on creation value: type: BRAND name: AXUR monitoring: - phishing - malware properties: officialWebsite: https://www.axur.com brandSize: enterprise nameVariations: - axur security primaryLocale: - BR:pt capabilities: takedown: enabled: true properties: country: BR corporateName: Axur S.A. registrationNumber: '900000000' registrationUrl: https://busca.inpi.gov.br/pePI/servlet/MarcasServletController?Action=detail&CodPedido=900000000 registrationCategory: '25' registrationOffice: INPI instagram: https://www.instagram.com/axaboratech facebook: https://www.facebook.com/axaboratech tiktok: https://www.tiktok.com/@axaboratech x: https://x.com/axaboratech brandWithTakedownNoRegistration: summary: BRAND with takedown capability (no brand registration) value: type: BRAND name: AXUR monitoring: - phishing - malware properties: officialWebsite: https://www.axur.com brandSize: enterprise nameVariations: - axur security primaryLocale: - BR:pt capabilities: takedown: enabled: true properties: country: BR corporateName: Marca Exemplo Ltda noBrandRegistration: true legalExistenceDetails: "Company incorporated in 2015, CNPJ 12.123.678/0001-90, no trademark registration filed yet." domain: summary: DOMAIN with domain monitoring value: type: DOMAIN name: axur.com monitoring: - credentials:user - credentials:employee - code-secret-leak - mentions - cti:infrastructure thirdPartyPage: summary: THIRD_PARTY_PAGE value: type: THIRD_PARTY_PAGE name: facebook.com/axur monitoring: - credentials:employee app: summary: APP value: type: APP name: com.axur.app monitoring: - credentials:user trackingToken: summary: TRACKING_TOKEN with tokenName property value: type: TRACKING_TOKEN monitoring: - database-exposure properties: tokenName: MAIL bin: summary: BIN with incomplete card flag value: type: BIN name: '123456' monitoring: - credit-card-exposure properties: incompleteCreditCardEnabled: true ip: summary: IP value: type: IP name: 203.0.113.10 monitoring: - cti:infrastructure responses: '201': description: Created content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/customers/ACME/asset' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"type": "BRAND", "name": "AXUR", "monitoring": ["phishing", "malware"], "properties": {"nameVariations": ["axur security"], "primaryLocale": ["BR:pt"]}}' - lang: json label: Payload source: | { "type": "BRAND", "name": "AXUR", "monitoring": ["phishing", "malware"], "properties": { "nameVariations": ["axur security"], "primaryLocale": ["BR:pt"] } } /assets-api/asset: post: operationId: createAssetUsingTokenCustomer summary: Create Asset in Authenticated User Main Tenant tags: - Assets description: | **What this does:** creates a new asset in the authenticated user's main tenant. **When to use:** when your integration always works in the tenant from the token. **Minimum required data:** `type` and valid fields for that type. > **Note:** in this endpoint, `properties` is a flat JSON object (e.g. `{"brandSize": "enterprise"}`). This differs from the `PATCH /properties/add` and `PATCH /properties/remove` endpoints, which use an array of `{"key": "...", "value": "..."}` objects. > **Important:** for `TRACKING_TOKEN`, do not send `name`. It is auto-generated by the backend. **Most common errors and how to fix:** - `400`: invalid payload. Check required fields by asset type. - `403`: user cannot create assets in current tenant. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AssetsApiCreateAssetRequest' examples: brand: summary: BRAND with monitoring and brand properties value: type: BRAND name: AXUR monitoring: - phishing - malware - fake-social-media-profile properties: officialWebsite: https://www.axur.com brandSize: enterprise nameVariations: - axur security tins: - '12345678000190' primaryLocale: - BR:pt additionalLocale: - US:en brandWithTakedown: summary: BRAND with takedown capability enabled on creation value: type: BRAND name: AXUR monitoring: - phishing - malware properties: officialWebsite: https://www.axur.com brandSize: enterprise nameVariations: - axur security primaryLocale: - BR:pt capabilities: takedown: enabled: true properties: country: BR corporateName: Axur S.A. registrationNumber: '900000000' registrationUrl: https://busca.inpi.gov.br/pePI/servlet/MarcasServletController?Action=detail&CodPedido=900000000 registrationCategory: '25' registrationOffice: INPI instagram: https://www.instagram.com/axaboratech facebook: https://www.facebook.com/axaboratech tiktok: https://www.tiktok.com/@axaboratech x: https://x.com/axaboratech brandWithTakedownNoRegistration: summary: BRAND with takedown capability (no brand registration) value: type: BRAND name: AXUR monitoring: - phishing - malware properties: officialWebsite: https://www.axur.com brandSize: enterprise nameVariations: - axur security primaryLocale: - BR:pt capabilities: takedown: enabled: true properties: country: BR corporateName: Marca Exemplo Ltda noBrandRegistration: true legalExistenceDetails: "Company incorporated in 2015, CNPJ 12.123.678/0001-90, no trademark registration filed yet." domain: summary: DOMAIN with domain monitoring value: type: DOMAIN name: axur.com monitoring: - credentials:user - credentials:employee - code-secret-leak - mentions - cti:infrastructure thirdPartyPage: summary: THIRD_PARTY_PAGE value: type: THIRD_PARTY_PAGE name: facebook.com/axur monitoring: - credentials:employee app: summary: APP value: type: APP name: com.axur.app monitoring: - credentials:user trackingToken: summary: TRACKING_TOKEN with tokenName property value: type: TRACKING_TOKEN monitoring: - database-exposure properties: tokenName: MAIL bin: summary: BIN with incomplete card flag value: type: BIN name: '123456' monitoring: - credit-card-exposure properties: incompleteCreditCardEnabled: true ip: summary: IP value: type: IP name: 203.0.113.10 monitoring: - cti:infrastructure responses: '201': description: Created content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/asset' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"type": "BRAND", "name": "AXUR", "monitoring": ["phishing", "malware"], "properties": {"nameVariations": ["axur security"], "primaryLocale": ["BR:pt"]}}' - lang: json label: Payload source: | { "type": "BRAND", "name": "AXUR", "monitoring": ["phishing", "malware"], "properties": { "nameVariations": ["axur security"], "primaryLocale": ["BR:pt"] } } /assets-api/assets: get: operationId: retrieveAssets summary: Retrieve Assets tags: - Assets description: | **What this does:** lists assets with optional filters and pagination. **When to use:** to build search, listing and synchronization screens. **Minimum required data:** none. You can call without filters. **Example usage:** - `?customerKey=ACME&page=1&perPage=20` - `?type=BRAND,DOMAIN&status=ACTIVE` **Most common errors and how to fix:** - `400`: invalid query value (page/perPage/filter format). parameters: - name: customerKey in: query required: false description: Customer identifier. Use [Retrieve Customers](#operation/getCustomersLite) to list valid keys. schema: type: string - name: assetKey in: query required: false schema: type: string - name: type in: query required: false schema: type: string description: Comma-separated list of asset types. - name: status in: query required: false schema: type: string description: Comma-separated list of asset statuses. - name: term in: query required: false schema: type: string - name: monitoring in: query required: false schema: type: string description: Comma-separated list of monitoring ids. - name: page in: query required: false schema: type: integer default: 1 minimum: 1 - name: perPage in: query required: false schema: type: integer default: 20 minimum: 1 maximum: 100 responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiRetrieveAssetsResponse' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets?customerKey=ACME&page=1&perPage=20' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /assets-api/assets/{assetKey}: get: operationId: retrieveAssetByKey summary: Retrieve Asset by Key tags: - Assets description: | **What this does:** retrieves one asset by its key. **When to use:** detail view or validation before updates. **Most common errors and how to fix:** - `400`: invalid `assetKey` format. Asset keys must be alphanumeric (max 8 characters). - `404`: the informed `assetKey` does not exist for accessible tenants. parameters: - name: assetKey in: path required: true description: Asset identifier. Must be alphanumeric (max 8 characters). schema: type: string responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/MYASSET' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /assets-api/customers/{customerKey}/monitoring: get: operationId: retrieveAvailableMonitoringByCustomer summary: Retrieve Customer Monitoring tags: - Assets description: | **What this does:** returns monitoring availability and usage for the customer. **When to use:** before adding monitoring to avoid unsupported or exhausted options. **Most common errors and how to fix:** - `404`: customer not found. parameters: - name: customerKey in: path required: true description: Customer identifier. Use [Retrieve Customers](#operation/getCustomersLite) to list valid keys. schema: type: string responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiMonitoringAvailabilityResponse' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/customers/ACME/monitoring' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /assets-api/assets/{assetKey}/monitoring/add: patch: operationId: addMonitoringToAsset summary: Add Monitoring to Asset tags: - Assets description: | **What this does:** adds monitoring ids to an existing asset. **When to use:** after asset creation or when extending monitoring scope. Allowed monitoring ids by asset type: - `BRAND`: `phishing`, `malware`, `paid-search`, `fraudulent-brand-use`, `fake-social-media-profile`, `fake-mobile-app`, `similar-domain-name`, `unauthorized-distribution`, `unauthorized-sale`, `dw-activity`, `other-sensitive-data` - `DOMAIN`: `credentials:user`, `credentials:employee`, `code-secret-leak`, `mentions`, `cti:infrastructure` - `THIRD_PARTY_PAGE`: `credentials:employee` - `APP`: `credentials:user` - `TRACKING_TOKEN`: `database-exposure` - `BIN`: `credit-card-exposure` - `IP`: `cti:infrastructure` - `VIP`: `executives` **Prerequisites:** some monitoring types require specific properties to be set on the asset before they can be added: - `fake-mobile-app` requires property `appIdsGooglePlay` (array of Google Play application IDs). **Most common errors and how to fix:** - `400`: monitoring id not allowed for this asset type, or a required property for the monitoring type is missing (e.g., adding `fake-mobile-app` without `appIdsGooglePlay`). - `409`: monitoring already configured or conflicting state. parameters: - name: assetKey in: path required: true description: Asset identifier. Must be alphanumeric (max 8 characters). schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AssetsApiMonitoringActionRequest' examples: brand: summary: BRAND value: monitoring: - phishing - malware - paid-search - fraudulent-brand-use - fake-social-media-profile - fake-mobile-app - similar-domain-name - unauthorized-distribution - unauthorized-sale - dw-activity - other-sensitive-data domain: summary: DOMAIN value: monitoring: - credentials:user - credentials:employee - code-secret-leak - mentions - cti:infrastructure thirdPartyPage: summary: THIRD_PARTY_PAGE value: monitoring: - credentials:employee app: summary: APP value: monitoring: - credentials:user trackingToken: summary: TRACKING_TOKEN value: monitoring: - database-exposure bin: summary: BIN value: monitoring: - credit-card-exposure ip: summary: IP value: monitoring: - cti:infrastructure responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/MYASSET/monitoring/add' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"monitoring": ["phishing", "malware"]}' - lang: json label: Payload source: | { "monitoring": ["phishing", "malware"] } /assets-api/assets/{assetKey}/monitoring/remove: patch: operationId: removeMonitoringFromAsset summary: Remove Monitoring from Asset tags: - Assets description: | **What this does:** removes monitoring ids from an existing asset. **When to use:** when monitoring is no longer required. Allowed monitoring ids by asset type: - `BRAND`: `phishing`, `malware`, `paid-search`, `fraudulent-brand-use`, `fake-social-media-profile`, `fake-mobile-app`, `similar-domain-name`, `unauthorized-distribution`, `unauthorized-sale`, `dw-activity`, `other-sensitive-data` - `DOMAIN`: `credentials:user`, `credentials:employee`, `code-secret-leak`, `mentions`, `cti:infrastructure` - `THIRD_PARTY_PAGE`: `credentials:employee` - `APP`: `credentials:user` - `TRACKING_TOKEN`: `database-exposure` - `BIN`: `credit-card-exposure` - `IP`: `cti:infrastructure` - `VIP`: `executives` **Most common errors and how to fix:** - `400`: invalid monitoring id or payload. - `409`: monitoring state conflict. parameters: - name: assetKey in: path required: true description: Asset identifier. Must be alphanumeric (max 8 characters). schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AssetsApiMonitoringActionRequest' examples: brand: summary: BRAND value: monitoring: - phishing - malware - paid-search - fraudulent-brand-use - fake-social-media-profile - fake-mobile-app - similar-domain-name - unauthorized-distribution - unauthorized-sale - dw-activity - other-sensitive-data domain: summary: DOMAIN value: monitoring: - credentials:user - credentials:employee - code-secret-leak - mentions - cti:infrastructure thirdPartyPage: summary: THIRD_PARTY_PAGE value: monitoring: - credentials:employee app: summary: APP value: monitoring: - credentials:user trackingToken: summary: TRACKING_TOKEN value: monitoring: - database-exposure bin: summary: BIN value: monitoring: - credit-card-exposure ip: summary: IP value: monitoring: - cti:infrastructure responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/MYASSET/monitoring/remove' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"monitoring": ["phishing"]}' - lang: json label: Payload source: | { "monitoring": ["phishing"] } /assets-api/assets/{assetKey}/properties/add: patch: operationId: addPropertiesToAsset summary: Add Properties to Asset tags: - Assets description: | **What this does:** adds or updates property key/value pairs on an asset. **When to use:** when enriching asset metadata used by monitoring and workflows. > **Note:** in this endpoint, `properties` is an array of `{"key": "...", "value": "..."}` objects. This differs from the create asset endpoints (`POST /asset` and `POST /customers/{customerKey}/asset`), where `properties` is a flat JSON object. **Most common errors and how to fix:** - `400`: invalid property key/value for this asset type. parameters: - name: assetKey in: path required: true description: Asset identifier. Must be alphanumeric (max 8 characters). schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AssetsApiPropertiesActionRequest' examples: brand-official-website: summary: Add BRAND officialWebsite (string) value: properties: - key: officialWebsite value: "https://www.example.com" brand-name-variations: summary: Add BRAND nameVariations (array of strings) value: properties: - key: nameVariations value: ["Example Brand", "Example Inc"] brand-multiple: summary: Add multiple BRAND properties at once value: properties: - key: officialWebsite value: "https://www.example.com" - key: brandSize value: "enterprise" - key: primaryLocale value: ["BR:pt"] - key: additionalLocale value: ["US:en", "PT:pt-PT"] - key: tins value: ["12345678000199"] domain: summary: Add DOMAIN credential uniqueness criteria value: properties: - key: employeeCredentialUniquenessCriteria value: "email" tracking-token: summary: Add TRACKING_TOKEN tokenName value: properties: - key: tokenName value: "MAIL" bin: summary: Add BIN incompleteCreditCardEnabled (boolean) value: properties: - key: incompleteCreditCardEnabled value: true responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' x-codeSamples: - lang: cURL label: cURL source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/ASTKEYXX/properties/add' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "properties": [ {"key": "brandSize", "value": "enterprise"}, {"key": "officialWebsite", "value": "https://www.example.com"} ] }' - lang: json label: Payload source: | { "properties": [ {"key": "brandSize", "value": "enterprise"}, {"key": "officialWebsite", "value": "https://www.example.com"} ] } /assets-api/assets/{assetKey}/properties/remove: patch: operationId: removePropertiesFromAsset summary: Remove Properties from Asset tags: - Assets description: | **What this does:** removes property key/value pairs from an asset. **When to use:** cleanup of obsolete metadata. > **Note:** in this endpoint, `properties` is an array of `{"key": "...", "value": "..."}` objects. This differs from the create asset endpoints (`POST /asset` and `POST /customers/{customerKey}/asset`), where `properties` is a flat JSON object. **Most common errors and how to fix:** - `400`: invalid property payload format. parameters: - name: assetKey in: path required: true description: Asset identifier. Must be alphanumeric (max 8 characters). schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AssetsApiPropertiesActionRequest' examples: brand: summary: Remove BRAND properties value: properties: - key: officialWebsite value: "https://www.old-website.com" responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' x-codeSamples: - lang: cURL label: cURL source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/ASTKEYXX/properties/remove' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "properties": [ {"key": "officialWebsite", "value": "https://www.old-website.com"} ] }' - lang: json label: Payload source: | { "properties": [ {"key": "officialWebsite", "value": "https://www.old-website.com"} ] } /assets-api/assets/{assetKey}/logos: post: operationId: uploadAssetLogos summary: Upload Asset Logos tags: - Assets description: | **What this does:** uploads one or more logos for a BRAND asset. **When to use:** improve brand matching and visual analysis. **Minimum required data:** at least one binary file sent as `multipart/form-data`. The field name is flexible — any name is accepted (e.g., `logos`, `file`, or even an empty name). **File restrictions:** - **Accepted formats:** PNG (`image/png`, `.png`) and JPEG (`image/jpeg`, `.jpg`, `.jpeg`) only. - **Maximum file size:** 10 MB per file. - **Content validation:** the file content is validated by its magic bytes (file signature), not just the extension. A file with a valid extension but invalid content (e.g., a renamed SVG or GIF) will be rejected with `400 Bad Request`. parameters: - name: assetKey in: path required: true description: Asset identifier. Must be alphanumeric (max 8 characters). schema: type: string requestBody: required: true content: multipart/form-data: schema: type: object properties: logos: type: array description: "Logo files. Accepted formats: PNG, JPEG. Max 10 MB per file." items: type: string format: binary responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/ASTKEYXX/logos' \ --header 'Authorization: Bearer ' \ --form 'logos=@/path/to/logo.png' delete: operationId: removeAssetLogos summary: Remove Asset Logos tags: - Assets description: | **What this does:** removes logo URLs from a BRAND asset. **When to use:** remove outdated or incorrect logo references. **How to get logo URLs:** call `GET /assets/{assetKey}` and read the `properties.logos` array from the response. parameters: - name: assetKey in: path required: true description: Asset identifier. Must be alphanumeric (max 8 characters). schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AssetsApiRemoveLogosRequest' responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' x-codeSamples: - lang: cURL label: cURL source: | curl --request DELETE \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/ASTKEYXX/logos' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "logos": ["https://cdn.example.com/logo.png"] }' - lang: json label: Payload source: | { "logos": ["https://cdn.example.com/logo.png"] } /assets-api/assets/{assetKey}/face-pictures: post: operationId: uploadVipFacePicture summary: Upload VIP Face Picture tags: - Assets description: | **What this does:** uploads one face picture to a VIP asset and appends it to the existing profile pictures. **When to use:** to add a profile picture to a VIP asset without resending the pictures it already has. **Minimum required data:** exactly one image file sent as `multipart/form-data`. **Requirements:** - The asset must be a `VIP` asset. - A VIP asset can have at most 10 profile pictures. **File restrictions:** - **Maximum file size:** 5 MB. - **Content validation:** the picture is validated by face detection and rejected when it does not contain a single, clearly visible face. **Most common errors and how to fix:** - `400` `param.invalid`: zero files or more than one file was sent. Send exactly one file. - `400` `asset.face_picture.too_large`: the file is larger than 5 MB. - `400` `vip.face_picture.invalid`: the picture did not pass face validation. The `context` identifies the rejected file and the reason, as `{"errors": {"": ""}}` or `{"filename": ""}` when the image could not be read. - `400` `asset.not-vip-category`: the asset is not a `VIP` asset. - `400` `asset.property.quantity.exceeded`: the asset already reached the maximum of 10 profile pictures. - `403`: you do not have access to the asset. - `404`: asset not found for accessible tenants. parameters: - name: assetKey in: path required: true description: Asset identifier. Must be alphanumeric (max 8 characters). schema: type: string requestBody: required: true content: multipart/form-data: schema: type: object properties: file: type: string format: binary description: "Face picture. Exactly one file. Max 5 MB." responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/ASTKEYXX/face-pictures' \ --header 'Authorization: Bearer ' \ --form 'file=@/path/to/face.jpg' /assets-api/assets/{assetKey}/face-pictures/remove: patch: operationId: removeVipFacePictures summary: Remove VIP Face Pictures tags: - Assets description: | **What this does:** removes face pictures from a VIP asset. The removed files are deleted. **When to use:** remove outdated or incorrect profile pictures. **How to get picture URLs:** call `GET /assets/{assetKey}` and read the `properties.vipProfilePictures` array from the response. **Minimum required data:** `facePictures` with at least one picture URL. URLs that do not belong to the asset are ignored. **Requirements:** - The asset must be a `VIP` asset. **Most common errors and how to fix:** - `400` `param.invalid`: `facePictures` is missing or empty. Send at least one picture URL. - `400` `asset.not-vip-category`: the asset is not a `VIP` asset. - `403`: you do not have access to the asset. - `404` `asset.permission.denied`: asset not found for accessible tenants. parameters: - name: assetKey in: path required: true description: Asset identifier. Must be alphanumeric (max 8 characters). schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AssetsApiRemoveFacePicturesRequest' responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' x-codeSamples: - lang: cURL label: cURL source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/ASTKEYXX/face-pictures/remove' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "facePictures": ["https://cdn.example.com/face.png"] }' - lang: json label: Payload source: | { "facePictures": ["https://cdn.example.com/face.png"] } /assets-api/assets/{assetKey}/deactivate: put: operationId: deactivateAssetByKey summary: Deactivate Asset by Key tags: - Assets description: | **What this does:** deactivates one asset. **When to use:** stop monitoring and operational use for a specific asset. > **Note:** there is no dedicated reactivation endpoint. A deactivated asset is automatically reactivated when you add a valid monitoring or enable the takedown capability on it. **Most common errors and how to fix:** - `404`: the informed `assetKey` does not exist for accessible tenants. parameters: - name: assetKey in: path required: true description: Asset identifier. Must be alphanumeric (max 8 characters). schema: type: string responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiDeactivateAssetsResponse' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/MYASSET/deactivate' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /assets-api/assets/deactivate: put: operationId: deactivateAssetsInBulk summary: Deactivate Assets in Bulk tags: - Assets description: | **What this does:** deactivates multiple assets in one request. **When to use:** bulk maintenance or large tenant cleanup. > **Note:** there is no dedicated reactivation endpoint. A deactivated asset is automatically reactivated when you add a valid monitoring or enable the takedown capability on it. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AssetsApiDeactivateAssetsRequest' responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiDeactivateAssetsResponse' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/deactivate' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"assetKeys": ["MYASSET", "MYASSET2"]}' - lang: json label: Payload source: | { "assetKeys": ["MYASSET", "MYASSET2"] } /assets-api/assets/{assetKey}/capabilities/{capability}/enable: patch: operationId: enableAssetCapability summary: Enable Asset Capability tags: - Assets description: | **What this does:** enables a capability on a BRAND asset and sets its properties. **When to use:** to activate takedown support for a brand asset. **Currently supported capabilities:** `takedown`. **Property requirements for takedown (two scenarios):** - Always required: `country`, `corporateName`. - **Brand with registration** (default): `registrationNumber`, `registrationUrl`, `registrationCategory`, `registrationOffice`. - **Brand without registration**: set `noBrandRegistration` to `true` and provide `legalExistenceDetails`. Registration fields are not needed and are silently discarded. - Optional: `instagram`, `facebook`, `tiktok`, `x` (must be valid URLs for the respective platforms). **URL auto-normalization:** `registrationUrl` and social media URLs without a protocol are automatically prefixed with `https://`. **Most common errors and how to fix:** - `400`: invalid capability, missing required properties, or invalid URL format. - `403`: customer does not have the capability licensed. - `404`: asset not found. parameters: - name: assetKey in: path required: true schema: type: string - name: capability in: path required: true description: "Capability identifier. Currently only `takedown` is supported." schema: type: string enum: - takedown requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AssetsApiEnableCapabilityRequest' examples: takedownWithRegistration: summary: Enable takedown with brand registration value: properties: country: BR corporateName: Axur S.A. registrationNumber: '900000000' registrationUrl: https://busca.inpi.gov.br/pePI/servlet/MarcasServletController?Action=detail&CodPedido=900000000 registrationCategory: '25' registrationOffice: INPI instagram: https://www.instagram.com/axaboratech facebook: https://www.facebook.com/axaboratech tiktok: https://www.tiktok.com/@axaboratech x: https://x.com/axaboratech takedownWithRegistrationMinimal: summary: Enable takedown with registration (minimal) value: properties: country: US corporateName: Acme Corporation registrationNumber: '97123456' registrationUrl: https://tsdr.uspto.gov/documentviewer?caseId=97123456 registrationCategory: '35' registrationOffice: USPTO takedownWithoutRegistration: summary: Enable takedown without brand registration value: properties: country: BR corporateName: Marca Exemplo Ltda noBrandRegistration: true legalExistenceDetails: "Company incorporated in 2015, CNPJ 12.345.678/0001-90, no trademark registration filed yet." responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '401': description: Unauthorized '403': description: Forbidden '404': description: Not Found x-codeSamples: - lang: cURL label: cURL source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/ASTKEYXX/capabilities/takedown/enable' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "properties": { "country": "BR", "corporateName": "Axur S.A.", "registrationNumber": "900000000", "registrationUrl": "https://busca.inpi.gov.br/pePI/servlet/MarcasServletController?Action=detail&CodPedido=900000000", "registrationCategory": "25", "registrationOffice": "INPI" } }' - lang: json label: Payload source: | { "properties": { "country": "BR", "corporateName": "Axur S.A.", "registrationNumber": "900000000", "registrationUrl": "https://busca.inpi.gov.br/pePI/servlet/MarcasServletController?Action=detail&CodPedido=900000000", "registrationCategory": "25", "registrationOffice": "INPI" } } /assets-api/assets/{assetKey}/capabilities/{capability}/disable: patch: operationId: disableAssetCapability summary: Disable Asset Capability tags: - Assets description: | **What this does:** disables a capability on a BRAND asset. **When to use:** to deactivate takedown support for a brand asset. Existing properties are preserved but the capability becomes inactive. **Currently supported capabilities:** `takedown`. parameters: - name: assetKey in: path required: true schema: type: string - name: capability in: path required: true description: "Capability identifier. Currently only `takedown` is supported." schema: type: string enum: - takedown responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '401': description: Unauthorized '403': description: Forbidden '404': description: Not Found x-codeSamples: - lang: cURL label: cURL source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/MYASSET/capabilities/takedown/disable' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /assets-api/assets/{assetKey}/capabilities/takedown/brand-registry-files: post: operationId: uploadBrandRegistryFile summary: Upload Brand Registry File tags: - Assets description: | **What this does:** uploads a brand registry file (PDF) for a takedown-enabled BRAND asset. **When to use:** to attach an official brand registration document that supports takedown requests. **Requirements:** exactly one PDF file must be sent. **File restrictions:** - **Accepted format:** PDF (`application/pdf`, `.pdf`) only. - **Maximum file size:** 10 MB. - **Content validation:** the file content is validated by its magic bytes (`%PDF-` signature), not just the extension. A file with a `.pdf` extension but invalid content will be rejected with `400 Bad Request`. parameters: - name: assetKey in: path required: true schema: type: string requestBody: required: true content: multipart/form-data: schema: type: object properties: file: type: string format: binary description: "Brand registry file. Accepted format: PDF only. Max 10 MB." responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '401': description: Unauthorized '403': description: Forbidden '404': description: Not Found x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/ASTKEYXX/capabilities/takedown/brand-registry-files' \ --header 'Authorization: Bearer ' \ --form 'file=@/path/to/brand-registry.pdf' - lang: json label: Payload source: | { "file": "" } delete: operationId: removeBrandRegistryFiles summary: Remove Brand Registry Files tags: - Assets description: | **What this does:** removes brand registry file URL from a takedown-enabled BRAND asset. **When to use:** to remove outdated or incorrect brand registration document. parameters: - name: assetKey in: path required: true schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AssetsApiRemoveBrandRegistryFilesRequest' responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '401': description: Unauthorized '403': description: Forbidden '404': description: Not Found x-codeSamples: - lang: cURL label: cURL source: | curl --request DELETE \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/ASTKEYXX/capabilities/takedown/brand-registry-files' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "files": ["https://cdn.example.com/brand-registry.pdf"] }' - lang: json label: Payload source: | { "files": ["https://cdn.example.com/brand-registry.pdf"] } /assets-api/assets/{assetKey}/capabilities/takedown/selfie-holding-document: post: operationId: uploadVipSelfieHoldingDocument summary: Upload VIP Selfie Holding Document tags: - Assets description: | **What this does:** uploads the selfie holding document of a VIP asset, used to support takedown requests. **When to use:** to provide or replace the document that proves the identity of the VIP. **Minimum required data:** exactly one file sent as `multipart/form-data`. **Requirements:** - The asset must be a `VIP` asset. **File restrictions:** - **Maximum file size:** 5 MB. **Asynchronous processing:** the response is `202 Accepted` and returns the asset. The takedown document is created asynchronously by the takedown service. Each upload replaces the previous document. The internal document identifier is not exposed in the response. **Most common errors and how to fix:** - `400` `param.invalid`: zero files or more than one file was sent. Send exactly one file. - `400` `asset.face_picture.too_large`: the file is larger than 5 MB. - `400` `asset.not-vip-category`: the asset is not a `VIP` asset. - `403`: you do not have access to the asset. - `404`: asset not found for accessible tenants. parameters: - name: assetKey in: path required: true description: Asset identifier. Must be alphanumeric (max 8 characters). schema: type: string requestBody: required: true content: multipart/form-data: schema: type: object properties: file: type: string format: binary description: "Selfie holding document. Exactly one file. Max 5 MB." responses: '202': description: Accepted — the takedown document is created asynchronously content: application/json: schema: $ref: '#/components/schemas/AssetsApiAsset' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/ASTKEYXX/capabilities/takedown/selfie-holding-document' \ --header 'Authorization: Bearer ' \ --form 'file=@/path/to/selfie.jpg' /assets-api/assets/{assetKey}/safeshare-form: post: operationId: generateVipSafeShareForm summary: Generate VIP SafeShare Form tags: - Assets description: | Permission Level Needed: Experts/Managers **What this does:** generates the SafeShare form the VIP signs and returns its link. The request takes no body. **When to use:** to get the link you send to the VIP so they sign the authorization form. **Requirements:** - The asset must be a `VIP` asset. **Most common errors and how to fix:** - `400` `asset.not-vip-category`: the asset is not a `VIP` asset. - `403`: you do not have access to the asset or the `exp` permission is missing. - `404` `asset.permission.denied`: asset not found for accessible tenants. parameters: - name: assetKey in: path required: true description: Asset identifier. Must be alphanumeric (max 8 characters). schema: type: string responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/AssetsApiSafeShareForm' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' '403': description: Forbidden — missing/invalid Bearer token or insufficient permissions '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/AssetsApiError' x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/assets-api/assets/ASTKEYXX/safeshare-form' \ --header 'Authorization: Bearer ' - lang: json label: Response source: | { "link": "https://safe-share.axur.com/vip/xxx" } /credit-management-api/customers/{customerKey}/settings: get: operationId: getCreditManagementCustomerSettingsByCustomerKey summary: Retrieve Customer Credit Settings by Customer Key tags: - Credit Management description: | **What this does:** retrieves credit settings for one customer. **When to use:** before changing limits or validating current configuration. **Most common errors and how to fix:** - `404`: customer not found for provided `customerKey`. parameters: - name: customerKey in: path required: true description: Customer identifier. Use [Retrieve Customers](#operation/getCustomersLite) to list valid keys. schema: type: string responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/CreditManagementCustomerSettingsResponse' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/CreditManagementError' '401': description: Unauthorized '403': description: Forbidden '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/CreditManagementError' '500': description: Internal Server Error x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/credit-management-api/customers/ACME/settings' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /credit-management-api/customers/{customerKey}/limit/{monthlyLimit}: patch: operationId: patchCreditManagementCustomerLimitByCustomerKey summary: Update Customer Monthly Limit by Customer Key tags: - Credit Management description: | **What this does:** updates monthly credit limit for one customer. **When to use:** limit adjustment after commercial or operational changes. `monthlyLimit` accepts a numeric value or the literals `unlimited` and `by-product`. Limit `by-product` requires request body with limits. Allowed products are: - `BRAND_PROTECTION` - `DEEP_AND_DARK_WEB` - `ONLINE_PIRACY` - `EXECUTIVES_AND_VIPS` - `DATA_LEAKAGE` - `TAKEDOWN` - `THREAT_HUNTING` - `ART_HOURS` Product limits not present in the request payload are set to `UNLIMITED` by default. **Most common errors and how to fix:** - `400`: invalid `monthlyLimit` value or below allowed consumption. parameters: - name: customerKey in: path required: true description: Customer identifier. Use [Retrieve Customers](#operation/getCustomersLite) to list valid keys. schema: type: string - name: monthlyLimit in: path required: true schema: type: string description: Monthly limit value or the literals `unlimited` and `by-product`. example: '1000' requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/CreditManagementProductLimitsRequest' responses: '204': description: No Content '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/CreditManagementError' '401': description: Unauthorized '403': description: Forbidden '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/CreditManagementError' '500': description: Internal Server Error x-codeSamples: - lang: cURL label: cURL global limit source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/credit-management-api/customers/ACME/limit/1000' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: cURL label: cURL unlimited source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/credit-management-api/customers/ACME/limit/unlimited' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: cURL label: cURL by-product source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/credit-management-api/customers/ACME/limit/by-product' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: json label: Payload (for /by-product limit) source: | { "limits": [ { "product": "BRAND_PROTECTION", "limit": 280, "status": "LIMITED" }, { "product": "DATA_LEAKAGE", "status": "DISABLED" }, { "product": "ONLINE_PIRACY", "status": "UNLIMITED" } ] } /credit-management-api/reports/monthly/{year}/{month}: get: operationId: getCreditManagementMonthlyPartnerUsageReport summary: Retrieve Monthly Partner Usage Report tags: - Credit Management description: | **What this does:** retrieves monthly partner-level usage report. **When to use:** monthly billing, governance and usage audits. If query parameter `customer` is omitted, customer key is resolved from token. **Most common errors and how to fix:** - `400`: invalid year/month format or invalid month range. parameters: - name: year in: path required: true schema: type: integer example: 2026 - name: month in: path required: true schema: type: integer minimum: 1 maximum: 12 example: 2 - name: customer in: query required: false schema: type: string responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/CreditManagementMonthlyPartnerReportResponse' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/CreditManagementError' '401': description: Unauthorized '403': description: Forbidden '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/CreditManagementError' '500': description: Internal Server Error x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/credit-management-api/reports/monthly/2024/01' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /credit-management-api/reports/tenant/{customerKey}: get: operationId: getCreditManagementTenantUsageReportByCustomerKey summary: Retrieve Tenant Usage Report by Customer Key tags: - Credit Management description: | **What this does:** retrieves tenant-level usage report for one customer. **When to use:** customer-level billing follow-up and anomaly analysis. Query parameters `year` and `month` are optional, but must be provided together. If both are omitted, current billing period is used. **Most common errors and how to fix:** - `400`: send `year` and `month` together, or omit both. parameters: - name: customerKey in: path required: true description: Customer identifier. Use [Retrieve Customers](#operation/getCustomersLite) to list valid keys. schema: type: string - name: year in: query required: false schema: type: integer example: 2026 - name: month in: query required: false schema: type: integer minimum: 1 maximum: 12 example: 2 responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/CreditManagementTenantReportResponse' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/CreditManagementError' '401': description: Unauthorized '403': description: Forbidden '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/CreditManagementError' '500': description: Internal Server Error x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/credit-management-api/reports/tenant/ACME' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /credit-tracker/credit-report/mssp-tenant/{customerKey}/download: get: operationId: getCreditReportMsspTenantConsumptionReportDownloadByCustomerKey summary: Download MSSP Tenant Consumption Report by Customer Key tags: - Credit Management description: | **What this does:** downloads a CSV file with the per-tenant credit consumption breakdown for the MSSP account matching `customerKey`, for a given billing period. **When to use:** to get a downloadable breakdown of credit usage by capability (Brand Protection, CTI, Data Leakage, Deep & Dark Web, Online Piracy, Executives & VIPs, Infrastructure, Takedown, Threat Hunting) across the MSSP account for billing review or governance. Permission Level Needed: MSSP Partner Manager Query parameters `year` and `month` are optional, but must be provided together. If both are omitted, current billing period is used. If `customerKey` does not match any tenant, the response is still `200` with a CSV containing only the header row. **Most common errors and how to fix:** - `400`: send `year` and `month` together, or omit both. - `403`: requester lacks MSSP management access to the given customer. parameters: - name: customerKey in: path required: true description: Customer identifier. Use [Retrieve Customers](#operation/getCustomersLite) to list valid keys. schema: type: string - name: year in: query required: false schema: type: integer example: 2026 - name: month in: query required: false schema: type: integer minimum: 1 maximum: 12 example: 5 responses: '200': description: Success content: text/csv: schema: type: string format: binary description: CSV file with the MSSP tenant credit consumption report. '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/CreditManagementError' '401': description: Unauthorized '403': description: Forbidden '500': description: Internal Server Error x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/credit-tracker/credit-report/mssp-tenant/ACME/download?year=2026&month=5' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /customers-api/customer: post: tags: - Customers summary: Create customer description: | **What this does:** creates a new MSSP customer tenant. **When to use:** onboarding a new customer. Permission Level Needed: MSSP Partner Manager **Minimum payload:** `customer.name` is required. **Asset is optional:** if `asset` is not sent, the API automatically creates a `BRAND` asset using the customer name. You can also request automatic asset creation as: - `BRAND` (example: send `asset.name` and optionally `asset.website`) - `DOMAIN` (example: send `asset.domain`) The `user` object is optional and can be omitted. **Important:** setting `customer.ctiEnabled` to `true` activates the CTI workspace and generates credit consumption. **Most common errors and how to fix:** - `400`: malformed payload or invalid object structure. - `403`: authenticated user does not have manager permission. operationId: createCustomer parameters: - in: header name: Authorization schema: type: string example: Bearer required: true requestBody: required: true content: application/json: schema: type: object required: - customer properties: customer: type: object required: - name properties: partnerKey: type: string example: P1 name: type: string example: External Customer segment: type: string description: "Supported values: FOOD_BEVERAGE, EDUCATION, POWER_CHEMISTRY, FINANCIAL_INSURANCE, LAW, MANUFACTURE, HEALTHCARE, REAL_ESTATE_SERVICES, PUBLIC_SECTOR_NGOS, TECHNOLOGY, TELECOMMUNICATIONS, TRANSPORT_LOGISTICS, TRAVEL_TOURISM, RETAIL_ECOMMERCE." enum: - FOOD_BEVERAGE - EDUCATION - POWER_CHEMISTRY - FINANCIAL_INSURANCE - LAW - MANUFACTURE - HEALTHCARE - REAL_ESTATE_SERVICES - PUBLIC_SECTOR_NGOS - TECHNOLOGY - TELECOMMUNICATIONS - TRANSPORT_LOGISTICS - TRAVEL_TOURISM - RETAIL_ECOMMERCE example: EDUCATION ctiEnabled: type: boolean example: true description: If true, activates CTI workspace and generates credit consumption. billingCountry: type: string description: "Supported values: values following ISO 3166-1 alpha-2 standard." example: US asset: type: object description: Optional. If omitted, a BRAND asset is automatically created with the customer name. properties: type: type: string example: BRAND name: type: string example: External Brand website: type: string example: https://example.com domain: type: string example: example.com user: type: object description: Optional. properties: name: type: string example: Jane Doe email: type: string example: jane.doe@example.com examples: minimumPayload: summary: Minimum payload (customer only) value: customer: name: Acme Corporation segment: EDUCATION automaticBrandAsset: summary: Automatic BRAND asset creation value: customer: partnerKey: P1 name: Acme Corporation segment: EDUCATION ctiEnabled: false asset: name: Acme Brand website: https://www.acme.com automaticDomainAsset: summary: Automatic DOMAIN asset creation value: customer: partnerKey: P1 name: Acme Corporation segment: EDUCATION ctiEnabled: true asset: domain: acme.com responses: '201': description: Created content: application/json: schema: type: object example: customerKey: EXTC name: External Customer category: MSSP_TENANT '400': description: Bad Request '403': description: Forbidden '404': description: Not Found x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/customers-api/customer' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"customer": {"name": "ACME Corp"}}' - lang: json label: Payload source: | { "customer": { "name": "ACME Corp", "segment": "EDUCATION" } } /customers-api/customers: get: tags: - Customers summary: Retrieve Customers description: | **What this does:** lists customers available to the authenticated user with lightweight metadata. **When to use:** before calling endpoints that require `customerKey`. Permission Level Needed: MSSP Partner Manager **Most common errors and how to fix:** - `403`: authenticated user does not have manager permission. operationId: getCustomersLite parameters: - in: header name: Authorization schema: type: string example: Bearer required: true responses: '200': description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/CustomersApiCustomerLite' examples: customers: summary: Example customer list value: - name: Acme Corp key: ACME active: true suspended: false category: MSSP_TENANT parentCustomerKey: AXURP childTenantCount: 3 - name: Beta Industries key: BETA active: true suspended: false category: MSSP_TENANT parentCustomerKey: AXURP childTenantCount: 0 '401': description: Unauthorized '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/customers-api/customers' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /customers-api/tenant/{key}/suspend: post: tags: - Customers summary: Suspend MSSP tenant description: | **What this does:** suspends an existing MSSP tenant. **When to use:** temporarily block activity that can generate credit consumption. Permission Level Needed: MSSP Partner Manager Suspends the tenant by disabling all asset monitorings and user activity, keeping the customer blocked for actions that could generate credit consumption. **Most common errors and how to fix:** - `404`: tenant key does not exist. operationId: suspendMsspTenant parameters: - in: header name: Authorization schema: type: string example: Bearer required: true - in: path name: key required: true schema: type: string example: T1 responses: '204': description: No Content '400': description: Bad Request '403': description: Forbidden '404': description: Not Found x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/customers-api/tenant/ACME/suspend' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /customers-api/tenant/{key}/resume: post: tags: - Customers summary: Resume MSSP tenant description: | **What this does:** resumes an already suspended MSSP tenant. **When to use:** re-enable customer operations and monitoring. Permission Level Needed: MSSP Partner Manager Reverts suspension by re-enabling monitorings and user activity, and unblocking the customer for actions that may generate credit consumption. **Most common errors and how to fix:** - `404`: tenant key does not exist. operationId: resumeMsspTenant parameters: - in: header name: Authorization schema: type: string example: Bearer required: true - in: path name: key required: true schema: type: string example: T1 responses: '204': description: No Content '400': description: Bad Request '403': description: Forbidden '404': description: Not Found x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/customers-api/tenant/ACME/resume' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /identity/users: get: tags: - Users summary: Get Users description: | Permission Level Needed: Managers Get user by parameters. operationId: getUsers parameters: - in: header name: Authorization schema: type: string example: Bearer required: true - in: query name: customers schema: type: string example: ACM1,ACM2 required: false - in: query name: accessToAreas schema: type: string example: area1,area1 required: false - in: query name: freeText schema: type: string example: freetext required: false - in: query name: offset schema: type: integer example: 1 - in: query name: pageSize schema: type: integer example: 10 responses: '200': description: success. content: application/json: schema: type: array items: type: object example: - id: value: 1 credentials: email: example@acme.com customer: key: ACM policies: - resource: asset:* profile: name: first: Example last: Last language: pt createdAt: 1577890800000 groups: - key: value: admin roles: - key: role1 roles: - key: tst internal: false active: true twoFactorEnabled: false lgpd: accepted: true '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/identity/users' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /identity/users/stream: get: tags: - Users summary: Get Users Stream description: | Permission Level Needed: Managers Get user stream by parameters. operationId: getUsersStream parameters: - in: header name: Authorization schema: type: string example: Bearer required: true - in: query name: customers schema: type: string example: ACM1,ACM2 required: false - in: query name: accessToAreas schema: type: string example: area1,area1 required: false - in: query name: freeText schema: type: string example: freetext required: false - in: query name: offset schema: type: integer example: 1 - in: query name: pageSize schema: type: integer example: 10 responses: '200': description: success. content: application/json: schema: type: array items: type: object example: - id: value: 1 credentials: email: example@acme.com customer: key: ACM policies: - resource: asset:* profile: name: first: Example last: Last language: pt createdAt: 1577890800000 groups: - key: value: admin roles: - key: role1 roles: - key: tst internal: false active: true twoFactorEnabled: false lgpd: accepted: true '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/identity/users/stream' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --no-buffer /tickets-api/tickets: get: operationId: retrieveTicketApi summary: Retrieve Tickets tags: - Tickets Api Operations description: | Permission Level Needed: All permission levels Returns ticket matching the specified filter. parameters: - name: current.type in: query description: The filters must be entered via query parameters (see [Examples of usage](#section/Examples-of-usage)). All ticket fields are supported (see [Fields supported by filters](#section/Fields-supported-by-filters)). For example, you could use “current.type=phishing,fraudulent-brand-use¤t.open.date=ge2024-01-01” to get tickets of type “phishing” or “fraudulent-brand-use” and with a date greater than or equal to “2024-01-01”. required: false schema: type: string example: phishing,fraudulent-brand-use - name: page in: query description: Page number schema: type: integer default: 1 example: 1 - name: pageSize in: query description: Page size schema: type: integer default: 50 example: 10 - name: sortBy in: query description: Sort by field schema: type: string example: ticket.creation.date - name: order in: query description: Sort order schema: type: string enum: - desc - asc example: desc - name: timezone in: query description: Use one of the records identified in the UTF Offset column on https://en.wikipedia.org/wiki/Time_zone#List_of_UTC_offsets. The UTC offset will be used to convert the date input via query parameters and the date output via json. schema: type: string example: Z - name: include in: query description: Information about the tickets to be retrieved. Available include parameters are ”fields”, ”snapshots”, ”texts”, ”attachments”. Default is all fields. schema: type: string example: fields,snapshots,texts,attachments responses: '200': description: OK content: application/json: schema: type: object properties: tickets: description: | Depending on the ticket type, some fields may not be present in the response. For example, a ticket of type "executive-credential-leak" may contain metadata about the credentials inside the "snapshots", while others may not have this field. type: array items: type: object example: - ticket: reference: https://fraud.acme.com ticketKey: h7dw97 customerKey: ACME creation.collector: ctlog last-update.date: '2024-03-13T18:20:19-03:00' creation.collection: '6469' creation.originator: collector creation.date: '2024-03-13T06:58:12-03:00' detection: close.date: '2024-03-13T18:20:19-03:00' creation.collector: ctlog open.date: '2024-03-13T06:58:12-03:00' prediction.languages: - EN prediction.has-authentication-form: 'false' isp: Cloudflare, Inc. ip: 104.21.95.254 type: phishing resolution: discarded prediction.main-language: EN resolution.reason: '' assets: - ACME creation.collection: '6469' domain: acme.com creation.originator: collector host: acme.com prediction.risk: '0.58' prediction.brand-logo: '0.0393319' status: closed group: - threat_validation texts: [ ] snapshots: ipFilter: filtering: true countries: [ ] content: title: 404 Not Found httpStatusCode: code: 404 domainInfo: nameServers: hostnames: [ ] ipAddresses: [ ] isp: name: Cloudflare, Inc. location: country: name: United States digitalLocation: url: https://fraud.acme.com host: name: acme.com domain: name: acme.com ip: address: 104.21.95.254 referenceInfo: originalReference: acme.com redirectChain: - http://acme.com - https://acme.com/ finalReference: https://acme.com correlatedLinks: { } attachments: - name: whois_010720241206580687d70f6412_fa73_4518_a03e_a8e8078f6519-e757e47ee0b64370a0d1d70a2ed50c93.txt url: https://api-dit.axreng.com/gateway/1.0/api/files/file/whois_010720241206580687d70f6412_fa73_4518_a03e_a8e8078f6519-e757e47ee0b64370a0d1d70a2ed50c93.txt - name: screenshot_run_mocky_io_1719835651890_257903-618283b816ea4cc28f88882a680fd019.jpg url: https://api-dit.axreng.com/gateway/1.0/api/files/file/screenshot_run_mocky_io_1719835651890_257903-618283b816ea4cc28f88882a680fd019.jpg - name: html_run_mocky_io_1719835652086_29650-0fcaa1120f3a4165999cf297fe280e1f.html url: https://api-dit.axreng.com/gateway/1.0/api/files/file/html_run_mocky_io_1719835652086_29650-0fcaa1120f3a4165999cf297fe280e1f.html - ticket: reference: https://acme1.com/ reup.expires: '1711499974058' ticketKey: e2ma5b customerKey: ACME creation.collector: ctlog last-update.date: '2024-03-13T15:05:50-03:00' creation.originator: collector creation.date: '2024-03-11T09:52:34-03:00' tags: - MOBILE INSPECTION detection: close.date: '2024-03-13T15:05:50-03:00' creation.collector: urlscan open.date: '2024-03-13T06:57:58-03:00' prediction.languages: - PT - EN - IT prediction.has-authentication-form: 'false' isp: Cloudflare ip: 23.227.38.36 domain.registrar: TUCOWS, INC. type: phishing resolution: discarded prediction.main-language: PT resolution.reason: inaccessible assets: - NTS creation.collection: '15296349' domain: netshosoutletoficial.com creation.originator: collector host: netshosoutletoficial.com prediction.risk: '0.75' prediction.brand-logo: '0.17038026' status: closed group: - threat_validation texts: [ ] snapshots: ipFilter: filtering: true countries: [ ] content: title: This store is unavailable httpStatusCode: code: 404 domainInfo: status: Registered registrar: TUCOWS, INC. registrarEmail: domainabuse@tucows.com registrant: Contact Privacy Inc. Customer 0170557109 registrantEmail: netshosoutletoficial.com@contactprivacy.com nameServers: hostnames: - ns-cloud-c1.googledomains.com - ns-cloud-c2.googledomains.com - ns-cloud-c3.googledomains.com - ns-cloud-c4.googledomains.com ipAddresses: [ ] isp: name: Cloudflare location: country: name: Canada digitalLocation: url: https://acme1.com/ host: name: acme1.com domain: name: acme1.com ip: address: 23.227.38.36 referenceInfo: originalReference: https://acme1.com/ redirectChain: [ ] finalReference: https://acme1.com/ correlatedLinks: { } attachments: - name: whois_010720241206580687d70f6412_fa73_4518_a03e_a8e8078f6519-e757e47ee0b64370a0d1d70a2ed50c93.txt url: https://api-dit.axreng.com/gateway/1.0/api/files/file/whois_010720241206580687d70f6412_fa73_4518_a03e_a8e8078f6519-e757e47ee0b64370a0d1d70a2ed50c93.txt - name: screenshot_run_mocky_io_1719835651890_257903-618283b816ea4cc28f88882a680fd019.jpg url: https://api-dit.axreng.com/gateway/1.0/api/files/file/screenshot_run_mocky_io_1719835651890_257903-618283b816ea4cc28f88882a680fd019.jpg - name: html_run_mocky_io_1719835652086_29650-0fcaa1120f3a4165999cf297fe280e1f.html url: https://api-dit.axreng.com/gateway/1.0/api/files/file/html_run_mocky_io_1719835652086_29650-0fcaa1120f3a4165999cf297fe280e1f.html pageable: type: object properties: pageNumber: type: integer example: 1 pageSize: type: integer example: 10 total: type: integer example: 1200 '400': description: Incorret Query Parameters content: application/json: schema: type: object properties: code: type: string message: type: string error: type: boolean examples: /tickets: value: code: 400 message: An error occurred while trying to retrieve your tickets. Please check the query parameters with their respective values. error: true '403': description: FORBIDDEN content: application/json: schema: type: object properties: code: type: integer example: 403 message: type: string example: Forbidden error: type: boolean example: true '429': description: Rate Limit exceded content: application/json: schema: type: object properties: code: type: integer example: 429 message: type: string example: Too many requests! error: type: boolean example: true x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/tickets?open.date=ge:2024-06-01T00:00:00&page=1&pageSize=50&order=asc' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.7 source: | #Remember to replace the 'ticket_query' params and 'token' fields. import requests ticket_query = 'open.date=ge:2024-06-01T13:00:00&open.date=le:2024-06-01T14:00:00&sortBy=open.date&page=1&pageSize=50&order=asc&utc=-03:00' token = '' PATH = f'https://api.axur.com/gateway/1.0/api/tickets-api/tickets?{ticket_query}' header = { 'Content-Type': 'application/json', 'Authorization': str.format("Bearer {}", token) } result = requests.get(PATH, headers=header) print(result.json()) - lang: cURL label: Bash cURL source: | TICKET_QUERY='open.date=ge:2024-06-01T13:00:00&open.date=le:2024-06-01T13:00:30&sortBy=open.date&page=1&pageSize=50&order=asc&utc=-03:00' TOKEN='' SEARCH=`curl --noproxy "*" \ -sLX GET "https://api.axur.com/gateway/1.0/api/tickets-api/tickets?${TICKET_QUERY}" \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer ${TOKEN}" ` echo $SEARCH post: operationId: createTicket summary: Create Ticket tags: - Tickets Api Operations description: | Permission Level Needed: Practitioners/Experts/Customs/Managers Creates a new ticket with the specified reference, type and asset. Reference schema and asset category must be valid for the selected ticket type. If the operation is successful, the key of the newly created ticket will be returned. However, if the reference already exists, the ticket will not be created. Tickets can be manually created as ticket-types examples bellow. - *To obtain the list of assets, the 'customer' section must be consulted (see [Get Customer](#operation/getCustomers)).* - *To obtain the list of ticket types, the 'ticket' section must be consulted (see [Get Ticket Types](#operation/getTicketTypes)).* parameters: - name: Content-Type in: header schema: type: string example: application/json requestBody: content: application/json: schema: type: object properties: reference: type: string example: https://www.a-phishing-url.com/ customer: type: string example: TEST type: type: string example: phishing enum: - code-secret-leak - executive-fake-social-media-profile - executive-personalinfo-leak - fake-mobile-app - fake-social-media-profile - fraudulent-brand-use - malware - other-sensitive-data - paid-search - phishing - similar-domain-name - unauthorized-distribution - unauthorized-sale description: Ticket Types can be obtained from the section 'tickets' (see [Get Ticket Types](#operation/getTicketTypes)). assets: type: array items: type: object example: - TSTAST description: Asset Keys can be obtained from the section 'customer' (see [Get Customer](#operation/getCustomers)). required: - reference - type - assets responses: '200': description: OK content: application/json: schema: type: object properties: ticket: type: string example: 2vdyqh description: Ticket key for created ticket. warnings: type: array description: The warnings field is only displayed when there are open phishing-type tickets associated with the same host as the one specified in the request’s reference, limited to a maximum of two results. items: type: object properties: message: type: string description: Warning message. example: "Open phishing tickets found for the same host." items: type: array description: List of related phishing tickets. items: type: object properties: ticketKey: type: string description: Unique identifier of the phishing ticket. example: "3cdyqp" reference: type: string description: URL or reference associated with the ticket. example: "https://www.a-phishing-url.com/file.html" example: - message: "Open phishing tickets found for the same host." items: - ticketKey: "3cdyqp" reference: "https://www.a-phishing-url.com/file.html" '400': description: Asset/Customer not found content: application/json: schema: type: object properties: message: type: string example: 'Asset not found: TST''.' code: type: integer example: 400 description: Error code. error: type: string example: true '409': description: Reference already exists content: application/json: schema: type: object properties: message: type: string example: 'A ticket with the same reference was identified. Ticket key: ''lzbexj'' Reference:''https://www.a-phishing-url.com/''.' code: type: integer example: 409 description: Error code. error: type: string example: true x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/tickets' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "reference": "https://www.phishing-example.com/", "customer": "ACME", "type": "phishing", "assets": ["ASTKEYXX"] }' - lang: json label: Payload source: | { "reference": "https://www.phishing-example.com/", "customer": "ACME", "type": "phishing", "assets": ["ASTKEYXX"] } - lang: Python label: Python 3.7 source: | #Remember to replace the token field. import requests PATH = "https://api.axur.com/gateway/1.0/api/tickets-api/tickets" token = 'token' header = { 'Content-Type': 'application/json', 'Authorization': str.format("Bearer {}", token) } payload = { "reference": "https://www.a-phishing-url.com/", "customer": "TEST", "type": "phishing", "assets": ["TSTAST"] } result = requests.post(PATH, json=payload, headers=header) # ticket key print(result.json()['ticket']) - lang: cURL label: Bash cURL source: | TOKEN='token' CREATE=`curl --noproxy "*" \ -sLX POST 'https://api.axur.com/gateway/1.0/api/tickets-api/tickets' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $TOKEN" \ --data '{ "reference": "https://www.abc-phishing-url.com/", "customer": "TEST", "type": "phishing", "assets": ["TSTAST"] }'` echo $CREATE /tickets-api/ticket: get: operationId: retrieveBulkTicketApi summary: Retrieve Bulk by Key tags: - Tickets Api Operations description: | Permission Level Needed: All permission levels Returns ticket matching the specified ticket key. parameters: - name: keys in: query required: true schema: type: string example: tsug6g,asdg8g - name: timezone in: query description: Use one of the records identified in the UTF Offset column on https://en.wikipedia.org/wiki/Time_zone#List_of_UTC_offsets. The UTC offset will be used to convert the date input via query parameters and the date output via json. schema: type: string example: Z - name: include in: query description: Information about the tickets to be retrieved. Available include parameters are ”fields”, ”snapshots”, ”texts”, ”attachments”. Default is all fields. schema: type: string example: fields,snapshots,attachments responses: '200': description: OK content: application/json: schema: type: object properties: tickets: description: | Depending on the ticket type, some fields may not be present in the response. For example, a ticket of type "executive-credential-leak" may contain metadata about the credentials inside the "snapshots", while others may not have this field. type: array items: type: object example: - ticket: reference: https://www.facebook.com/61559521153572 ticketKey: ui40ay customerKey: ACME creation.collector: facebook last-update.date: '2024-08-06T17:16:39-03:03' creation.collection: '92056' creation.originator: collector creation.date: '2024-07-17T09:41:01-03:03' tags: - TAG detection: creation.collector: facebook open.date: '2024-07-17T09:41:01-03:03' incident.date: '2024-08-06T17:16:27-03:03' isp: Facebook ip: 157.240.229.35 domain.registrar: RegistrarSafe, LLC type: fake-social-media-profile resolution: '' resolution.reason: '' assets: - BACME creation.collection: '92056' domain: facebook.com creation.originator: collector host: www.facebook.com prediction.risk: '0.96' prediction.brand-logo: '1.0' status: incident prediction.brand-name: '0.9955' group: - null texts: - author: John content: text date: '2024-09-13T13:24:15-03:03' snapshots: content: title: ACME httpStatusCode: code: 200 message: OK hashMD5: value: a37e09a41ebf0874244a683da9d9a961 domainInfo: status: Registered registrar: RegistrarSafe, LLC registrarEmail: abusecomplaints@registrarsafe.com registrant: Domain Admin registrantEmail: domain@fb.com nameServers: hostnames: - d.ns.facebook.com - a.ns.facebook.com - b.ns.facebook.com - c.ns.facebook.com ipAddresses: - null - null - null - null - null - null - null - null createdAt: '1997-03-28T20:57:00-03:03' updatedAt: '2024-04-23T20:57:00-03:03' isp: name: Facebook location: country: name: United States digitalLocation: url: https://www.facebook.com/61559521153572 host: name: www.facebook.com domain: name: facebook.com ip: address: 157.240.229.35 correlatedLinks: { } attachments: - name: whois_010720241206580687d70f6412_fa73_4518_a03e_a8e8078f6519-e757e47ee0b64370a0d1d70a2ed50c93.txt url: https://api-dit.axreng.com/gateway/1.0/api/files/file/whois_010720241206580687d70f6412_fa73_4518_a03e_a8e8078f6519-e757e47ee0b64370a0d1d70a2ed50c93.txt - name: screenshot_run_mocky_io_1719835651890_257903-618283b816ea4cc28f88882a680fd019.jpg url: https://api-dit.axreng.com/gateway/1.0/api/files/file/screenshot_run_mocky_io_1719835651890_257903-618283b816ea4cc28f88882a680fd019.jpg - name: html_run_mocky_io_1719835652086_29650-0fcaa1120f3a4165999cf297fe280e1f.html url: https://api-dit.axreng.com/gateway/1.0/api/files/file/html_run_mocky_io_1719835652086_29650-0fcaa1120f3a4165999cf297fe280e1f.html unavailableTickets: type: array items: type: object example: - ui40ai '400': description: Ticket does not exist content: application/json: schema: type: object properties: code: type: string message: type: string error: type: boolean examples: /tickets: value: code: 400 message: The requested ticket does not exist.. error: true x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/ticket?keys=TSK1AB,TSK2CD' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-api/ticket-history/{ticketKey}: get: operationId: getTicketHistoryApi summary: Get ticket history tags: - Tickets Api Operations description: | Permission Level Needed: All permission levels Retrieve the chronological timeline (history) of specific events for the ticket. An effective way to track takedown status. parameters: - name: ticketKey in: path required: true schema: type: string example: 6ctz5w responses: '200': description: OK content: application/json: schema: type: object example: ticket: 6ctz5w actions: - type: ticket.created date: "2025-08-19T03:47:27.003-03:00" - type: takedown.requested date: "2025-08-19T10:38:15.014-03:00" - type: lifecycle.transition-applied date: "2025-08-19T10:38:15.253-03:00" payload: from: open to: treatment - type: takedown.eligibility.prediction.finished date: "2025-08-19T10:40:35.532-03:00" payload: takedownEligibility: Subject to Notification takedownEvaluationCriteria: - type: Trademark Infringement explanation: >- The domain name "domain.com" incorporates the protected brand term "Brand" and the site prominently displays the Brand logo in the header. The visual style (blue Brand logo, e-commerce layout) closely resembles Brand's official storefront, yet the domain is not owned by Brand (WHOIS shows a recent, unrelated registrant in the US and a registrar that is not normally used by Brand). This constitutes clear, unauthorized use of the trademark and likely domain-squatting meant to profit from consumer confusion. - type: Phishing explanation: >- The site presents itself as an official Brand shopping platform to lure users into making purchases and submitting payment data. Indicators include: (1) very recent domain creation (3 days before detection), (2) low-priced, unrelated products (cuticle oil, HP ink) atypical of Brand's catalogue, (3) multilingual mix (Spanish UI for a Brazilian brand) and (4) payment prompts (PayPal / credit-card) without any verified merchant information. These patterns match common fake-shop scams aimed at harvesting money and card details. - type: takedown.notified date: "2025-08-19T10:40:37.111-03:00" payload: type: comment body: |- Phishing site detected: https://domain.com (IP 104.21.25.241) Please disable the domain and associated hosting. Access may require mobile/incognito. Tracking code: #EFCXXXXX. Regards, Abuse Team abuse@example.com targets: [ ISP ] entities: - name: Cloudflare type: ISP date: "2025-08-19T10:40:37.105-03:00" - type: takedown.denounced date: "2025-08-19T10:40:42.107-03:00" payload: { entity: Phishtank } - type: takedown.denounced date: "2025-08-19T10:40:42.162-03:00" payload: { entity: ESET } - type: takedown.denounced date: "2025-08-19T10:40:42.296-03:00" payload: { entity: McAfee } - type: takedown.denounced date: "2025-08-19T10:40:42.204-03:00" payload: { entity: PSafe } - type: takedown.denounced date: "2025-08-19T10:40:42.258-03:00" payload: { entity: Baidu } - type: takedown.denounced date: "2025-08-19T10:40:42.354-03:00" payload: { entity: OpenDNS } - type: takedown.denounced date: "2025-08-19T10:40:42.325-03:00" payload: { entity: OpenPhish } - type: takedown.denounced date: "2025-08-19T10:40:42.404-03:00" payload: { entity: Trend Micro } - type: takedown.denounced date: "2025-08-19T10:40:42.484-03:00" payload: { entity: APWG } - type: takedown.denounced date: "2025-08-19T10:40:42.504-03:00" payload: { entity: REDAMP } - type: takedown.denounced date: "2025-08-19T10:40:42.443-03:00" payload: { entity: Alibaba } - type: takedown.denounced date: "2025-08-19T10:40:42.549-03:00" payload: { entity: Federal Trade Commission } - type: takedown.denounced date: "2025-08-19T10:40:42.577-03:00" payload: { entity: Norton Safe Web } - type: takedown.notification.replied date: "2025-08-19T15:30:37.193-03:00" payload: type: email sender: cloudflare.com subject: "[981da46e2d2d3579]: Cloudflare has responded to your phishing report" body: |- We received your report for hxxps://domain[.]com. Cloudflare is a pass-through network and cannot remove hosted content. Hosting provider: AMAZON-02 (US). Abuse: example@support.aws.com. We notified our customer and forwarded your report to the host. date: "2025-08-19T15:24:17-03:00" - type: takedown.closed date: "2025-08-19T17:04:07.076-03:00" payload: resolution: resolved reason: IP_NOT_FOUND - type: lifecycle.transition-applied date: "2025-08-19T17:04:07.39-03:00" payload: from: treatment to: closed resolution: resolved - type: detection.closed date: "2025-08-19T17:04:07.606-03:00" '404': description: Ticket not found. content: application/json: schema: type: object properties: code: type: string message: type: string error: type: boolean examples: /tickets: value: code: 404 message: The requested ticket wasn't found. error: true x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/ticket-history/TSK1AB' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-api/ticket/{ticketKey}: get: operationId: retrieveIndividualTicketApi summary: Retrieve by Key tags: - Tickets Api Operations description: | Permission Level Needed: All permission levels Returns ticket matching the specified ticket key. parameters: - name: ticketKey in: path required: true schema: type: string example: tsug6g - name: timezone in: query description: Use one of the records identified in the UTF Offset column on https://en.wikipedia.org/wiki/Time_zone#List_of_UTC_offsets. The UTC offset will be used to convert the date input via query parameters and the date output via json. schema: type: string example: Z - name: include in: query description: Information about the tickets to be retrieved. Available include parameters are ”fields”, ”snapshots”, ”texts”, ”attachments”. Default is all fields. schema: type: string example: fields,snapshots,attachments responses: '200': description: OK content: application/json: example: ticket: reference: https://www.facebook.com/61559521153572 ticketKey: ui40ay customerKey: ACME creation.collector: facebook last-update.date: '2024-08-06T17:16:39-03:03' creation.collection: '92056' creation.originator: collector creation.date: '2024-07-17T09:41:01-03:03' tags: - TAG detection: creation.collector: facebook open.date: '2024-07-17T09:41:01-03:03' incident.date: '2024-08-06T17:16:27-03:03' isp: Facebook ip: 157.240.229.35 domain.registrar: RegistrarSafe, LLC type: fake-social-media-profile resolution: '' resolution.reason: '' assets: - BACME creation.collection: '92056' domain: facebook.com creation.originator: collector host: www.facebook.com prediction.risk: '0.96' prediction.brand-logo: '1.0' status: incident prediction.brand-name: '0.9955' group: - null texts: - author: John content: text date: '2024-09-13T13:24:15-03:03' snapshots: content: title: ACME httpStatusCode: code: 200 message: OK hashMD5: value: a37e09a41ebf0874244a683da9d9a961 domainInfo: status: Registered registrar: RegistrarSafe, LLC registrarEmail: abusecomplaints@registrarsafe.com registrant: Domain Admin registrantEmail: domain@fb.com nameServers: hostnames: - d.ns.facebook.com - a.ns.facebook.com - b.ns.facebook.com - c.ns.facebook.com ipAddresses: - null - null - null - null - null - null - null - null createdAt: '1997-03-28T20:57:00-03:03' updatedAt: '2024-04-23T20:57:00-03:03' isp: name: Facebook location: country: name: United States digitalLocation: url: https://www.facebook.com/61559521153572 host: name: www.facebook.com domain: name: facebook.com ip: address: 157.240.229.35 correlatedLinks: { } attachments: - name: whois_010720241206580687d70f6412_fa73_4518_a03e_a8e8078f6519-e757e47ee0b64370a0d1d70a2ed50c93.txt url: https://api-dit.axreng.com/gateway/1.0/api/files/file/whois_010720241206580687d70f6412_fa73_4518_a03e_a8e8078f6519-e757e47ee0b64370a0d1d70a2ed50c93.txt - name: screenshot_run_mocky_io_1719835651890_257903-618283b816ea4cc28f88882a680fd019.jpg url: https://api-dit.axreng.com/gateway/1.0/api/files/file/screenshot_run_mocky_io_1719835651890_257903-618283b816ea4cc28f88882a680fd019.jpg - name: html_run_mocky_io_1719835652086_29650-0fcaa1120f3a4165999cf297fe280e1f.html url: https://api-dit.axreng.com/gateway/1.0/api/files/file/html_run_mocky_io_1719835652086_29650-0fcaa1120f3a4165999cf297fe280e1f.html '400': description: Ticket does not exist content: application/json: schema: type: object properties: code: type: string message: type: string error: type: boolean examples: /tickets: value: code: 400 message: The requested ticket does not exist.. error: true x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/ticket/TSK1AB' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-api/predictions/ticket/{ticketKey}: get: operationId: getTicketPredictionsApi summary: Get ticket predictions tags: - Tickets Api Operations description: | Permission Level Needed: All permission levels Retrieve the machine learning predictions produced for a ticket. Predictions are always returned for the most recent detection of the ticket. The detection index used is echoed back in the detection field. Only the latest version of each prediction type is returned. Predictions that have been invalidated are omitted. parameters: - name: ticketKey in: path required: true schema: type: string example: 6ctz5w responses: '200': description: OK content: application/json: schema: type: object example: ticket: 6ctz5w detection: 0 predictions: risk: risk: score: 0.86 model: dfs_final_risk_v1 status: success language: languages: - abbreviation: EN model: threat-hunting main: true confidence: 1.0 share: 1.0 status: success hasAuthenticationForm: hasAuthenticationForm: model: threat-hunting containsAuthenticationField: true logo: brandLogos: - mlEvidence: url: https://evidences.example.com/screenshot/6b549734 category: screenshot model: brandLogo_Matcher status: failed reason: unknown_brand correlations: - context: screenshotAttachmentId value: PGJhc2U2NC1lbmNvZGVkIGF0dGFjaG1lbnQgcmVmZXJlbmNlPg== aiInspection: threatHuntingAttributes: contentType: type: Login page explanation: The page displays a prominent login button for accessing the database. imageDescription: >- A minimalist webpage with a dark header bar and a centered login button over a light gray background. passwordRequested: value: "Yes" explanation: The login flow typically requires a password. paymentRequested: value: "No" explanation: No payment-related elements or prompts are present. credentialRequested: value: "Yes" explanation: The login button implies that credentials may be requested. idioms: [ EN ] predominantIdiom: EN companyLogos: - companyName: Example Corp companiesMentioned: [ ] impersonatedBrands: [ ] predominantColors: - hex: "#0f62fe" text: Blue rgb: [ 15, 98, 254 ] riskAnalysis: brandMentionInDomain: false brandMentionInSubdomain: false brandMentionInPath: true urlBrandMismatch: true htmlCodeThreatLabel: false websiteAnalysis: >- The site presents a simple login page and offers a federated sign-in button. There are no visual or structural indicators of phishing or credential harvesting. threatCategory: Benign riskScore: 2.3 scoreBreakdown: hasCredentialRequestedPossibly: 0.8 brandMentionInPath: 0.3 brandMismatch: 0.5 '400': description: The requested ticket does not exist or has no detections. content: application/json: schema: type: object properties: message: type: string code: type: integer example: 400 error: type: boolean example: true examples: /predictions: value: message: "Detection not found: Ticket key '6ctz5w' has no detections." code: 400 error: true '403': description: FORBIDDEN '429': description: | Too many requests. Rate limit of 60 requests per minute exceeded. x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/predictions/ticket/6ctz5w' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-api/snapshots/ticket/{ticketKey}: get: operationId: getTicketSnapshotApi summary: Get ticket snapshot tags: - Tickets Api Operations description: | Permission Level Needed: All permission levels Retrieve the merged snapshot produced for a ticket. Snapshots are always returned for the most recent detection of the ticket. parameters: - name: ticketKey in: path required: true schema: type: string example: 6ctz5w - name: timezone in: query description: Use one of the records identified in the UTF Offset column on https://en.wikipedia.org/wiki/Time_zone#List_of_UTC_offsets. Used to format the domain registration dates in the response. Default is Z. schema: type: string example: Z responses: '200': description: OK content: application/json: schema: type: object example: ticket: 6ctz5w detection: 2 details: content: title: Sample title httpStatusCode: code: 200 message: OK domainInfo: status: Registered registrar: Registrant Name createdAt: "2019-02-28T16:01:20Z" updatedAt: "2026-02-03T06:31:19Z" '400': description: The requested ticket does not exist or has no detections. content: application/json: schema: type: object properties: message: type: string code: type: integer example: 400 error: type: boolean example: true examples: /snapshots: value: message: No detection found for ticket 6ctz5w code: 400 error: true '403': description: FORBIDDEN '429': description: | Too many requests. Rate limit of 60 requests per minute exceeded. x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/snapshots/ticket/6ctz5w' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-api/stats/customer: get: operationId: ticketCountByStatus summary: Ticket Count by Status tags: - Tickets Api Operations description: | This refers to the **Monitoring** section of stats (see [Stats](https://one.axur.com/stats)) **Note:** `from` and `to` parameters are required and must not exceed 90 days. parameters: - name: customer in: query required: false schema: type: string example: ACME - name: from in: query required: true schema: type: string format: date-time example: '2024-01-01' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss" - name: to in: query required: true schema: type: string format: date-time example: '2024-01-31' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss" - name: ticketTypes in: query required: false schema: type: string example: phishing,paid-search description: | Supported types: executive-card-leak, similar-domain-name, executive-personalinfo-leak, data-sale-website, phishing, executive-credential-leak, unauthorized-distribution, database-exposure, code-secret-leak, executive-mobile-phone, suspicious-activity-message, fraud-tool-scheme-message, fraud-tool-scheme-website, data-sale-message, fake-mobile-app, fraudulent-brand-use, malware, fake-social-media-profile, other-sensitive-data, data-exposure-website, executive-fake-social-media-profile, ransomware-attack, paid-search, suspicious-activity-website, data-exposure-message, dw-activity, unauthorized-sale, infrastructure-exposure - name: status in: query required: true schema: type: string example: open description: | Supported status: open, quarantine, incident, treatment, closed - name: assets in: query required: false schema: type: string example: BRANDACME - name: timezone in: query required: false schema: type: string example: '-03:00' description: | Timezone in the format "HH:mm" More examples can be found on: https://en.wikipedia.org/wiki/List_of_UTC_offsets. Notice timezone is optional, if not informed the default timezone is UTC responses: '200': description: OK content: application/json: schema: type: object properties: total: type: integer example: 99999 '403': description: FORBIDDEN x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/stats/customer' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-api/stats/incident/count/ticket-types: get: tags: - Tickets Api Operations summary: Ticket Incident Count by Type description: | This refers to the **Incidents by threat type** section of stats (see [Stats](https://one.axur.com/stats)) **Note:** `from` and `to` parameters are required and must not exceed 90 days. operationId: ticketIncidentCountByType parameters: - name: customer in: query required: false schema: type: string example: ACME - name: from in: query required: true schema: type: string format: date-time example: '2024-01-01' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss" - name: to in: query required: true schema: type: string format: date-time example: '2024-01-31' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss" - name: ticketTypes in: query required: false schema: type: string example: phishing,paid-search description: | Supported types: executive-card-leak, similar-domain-name, executive-personalinfo-leak, data-sale-website, phishing, executive-credential-leak, unauthorized-distribution, database-exposure, code-secret-leak, executive-mobile-phone, suspicious-activity-message, fraud-tool-scheme-message, fraud-tool-scheme-website, data-sale-message, fake-mobile-app, fraudulent-brand-use, malware, fake-social-media-profile, other-sensitive-data, data-exposure-website, executive-fake-social-media-profile, ransomware-attack, paid-search, suspicious-activity-website, data-exposure-message, dw-activity, unauthorized-sale, infrastructure-exposure - name: assets in: query required: false schema: type: string example: BRANDACME - name: timezone in: query required: false schema: type: string example: '12:00' description: | Timezone in the format "HH:mm" More examples can be found on: https://en.wikipedia.org/wiki/List_of_UTC_offsets. Notice timezone is optional, if not informed the default timezone is UTC responses: '200': description: OK content: application/json: schema: type: object properties: totalByTicketType: type: array items: type: object example: - type: fraudulent-brand-use totalOnPeriod: 18 - type: fake-social-media-profile totalOnPeriod: 3 - type: executive-card-leak totalOnPeriod: 0 - type: similar-domain-name totalOnPeriod: 0 - type: executive-personalinfo-leak totalOnPeriod: 0 - type: data-sale-website totalOnPeriod: 0 - type: executive-credential-leak totalOnPeriod: 0 - type: unauthorized-distribution totalOnPeriod: 0 - type: database-exposure totalOnPeriod: 0 - type: code-secret-leak totalOnPeriod: 0 - type: executive-mobile-phone totalOnPeriod: 0 - type: suspicious-activity-message totalOnPeriod: 0 - type: fraud-tool-scheme-message totalOnPeriod: 0 - type: fraud-tool-scheme-website totalOnPeriod: 0 - type: data-sale-message totalOnPeriod: 0 - type: fake-mobile-app totalOnPeriod: 0 - type: malware totalOnPeriod: 0 - type: other-sensitive-data totalOnPeriod: 0 - type: data-exposure-website totalOnPeriod: 0 - type: executive-fake-social-media-profile totalOnPeriod: 0 - type: ransomware-attack totalOnPeriod: 0 - type: paid-search totalOnPeriod: 0 - type: suspicious-activity-website totalOnPeriod: 0 - type: data-exposure-message totalOnPeriod: 0 - type: dw-activity totalOnPeriod: 0 - type: unauthorized-sale totalOnPeriod: 0 - type: infrastructure-exposure totalOnPeriod: 0 - type: phishing totalOnPeriod: 0 '400': description: BAD REQUEST content: application/json: schema: type: object properties: message: type: string example: '''from'' and ''to'' dates must be within 90 days' code: type: integer example: 400 error: type: boolean example: true '403': description: FORBIDDEN '429': description: | Too many requests. Rate limit of 60 requests per minute exceeded. x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/stats/incident/count/ticket-types' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-api/stats/takedown: get: tags: - Tickets Api Operations summary: Takedown Metrics description: | This refers to the **Treatment > Takedown** section of stats (see [Stats](https://one.axur.com/stats)) **Note:** `from` and `to` parameters are required and must not exceed 90 days. operationId: takedownMetrics parameters: - name: customer in: query required: false schema: type: string example: ACME - name: from in: query required: true schema: type: string format: date-time example: '2024-01-01' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss" - name: to in: query required: true schema: type: string format: date-time example: '2024-01-31' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss" - name: ticketTypes in: query required: false schema: type: string example: phishing,paid-search description: | Supported types: executive-card-leak, similar-domain-name, executive-personalinfo-leak, data-sale-website, phishing, executive-credential-leak, unauthorized-distribution, database-exposure, code-secret-leak, executive-mobile-phone, suspicious-activity-message, fraud-tool-scheme-message, fraud-tool-scheme-website, data-sale-message, fake-mobile-app, fraudulent-brand-use, malware, fake-social-media-profile, other-sensitive-data, data-exposure-website, executive-fake-social-media-profile, ransomware-attack, paid-search, suspicious-activity-website, data-exposure-message, dw-activity, unauthorized-sale, infrastructure-exposure - name: assets in: query required: false schema: type: string example: BRANDACME - name: timezone in: query required: false schema: type: string example: '12:00' description: | Timezone in the format "HH:mm" More examples can be found on: https://en.wikipedia.org/wiki/List_of_UTC_offsets. Notice timezone is optional, if not informed the default timezone is UTC responses: '200': description: OK content: application/json: schema: type: object properties: total: type: object properties: requested: type: integer example: 3111 successRate: type: number example: 97.74070212 medianTimeToFirstNotification: type: string example: P4DT13H description: | Durations using ISO 8601 format. See more at https://en.wikipedia.org/wiki/ISO_8601#Durations medianUptime: type: string example: P23DT23H description: | Durations using ISO 8601 format. See more at https://en.wikipedia.org/wiki/ISO_8601#Durations rawMedianUptime: type: number example: 120771776.29297659 discarded: type: integer example: 0 aborted: type: integer example: 93 pending: type: integer example: 141 resolved: type: integer example: 2812 unresolved: type: integer example: 65 '400': description: BAD REQUEST content: application/json: schema: type: object properties: message: type: string example: '''from'' and ''to'' dates must be within 90 days' code: type: integer example: 400 error: type: boolean example: true '403': description: FORBIDDEN '429': description: | Too many requests. Rate limit of 60 requests per minute exceeded. x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/stats/takedown' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-api/stats/internal-treatment: get: tags: - Tickets Api Operations summary: Internal Treatment Metrics description: | This refers to the **Treatment > Internal treatment** section of stats (see [Stats](https://one.axur.com/stats)) **Note:** `from` and `to` parameters are required and must not exceed 90 days. operationId: internalTreatmentMetrics parameters: - name: customer in: query required: false schema: type: string example: ACME - name: from in: query required: true schema: type: string format: date-time example: '2024-01-01' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss" - name: to in: query required: true schema: type: string format: date-time example: '2024-01-31' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss" - name: ticketTypes in: query required: false schema: type: string example: phishing,paid-search description: | Supported types: executive-card-leak, similar-domain-name, executive-personalinfo-leak, data-sale-website, phishing, executive-credential-leak, unauthorized-distribution, database-exposure, code-secret-leak, executive-mobile-phone, suspicious-activity-message, fraud-tool-scheme-message, fraud-tool-scheme-website, data-sale-message, fake-mobile-app, fraudulent-brand-use, malware, fake-social-media-profile, other-sensitive-data, data-exposure-website, executive-fake-social-media-profile, ransomware-attack, paid-search, suspicious-activity-website, data-exposure-message, dw-activity, unauthorized-sale, infrastructure-exposure - name: assets in: query required: false schema: type: string example: BRANDACME - name: timezone in: query required: false schema: type: string example: '-11:00' description: | Timezone in the format "HH:mm" More examples can be found on: https://en.wikipedia.org/wiki/List_of_UTC_offsets. Notice timezone is optional, if not informed the default timezone is UTC responses: '200': description: OK content: application/json: schema: type: object properties: total: type: object properties: requested: type: integer example: 0 unresolved: type: integer example: 0 medianUptime: type: string example: PT0S description: | Durations using ISO 8601 format. See more at https://en.wikipedia.org/wiki/ISO_8601#Durations successRate: type: number example: 100 takedownRequested: type: integer example: 0 pending: type: integer example: 0 resolved: type: integer example: 0 discarded: type: integer example: 0 '400': description: BAD REQUEST content: application/json: schema: type: object properties: message: type: string example: '''from'' and ''to'' dates must be within 90 days' code: type: integer example: 400 error: type: boolean example: true '403': description: FORBIDDEN '429': description: | Too many requests. Rate limit of 60 requests per minute exceeded. x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/stats/internal-treatment' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-api/stats/takedown/uptime: get: tags: - Tickets Api Operations summary: Takedown Uptime description: | This refers to the **Resolution uptime in days** section of stats (see [Stats](https://one.axur.com/stats)) **Note:** `from` and `to` parameters are required and must not exceed 90 days. operationId: takedownUptime parameters: - name: customer in: query required: false schema: type: string example: ACME - name: from in: query required: true schema: type: string format: date-time example: '2024-01-01' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss" - name: to in: query required: true schema: type: string format: date-time example: '2024-01-31' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss" - name: ticketTypes in: query required: false schema: type: string example: phishing,paid-search description: | Supported types: executive-card-leak, similar-domain-name, executive-personalinfo-leak, data-sale-website, phishing, executive-credential-leak, unauthorized-distribution, database-exposure, code-secret-leak, executive-mobile-phone, suspicious-activity-message, fraud-tool-scheme-message, fraud-tool-scheme-website, data-sale-message, fake-mobile-app, fraudulent-brand-use, malware, fake-social-media-profile, other-sensitive-data, data-exposure-website, executive-fake-social-media-profile, ransomware-attack, paid-search, suspicious-activity-website, data-exposure-message, dw-activity, unauthorized-sale, infrastructure-exposure - name: assets in: query required: false schema: type: string example: BRANDACME responses: '200': description: OK content: application/json: schema: type: object properties: uptime: type: object properties: lessThan1Day: type: integer example: 1280 upTo2Days: type: integer example: 296 upTo5Days: type: integer example: 535 upTo10Days: type: integer example: 145 upTo15Days: type: integer example: 365 upTo30Days: type: integer example: 78 upTo60Days: type: integer example: 113 over60Days: type: integer example: 0 additionalProperties: false additionalProperties: false '400': description: BAD REQUEST content: application/json: schema: type: object properties: message: type: string example: '''from'' and ''to'' dates must be within 90 days' code: type: integer example: 400 error: type: boolean example: true '403': description: FORBIDDEN '429': description: | Too many requests. Rate limit of 60 requests per minute exceeded. x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/stats/takedown/uptime' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-api/stats/internal-treatment/uptime: get: tags: - Tickets Api Operations summary: Internal Treatment Uptime description: | This refers to the **Resolution uptime in days** section of stats (see [Stats](https://one.axur.com/stats)) **Note:** `from` and `to` parameters are required and must not exceed 90 days. operationId: internalTreatmentUptime parameters: - name: customer in: query required: false schema: type: string example: ACME - name: from in: query required: true schema: type: string format: date-time example: '2024-01-01' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss" - name: to in: query required: true schema: type: string format: date-time example: '2024-01-31' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss" - name: ticketTypes in: query required: false schema: type: string example: phishing,paid-search description: | Supported types: executive-card-leak, similar-domain-name, executive-personalinfo-leak, data-sale-website, phishing, executive-credential-leak, unauthorized-distribution, database-exposure, code-secret-leak, executive-mobile-phone, suspicious-activity-message, fraud-tool-scheme-message, fraud-tool-scheme-website, data-sale-message, fake-mobile-app, fraudulent-brand-use, malware, fake-social-media-profile, other-sensitive-data, data-exposure-website, executive-fake-social-media-profile, ransomware-attack, paid-search, suspicious-activity-website, data-exposure-message, dw-activity, unauthorized-sale, infrastructure-exposure - name: assets in: query required: false schema: type: string example: BRANDACME - name: timezone in: query required: false schema: type: string example: '-09:30' description: | Timezone in the format "HH:mm" More examples can be found on: https://en.wikipedia.org/wiki/List_of_UTC_offsets. Notice timezone is optional, if not informed the default timezone is UTC responses: '200': description: OK content: application/json: schema: type: object properties: uptime: type: object properties: lessThan1Day: type: integer example: 1280 upTo2Days: type: integer example: 296 upTo5Days: type: integer example: 535 upTo10Days: type: integer example: 145 upTo15Days: type: integer example: 365 upTo30Days: type: integer example: 78 upTo60Days: type: integer example: 113 over60Days: type: integer example: 0 additionalProperties: false additionalProperties: false '400': description: BAD REQUEST content: application/json: schema: type: object properties: message: type: string example: '''from'' and ''to'' dates must be within 90 days' code: type: integer example: 400 error: type: boolean example: true '403': description: FORBIDDEN '429': description: | Too many requests. Rate limit of 60 requests per minute exceeded. x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/stats/internal-treatment/uptime' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-api/stats/incident/customer/global/median: get: tags: - Tickets Api Operations summary: Median number of internal incidents by Axur customers description: This refers to the **Axur customers median** section of stats (see [Stats](https://one.axur.com/stats)) operationId: axurCustomersMedian parameters: - name: customer in: query required: false schema: type: string example: ACME - name: to in: query required: true schema: type: string format: date-time example: '2024-01-01' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss". Get 13 months back from the indicated date - name: ticketTypes in: query required: false schema: type: string example: phishing,paid-search description: | Supported types: executive-card-leak, similar-domain-name, executive-personalinfo-leak, data-sale-website, phishing, executive-credential-leak, unauthorized-distribution, database-exposure, code-secret-leak, executive-mobile-phone, suspicious-activity-message, fraud-tool-scheme-message, fraud-tool-scheme-website, data-sale-message, fake-mobile-app, fraudulent-brand-use, malware, fake-social-media-profile, other-sensitive-data, data-exposure-website, executive-fake-social-media-profile, ransomware-attack, paid-search, suspicious-activity-website, data-exposure-message, dw-activity, unauthorized-sale, infrastructure-exposure - name: assets in: query required: false schema: type: string example: BRANDACME - name: timezone in: query required: false schema: type: string example: '-09:30' description: | Timezone in the format "HH:mm" More examples can be found on: https://en.wikipedia.org/wiki/List_of_UTC_offsets. Notice timezone is optional, if not informed the default timezone is UTC responses: '200': description: OK content: application/json: schema: type: object properties: averageType: type: string example: median monthlyStats: type: array items: type: object example: - total: 161.5 referenceMonth: 2024-11 - total: 119.5 referenceMonth: 2024-10 - total: 114 referenceMonth: 2024-09 - total: 99.5 referenceMonth: 2024-08 - total: 70 referenceMonth: 2024-07 - total: 51.5 referenceMonth: 2024-06 - total: 74 referenceMonth: 2024-05 - total: 120.5 referenceMonth: 2024-04 - total: 53 referenceMonth: 2024-03 - total: 37 referenceMonth: 2024-02 - total: 44 referenceMonth: 2024-01 - total: 44.5 referenceMonth: 2023-12 - total: 45.5 referenceMonth: 2023-11 '400': description: BAD REQUEST content: application/json: schema: type: object properties: message: type: string code: type: integer example: 400 error: type: boolean example: true '403': description: FORBIDDEN '429': description: | Too many requests. Rate limit of 60 requests per minute exceeded. x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/stats/incident/customer/global/median' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-api/stats/incident/customer/global/mean: get: tags: - Tickets Api Operations summary: Mean number of internal incidents by Axur customers description: This refers to the **Axur customers mean** section of stats (see [Stats](https://one.axur.com/stats)) operationId: axurCustomersMean parameters: - name: customer in: query required: false schema: type: string example: ACME - name: to in: query required: true schema: type: string format: date-time example: '2024-01-01' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss". Get 13 months back from the indicated date - name: ticketTypes in: query required: false schema: type: string example: phishing,paid-search description: | Supported types: executive-card-leak, similar-domain-name, executive-personalinfo-leak, data-sale-website, phishing, executive-credential-leak, unauthorized-distribution, database-exposure, code-secret-leak, executive-mobile-phone, suspicious-activity-message, fraud-tool-scheme-message, fraud-tool-scheme-website, data-sale-message, fake-mobile-app, fraudulent-brand-use, malware, fake-social-media-profile, other-sensitive-data, data-exposure-website, executive-fake-social-media-profile, ransomware-attack, paid-search, suspicious-activity-website, data-exposure-message, dw-activity, unauthorized-sale, infrastructure-exposure - name: assets in: query required: false schema: type: string example: BRANDACME - name: timezone in: query required: false schema: type: string example: '-03:00' description: | Timezone in the format "HH:mm" More examples can be found on: https://en.wikipedia.org/wiki/List_of_UTC_offsets. Notice timezone is optional, if not informed the default timezone is UTC responses: '200': description: OK content: application/json: schema: type: object properties: averageType: type: string example: mean monthlyStats: type: array items: type: object example: - total: 161.5 referenceMonth: 2024-11 - total: 119.5 referenceMonth: 2024-10 - total: 114 referenceMonth: 2024-09 - total: 99.5 referenceMonth: 2024-08 - total: 70 referenceMonth: 2024-07 - total: 51.5 referenceMonth: 2024-06 - total: 74 referenceMonth: 2024-05 - total: 120.5 referenceMonth: 2024-04 - total: 53 referenceMonth: 2024-03 - total: 37 referenceMonth: 2024-02 - total: 44 referenceMonth: 2024-01 - total: 44.5 referenceMonth: 2023-12 - total: 45.5 referenceMonth: 2023-11 '400': description: BAD REQUEST content: application/json: schema: type: object properties: message: type: string code: type: integer example: 400 error: type: boolean example: true '403': description: FORBIDDEN '429': description: | Too many requests. Rate limit of 60 requests per minute exceeded. x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/stats/incident/customer/global/mean' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-api/stats/incident/customer/market-segment/median: get: tags: - Tickets Api Operations summary: Median number of Incidents by Customer Market Segment description: This refers to the **{{Market Segment}} sector median** section of stats (see [Stats](https://one.axur.com/stats)) operationId: axurMarketSegmentMedian parameters: - name: customer in: query required: false schema: type: string example: ACME - name: to in: query required: true schema: type: string format: date-time example: '2024-01-01' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss". Get 13 months back from the indicated date - name: ticketTypes in: query required: false schema: type: string example: phishing,paid-search description: | Supported types: executive-card-leak, similar-domain-name, executive-personalinfo-leak, data-sale-website, phishing, executive-credential-leak, unauthorized-distribution, database-exposure, code-secret-leak, executive-mobile-phone, suspicious-activity-message, fraud-tool-scheme-message, fraud-tool-scheme-website, data-sale-message, fake-mobile-app, fraudulent-brand-use, malware, fake-social-media-profile, other-sensitive-data, data-exposure-website, executive-fake-social-media-profile, ransomware-attack, paid-search, suspicious-activity-website, data-exposure-message, dw-activity, unauthorized-sale, infrastructure-exposure - name: assets in: query required: false schema: type: string example: BRANDACME - name: timezone in: query required: false schema: type: string example: '-03:00' description: | Timezone in the format "HH:mm" More examples can be found on: https://en.wikipedia.org/wiki/List_of_UTC_offsets. Notice timezone is optional, if not informed the default timezone is UTC responses: '200': description: OK content: application/json: schema: type: object properties: marketSegment: type: string example: TECHNOLOGY medians: type: array items: type: object example: - total: 42 referenceMonth: 2024-11 - total: 41.5 referenceMonth: 2024-10 - total: 31.5 referenceMonth: 2024-09 - total: 23.5 referenceMonth: 2024-08 - total: 16 referenceMonth: 2024-07 - total: 20 referenceMonth: 2024-06 - total: 43 referenceMonth: 2024-05 - total: 56.5 referenceMonth: 2024-04 - total: 23 referenceMonth: 2024-03 - total: 29 referenceMonth: 2024-02 - total: 31 referenceMonth: 2024-01 - total: 20 referenceMonth: 2023-12 - total: 27.5 referenceMonth: 2023-11 '400': description: BAD REQUEST content: application/json: schema: type: object properties: message: type: string code: type: integer example: 400 error: type: boolean example: true '403': description: FORBIDDEN '429': description: | Too many requests. Rate limit of 60 requests per minute exceeded. x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/stats/incident/customer/market-segment/median' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-api/stats/incident/customer/market-segment/mean: get: tags: - Tickets Api Operations summary: Mean number of Incidents by Customer Market Segment description: This refers to the **{{Market Segment}} sector mean** section of stats (see [Stats](https://one.axur.com/stats)) operationId: axurMarketSegmentMean parameters: - name: customer in: query required: false schema: type: string example: ACME - name: to in: query required: true schema: type: string format: date-time example: '2024-01-01' description: | Date in the format "YYYY-MM-DD" or "YYYY-MM-DDTHH:mm:ss". Get 13 months back from the indicated date - name: ticketTypes in: query required: false schema: type: string example: phishing,paid-search description: | Supported types: executive-card-leak, similar-domain-name, executive-personalinfo-leak, data-sale-website, phishing, executive-credential-leak, unauthorized-distribution, database-exposure, code-secret-leak, executive-mobile-phone, suspicious-activity-message, fraud-tool-scheme-message, fraud-tool-scheme-website, data-sale-message, fake-mobile-app, fraudulent-brand-use, malware, fake-social-media-profile, other-sensitive-data, data-exposure-website, executive-fake-social-media-profile, ransomware-attack, paid-search, suspicious-activity-website, data-exposure-message, dw-activity, unauthorized-sale, infrastructure-exposure - name: assets in: query required: false schema: type: string example: BRANDACME - name: timezone in: query required: false schema: type: string example: '-03:00' description: | Timezone in the format "HH:mm" More examples can be found on: https://en.wikipedia.org/wiki/List_of_UTC_offsets. Notice timezone is optional, if not informed the default timezone is UTC responses: '200': description: OK content: application/json: schema: type: object properties: marketSegment: type: string example: TECHNOLOGY mean: type: array items: type: object example: - total: 42 referenceMonth: 2024-11 - total: 41.5 referenceMonth: 2024-10 - total: 31.5 referenceMonth: 2024-09 - total: 23.5 referenceMonth: 2024-08 - total: 16 referenceMonth: 2024-07 - total: 20 referenceMonth: 2024-06 - total: 43 referenceMonth: 2024-05 - total: 56.5 referenceMonth: 2024-04 - total: 23 referenceMonth: 2024-03 - total: 29 referenceMonth: 2024-02 - total: 31 referenceMonth: 2024-01 - total: 20 referenceMonth: 2023-12 - total: 27.5 referenceMonth: 2023-11 '400': description: BAD REQUEST content: application/json: schema: type: object properties: message: type: string code: type: integer example: 400 error: type: boolean example: true '403': description: FORBIDDEN '429': description: | Too many requests. Rate limit of 60 requests per minute exceeded. x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-api/stats/incident/customer/market-segment/mean' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /integration-feed/feeds/feed/{feedId}: get: operationId: getFeed summary: Get feed by id tags: - Integration Feed description: | Permission Level Needed: Managers Returns a feed information containing feed details and its associated collection data. Each request by feedId has a rate limit of one request per 30 seconds. parameters: - name: feedId in: path required: true schema: type: string example: 9e780987-10df-409e-9d1b-a63dfeecded0 - name: dry-run in: query description: use this query parameter if you want to test the request. schema: type: boolean example: true responses: '200': description: OK content: application/json: schema: type: object properties: feedData: type: object properties: id: type: string title: type: string url: type: string createdAt: type: integer format: int64 createdBy: type: integer format: int64 nullable: true lastRequest: type: integer format: int64 lastDataRetrieved: type: string nullable: true isActive: type: boolean customerKey: type: string updatedAt: type: integer format: int64 nullable: true updatedBy: type: integer format: int64 nullable: true params: type: string eventDate: type: string nextPage: type: integer format: int64 feedType: type: string collectionData: type: object examples: /a3c-867-40f-b79-f18d74: value: feedData: id: a3c-867-40f-b79-f18d74 title: Closed tickets url: https://api.axur.com/gateway/1.0/api/integration-feed/feeds/feed/a3c-867-40f-b79-f18d74 createdAt: 1727983596891 lastRequest: 1728063161589 lastDataRetrieved: e2ma5b isActive: true customerKey: ACME updatedAt: 1728062627600 params: status=closed eventDate: ticket.creation.date nextPage: 2 feedType: ticket collectionData: tickets: - ticket: reference: https://fraud.acme.com ticketKey: h7dw97 customerKey: ACME creation.collector: ctlog last-update.date: '2024-03-13T18:20:19-03:00' creation.collection: '6469' creation.originator: collector creation.date: '2024-03-13T06:58:12-03:00' detection: close.date: '2024-03-13T18:20:19-03:00' creation.collector: ctlog open.date: '2024-03-13T06:58:12-03:00' prediction.languages: - EN prediction.has-authentication-form: 'false' isp: Cloudflare, Inc. ip: 104.21.95.254 type: phishing resolution: discarded prediction.main-language: EN resolution.reason: '' assets: - ACME creation.collection: '6469' domain: acme.com creation.originator: collector host: acme.com prediction.risk: '0.58' prediction.brand-logo: '0.0393319' status: closed group: - threat_validation texts: [ ] snapshots: ipFilter: filtering: true countries: [ ] content: title: 404 Not Found httpStatusCode: code: 404 domainInfo: nameServers: hostnames: [ ] ipAddresses: [ ] isp: name: Cloudflare, Inc. location: country: name: United States digitalLocation: url: https://fraud.acme.com host: name: acme.com domain: name: acme.com ip: address: 104.21.95.254 referenceInfo: originalReference: acme.com redirectChain: - http://acme.com - https://acme.com/ finalReference: https://acme.com correlatedLinks: { } - ticket: reference: https://acme1.com/ reup.expires: '1711499974058' ticketKey: e2ma5b customerKey: ACME creation.collector: ctlog last-update.date: '2024-03-13T15:05:50-03:00' creation.originator: collector creation.date: '2024-03-11T09:52:34-03:00' tags: - MOBILE INSPECTION detection: close.date: '2024-03-13T15:05:50-03:00' creation.collector: urlscan open.date: '2024-03-13T06:57:58-03:00' prediction.languages: - PT - EN - IT prediction.has-authentication-form: 'false' isp: Cloudflare ip: 23.227.38.36 domain.registrar: TUCOWS, INC. type: phishing resolution: discarded prediction.main-language: PT resolution.reason: inaccessible assets: - NTS creation.collection: '15296349' domain: netshosoutletoficial.com creation.originator: collector host: netshosoutletoficial.com prediction.risk: '0.75' prediction.brand-logo: '0.17038026' status: closed group: - threat_validation texts: [ ] snapshots: ipFilter: filtering: true countries: [ ] content: title: This store is unavailable httpStatusCode: code: 404 domainInfo: status: Registered registrar: TUCOWS, INC. registrarEmail: domainabuse@tucows.com registrant: Contact Privacy Inc. Customer 0170557109 registrantEmail: netshosoutletoficial.com@contactprivacy.com nameServers: hostnames: - ns-cloud-c1.googledomains.com - ns-cloud-c2.googledomains.com - ns-cloud-c3.googledomains.com - ns-cloud-c4.googledomains.com ipAddresses: [ ] isp: name: Cloudflare location: country: name: Canada digitalLocation: url: https://acme1.com/ host: name: acme1.com domain: name: acme1.com ip: address: 23.227.38.36 referenceInfo: originalReference: https://acme1.com/ redirectChain: [ ] finalReference: https://acme1.com/ correlatedLinks: { } pageable: pageNumber: 1 pageSize: 2 total: 50 '403': description: Forbidden '404': description: Not Found content: application/json: schema: type: object properties: code: type: integer message: type: string error: type: boolean examples: /107c-498-4d-9e-78e829: value: code: 400 message: There is no feed with the specified parameters. error: true '429': description: Too Many Requests content: application/json: schema: type: object properties: code: type: integer message: type: string error: type: boolean examples: /107c-498-4d-9e-78e829: value: code: 429 message: Feed 107c-498-4d-9e-78e829 reached the rate limit. Try again later. error: true x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/integration-feed/feeds/feed/my-feed-id' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-filters/filters/tickets: post: operationId: generateFilterId summary: Create Filter tags: - Filter Operations description: | *A new API has been implemented to facilitate the process of obtaining tickets (see [Tickets API](#section/Examples-of-usage)).* Permission Level Needed: All permission levels Creates a new search filter from the request body and returns its identifier. parameters: - name: Accept in: header schema: type: string example: application/json - name: Content-Type in: header schema: type: string example: application/json requestBody: content: application/json: schema: type: object properties: queries: type: array description: Array of one or more queries items: type: object example: - fieldName: current.status values: - open - incident operation: OR operation: type: string description: Operation enum: - AND - OR - NOT - GREATER_THAN - GREATER_THAN_OR_EQUAL - LESS_THAN - LESS_THAN_OR_EQUAL - BETWEEN - EXISTS - NOT_EXISTS - CONTAINS_TEXT responses: '200': description: OK content: application/json: schema: type: object properties: queryId: type: string example: fee315d76f684831bd89df885b775b33 '403': description: FORBIDDEN content: application/json: schema: type: object properties: statusCode: type: integer example: 403 message: type: string example: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/tickets-filters/filters/tickets' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "queries": [ {"fieldName": "current.status", "values": ["open", "incident"], "operation": "OR"} ], "operation": "AND" }' - lang: json label: Payload source: | { "queries": [ {"fieldName": "current.status", "values": ["open", "incident"], "operation": "OR"} ], "operation": "AND" } get: operationId: getTicketsForFilter summary: Retrieve filter results tags: - Filter Operations description: | *A new API has been implemented to facilitate the process of obtaining tickets (see [Tickets API](#section/Examples-of-usage)).* Permission Level Needed: All permission levels Returns ticket keys matching the specified filter. parameters: - name: q in: query description: Filter id required: true schema: type: string example: 20b55a35dc7a4bd89892c8a3db09e2c0 - name: page in: query description: Page number schema: type: integer default: 1 example: 1 - name: pageSize in: query description: Page size schema: type: integer default: 50 example: 10 - name: sortBy in: query description: Sort by field schema: type: string example: ticket.creation.date - name: order in: query description: Sort order schema: type: string enum: - desc - asc example: desc responses: '200': description: OK content: application/json: schema: type: object properties: tickets: type: array items: type: object example: - key: b2wsek - key: h244n7 - key: '419633' - key: flrueu - key: 3v0l0x - key: 8tpxo0 - key: gqv0jy - key: 9ckaso - key: j6zhop - key: e3h88n metadata: type: object properties: total: type: integer example: 123 perPage: type: integer example: 10 page: type: integer example: 1 offset: type: integer example: 0 x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-filters/filters/tickets?filterId=abc123&page=1&pageSize=50' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-core/tickets/{ticketKey}: get: operationId: getFields summary: Retrieve ticket fields tags: - Ticket Operations description: | *A new API has been implemented to facilitate the process of obtaining tickets (see [Tickets API](#section/Examples-of-usage)).* Permission Level Needed: All permission levels Returns field values for the specified ticket. Returned fields may vary depending on the ticket type and other criteria. parameters: - name: ticketKey in: path required: true schema: type: string example: tsug6g responses: '200': description: OK content: application/json: schema: type: object properties: ticket: type: object properties: key: type: string example: tsug6g customer: type: string example: TEST reference: type: string example: https://www.instagram.com/anyfakeprofile fields: type: array items: type: object example: - key: ticket.creation.user dimension: single value: 1234 - key: ticket.last-update.date dimension: single value: 1655758251091 - key: ticket.creation.date dimension: single value: 1653410847002 - key: current.creation.user dimension: single value: 2345 - key: current.creation.customer dimension: single value: TEST - key: current.domain dimension: single value: instagram.com - key: current.host dimension: single value: www.instagram.com - key: current.isp dimension: single value: Facebook - key: current.domain.registrar dimension: single value: RegistrarSafe, LLC - key: current.open.date dimension: single value: 1654190450226 - key: current.resolution dimension: single value: '' - key: current.treatment.type dimension: single value: internal - key: current.status dimension: single value: treatment - key: current.ip dimension: single value: 31.13.66.174 - key: current.type dimension: single value: fake-social-media-profile - key: current.prediction.main-language dimension: single value: EN - key: current.assets dimension: multi values: - TSTAST - key: current.prediction.languages dimension: multi values: - EN detection: type: object properties: index: type: integer example: 2 open: type: boolean example: true fields: type: object example: - key: detection.creation.user dimension: single value: 2345 - key: detection.creation.customer dimension: single value: TEST - key: detection.domain dimension: single value: instagram.com - key: detection.host dimension: single value: www.instagram.com - key: detection.isp dimension: single value: Facebook - key: detection.resolution.reason dimension: single value: '' - key: detection.domain.registrar dimension: single value: RegistrarSafe, LLC - key: detection.open.date dimension: single value: 1654190450226 - key: detection.resolution dimension: single value: '' - key: detection.treatment.type dimension: single value: internal - key: detection.status dimension: single value: treatment - key: detection.ip dimension: single value: 31.13.66.174 - key: detection.type dimension: single value: fake-social-media-profile - key: detection.prediction.main-language dimension: single value: EN - key: detection.assets dimension: multi values: - TSTAST - key: detection.prediction.languages dimension: multi values: - EN x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-core/tickets/TSK1AB' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.7 source: | #Remember to replace the 'ticket_key' and 'token' fields. import requests ticket_key = 'ticket key' PATH = f'https://api.axur.com/gateway/1.0/api/tickets-core/tickets/{ticket_key}' token = 'token' header = { 'Content-Type': 'application/json', 'Authorization': str.format("Bearer {}", token) } result = requests.get(PATH, headers=header) print(result.json()) - lang: cURL label: Bash cURL source: | TICKET_KEY='ticket_key' TOKEN='token' SEARCH=`curl --noproxy "*" \ -sLX GET 'https://api.axur.com/gateway/1.0/api/tickets-core/tickets/'${TICKET_KEY} \ -H "Authorization: Bearer $TOKEN"` echo $SEARCH /tickets-core/fields/types: get: operationId: getTicketTypes summary: Get Ticket Types tags: - Ticket Operations description: | Permission Level Needed: All permission levels Retrieves the currently supported ticket types. responses: '200': description: OK content: application/json: schema: type: object properties: types: type: array items: type: object example: - code-secret-leak - fake-social-media-profile - unauthorized-sale - data-sale-website - dw-activity - executive-mobile-phone - executive-fake-social-media-profile - data-sale-message - infrastructure-exposure - paid-search - executive-credential-leak - fraud-tool-scheme-website - ransomware-attack - suspicious-activity-website - phishing - malware - data-exposure-website - executive-personalinfo-leak - database-exposure - fake-mobile-app - executive-card-leak - data-exposure-message - other-sensitive-data - fraudulent-brand-use - fraud-tool-scheme-message - similar-domain-name - unauthorized-distribution - suspicious-activity-message x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-core/fields/types' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-texts/texts/tickets/{ticketKey}: get: operationId: getTexts summary: Retrieve ticket textual data tags: - Ticket Operations description: | *A new API has been implemented to facilitate the process of obtaining tickets (see [Tickets API](#section/Examples-of-usage)).* Permission Level Needed: All permission levels Returns textual data items for the specified ticket, such as user comments, description, evidence message etc. Returned items may vary depending on the ticket type and other criteria. parameters: - name: ticketKey in: path required: true schema: type: string example: k2il51 responses: '200': description: OK content: application/json: schema: type: object properties: texts: type: array items: type: object properties: id: type: integer content: type: string type: type: string date: type: integer internal: type: boolean example: - id: 1234 content: '[Description of fraud]' type: description date: 1656614712557 internal: false - id: 2345 content: '[Message content / evidence]' type: evidence-message date: 1656614712791 internal: false x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-texts/texts/tickets/TSK1AB' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' post: operationId: addComment summary: Add comment to ticket tags: - Ticket Operations description: | Permission Level Needed: Practitioners/Experts/Customs/Managers Adds a text comment to the specified ticket. parameters: - name: ticketKey in: path required: true schema: type: string example: hvewpn requestBody: content: application/json: schema: type: object properties: content: type: string example: Lorem ipsum dolor sit amet. internal: type: boolean example: false type: type: string example: comment responses: '200': description: OK x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/tickets-texts/texts/tickets/TSK1AB' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "content": "Lorem ipsum dolor sit amet.", "type": "comment", "internal": false }' - lang: json label: Payload source: | { "content": "Lorem ipsum dolor sit amet.", "type": "comment", "internal": false } /tickets-snapshots/snapshots/tickets/{ticketKey}/detections/{detectionIndex}/merge: get: operationId: getDetectionSnapshots summary: Retrieve ticket snapshots tags: - Ticket Operations deprecated: true description: | ⚠️ Deprecated: Use the [ticket API](#operation/getTicketSnapshotApi) Permission Level Needed: All permission levels Retrieve snapshot from specified ticket detection. parameters: - name: ticketKey in: path required: true schema: type: string example: hvewpn - name: detectionIndex in: path required: true schema: type: integer example: 0 responses: '200': description: OK content: application/json: schema: type: object properties: ticket: type: string example: n432h7 detection: type: integer example: 0 details: type: object example: content: title: Sample title httpStatusCode: code: 200 message: OK hashMD5: value: 1768b9f1655cd7b952e83bc8be3fdfff domainInfo: status: Registered registrar: Registrant Name registrarEmail: sample@mail.com registrant: Sample Domain Admin registrantEmail: sample@domainadmin.com nameServers: hostnames: - c.ns.sample.com - b.ns.sample.com - a.ns.sample.com - d.ns.sample.com isp: name: Sample Isp Name location: country: name: Country name digitalLocation: url: https://www.sample.com/sample-page host: name: www.sample.com domain: name: sample.com ip: address: 127.0.0.1 x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-snapshots/snapshots/tickets/TSK1AB/detections/0/merge' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-lifecycle/lifecycle/tickets/{ticketKey}/transitions: get: operationId: listTicketAvailableTransitions summary: Retrieve ticket lifecycle options tags: - Ticket Operations description: | Permission Level Needed: Experts/Customs with Takedown permission/Managers Returns currently available lifecycle transitions for the specified ticket. Returned keys may be used to execute lifecycle transitions (see [Execute lifecycle transition](#operation/applyTransition) operation below). parameters: - name: ticketKey in: path required: true schema: type: string example: xi8luf responses: '200': description: OK content: application/json: schema: type: object properties: transitions: type: array items: type: object properties: destination: type: string key: type: string example: - destination: TREATMENT key: treatment - destination: CLOSED key: closed:discarded currentStatus: type: string example: open x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-lifecycle/lifecycle/tickets/TSK1AB/transitions' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.7 source: | #Remember to replace the 'ticket_key' and 'token' fields. import requests ticket_key = 'ticket key' PATH = f'https://api.axur.com/gateway/1.0/api/tickets-lifecycle/lifecycle/tickets/{ticket_key}/transitions' token = 'token' header = { 'Content-Type': 'application/json', 'Authorization': str.format("Bearer {}", token) } result = requests.get(PATH, headers=header) print(result.json()) - lang: cURL label: Bash cURL source: | TICKET_KEY='ticket_key' TOKEN='token' SEARCH=`curl --noproxy "*" \ -sLX GET 'https://api.axur.com/gateway/1.0/api/tickets-lifecycle/lifecycle/tickets/'${TICKET_KEY}'/transitions' \ -H "Authorization: Bearer $TOKEN"` echo $SEARCH /tickets-lifecycle/lifecycle/tickets/{ticketKey}/transitions/{transitionKey}: post: operationId: applyTransition summary: Execute lifecycle transition tags: - Ticket Operations description: | Permission Level Needed: Experts/Customs with Takedown permission Executes a lifecycle transition (given as a path parameter) on the specified ticket. For a list of valid transitions, see [Retrieve ticket lifecycle options](#operation/listTicketAvailableTransitions) operation above. parameters: - name: ticketKey in: path required: true schema: type: string example: 11c4hl - name: transitionKey in: path required: true schema: type: string example: closed:discarded responses: '200': description: OK content: application/json: schema: type: object properties: ticket: type: string example: 11c4hl detection: type: integer example: 0 actions: type: array items: type: object example: - request x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/tickets-lifecycle/lifecycle/tickets/TSK1AB/transitions/closed:discarded' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.7 source: | #Remember to replace the 'ticket_key', 'transition_key' and 'token' fields. import requests ticket_key = '11c4hl' transition_key = 'closed:discarded' token = 'token' PATH = f'https://api.axur.com/gateway/1.0/api/tickets-lifecycle/lifecycle/tickets/{ticket_key}/transitions/{transition_key}' header = { 'Content-Type': 'application/json', 'Authorization': str.format("Bearer {}", token) } result = requests.post(PATH, headers=header) print(result.json()) - lang: cURL label: Bash cURL source: | TICKET_KEY='qu51q3' TRANSITION_KEY='closed:discarded' TOKEN='token' EXEC=`curl --noproxy "*" \ -sLX POST 'https://api.axur.com/gateway/1.0/api/tickets-lifecycle/lifecycle/tickets/'${TICKET_KEY}'/transitions/'${TRANSITION_KEY} \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $TOKEN"` echo $EXEC /tickets-takedown/takedown/tickets/{ticketKey}: get: operationId: listTicketTakedownOptions summary: Retrieve ticket takedown options tags: - Ticket Operations description: | Permission Level Needed: Experts/Customs with Takedown permission/Managers Returns currently available takedown options for the specified ticket. A `request` value in the `actions` array indicates that the ticket is eligible for takedown. parameters: - name: ticketKey in: path required: true schema: type: string example: nbz092 responses: '200': description: OK content: application/json: schema: type: object properties: ticket: type: string example: nbz092 detection: type: integer example: 0 actions: type: array items: type: string example: - request x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-takedown/takedown/tickets/TSK1AB' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.7 source: | #Remember to replace the 'ticket_key' and 'token' fields. import requests ticket_key = 'b8tq53' PATH = f'https://api.axur.com/gateway/1.0/api/tickets-takedown/takedown/tickets/{ticket_key}' token = 'token' header = { 'Content-Type': 'application/json', 'Authorization': str.format("Bearer {}", token) } result = requests.get(PATH, headers=header) print(result.json()) - lang: cURL label: Bash cURL source: | TICKET_KEY='ticket_key' TOKEN='token' SEARCH=`curl --noproxy "*" \ -sLX GET 'https://api.axur.com/gateway/1.0/api/tickets-takedown/takedown/tickets/'${TICKET_KEY} \ -H "Authorization: Bearer $TOKEN"` echo $SEARCH /tickets-takedown/takedown/tickets/{ticketKey}/detections/{detectionIndex}: post: operationId: requestTakedown summary: Request takedown tags: - Ticket Operations description: | Permission Level Needed: Experts/Customs with Takedown permission/Managers Requests takedown for the specified ticket. The ticket's most recent detection index must be specified as a path parameter. parameters: - name: ticketKey in: path required: true schema: type: string example: nbz092 - name: detectionIndex in: path required: true schema: type: integer example: 0 - name: Content-Type in: header schema: type: string example: application/json requestBody: content: application/json: schema: type: object properties: action: type: string example: request responses: '200': description: OK x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/tickets-takedown/takedown/tickets/TSK1AB/detections/0' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"action": "request"}' - lang: json label: Payload source: | { "action": "request" } - lang: Python label: Python 3.7 source: | #Remember to replace the 'ticket_key', 'detection_index', 'action' and 'token' fields. import requests ticket_key = 'nbz092' detection_index = '0' action = 'request' PATH = f'https://api.axur.com/gateway/1.0/api/tickets-takedown/takedown/tickets/{ticket_key}/detections/{detection_index}' token = 'token' header = { 'Content-Type': 'application/json', 'Authorization': str.format("Bearer {}", token) } payload = { "action": action } result = requests.post(PATH, json=payload, headers=header) print(result.json()) - lang: cURL label: Bash cURL source: | TICKET_KEY='nbz092' DETECTION_INDEX='0' ACTION='request' TOKEN='token' EXEC=`curl --noproxy "*" \ -sLX POST 'https://api.axur.com/gateway/1.0/api/tickets-takedown/takedown/tickets/'${TICKET_KEY}'/detections/'${DETECTION_INDEX} \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $TOKEN" \ --data '{ "action": "'${ACTION}'" }'` echo $EXEC /tickets-timeline/timelines/ticket-history/{ticketKey}: get: operationId: getTicketHistory summary: Get ticket history tags: - Ticket Operations deprecated: true description: | ⚠️ Deprecated: Use the [ticket API](#operation/getTicketHistoryApi) Permission Level Needed: All permission levels Retrieve the chronological timeline (history) of specific events for the ticket. An effective way to track takedown status. parameters: - name: ticketKey in: path required: true schema: type: string example: 6ctz5w responses: '200': description: OK content: application/json: schema: type: object example: ticket: 6ctz5w actions: - type: ticket.created date: "2025-08-19T03:47:27.003-03:00" - type: takedown.requested date: "2025-08-19T10:38:15.014-03:00" - type: lifecycle.transition-applied date: "2025-08-19T10:38:15.253-03:00" payload: from: open to: treatment - type: takedown.eligibility.prediction.finished date: "2025-08-19T10:40:35.532-03:00" payload: takedownEligibility: Subject to Notification takedownEvaluationCriteria: - type: Trademark Infringement explanation: >- The domain name "domain.com" incorporates the protected brand term "Brand" and the site prominently displays the Brand logo in the header. The visual style (blue Brand logo, e-commerce layout) closely resembles Brand's official storefront, yet the domain is not owned by Brand (WHOIS shows a recent, unrelated registrant in the US and a registrar that is not normally used by Brand). This constitutes clear, unauthorized use of the trademark and likely domain-squatting meant to profit from consumer confusion. - type: Phishing explanation: >- The site presents itself as an official Brand shopping platform to lure users into making purchases and submitting payment data. Indicators include: (1) very recent domain creation (3 days before detection), (2) low-priced, unrelated products (cuticle oil, HP ink) atypical of Brand's catalogue, (3) multilingual mix (Spanish UI for a Brazilian brand) and (4) payment prompts (PayPal / credit-card) without any verified merchant information. These patterns match common fake-shop scams aimed at harvesting money and card details. - type: takedown.notified date: "2025-08-19T10:40:37.111-03:00" payload: type: comment body: |- Phishing site detected: https://domain.com (IP 104.21.25.241) Please disable the domain and associated hosting. Access may require mobile/incognito. Tracking code: #EFCXXXXX. Regards, Abuse Team abuse@example.com targets: [ ISP ] entities: - name: Cloudflare type: ISP date: "2025-08-19T10:40:37.105-03:00" - type: takedown.denounced date: "2025-08-19T10:40:42.107-03:00" payload: { entity: Phishtank } - type: takedown.denounced date: "2025-08-19T10:40:42.162-03:00" payload: { entity: ESET } - type: takedown.denounced date: "2025-08-19T10:40:42.296-03:00" payload: { entity: McAfee } - type: takedown.denounced date: "2025-08-19T10:40:42.204-03:00" payload: { entity: PSafe } - type: takedown.denounced date: "2025-08-19T10:40:42.258-03:00" payload: { entity: Baidu } - type: takedown.denounced date: "2025-08-19T10:40:42.354-03:00" payload: { entity: OpenDNS } - type: takedown.denounced date: "2025-08-19T10:40:42.325-03:00" payload: { entity: OpenPhish } - type: takedown.denounced date: "2025-08-19T10:40:42.404-03:00" payload: { entity: Trend Micro } - type: takedown.denounced date: "2025-08-19T10:40:42.484-03:00" payload: { entity: APWG } - type: takedown.denounced date: "2025-08-19T10:40:42.504-03:00" payload: { entity: REDAMP } - type: takedown.denounced date: "2025-08-19T10:40:42.443-03:00" payload: { entity: Alibaba } - type: takedown.denounced date: "2025-08-19T10:40:42.549-03:00" payload: { entity: Federal Trade Commission } - type: takedown.denounced date: "2025-08-19T10:40:42.577-03:00" payload: { entity: Norton Safe Web } - type: takedown.notification.replied date: "2025-08-19T15:30:37.193-03:00" payload: type: email sender: cloudflare.com subject: "[981da46e2d2d3579]: Cloudflare has responded to your phishing report" body: |- We received your report for hxxps://domain[.]com. Cloudflare is a pass-through network and cannot remove hosted content. Hosting provider: AMAZON-02 (US). Abuse: example@support.aws.com. We notified our customer and forwarded your report to the host. date: "2025-08-19T15:24:17-03:00" - type: takedown.closed date: "2025-08-19T17:04:07.076-03:00" payload: resolution: resolved reason: IP_NOT_FOUND - type: lifecycle.transition-applied date: "2025-08-19T17:04:07.39-03:00" payload: from: treatment to: closed resolution: resolved - type: detection.closed date: "2025-08-19T17:04:07.606-03:00" x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-timeline/timelines/ticket-history/TSK1AB' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-tags/tags/tickets/{ticketKey}/{tagLabel}: put: operationId: addTagToTicket summary: Add tag to ticket tags: - Ticket Operations description: | Permission Level Needed: Practitioners/Experts/Customs/Managers Adds a tag to the specified ticket. Current ticket tags can be found in field `ticket.tags` (see [Retrieve ticket fields](#operation/getFields) operation above). parameters: - name: ticketKey in: path required: true schema: type: string example: hvewpn - name: tagLabel in: path required: true schema: type: string example: '{my-tag}' responses: '200': description: OK x-codeSamples: - lang: cURL label: cURL source: | curl --request PUT \ --url 'https://api.axur.com/gateway/1.0/api/tickets-tags/tags/tickets/TSK1AB/false-positive' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' delete: operationId: removeTagFromTicket summary: Remove tag from ticket tags: - Ticket Operations description: | Permission Level Needed: Practitioners/Experts/Customs/Managers Removes a tag from the specified ticket. parameters: - name: ticketKey in: path required: true schema: type: string example: hvewpn - name: tagLabel in: path required: true schema: type: string example: '{my-tag}' responses: '200': description: OK x-codeSamples: - lang: cURL label: cURL source: | curl --request DELETE \ --url 'https://api.axur.com/gateway/1.0/api/tickets-tags/tags/tickets/TSK1AB/false-positive' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-attachments/attachments/tickets/{ticketKey}/detections/{detectionIndex}: get: operationId: getDetectionAttachments summary: Retrieve ticket attachments tags: - Ticket Operations description: | Permission Level Needed: All permission levels Retrieve attachments from specified ticket detection. parameters: - name: ticketKey in: path required: true schema: type: string example: hvewpn - name: detectionIndex in: path required: true schema: type: integer example: 0 responses: '200': description: OK content: application/json: schema: type: object example: attachments: - name: whois_123456.txt url: https://api.axur.com/gateway/1.0/api/files/file/whois_123456.txt metadata: byteSize: 1234 contentType: text/plain illustrative: false date: 1672066466935 attachmentId: abcd1234 fileKey: 1234abcd - name: html_123456.html url: https://api.axur.com/gateway/1.0/api/files/file/html_123456.html metadata: byteSize: 5678 contentType: text/html illustrative: false date: 1672066466935 attachmentId: efgh5678 fileKey: 5678efgh - name: screenshot_123456.jpg url: https://api.axur.com/gateway/1.0/api/files/file/screenshot_123456.jpg metadata: byteSize: 9101 contentType: image/jpeg illustrative: false date: 1672066466935 attachmentId: ijkl9101 fileKey: 9101ijkl x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-attachments/attachments/tickets/TSK1AB/detections/0' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' post: operationId: postDetectionAttachments summary: Add attachment to ticket tags: - Ticket Operations description: | Permission Level Needed: Practitioners/Experts/Customs/Managers Add attachment to specified ticket detection. parameters: - name: ticketKey in: path required: true schema: type: string example: hvewpn - name: detectionIndex in: path required: true schema: type: integer example: 0 requestBody: content: multipart/form-data: schema: properties: file: type: string format: binary description: The attachment file to be uploaded responses: '200': description: OK content: application/json: schema: type: object example: name: name.png url: https://api.axur.com/gateway/1.0/api/files/file/name.png metadata: byteSize: 0 contentType: text/html illustrative: false author: 123 date: 1672066466935 attachmentId: Base64 encoded URL fileKey: abcd1234 x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/tickets-attachments/attachments/tickets/TSK1AB/detections/0' \ --header 'Authorization: Bearer ' \ --form 'file=@/path/to/attachment.png' /tickets-attachments/attachments/tickets/{ticketKey}/detections/detection: get: operationId: getticketAttachments summary: Retrieve ticket attachments just by key tags: - Ticket Operations description: | Permission Level Needed: All permission levels Retrieve attachments from specified ticket detection. parameters: - name: ticketKey in: path required: true schema: type: string example: hvewpn responses: '200': description: OK content: application/json: schema: type: object example: - name: whois_123456.txt url: https://api.axur.com/gateway/1.0/api/files/file/whois_123456.txt - name: html_123456.html url: https://api.axur.com/gateway/1.0/api/files/file/html_123456.html - name: screenshot_123456.jpg url: https://api.axur.com/gateway/1.0/api/files/file/screenshot_123456.jpg x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/tickets-attachments/attachments/tickets/TSK1AB/detections/detection' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /tickets-attachments/attachments/tickets/{ticketKey}/detections/{detectionIndex}/{attachmentId}: delete: operationId: deleteDetectionAttachment summary: Delete attachment from ticket tags: - Ticket Operations description: | Permission Level Needed: Practitioners/Experts/Customs/Managers Remove an attachment from specified ticket detection. parameters: - name: ticketKey in: path required: true schema: type: string example: hvewpn - name: detectionIndex in: path required: true schema: type: integer example: 0 - name: attachmentId in: path required: true schema: type: string example: aHR0cHM6Ly9hcGkuYXh1ci5jb20vZ2F0ZXdheS8xLjAvZmlsZXMvZmlsZS9odG1sXzEyMzQ1Ni5odG1s responses: '204': description: Attachment was successfully removed. x-codeSamples: - lang: cURL label: cURL source: | curl --request DELETE \ --url 'https://api.axur.com/gateway/1.0/api/tickets-attachments/attachments/tickets/TSK1AB/detections/0/ATT1' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /webhooks/subscriptions: get: tags: - Axur Platform webhooks summary: Retrieve subscriptions description: | Permission Level Needed: Managers Returns all webhook subscriptions and related info (identifiers, endpoints and secrets). operationId: retrieveSubscriptions responses: '200': description: Retrieve webhook subscriptions content: application/json: schema: type: object properties: subscriptions: type: array items: type: object properties: endpoint: type: string example: https://www.acme.net/webhooks id: type: number example: 321 secret: type: string example: ddPxe5Vdh9XH1kemf7NWyhRVKWYalTj3L0yrZDuvMSg1CousHokWF38RoxsaYs35MS7jwkuBqVPSHRvpybYgrlEEJxX8GQhhxVUi1ViaGD5SAEwH68PUsEkHC1KQa5z9 example: - endpoint: https://www.acme.net/webhooks id: 321 secret: ddPxe5Vdh9XH1kemf7NWyhRVKWYalTj3L0yrZDuvMSg1CousHokWF38RoxsaYs35MS7jwkuBqVPSHRvpybYgrlEEJxX8GQhhxVUi1ViaGD5SAEwH68PUsEkHC1KQa5z9 examples: Retrieve webhook subscriptions: value: subscriptions: - endpoint: https://www.acme.net/webhooks id: 321 secret: ddPxe5Vdh9XH1kemf7NWyhRVKWYalTj3L0yrZDuvMSg1CousHokWF38RoxsaYs35MS7jwkuBqVPSHRvpybYgrlEEJxX8GQhhxVUi1ViaGD5SAEwH68PUsEkHC1KQa5z9 x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/webhooks/subscriptions' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' post: tags: - Axur Platform webhooks summary: Create subscription description: | Permission Level Needed: Managers Creates a new webhook subscription with the given endpoint to receive ticket events in real-time. Important: the endpoint value must be a valid URL that accepts the POST verb and returns an HTTP success code (2xx), otherwise an error will be thrown. An automatically generated secret is returned along with the created subscription information, which should be used to validate the signature of published events. After this request is completed, new ticket events will be published to the webhook endpoint. operationId: createSubscription requestBody: content: application/json: schema: type: object properties: endpoint: type: string example: example: endpoint: responses: '200': description: Create webhook subscription content: application/json: schema: type: object properties: endpoint: type: string example: https://www.acme.net/webhooks id: type: number example: 321 secret: type: string example: ddPxe5Vdh9XH1kemf7NWyhRVKWYalTj3L0yrZDuvMSg1CousHokWF38RoxsaYs35MS7jwkuBqVPSHRvpybYgrlEEJxX8GQhhxVUi1ViaGD5SAEwH68PUsEkHC1KQa5z9 examples: Create webhook subscription: value: endpoint: https://www.acme.net/webhooks id: 321 secret: ddPxe5Vdh9XH1kemf7NWyhRVKWYalTj3L0yrZDuvMSg1CousHokWF38RoxsaYs35MS7jwkuBqVPSHRvpybYgrlEEJxX8GQhhxVUi1ViaGD5SAEwH68PUsEkHC1KQa5z9 x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/webhooks/subscriptions' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"endpoint": "https://your-endpoint.example.com/webhook"}' - lang: json label: Payload source: | { "endpoint": "https://your-endpoint.example.com/webhook" } /webhooks/subscriptions/{subscriptionKey}: delete: tags: - Axur Platform webhooks summary: Remove subscription description: | Permission Level Needed: Managers Removes the existing webhook subscription with the given identifier. After this request is completed, new ticket events will not be published to the webhook endpoint. operationId: removeSubscription parameters: - name: subscriptionKey in: path required: true schema: type: number example: 321 responses: '204': description: Remove webhook subscription content: { } x-codeSamples: - lang: cURL label: cURL source: | curl --request DELETE \ --url 'https://api.axur.com/gateway/1.0/api/webhooks/subscriptions/SUB1' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /webhooks/subscriptions/{subscriptionKey}/ping: post: tags: - Axur Platform webhooks summary: Ping subscription description: | Permission Level Needed: Managers Sends a `ping` event to the endpoint of the existing webhook subscription with the given identifier, for testing or validation purposes.\nIf this operation succeeds, it returns an HTTP 200 status code and a JSON body containing the pinged endpoint's HTTP response data. Otherwise, a JSON response body like `{\"error\": \"message\"}` is returned. operationId: pingSubscription parameters: - name: subscriptionKey in: path required: true schema: type: number example: 321 responses: '200': description: Ping subscription content: application/json: schema: type: object properties: body: type: string example: body from webhook endpoint response status: type: number example: 200 examples: Ping subscription: value: body: body from webhook endpoint response status: 200 x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/webhooks/subscriptions/SUB1/ping' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /touchpoints/items: post: tags: - Safelist operations summary: Create safelist item description: | Permission Level Needed: Experts/Customs with Safelist permission/Managers Creates one or multiple safelist items. **Field `group`** accepts values `self`, `partner`, `email` and `other`, indicating the desired group for the created safelist items. operationId: createSafelistItem parameters: - in: header name: Authorization schema: type: string example: Bearer required: true requestBody: content: application/json: schema: type: object properties: customerKey: type: string example: ACM group: type: string example: SELF items: type: array items: type: object properties: content: type: string example: example.com/acme required: - customerKey - group - items responses: '204': description: Safelist item was added successfully. '400': description: Safelist item wasn't added because has a body request error content: application/json: schema: type: object properties: error: type: string examples: /touchpoints: value: error: items are required '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/touchpoints/items' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "customerKey": "ACME", "group": "self", "items": [{"content": "safedomain.com"}] }' - lang: json label: Payload source: | { "customerKey": "ACME", "group": "self", "items": [{"content": "safedomain.com"}] } get: tags: - Safelist operations summary: Get customer safelist items description: | Permission Level Needed: Experts/Customs with Safelist permission/Managers Get customer safelist items by parameters. **Parameter `group`** accepts values `self`, `partner`, `email` and `other`, and filters the response to only include safelist items within the indicated group. **Parameter `categories`** accepts values `app`, `marketplace`, `social` and `other`, and filters the response to only include safelist items within the indicated categories. operationId: getSafelistItems parameters: - in: header name: Authorization schema: type: string example: Bearer required: true - in: query name: customerKey schema: type: string example: ACM required: true - in: query name: group schema: type: string example: self - in: query name: categories schema: type: string example: social,app - in: query name: page schema: type: integer example: 2 - in: query name: perPage schema: type: integer example: 3 responses: '200': description: success. content: application/json: schema: type: object properties: metadata: type: object properties: page: type: integer example: 2 perPage: type: integer example: 3 offset: type: integer example: 2 total: type: integer example: 5 safelistItems: type: array items: type: object properties: id: type: integer example: 6 group: type: string example: SELF category: type: string example: SOCIAL content: type: string example: example.com/acme createdAt: type: integer format: timestamp example: 1636467296052 user: type: object properties: userId: type: integer isInternal: type: boolean foundAliases: type: array items: type: object properties: id: type: integer example: 7 content: type: string example: aliasexample.com/acme createdAt: type: integer format: timestamp example: 1636467296060 examples: /touchpoints: value: metadata: page: 2 perPage: 3 offset: 2 total: 5 safelistItems: - id: 1 group: SELF category: SOCIAL content: example.com/acme createdAt: 1636467296052 user: userId: 1 isInternal: false foundAliases: - id: 7 content: aliasexample.com/acme createdAt: 1636467296060 '400': description: Safelist items weren't listed because has a request error content: application/json: schema: type: object properties: error: type: string examples: /touchpoints: value: error: invalid request '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/touchpoints/items' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /touchpoints/items/{id}: put: tags: - Safelist operations summary: Update safelist item description: | Permission Level Needed: Experts/Customs with Safelist permission/Managers Updates a safelist item. **Field `group`** accepts values `self`, `partner`, `email` and `other`, indicating the desired group for the created safelist item. **Field `category`** accepts values `app`, `marketplace`, `social` and `other`, indicating the desired categories for filter safelist item. operationId: updateSafelistItem parameters: - in: header name: Authorization schema: type: string example: Bearer required: true - in: path name: id schema: type: integer example: 1 required: true requestBody: content: application/json: schema: type: object properties: content: type: string example: example-updated.com/acme group: type: string example: SELF category: type: string example: social required: - content - group - category responses: '204': description: Safelist item was updated successfully. '400': description: Safelist item wasn't updated because has a body request error content: application/json: schema: type: object properties: error: type: string examples: /touchpoints: value: error: content is required '403': description: Forbidden '404': description: Safelist item not found content: application/json: schema: type: object properties: error: type: string examples: /touchpoints: value: error: safelist item not found x-codeSamples: - lang: cURL label: cURL source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/touchpoints/items/123' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "content": "updated-domain.com", "group": "self", "category": "social" }' - lang: json label: Payload source: | { "content": "updated-domain.com", "group": "self", "category": "social" } delete: tags: - Safelist operations summary: Deactivate safelist item description: | Permission Level Needed: Experts/Customs with Safelist permission/Managers Deactivates a safelist item. operationId: deleteSafelistItem parameters: - in: header name: Authorization schema: type: string example: Bearer required: true - in: path name: id schema: type: integer example: 1 required: true responses: '204': description: Safelist item was deactivated successfully. '403': description: Forbidden '404': description: Safelist item not found content: application/json: schema: type: object properties: error: type: string examples: /touchpoints: value: error: safelist item not found x-codeSamples: - lang: cURL label: cURL source: | curl --request DELETE \ --url 'https://api.axur.com/gateway/1.0/api/touchpoints/items/123' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /exposure-api/{exposureCategory}: get: operationId: retrieveDetections summary: Retrieve Detections tags: - Exposure Api Operations description: | Permission Level Needed: All permission levels Returns detections matching the specified filter. parameters: - name: exposureCategory description: category name ('credentials', 'credit-cards' or 'infostealer') in: path required: true schema: type: string example: credit-cards - name: created in: query description: A filter to retrieve detections created on or after the specified date in ISO 8601 format (e.g., 'yyyy-MM-dd'). required: false schema: type: string example: ge:2024-07-01 - name: sortBy in: query description: A field to specify the attribute by which the results will be sorted. schema: type: string default: created example: created - name: page in: query description: The page number to retrieve in the paginated response. Defaults to 1 if not specified. schema: type: integer default: 1 example: 1 - name: pageSize in: query description: The number of results displayed per page in the paginated response, from 1 to 1000. Defaults to 50 if not specified. When 'include' names an infostealer record table, accepts 1 to 5 and defaults to 5. schema: type: integer default: 50 example: 2 - name: order in: query description: The order in which the results are sorted. Accepts 'asc' for ascending order and 'desc' for descending order. Defaults to 'desc'. schema: type: string enum: - desc - asc default: desc example: desc - name: timezone in: query description: Use one of the records identified in the UTF Offset column on https://en.wikipedia.org/wiki/Time_zone#List_of_UTC_offsets. The UTC offset will be used to convert the date input via query parameters and the date output via json. schema: type: string default: '00:00' example: '-03:00' - name: include in: query description: Comma-separated optional fields to retrieve. 'history' and 'notes' are supported by every category; the 'infostealer' category also supports its record tables 'autofill', 'cookies', 'credentials', 'creditCards', 'files', 'processes' and 'software' (see [Infostealer Record Tables](#tag/Exposure-Api-Operations/Exposure-Search-Operations/Infostealer-Record-Tables)). schema: type: string example: 'notes' responses: '200': description: OK content: application/json: schema: type: object properties: detections: type: array items: type: object example: - file.path: '' source.name: Deep/Dark Web - Telegram message.chat.name: 🧩 [LB.SB] GoldPack password.hasUpperCase: true document.links.parsedFrom: 2024112712414376746209263E79BF07D88062437 message.timestamp: '2024-11-27T10:24:31' source.timestamp: '2024-11-27T10:24:31' access.host: com.nvt.cs password.hasSpecialChar: true password: DtsKcJvlpM assets: - TEST message.chat.type: SUPERGROUP password.type: PLAIN password.hasLetter: true id: 20241127131956500FC0C39483D76B7A0 user.emailDomain: example.com message.type: DOCUMENT created: '2025-01-27T20:18:36' document.links.raw: 202411271024326730974476370E166FD65080664 document.timestamp: '2024-11-27T13:19:56' file.name: 78kk_URLPW_LB.SB_Part_12-30.txt document.links.originalFilePackage: 2024112710375249958970963386844C5B4026775 credential.types: - user message.author.type: CHAT password.length: 10 password.hasNumber: true document.links.originalFile: 2024112712352918443263663127D793831030506 access.domain: '' detectionDate: '2024-11-27T12:56:31' user.emailHost: example.com user.type: EMAIL access.url: https://com.nvt.cs/ password.hasLowerCase: true user.emailTld: com document.id: 202411271319565007421696470E166FD65067540 user: test@example.com updated: '2025-01-27T20:20:38' access.tld: '' status: DISCARDED customer: BEES - file.path: '' source.name: Deep/Dark Web - Telegram message.chat.name: 🧩 [LB.SB] GoldPack password.hasUpperCase: true document.links.parsedFrom: 2024112712414376746209263E79BF07D88062437 message.timestamp: '2024-11-27T10:24:31' source.timestamp: '2024-11-27T10:24:31' access.host: com.nvt.cs password.hasSpecialChar: true password: LBHxSUUiZT assets: - TEST message.chat.type: SUPERGROUP password.type: PLAIN password.hasLetter: true id: 202411271319565002EF35C72F8C5C298 user.emailDomain: example.com message.type: DOCUMENT created: '2025-01-27T20:18:36' document.links.raw: 202411271024326730974476370E166FD65080664 document.timestamp: '2024-11-27T13:19:56' file.name: 78kk_URLPW_LB.SB_Part_12-30.txt document.links.originalFilePackage: 2024112710375249958970963386844C5B4026775 credential.types: - user message.author.type: CHAT password.length: 10 password.hasNumber: true document.links.originalFile: 2024112712352918443263663127D793831030506 access.domain: '' detectionDate: '2024-11-27T12:56:31' user.emailHost: example.com user.type: EMAIL access.url: https://com.nvt.cs/ password.hasLowerCase: true user.emailTld: com document.id: 202411271319565007421696470E166FD65067540 user: test@example.com updated: '2025-01-27T20:20:38' access.tld: '' status: DISCARDED customer: BEES pageable: type: object properties: pageNumber: type: integer example: 1 pageSize: type: integer example: 2 total: type: integer example: 1200 '400': description: Incorrect Query Parameters content: application/json: schema: type: object properties: code: type: string error: type: boolean examples: /detections: value: code: 400 error: 'Invalid query parameter (created) value: ''''' '403': description: FORBIDDEN content: application/json: schema: type: object properties: code: type: integer example: 403 error: type: string example: Forbidden '429': description: Rate Limit exceeded content: application/json: schema: type: object properties: code: type: integer example: 429 error: type: string example: Too many requests! x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/exposure-api/credentials?page=1&pageSize=50' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.12 source: | #Remember to replace the 'query' params and 'token' fields. import requests query = 'created=ge:2024-07-01&sortBy=created&page=1&pageSize=2&order=desc&timezone=-03:00' token = '' exposureCategory = 'credentials' PATH = f'https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}?{query}' header = { 'Content-Type': 'application/json', 'Authorization': str.format("Bearer {}", token) } result = requests.get(PATH, headers=header) print(result.json()) - lang: cURL label: Bash cURL source: | QUERY='created=ge:2024-07-01&sortBy=created&page=1&pageSize=1&order=desc&timezone=-03:00' TOKEN='' SEARCH=`curl --noproxy "*" \ -sLX GET "https://api.axur.com/gateway/1.0/api/exposure-api/credentials?${QUERY}" \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer ${TOKEN}" ` echo $SEARCH patch: operationId: bulkUpdateDetection summary: Bulk Update Detection tags: - Exposure Api Operations description: | Permission Level Needed: All permission levels Update the detection field with the specified ids. - *To obtain id, the 'Exposure Search Operations' section must be consulted (see [Get Exposure Search Operations](#tag/Exposure-Api-Operations/Exposure-Search-Operations/Examples-of-search-usage)).* parameters: - name: exposureCategory description: category name ('credentials', 'credit-cards' or 'infostealer') in: path required: true schema: type: string example: credit-cards - name: Content-Type in: header schema: type: string example: application/json requestBody: content: application/json: schema: type: object properties: field: type: string example: status value: type: string example: DISCARDED ids: type: array items: type: string example: - 202411271319565002EF35C72F8C5C298 - 202411271319565002EF35C72F8C5C299 customer: type: string description: Customer key (required for MSSP users when managing child tenant's credentials) example: CHILD_KEY required: - field - value - ids responses: '204': description: NO CONTENT content: text/plain: examples: /exposure-api/{exposureCategory}/{id}: value: '' '400': description: Incorrect Query Parameters or Body content: application/json: schema: type: object properties: code: type: integer example: 400 error: type: string example: is not a valid field '429': description: Rate Limit exceeded content: application/json: schema: type: object properties: code: type: integer example: 429 error: type: string example: Too many requests! x-codeSamples: - lang: cURL label: cURL source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/exposure-api/credentials' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "field": "status", "value": "DISCARDED", "ids": ["202411271319565002EF35C72F8C5C298", "202411271319565002EF35C72F8C5C299"] }' - lang: json label: Payload source: | { "field": "status", "value": "DISCARDED", "ids": [ "202411271319565002EF35C72F8C5C298", "202411271319565002EF35C72F8C5C299" ] } - lang: Python label: Python 3.12 source: | #Remember to replace the token field. import requests token = '' exposureCategory = 'credentials' PATH = f'https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}' header = { 'Content-Type': 'application/json', 'Authorization': str.format("Bearer {}", token) } payload = { "field": "status", "value": "DISCARDED", "ids": [ "202411271319565002EF35C72F8C5C298", "202411271319565002EF35C72F8C5C299" ] } result = requests.patch(PATH, json=payload, headers=header) print(result.status_code) - lang: cURL label: Bash cURL source: | TOKEN='token' UPDATE=`curl --noproxy "*" \ -sLX PATCH 'https://api.axur.com/gateway/1.0/api/exposure-api/credentials' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $TOKEN" \ --data '{ "field": "status", "value": "DISCARDED", "ids": [ "202411271319565002EF35C72F8C5C298", "202411271319565002EF35C72F8C5C299" ] }'` echo $UPDATE /exposure-api/{exposureCategory}/{id}: patch: operationId: updateDetection summary: Update Detection tags: - Exposure Api Operations description: | Permission Level Needed: All permission levels Update the detection field with the specified id. - *To obtain id, the 'Exposure Search Operations' section must be consulted (see [Get Detection Search Operations](#tag/Exposure-Api-Operations/Exposure-Search-Operations/Examples-of-search-usage)).* parameters: - name: exposureCategory description: category name ('credentials', 'credit-cards' or 'infostealer') in: path required: true schema: type: string example: credit-cards - name: Content-Type in: header schema: type: string example: "application/json" - name: id in: path description: detection id required: true schema: type: string example: 202411271319565002EF35C72F8C5C298 requestBody: content: application/json: schema: type: object properties: field: type: string example: status value: type: string example: DISCARDED customer: type: string description: Customer key (required for MSSP users when managing child tenant's credentials) example: CHILD_KEY required: - field - value responses: '204': description: NO CONTENT content: text/plain: examples: /exposure-api/{exposureCategory}/{id}: value: '' '400': description: Incorrect Query Parameters or Body content: application/json: schema: type: object properties: code: type: integer example: 400 error: type: string example: is not a valid field '429': description: Rate Limit exceeded content: application/json: schema: type: object properties: code: type: integer example: 429 error: type: string example: Too many requests! x-codeSamples: - lang: cURL label: cURL source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/exposure-api/credentials/123' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"field": "status", "value": "DISCARDED"}' - lang: json label: Payload source: | { "field": "status", "value": "DISCARDED" } - lang: Python label: Python 3.12 source: | #Remember to replace the token and id fields. import requests id = '' token = '' exposureCategory = 'credentials' PATH = f'https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}/{id}' header = { 'Content-Type': 'application/json', 'Authorization': str.format("Bearer {}", token) } payload = { "field": "status", "value": "DISCARDED" } result = requests.patch(PATH, json=payload, headers=header) print(result.status_code) - lang: cURL label: Bash cURL source: | TOKEN='token' ID='id' UPDATE=`curl --noproxy "*" \ -sLX PATCH 'https://api.axur.com/gateway/1.0/api/exposure-api/credentials/${ID}' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $TOKEN" \ --data '{ "field": "status", "value": "DISCARDED" }'` echo $UPDATE /exposure-api/{exposureCategory}/{id}/{field}: post: operationId: addFieldDataToDetection summary: Add Field Data to Detection tags: - Exposure Api Operations description: | Permission Level Needed: All permission levels Add field data to the detection with the specified id and field. - *To obtain id, the 'Exposure Search Operations' section must be consulted (see [Get Exposure Search Operations](#tag/Exposure-Api-Operations/Exposure-Search-Operations/Examples-of-search-usage)).* - *Currently only 'tags' field is supported.* parameters: - name: exposureCategory description: category name ('credentials', 'credit-cards' or 'infostealer') in: path required: true schema: type: string example: credit-cards - name: Content-Type in: header schema: type: string example: application/json - name: id in: path description: detection id required: true schema: type: string example: 202411271319565002EF35C72F8C5C298 - name: field in: path description: field name (currently only 'tags' is supported) required: true schema: type: string example: tags requestBody: content: application/json: schema: type: object properties: values: type: array items: type: string example: - my tag - tag2 customer: type: string description: Customer key (required for MSSP users when managing child tenant's detections) example: CHILD_KEY required: - values responses: '204': description: NO CONTENT content: text/plain: examples: /exposure-api/{exposureCategory}/{id}/{field}: value: '' '400': description: Incorrect Query Parameters or Body content: application/json: schema: type: object properties: code: type: integer example: 400 error: type: string example: is not a valid field '429': description: Rate Limit exceeded content: application/json: schema: type: object properties: code: type: integer example: 429 error: type: string example: Too many requests! x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/exposure-api/credentials/123/tags' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"values": ["false-positive"]}' - lang: json label: Payload source: | { "values": ["false-positive"] } - lang: Python label: Python 3.12 source: | #Remember to replace the token, id and field parameters. import requests id = '' field = 'tags' token = '' exposureCategory = 'credentials' PATH = f'https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}/{id}/{field}' header = { 'Content-Type': 'application/json', 'Authorization': str.format("Bearer {}", token) } payload = { "values": ["my tag", "tag2"] } result = requests.post(PATH, json=payload, headers=header) print(result.status_code) - lang: cURL label: Bash cURL source: | TOKEN='' ID='' FIELD='tags' ADD_TAGS=`curl --noproxy "*" \ -sLX POST "https://api.axur.com/gateway/1.0/api/exposure-api/credentials/${ID}/${FIELD}" \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $TOKEN" \ --data '{ "values": ["my tag", "tag2"] }'` echo $ADD_TAGS /exposure-api/{exposureCategory}/delete/{id}/{field}: post: operationId: removeFieldDataFromDetection summary: Remove Field Data from Detection tags: - Exposure Api Operations description: | Permission Level Needed: All permission levels Remove field data from the detection with the specified id and field. - *To obtain id, the 'Detection Search Operations' section must be consulted (see [Get Detection Search Operations](#tag/Exposure-Api-Operations/Exposure-Search-Operations/Examples-of-search-usage)).* - *Currently only 'tags' field is supported.* parameters: - name: exposureCategory description: category name ('credentials', 'credit-cards' or 'infostealer') in: path required: true schema: type: string example: credit-cards - name: Content-Type in: header schema: type: string example: application/json - name: id in: path description: detection id required: true schema: type: string example: 202411271319565002EF35C72F8C5C298 - name: field in: path description: field name (currently only 'tags' is supported) required: true schema: type: string example: tags requestBody: content: application/json: schema: type: object properties: values: type: array items: type: string example: - my tag - tag2 customer: type: string description: Customer key (required for MSSP users when managing child tenant's detections) example: CHILD_KEY required: - values responses: '204': description: NO CONTENT content: text/plain: examples: /exposure-api/{exposureCategory}/delete/{id}/{field}: value: '' '400': description: Incorrect Query Parameters or Body content: application/json: schema: type: object properties: code: type: integer example: 400 error: type: string example: is not a valid field '429': description: Rate Limit exceeded content: application/json: schema: type: object properties: code: type: integer example: 429 error: type: string example: Too many requests! x-codeSamples: - lang: cURL label: cURL source: | curl --request DELETE \ --url 'https://api.axur.com/gateway/1.0/api/exposure-api/credentials/delete/123/tags' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: json label: Payload source: | { "values": ["my tag", "tag2"] } - lang: Python label: Python 3.12 source: | #Remember to replace the token, id and field parameters. import requests id = '' field = 'tags' token = '' exposureCategory = 'credentials' PATH = f'https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}/delete/{id}/{field}' header = { 'Content-Type': 'application/json', 'Authorization': str.format("Bearer {}", token) } payload = { "values": ["my tag", "tag2"] } result = requests.delete(PATH, json=payload, headers=header) print(result.status_code) - lang: cURL label: Bash cURL source: | TOKEN='' ID='' FIELD='tags' REMOVE_TAGS=`curl --noproxy "*" \ -sLX DELETE "https://api.axur.com/gateway/1.0/api/exposure-api/credentials/${ID}/${FIELD}" \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $TOKEN" \ --data '{ "values": ["my tag", "tag2"] }'` echo $REMOVE_TAGS /exposure-api/{exposureCategory}/{field}: post: operationId: bulkAddFieldDataToDetections summary: Bulk Add Field Data to Detections tags: - Exposure Api Operations description: | Permission Level Needed: All permission levels Add field data to multiple detections with the specified field. - *To obtain ids, the 'Detections Search Operations' section must be consulted (see [Get Detection Search Operations](#tag/Exposure-Api-Operations/Exposure-Search-Operations/Examples-of-search-usage)).* - *Currently only 'tags' field is supported.* parameters: - name: exposureCategory description: category name ('credentials', 'credit-cards' or 'infostealer') in: path required: true schema: type: string example: credit-cards - name: Content-Type in: header schema: type: string example: application/json - name: field in: path description: field name (currently only 'tags' is supported) required: true schema: type: string example: tags requestBody: content: application/json: schema: type: object properties: values: type: array items: type: string example: - my tag - tag2 ids: type: array items: type: string example: - 202411271319565002EF35C72F8C5C298 - 202411271319565002EF35C72F8C5C299 customer: type: string description: Customer key (required for MSSP users when managing child tenant's detections) example: CHILD_KEY required: - values - ids responses: '204': description: NO CONTENT content: text/plain: examples: /exposure-api/{exposureCategory}/{field}: value: '' '400': description: Incorrect Query Parameters or Body content: application/json: schema: type: object properties: code: type: integer example: 400 error: type: string example: is not a valid field '429': description: Rate Limit exceeded content: application/json: schema: type: object properties: code: type: integer example: 429 error: type: string example: Too many requests! x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/exposure-api/credentials/tags' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"ids": [123, 456], "values": ["reviewed"]}' - lang: json label: Payload source: | { "ids": [123, 456], "values": ["reviewed"] } - lang: Python label: Python 3.12 source: | #Remember to replace the token and field parameters. import requests field = 'tags' token = '' exposureCategory = 'credentials' PATH = f'https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}/{field}' header = { 'Content-Type': 'application/json', 'Authorization': str.format("Bearer {}", token) } payload = { "values": ["my tag", "tag2"], "ids": [ "202411271319565002EF35C72F8C5C298", "202411271319565002EF35C72F8C5C299" ] } result = requests.post(PATH, json=payload, headers=header) print(result.status_code) - lang: cURL label: Bash cURL source: | TOKEN='' FIELD='tags' BULK_ADD_TAGS=`curl --noproxy "*" \ -sLX POST "https://api.axur.com/gateway/1.0/api/exposure-api/credentials/${FIELD}" \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $TOKEN" \ --data '{ "values": ["my tag", "tag2"], "ids": [ "202411271319565002EF35C72F8C5C298", "202411271319565002EF35C72F8C5C299" ] }'` echo $BULK_ADD_TAGS /exposure-api/{exposureCategory}/delete/{field}: post: operationId: bulkRemoveFieldDataFromDetections summary: Bulk Remove Field Data from Detections tags: - Exposure Api Operations description: | Permission Level Needed: All permission levels Remove field data from multiple detections with the specified field. - *To obtain ids, the 'Detections Search Operations' section must be consulted (see [Get Detection Search Operations](#tag/Exposure-Api-Operations/Exposure-Search-Operations/Examples-of-search-usage)).* - *Currently only 'tags' field is supported.* parameters: - name: exposureCategory description: category name ('credentials', 'credit-cards' or 'infostealer') in: path required: true schema: type: string example: credit-cards - name: Content-Type in: header schema: type: string example: application/json - name: field in: path description: field name (currently only 'tags' is supported) required: true schema: type: string example: tags requestBody: content: application/json: schema: type: object properties: values: type: array items: type: string example: - my tag - tag2 ids: type: array items: type: string example: - 202411271319565002EF35C72F8C5C298 - 202411271319565002EF35C72F8C5C299 customer: type: string description: Customer key (required for MSSP users when managing child tenant's detections) example: CHILD_KEY required: - values - ids responses: '204': description: NO CONTENT content: text/plain: examples: /exposure-api/{exposureCategory}/delete/{field}: value: '' '400': description: Incorrect Query Parameters or Body content: application/json: schema: type: object properties: code: type: integer example: 400 error: type: string example: is not a valid field '429': description: Rate Limit exceeded content: application/json: schema: type: object properties: code: type: integer example: 429 error: type: string example: Too many requests! x-codeSamples: - lang: cURL label: cURL source: | curl --request DELETE \ --url 'https://api.axur.com/gateway/1.0/api/exposure-api/credentials/delete/tags' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: json label: Payload source: | { "ids": ["202411271319565002EF35C72F8C5C298", "202411271319565002EF35C72F8C5C299"], "values": ["my tag", "tag2"] } - lang: Python label: Python 3.12 source: | #Remember to replace the token and field parameters. import requests field = 'tags' token = '' exposureCategory = 'credentials' PATH = f'https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}/delete/{field}' header = { 'Content-Type': 'application/json', 'Authorization': str.format("Bearer {}", token) } payload = { "values": ["my tag", "tag2"], "ids": [ "202411271319565002EF35C72F8C5C298", "202411271319565002EF35C72F8C5C299" ] } result = requests.delete(PATH, json=payload, headers=header) print(result.status_code) - lang: cURL label: Bash cURL source: | TOKEN='' FIELD='tags' BULK_REMOVE_TAGS=`curl --noproxy "*" \ -sLX DELETE "https://api.axur.com/gateway/1.0/api/exposure-api/credentials/${FIELD}" \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $TOKEN" \ --data '{ "values": ["my tag", "tag2"], "ids": [ "202411271319565002EF35C72F8C5C298", "202411271319565002EF35C72F8C5C299" ] }'` echo $BULK_REMOVE_TAGS /exposure-api/{exposureCategory}/total: get: operationId: countDetections summary: Count Detections tags: - Exposure Api Operations description: | Permission Level Needed: All permission levels Returns total of detections that match the specified filters. parameters: - name: exposureCategory description: category name ('credentials', 'credit-cards' or 'infostealer') in: path required: true schema: type: string example: credit-cards - name: created in: query description: The date and time the detections were created, in ISO 8601 format (e.g., yyyy-MM-ddTHH:mm:ss). This parameter is optional and may be used to filter results based on the creation date. required: false schema: type: string example: ge:2024-07-01T20:18:36 - name: timezone in: query description: Use one of the records identified in the UTF Offset column on https://en.wikipedia.org/wiki/Time_zone#List_of_UTC_offsets. The UTC offset will be used to convert the date input via query parameters and the date output via json. schema: type: string default: '00:00' example: '-03:00' responses: '200': description: OK content: application/json: schema: type: object properties: total: type: integer example: 42 '400': description: Incorrect Query Parameters content: application/json: schema: type: object properties: code: type: string error: type: boolean examples: /detections: value: code: 400 error: 'Invalid query parameter (created) value: ''''' '403': description: FORBIDDEN content: application/json: schema: type: object properties: code: type: integer example: 403 error: type: string example: Forbidden '429': description: Rate Limit exceeded content: application/json: schema: type: object properties: code: type: integer example: 429 error: type: string example: Too many requests! x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/exposure-api/credentials/total' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.12 source: | #Remember to replace the 'query' params and 'token' fields. import requests query = 'created=ge:2024-07-01T20:18:36&timezone=-03:00' token = '' exposureCategory = 'credentials' PATH = f'https://api.axur.com/gateway/1.0/api/exposure-api/{exposureCategory}/total?{query}' header = { 'Content-Type': 'application/json', 'Authorization': str.format("Bearer {}", token) } result = requests.get(PATH, headers=header) print(result.json()) - lang: cURL label: Bash cURL source: | QUERY='created=ge:2024-07-01T20:18:36&timezone=-03:00' TOKEN='' COUNT=`curl --noproxy "*" \ -sLX GET "https://api.axur.com/gateway/1.0/api/exposure-api/credentials/total?${QUERY}" \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer ${TOKEN}" ` echo $COUNT /web-complaints/results: get: tags: - Web complaints API summary: Get web complaints description: |- API for querying web complaints that retrieves a paginated list based on filter criteria, with authentication performed using api-key sent in the Authorization header. ## Request Examples ### cURL Example of a request using cURL in the terminal. ```bash curl -X GET "https://api.axur.com/gateway/1.0/api/web-complaints/results?initialDate=2022-01-01&finalDate=2025-09-09&order=desc&timezone=-3&page=1&pageSize=200" -H "Authorization: Bearer " ``` ### Python Example of a request using the Python requests library. ```python import requests import json base_path = "https://api.axur.com/gateway/1.0/api/web-complaints/results" api_key = "API-KEY" headers = { "Authorization": f"Bearer {api_key}" } params = { "initialDate": "2022-01-01", "finalDate": "2025-09-09", "order": "desc", "timezone": "-03:00", "page": 1, "pageSize": 200 } try: response = requests.get(base_path, headers=headers, params=params) response.raise_for_status() print(f"Status Code: {response.status_code}") print("Response JSON:") print(json.dumps(response.json(), indent=2)) except requests.exceptions.HTTPError as http_err: print(f"HTTP error occurred: {http_err}") print(f"Response Content: {response.text}") except requests.exceptions.RequestException as req_err: print(f"An error occurred: {req_err}") ``` parameters: - in: header name: Authorization required: true schema: type: string description: "Mandatory. The api-key for authentication." - in: query name: initialDate required: true schema: type: string format: date example: '2021-01-01' description: "Mandatory filter. Date in format yyyy-MM-dd." - in: query name: finalDate required: false schema: type: string format: date example: '2025-09-23' description: "Optional filter. To include data up to the current day, leave it empty or provide a date equal to or later than today." - in: query name: order required: false schema: type: string enum: [ asc, desc ] default: desc description: "Optional filter. Use 'asc' or 'desc' to sort the response by creation date." - in: query name: timezone required: false schema: type: string example: '-03:00' description: "Optional filter. Time zone used to compose the response. Default is Z (UTC)." - in: query name: page required: false schema: type: integer default: 1 description: "Optional filter. The page number of the content." - in: query name: pageSize required: false schema: type: integer default: 200 minimum: 1 maximum: 200 description: "Optional filter. The size of the response page, with allowed values between 1 and 200." responses: '200': description: A paginated list of complaints. content: application/json: schema: type: object properties: content: type: array items: type: object properties: id: type: integer url: type: string format: uri reportedAt: type: string format: date-time channelToken: type: string ticketKey: type: string format: uri ticketType: type: string pageNumber: type: integer pageSize: type: integer totalElements: type: integer previousPage: type: string format: uri nullable: true nextPage: type: string format: uri nullable: true examples: SuccessWithData: summary: A successful response with a list of complaints value: content: - id: 201 url: "https://example.com" reportedAt: "2025-09-01T17:14:51 -03:00" channelToken: "channel token" ticketKey: "https://one.axur.com/digital-fraud/tickets/ticket-key" ticketType: "fraudulent-brand-use" - id: 202 url: "https://example.com" reportedAt: "2025-09-01T17:14:51 -03:00" channelToken": "channel token" ticketKey: "https://one.axur.com/digital-fraud/tickets/ticket-key" ticketType": "fraudulent-brand-use" pageNumber: 2 pageSize: 200 totalElements: 435 previousPage: "https://api.axur.com/gateway/1.0/web-complaints/results?initialDate=2021-01-01&page=1" nextPage: "https://api.axur.com/gateway/1.0/web-complaints/results?initialDate=2021-01-01&page=3" SuccessNoData: summary: A successful response when no results are found value: content: [ ] pageNumber: 1 pageSize: 200 totalElements": 0 '401': description: Unauthorized. The authorization token was not provided or is invalid. content: application/json: schema: type: object properties: httpStatus: type: integer example: 401 message: type: string example: "authorization failure: authorization failure" example: httpStatus: 401 message: "authorization failure: authorization failure" '429': description: Too Many Requests — this endpoint allows up to 3 requests per second. content: application/json: schema: type: object properties: httpStatus: type: integer example: 429 message: type: string example: "429 Client Error: Too Many Requests for url" example: httpStatus: 429 message: "Too Many Requests" x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/web-complaints/results?initialDate=2022-01-01&finalDate=2025-09-09' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /web-complaints/attachments/upload: post: tags: - Web complaints API summary: Upload attachments security: [] description: |- API for uploading one or more attachments using multipart/form-data. The files must be sent in the `attachments` field. A maximum of **3 attachments per request** is allowed. \ Accepted file formats: **png, jpg, jpeg**. \ Maximum file size: **4 MB per attachment**. **Usage note:** \ This endpoint is intended to upload attachments that will later be referenced and sent with complaints. \ The returned filenames should be used when creating a complaint request. Authentication requires a hash key in the Authorization header. ## Request Examples ### cURL Example of a request using cURL in the terminal. ```bash curl -X POST "https://api.axur.com/gateway/1.0/api/web-complaints/attachments/upload" \ -H "Authorization: " \ -H "Content-Type: multipart/form-data" \ -F "attachments=@file1.png" \ -F "attachments=@file2.jpg" ``` parameters: - in: header name: Authorization required: true schema: type: string description: "Mandatory. The hash-key for authentication." requestBody: required: true content: multipart/form-data: schema: type: object required: - attachments properties: attachments: type: array maxItems: 3 items: type: string format: binary description: "One or more files to upload (maximum of 3 attachments, formats: png, jpg, jpeg, max size: 4MB each)." responses: '200': description: Successfully uploaded attachments. content: application/json: schema: type: object properties: names: type: array items: type: string examples: Success: summary: A successful upload response value: names: - "fileName1.png" - "fileName2.jpg" '400': description: Invalid input, unsupported file format, file too large, more than 3 attachments, or malformed multipart request. content: application/json: schema: type: object properties: code: type: integer error: type: string examples: BadRequest: summary: Invalid input value: code: 400 error: "Invalid attachment: 'Maximum of 3 images allowed'" '401': description: Authorization failure content: application/json: schema: type: object properties: code: type: integer error: type: string examples: AuthFailure: summary: Invalid authorization hash value: code: 401 error: "authorization failure: authorization failure" x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/web-complaints/attachments/upload' \ --header 'Authorization: ' \ --header 'Content-Type: multipart/form-data' \ --form 'attachments=@file1.png' \ --form 'attachments=@file2.jpg' /web-complaints/complaints: post: tags: - Web complaints API summary: Create complaint from URL security: [] description: |- API for creating a complaint based on a URL and optional attachments. The request must include the target URL and may include previously uploaded attachment filenames. **Usage note:** \ Attachments must be uploaded beforehand using the `/attachments/upload` endpoint. \ The returned filenames should be included in this request. Authentication requires a hash key in the Authorization header. ## Request Examples ### cURL Example of a request using cURL in the terminal. ```bash curl -X POST "https://api.axur.com/gateway/1.0/api/web-complaints/complaints" \ -H "Authorization: " \ -H "Content-Type: application/json" \ -d '{ "url": "https://example.com", "attachments": ["fileName1.png", "fileName2.jpg"] }' ``` parameters: - in: header name: Authorization required: true schema: type: string description: "Mandatory. The hash-key for authentication." requestBody: required: true content: application/json: schema: type: object required: - url properties: url: type: string format: uri example: "https://example.com" attachments: type: array items: type: string description: "Optional. List of attachment filenames previously uploaded." example: - file.png responses: '200': description: Complaint successfully created. content: application/json: schema: type: object properties: id: type: string description: "Encoded complaint identifier." examples: Success: summary: Successful complaint creation value: id: "ZW5jb2RlZC1pZA==" '400': description: Invalid request payload. content: application/json: schema: type: object properties: code: type: integer error: type: string examples: InvalidRequest: summary: Invalid complaint request value: code: 400 error: "invalid request message" '401': description: Authorization failure content: application/json: schema: type: object properties: code: type: integer error: type: string examples: AuthFailure: summary: Invalid authorization value: code: 401 error: "authorization failure: authorization failure" x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/web-complaints/complaints' \ --header 'Authorization: ' \ --header 'Content-Type: application/json' \ --data '{ "url": "https://example.com", "attachments": ["fileName1.png"] }' /web-complaints/complaints/whatsapp: post: tags: - Web complaints API summary: Create complaint from WhatsApp number security: [] description: |- API for creating a complaint based on a WhatsApp number and optional attachments. The service will internally resolve the number into a URL and process it as a complaint. **Usage note:** \ Attachments must be uploaded beforehand using the `/attachments/upload` endpoint. \ The returned filenames should be included in this request. Authentication requires a hash key in the Authorization header. ## Request Examples ### cURL Example of a request using cURL in the terminal. ```bash curl -X POST "https://api.axur.com/gateway/1.0/api/web-complaints/complaints/whatsapp" \ -H "Authorization: " \ -H "Content-Type: application/json" \ -d '{ "phone": "+5511999999999", "attachments": ["fileName1.png"] }' ``` parameters: - in: header name: Authorization required: true schema: type: string description: "Mandatory. The hash-key for authentication." requestBody: required: true content: application/json: schema: type: object required: - phone properties: phone: type: string example: "+5511999999999" attachments: type: array items: type: string description: "Optional. List of attachment filenames." example: - file.png responses: '200': description: Complaint successfully created. content: application/json: schema: type: object properties: id: type: string description: "Encoded complaint identifier." examples: Success: summary: Successful complaint creation value: id: "ZW5jb2RlZC1pZA==" '400': description: Invalid request payload. content: application/json: schema: type: object properties: code: type: integer example: 400 error: type: string example: "invalid request" example: code: 400 error: "invalid request message" '401': description: Authorization failure content: application/json: schema: type: object properties: code: type: integer error: type: string examples: AuthFailure: summary: Invalid authorization value: code: 401 error: "authorization failure: authorization failure" x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/web-complaints/complaints/whatsapp' \ --header 'Authorization: ' \ --header 'Content-Type: application/json' \ --data '{ "phone": "+5511999999999", "attachments": ["fileName1.png"] }' /cardstream/{hash}: get: operationId: existLeak summary: Exists Leak tags: - Supported operations on Credit Card Exposure for Application description: Check if a credit card has leaks. parameters: - name: hash in: path required: true example: 744807d6af484cebf6f3138ee8d504340eed54daa71630aeebe5174f1b775429 description: sha256 hash with the desired credit card number schema: type: string - name: incomplete in: query required: false example: true description: Flag to check incomplete cards, detected without expiration and/or CVV (default is false) schema: type: boolean responses: '200': description: OK content: application/json: schema: type: object properties: leaked: type: boolean example: true description: Indicates leaked credit card '204': description: No results '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/cardstream/a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.7 source: | import requests PATH = 'https://api.axur.com/gateway/1.0/api/cardstream/{}' token = '' card_hash = '' headers = { 'Content-Type': 'application/json', 'Authorization': 'Bearer {}'.format(token) } url = PATH.format(card_hash) result = requests.get(url, headers=headers) print(result.json()) - lang: cURL label: Bash cURL source: | TOKEN='' CARD_HASH='' curl -s https://api.axur.com/gateway/1.0/api/cardstream/$CARD_HASH \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" /cardstream/{hash}/leaks: get: summary: Find Leaks operationId: findLeaks tags: - Supported operations on Credit Card Exposure for Application description: List all leaks for a credit card. parameters: - name: hash in: path required: true example: 744807d6af484cebf6f3138ee8d504340eed54daa71630aeebe5174f1b775429 description: sha256 hash with the desired credit card number schema: type: string - name: incomplete in: query required: false example: true description: Flag to return incomplete cards, detected without expiration and/or CVV (default is false) schema: type: boolean responses: '200': description: OK content: application/json: schema: type: array items: type: object properties: cc: type: integer detectedAt: type: integer expiryAt: type: string example: - cc: 1111110000000000 detectedAt: 1674840216 expiryAt: 10/27 '204': description: No results '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/cardstream/a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3/leaks' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.7 source: | import requests PATH = 'https://api.axur.com/gateway/1.0/api/cardstream/{}/leaks' token = '' card_hash = '' headers = { 'Content-Type': 'application/json', 'Authorization': 'Bearer {}'.format(token) } url = PATH.format(card_hash) result = requests.get(url, headers=headers) print(result.json()) - lang: cURL label: Bash cURL source: | TOKEN='' CARD_HASH='' curl -s https://api.axur.com/gateway/1.0/api/cardstream/$CARD_HASH/leaks \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" /cardhash/check/{hash}: get: summary: Check Leak operationId: checkLeak tags: - Supported operations on Credit Card Exposure for Application description: | Check if a credit card has leaks with low latency for South American customers. This API endpoint has a rate limit of **1,150 requests per minute** per IP address. **Important:** This endpoint is unavailable for European customers. servers: - url: https://sa.api.axur.com/gateway/1.0/api description: Custom API Base URL parameters: - name: hash in: path required: true example: 744807d6af484cebf6f3138ee8d504340eed54daa71630aeebe5174f1b775429 description: sha256 hash with the desired credit card number schema: type: string responses: '200': description: Credit card leak status. content: application/json: schema: type: object properties: hash: type: string example: 744807d6af484cebf6f3138ee8d504340eed54daa71630aeebe5174f1b775429 description: Credit card hash value exists: type: boolean example: true description: Indicates leaked credit card '400': description: Invalid request due to bad input format. content: application/json: schema: type: object properties: httpStatus: type: number example: 400 message: type: string example: Invalid card number hash format '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/cardhash/check/a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.7 source: | import requests PATH = 'https://sa.api.axur.com/gateway/1.0/api/cardhash/check/{}' token = '' card_hash = '' headers = { 'Content-Type': 'application/json', 'Authorization': 'Bearer {}'.format(token) } url = PATH.format(card_hash) result = requests.get(url, headers=headers) print(result.json()) - lang: cURL label: Bash cURL source: | TOKEN='' CARD_HASH='' curl -s https://sa.api.axur.com/gateway/1.0/api/cardhash/check/$CARD_HASH \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" /cyber-stix/taxii2/: get: operationId: discovery summary: TAXII Server Discovery tags: - Supported operations on Cyber Threat Intel (CTI) TAXII Server description: | Permission Level Needed: None This Endpoint provides general information about a TAXII Server, including the advertised API Roots. It's a common entry point for TAXII Clients into the data and services provided by a TAXII Server. responses: '200': description: OK content: application/taxii+json;version=2.1: schema: type: object properties: title: type: string example: Axur TAXII server description: type: string example: Server description api_roots: type: array items: type: string example: - api_root_url_1 - api_root_url_2 x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/cyber-stix/taxii2/' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.12 source: | import requests result = requests.get('https://api.axur.com/gateway/1.0/api/cyber-stix/taxii2/') print(result.json()) /cyber-stix/{api-root-id}/: get: operationId: apiRoot summary: Retrieve API Root tags: - Supported operations on Cyber Threat Intel (CTI) TAXII Server description: | Permission Level Needed: All users This Endpoint provides general information about an API Root, which can be used to help users and clients decide whether and how they want to interact with it. parameters: - name: api-root-id in: path required: true schema: type: string example: polaris responses: '200': description: OK content: application/taxii+json;version=2.1: schema: type: object properties: title: type: string example: API Root description: type: string example: API Root description versions: type: string example: application/taxii+json;version=2.1 max_content_length: type: integer example: 1 x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/cyber-stix/axur/' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.12 source: | # Remember to replace with the discovery api root id import requests token = '' api_root = 'polaris' path = f'https://api.axur.com/gateway/1.0/api/cyber-stix/{api_root}/' header = { 'Authorization': f'Bearer {token}' } result = requests.get(path, headers=header) print(result.json()) /cyber-stix/{api-root-id}/collections/: get: operationId: getCollections summary: Retrieve API Root Collections tags: - Supported operations on Cyber Threat Intel (CTI) TAXII Server description: | Permission Level Needed: All users This Endpoint provides information about the Collections hosted under this API Root. parameters: - name: api-root-id in: path required: true schema: type: string example: polaris responses: '200': description: OK content: application/taxii+json;version=2.1: schema: type: object properties: collections: type: array items: type: object properties: id: type: string example: collectionId title: type: string example: title description: type: string example: description can_read: type: boolean example: true can_write: type: boolean example: false media_types: type: array items: type: string example: application/taxii+json;version=2.1 x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/cyber-stix/axur/collections/' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.12 source: | # Remember to replace with the discovery api root id import requests token = '' api_root = 'polaris' path = f'https://api.axur.com/gateway/1.0/api/cyber-stix/{api_root}/collections/' header = { 'Authorization': f'Bearer {token}' } result = requests.get(path, headers=header) print(result.json()) /cyber-stix/{api-root-id}/collections/{collection-id}/: get: operationId: getCollection summary: Retrieve API Root Collection by Id tags: - Supported operations on Cyber Threat Intel (CTI) TAXII Server description: | Permission Level Needed: All users This Endpoint provides general information about a Collection, which can be used to help users and clients decide whether and how they want to interact with it. parameters: - name: api-root-id in: path required: true schema: type: string example: polaris - name: collection-id in: path required: true schema: type: string responses: '200': description: OK content: application/taxii+json;version=2.1: schema: type: object properties: id: type: string example: collectionId title: type: string example: title description: type: string example: description can_read: type: boolean example: true can_write: type: boolean example: false media_types: type: array items: type: string example: application/taxii+json;version=2.1 x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/cyber-stix/axur/collections/indicators/' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.12 source: | # Remember to replace with the discovery api root and collection ids import requests token = '' api_root = 'polaris' collection_id = 'anId' path = f'https://api.axur.com/gateway/1.0/api/cyber-stix/{api_root}/collections/{collection_id}/' header = { 'Authorization': f'Bearer {token}' } result = requests.get(path, headers=header) print(result.json()) /cyber-stix/{api-root-id}/collections/{collection-id}/manifest/: get: operationId: getCollectionManifest summary: Retrieve Collection Manifest tags: - Supported operations on Cyber Threat Intel (CTI) TAXII Server description: | Permission Level Needed: All users This Endpoint retrieves a manifest about the objects in a Collection. parameters: - name: api-root-id in: path required: true schema: type: string example: polaris - name: collection-id in: path required: true schema: type: string - name: added_after in: query required: false schema: type: string example: '2016-03-23T01:01:01.000Z' - name: limit in: query required: false schema: type: number example: 10 - name: next in: query required: false schema: type: number example: 10 - name: match[] in: query required: false schema: type: string example: id-1,id-2,id-3 - name: match[] in: query required: false schema: type: string example: 2.0,2.1 - name: match[] in: query required: false schema: type: string example: bundle - name: match[] in: query required: false schema: type: string example: '2016-03-23T01:01:01.000Z' responses: '200': description: OK content: application/taxii+json;version=2.1: schema: type: object properties: more: type: boolean example: true next: type: string example: 2 objects: type: array items: type: object properties: id: type: string example: objectId date_added: type: string example: '2024-05-28T17:37:47.799Z' version: type: string example: '2024-05-28T17:37:47.799Z' media_type: type: string example: application/taxii+json;version=2.1 x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/cyber-stix/axur/collections/indicators/manifest/' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /cyber-stix/{api-root-id}/collections/{collection-id}/objects/: get: operationId: getCollectionObjects summary: Retrieve Collection STIX Objects tags: - Supported operations on Cyber Threat Intel (CTI) TAXII Server description: | Permission Level Needed: All users This Endpoint retrieves objects from a Collection. Clients can search for objects in the Collection, retrieve all objects in a Collection, or paginate through objects in the Collection. Refer to the [documentation](https://docs.oasis-open.org/cti/stix/v2.1/csprd01/stix-v2.1-csprd01.html#_Toc16070617) for a detailed schema of STIX objects. parameters: - name: api-root-id in: path required: true schema: type: string example: polaris - name: collection-id in: path required: true schema: type: string - name: added_after in: query required: false schema: type: string example: '2016-03-23T01:01:01.000Z' - name: limit in: query required: false schema: type: number example: 10 - name: next in: query required: false schema: type: number example: 10 - name: match[] in: query required: false schema: type: string example: id-1,id-2,id-3 - name: match[] in: query required: false schema: type: string example: 2.0,2.1 - name: match[] in: query required: false schema: type: string example: bundle - name: match[] in: query required: false schema: type: string example: '2016-03-23T01:01:01.000Z' responses: '200': description: OK content: application/taxii+json;version=2.1: schema: type: object properties: more: type: boolean example: true next: type: string example: 2 objects: type: array items: type: object description: STIX Envelope example: - type: bundle id: bundle--252c7c11-daf2-42bd-843b-be65edca9f61 ...: other properties omitted - ... x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/cyber-stix/axur/collections/indicators/objects/' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: taxii2client + BearerAuth source: | from taxii2client.v21 import Server, as_pages from requests.auth import AuthBase # === Bearer authentication class === class BearerAuth(AuthBase): def __init__(self, token): self.token = token def __call__(self, r): r.headers["Authorization"] = f"Bearer {self.token}" return r auth = BearerAuth('') server = Server('https://api.axur.com/gateway/1.0/api/cyber-stix/taxii2/', auth=auth) print(f"Number of API Roots: {len(server.api_roots)}") # Only the first API Root is used to avoid excessive load in production api_root = server.api_roots[0] print(f"API Root URL: {api_root.url}") print(f"Title: {api_root.title}") print(f"Description: {api_root.description}") print(f"Max Content Length: {api_root.max_content_length}") for collection in api_root.collections: print(f"\nCollection: {collection.title}") print(f"ID: {collection.id}") print(f"Can Read: {collection.can_read}") print(f"Can Write: {collection.can_write}") # Only the first page is fetched with 1 object per request, # to keep the example fast and light in production environments. envelope = next(as_pages(collection.get_objects, per_request=1)) print(f"Number of objects returned: {len(envelope['objects'])}") for i, obj in enumerate(envelope['objects'], start=1): if obj['type'] == 'bundle': print(f"Number of objects in bundle {i}: {len(obj['objects'])}") for j, bundle_obj in enumerate(obj['objects'], start=1): print(f"Object {j}: =============================") print(bundle_obj) print() else: print(f"Object {i}: =============================") print(obj) /cyber-stix/{api-root-id}/collections/{collection-id}/objects/{object-id}/: get: operationId: getCollectionObjectById summary: Retrieve STIX Object by Id tags: - Supported operations on Cyber Threat Intel (CTI) TAXII Server description: | Permission Level Needed: All users This Endpoint gets an object from a Collection by its id. It can be thought of as a search where the match[id] parameter is set to the {object-id} in the path. Refer to the [documentation](https://docs.oasis-open.org/cti/stix/v2.1/csprd01/stix-v2.1-csprd01.html#_Toc16070617) for a detailed schema of STIX objects. parameters: - name: api-root-id in: path required: true schema: type: string example: polaris - name: collection-id in: path required: true schema: type: string - name: object-id in: path required: true schema: type: string example: indicator--252c7c11-daf2-42bd-843b-be65edca9f61 - name: added_after in: query required: false schema: type: string example: '2016-03-23T01:01:01.000Z' - name: limit in: query required: false schema: type: number example: 10 - name: next in: query required: false schema: type: number example: 10 - name: match[] in: query required: false schema: type: string example: '2016-03-23T01:01:01.000Z' responses: '200': description: OK content: application/taxii+json;version=2.1: schema: type: object properties: more: type: boolean example: true objects: type: array items: type: object description: STIX Envelope example: - type: indicator id: indicator--252c7c11-daf2-42bd-843b-be65edca9f61 ...: other properties omitted x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/cyber-stix/axur/collections/indicators/objects/indicator--1234/' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /cyber-stix/{api-root-id}/collections/{collection-id}/objects/{object-id}/versions/: get: operationId: getObjectVersions summary: Retrieve STIX Object Versions tags: - Supported operations on Cyber Threat Intel (CTI) TAXII Server description: | Permission Level Needed: All users This Endpoint retrieves a list of one or more versions of an object in a Collection. parameters: - name: api-root-id in: path required: true schema: type: string example: polaris - name: collection-id in: path required: true schema: type: string - name: object-id in: path required: true schema: type: string example: indicator--252c7c11-daf2-42bd-843b-be65edca9f61 responses: '200': description: OK content: application/taxii+json;version=2.1: schema: type: object properties: versions: type: array items: type: string example: '2024-05-28T17:37:47.799Z' x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/cyber-stix/axur/collections/indicators/objects/indicator--1234/versions/' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /threat-hunting-api/external/sources/{sourceId}/query-fields: get: tags: - Supported operations on Threat Hunting summary: List Query Fields description: This endpoint is used to list the fields supported on search queries on the target source. operationId: listQueryFields parameters: - name: sourceId in: path required: true schema: type: string example: credential description: | - `signal-lake` - urls and domains, such as websites and the data it contains - `signal-lake-social-media` - profiles in social media platforms, such as Facebook - `signal-lake-ads` - ads in social media, such as Facebook - `credential` - login credentials from different platforms, such as email and password - `credit-card` - credit card data, such as bin and cvv - `infostealer` - Infostealer data, such as machine and cookies information - `chat-message` - messages in chat apps, such as Whatsapp, Telegram and Discord - `forum-message` - messages in deep web forums and ransomware feeds - `social-media-posts` - posts in social media, such as Twitter / X - `tokens` - chunks of text files where we identified tokens, such as urls, names, emails and SSNs responses: '200': description: OK content: application/json: schema: type: object example: [ { "name": "detectionDate", "label": "Detection date", "type": "DATE" }, { "name": "password", "label": "Password", "type": "TEXT" }, { "name": "passwordHasLetter", "label": "Contains letter", "type": "BOOLEAN" }, { "name": "passwordLength", "label": "Password length", "type": "NUMBER" } ] x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/threat-hunting-api/external/sources/credential/query-fields' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ /threat-hunting-api/external/querybuilder/{sourceId}/generate: post: tags: - Supported operations on Threat Hunting summary: AI Query Builder description: This endpoint is used to prompt our AI Query Builder to generate a search query matching your intent operationId: promptSearchQuery parameters: - name: sourceId in: path required: true schema: type: string example: credential requestBody: required: true content: application/json: schema: type: object required: - prompt properties: prompt: type: string description: Natural language description of the search intent. example: Find credentials related to company.com detected on the year of 2026 responses: '200': description: OK content: application/json: schema: type: object example: { "queries": [ "emailDomain=\"company.com\" AND detectionDate>=2026-01-01", "accessDomain=\"company.com\" AND detectionDate>=2026-01-01", "accessUrl=\"company.com\" AND detectionDate>=2026-01-01" ] } x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/threat-hunting-api/external/querybuilder/credential/generate' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ - lang: json label: Payload source: | { "prompt": "Find credentials related to company.com detected on the year of 2026", } /threat-hunting-api/external/search: post: tags: - Supported operations on Threat Hunting summary: Start Search description: This endpoint is used to initiate an asynchronous search. After initiating the search, you will receive a search-id and use it to pool the search results and status. Idle searches will be automatically cancelled. operationId: startSearch requestBody: content: application/json: schema: type: object properties: query: type: string example: "emailDomain=\"acme.com\"" source: type: string example: credential description: | - `signal-lake` - urls and domains, such as websites and the data it contains - `signal-lake-social-media` - profiles in social media platforms, such as Facebook - `signal-lake-ads` - ads in social media, such as Facebook - `credential` - login credentials from different platforms, such as email and password - `credit-card` - credit card data, such as bin and cvv - `infostealer` - Infostealer data, such as machine and cookies information - `chat-message` - messages in chat apps, such as Whatsapp, Telegram and Discord - `forum-message` - messages in deep web forums and ransomware feeds - `social-media-posts` - posts in social media, such as Twitter / X - `tokens` - chunks of text files where we identified tokens, such as urls, names, emails and SSNs customer: type: string example: TEST description: | Search credits will be consumed from the customer informed here. If no customer is informed, credits will be consumed from the user's main customer. required: - query - source responses: '200': description: OK content: application/json: schema: type: object properties: searchId: type: string example: 5daeb8ae-dedb-4b87-b55d-9c26b00c612f '402': description: PAYMENT_REQUIRED content: application/json: schema: type: object properties: status: type: integer example: 403 code: type: string example: OUT_OF_CREDITS message: type: string example: The customer TEST does not have enough credits for this operation x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/threat-hunting-api/external/search' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"query": "emailDomain=\"acme.com\"", "source": "credential"}' - lang: json label: Payload source: | { "query": "emailDomain=\"acme.com\"", "source": "credential" } /threat-hunting-api/external/search/{searchId}: get: tags: - Supported operations on Threat Hunting summary: Get Search Results description: | This endpoint is used to get the status of a search and the paginated results. Credits are consumed everytime you hit this endpoint with results to be seen. If the page you requested has no results, or if the partial results are insufficiente for pagination, you will not be charged. operationId: getSearchResults parameters: - name: searchId in: path required: true schema: type: string example: 355ecaed-f1c7-4206-8ae8-f2c85bab3343 - name: page in: query required: true schema: type: integer example: 1 - name: alias in: query required: false schema: type: boolean example: true description: used to apply human-readable aliases on the document's properties responses: '200': description: OK content: application/json: schema: type: object example: { "id": "b9fa46a6-9e3a-4b2f-8fec-0a4e9e937a6b", "result": { "status": { "running": false, "totalParts": 14, "searchedParts": 14, "resultsLimit": 250000, "finishReason": "SUCCESSFUL", "totalResults": 102 }, "data": [ { "metadata.detectionDate": 1743682310476, "content.cardNumber": "1712891323625490", "metadata.bin": "171289", "metadata.bin8": "17128913", "metadata.source.name": "Deep/Dark Web - Telegram", "metadata.source.timestamp": 1743680249000, "metadata.file.name": "ashawn_unobs_2.2.txt", "metadata.file.path": "[PH]49.150.6.168/Important Files/Desktop/AAA/", "metadata.message.author.type": "CHAT", "metadata.message.timestamp": 1743680249000, "metadata.message.type": "DOCUMENT", "metadata.message.chat.name": "🌩️ Moon Cloud | Free Logs", "metadata.message.chat.type": "SUPERGROUP", "id": "2025040312115075065500965443D2EDB11026979", "metadata.message.caption": "🔗 Link | 🌙 MoonProject | 👤 Admin\n———————————————————\n🪙BUY MOON CLOUD PRIVATE🪙\n\n🔎MoonSearcher | Best url-searcher bot" }, { "metadata.detectionDate": 1743682264714, "content.cardNumber": "1712891323625490", "metadata.bin": "171289", "metadata.bin8": "17128913", "metadata.source.name": "Deep/Dark Web - Telegram", "metadata.source.timestamp": 1743680249000, "metadata.file.name": "aFOR NEW INDEX.txt", "metadata.file.path": "[PH]49.150.6.168/Important Files/Desktop/AAA/A/", "metadata.message.author.type": "CHAT", "metadata.message.timestamp": 1743680249000, "metadata.message.type": "DOCUMENT", "metadata.message.chat.name": "🌩️ Moon Cloud | Free Logs", "metadata.message.chat.type": "SUPERGROUP", "id": "20250403121105075390602653EB5C6EA00023671", "metadata.message.caption": "🔗 Link | 🌙 MoonProject | 👤 Admin\n———————————————————\n🪙BUY MOON CLOUD PRIVATE🪙\n\n🔎MoonSearcher | Best url-searcher bot" } ], "pagination": { "page": 2, "size": 100, "offset": 100, "total": 102 } } } '402': description: PAYMENT_REQUIRED content: application/json: schema: type: object properties: status: type: integer example: 403 code: type: string example: OUT_OF_CREDITS message: type: string example: The customer TEST does not have enough credits for this operation x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/threat-hunting-api/external/search/SRCH1' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /threat-hunting-api/external/detail/{documentId}: get: tags: - Supported operations on Threat Hunting summary: Get Document Details description: | This endpoint is used to get details of a document that may not be available on the paginated results endpoint. operationId: getDocumentDetails parameters: - name: documentId in: path required: true schema: type: string example: 202605211446221951654824AFFFD203E7B024793 - name: source in: query required: true schema: type: string example: credential - name: alias in: query required: false schema: type: boolean example: true description: used to apply human-readable aliases on the document's properties - name: customer in: query required: false schema: type: string example: true description: used to identify the requester responses: '200': description: OK content: application/json: schema: type: object example: { "metadata.detectionDate": 1743682310476, "content.cardNumber": "1712891323625490", "metadata.bin": "171289", "metadata.bin8": "17128913", "metadata.source.name": "Deep/Dark Web - Telegram", "metadata.source.timestamp": 1743680249000, "metadata.file.name": "ashawn_unobs_2.2.txt", "metadata.file.path": "[PH]49.150.6.168/Important Files/Desktop/AAA/", "metadata.message.author.type": "CHAT", "metadata.message.timestamp": 1743680249000, "metadata.message.type": "DOCUMENT", "metadata.message.chat.name": "🌩️ Moon Cloud | Free Logs", "metadata.message.chat.type": "SUPERGROUP", "id": "2025040312115075065500965443D2EDB11026979", "metadata.message.caption": "🔗 Link | 🌙 MoonProject | 👤 Admin\n———————————————————\n🪙BUY MOON CLOUD PRIVATE🪙\n\n🔎MoonSearcher | Best url-searcher bot" } x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/threat-hunting-api/external/detail/202605211446221951654824AFFFD203E7B024793?source=credential&alias=false&customer=CTM1' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /threat-hunting-api/external/file-download: post: tags: - Supported operations on Threat Hunting summary: Request File Download description: | Initiates a file download request for a document identified by its ID. This endpoint validates the user's access, checks usage limits, and reserves credits for the download. On success, it returns a `fileDownloadId` that must be used to retrieve the temporary download link via the [Get Download Link](#operation/getFileDownloadLink) endpoint. **Credits:** This operation consumes 1 credit per request. operationId: requestFileDownload requestBody: required: true content: application/json: schema: type: object required: - id - customerKey properties: id: type: string description: The unique identifier of the document to be downloaded. example: "20250222220017461854885645822356A48034200:f92ae5498a7747db3b778cabbb6206c018dc621576237dd54ca326fc80c7fe72" customerKey: type: string description: The customer key (tenant identifier). Required when operating on behalf of a specific tenant. example: "TEST" responses: '200': description: OK content: application/json: schema: type: object properties: fileDownloadId: type: integer format: int64 description: The ID of the file download request. Use this to retrieve the temporary download link. example: 4821 '400': description: BAD REQUEST — Missing required parameter (`id` or `customerKey`). '402': description: PAYMENT REQUIRED — The customer does not have enough credits for this operation. '403': description: FORBIDDEN — The requester does not have access to the requested customer. '404': description: NOT FOUND — The document with the given `id` was not found. x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/threat-hunting-api/external/file-download' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "id": "20250222220017461854885645822356A48034200:f92ae5498a7747db3b778cabbb6206c018dc621576237dd54ca326fc80c7fe72", "customerKey": "TEST" }' /threat-hunting-api/external/file-download/{id}: get: tags: - Supported operations on Threat Hunting summary: Get Download Link description: | Generates a temporary download link for a previously requested file download. The link is valid for a limited time window. Once expired, the request must be repeated via [Request File Download](#operation/requestFileDownload). operationId: getFileDownloadLink parameters: - name: id in: path required: true description: The `fileDownloadId` returned by the [Request File Download](#operation/requestFileDownload) endpoint. schema: type: integer format: int64 example: 4821 responses: '200': description: OK — Returns the temporary URL to download the file. content: text/plain: schema: type: string example: "https://storage.axur.com/files/abc123?token=xyz&expires=1234567890" '403': description: FORBIDDEN — The requester does not have access to the requested customer. '404': description: NOT FOUND — No file download request found for the given `id`. '410': description: GONE — The file download request has expired. Please submit a new request. x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/threat-hunting-api/external/file-download/4821' \ --header 'Authorization: Bearer ' /investigations/investigation: post: operationId: createInvestigation summary: Create Investigation tags: - Supported operations on Investigations description: | Permission Level Needed: Experts/Managers Create Investigation requestBody: required: true content: application/json: schema: properties: customer: type: string description: customer key asset: type: string description: asset associated with the investigation relation: type: string description: Ticket url example: https://one.axur.com/deep-dark-web/tickets/ title: type: string details: type: string description: type: string recipients: type: array description: recipients emails items: type: string responses: 200: description: OK content: application/json: schema: type: object properties: id: type: integer 400: description: Bad Request content: text/plain: schema: type: string example: Contract not found 403: description: Forbidden content: text/plain: schema: type: string example: Not authorized 405: description: Method Not Allowed content: text/plain: schema: type: string example: Cannot open investigation because customer already has an opened investigation with reference . 500: description: Internal Server Error content: text/plain: schema: type: string example: Internal error OR Ticket has a open takedown OR Ticket is closed x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/investigations/investigation' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "customer": "ACME", "title": "Phishing Campaign Investigation", "description": "Investigation of phishing campaign targeting employees." }' - lang: json label: Payload source: | { "customer": "ACME", "title": "Phishing Campaign Investigation", "description": "Investigation of phishing campaign targeting employees." } /investigations/investigation/search/{customer_key}: get: operationId: getInvestigationsPaginated summary: Get Investigations paginated tags: - Supported operations on Investigations description: | Permission Level Needed: Experts/Managers Get Investigations paginated parameters: - name: customer_key in: path required: true schema: type: string example: CSTMR_KEY responses: '200': description: OK content: application/json: schema: type: object properties: metadata: type: object properties: total: type: integer example: 10 page: type: integer example: 2 investigations: type: array description: A list of investigation objects items: type: object properties: title: type: string id: type: object properties: value: type: integer example: 329 relation: type: object properties: url: type: string type: type: string totalTime: type: integer creationDate: type: integer lastUpdateDate: type: integer currentStatus: type: string reportAttachment: type: object properties: url: type: string fileName: type: string metadata: type: object properties: bytesize: type: integer contentType: type: string date: type: integer author: type: object properties: id: type: integer isAnalyst: type: boolean isEnable: type: boolean isDeleted: type: boolean '400': description: Bad Request content: text/plain: schema: enum: - Contract not found - Customer no have active contract to disable - Customer contract does not include access to investigations - Customer from investigation cannot be '*' - Some ids is invalid - Customer contract does not include access to investigations - User(s) do not exist '403': description: Forbidden content: text/plain: schema: type: string example: Not authorized '500': description: Internal Server Error content: text/plain: schema: type: string example: Internal error x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/investigations/investigation/search/ACME?page=1&pageSize=20' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /investigations/investigation/{investigation_id}/attachment: post: operationId: uploadAttachmentAndAddToInvestigation summary: Upload attachment and add it to investigation tags: - Supported operations on Investigations description: | Permission Level Needed: Experts/Managers Upload attachment and add it to investigation parameters: - name: investigation_id in: path required: true schema: type: integer example: 123 requestBody: required: true content: multipart/form-data: schema: properties: file: type: string format: binary description: The attachment file to be uploaded, the max size for the file name is 223 characters responses: '200': description: OK content: application/json: schema: type: object properties: attachment: type: object description: Attatchment object properties: url: type: string example: https://url_to_your_attachment.com/some/path/to/attachment.png fileName: type: string example: your_file_name.png date: type: integer example: 2178781 description: Date in millis metadata: type: object description: attachment metadata properties: byteSize: type: integer example: 16 contentType: type: string example: image/jpeg author: type: object description: upload author object properties: id: type: integer example: 1 isAnalyst: type: boolean example: false isEnable: type: boolean example: true '400': description: Bad Request – various validation errors content: text/plain: schema: type: string enum: - Contract not found - Customer no have active contract to disable - Customer contract does not include access to investigations - Customer from investigation cannot be '*' - Some ids is invalid - User(s) do not exist '403': description: Forbidden content: text/plain: schema: type: string example: Not authorized '404': description: Not Found content: text/plain: schema: type: string enum: - Investigation with id not found - Investigation not found for reference '405': description: Method Not Allowed content: text/plain: schema: type: string enum: - Invalid relation url submitted Only one relation url can be submitted for investigation! - Cannot open investigation because customer already has an opened investigation with reference . - Ticket has a open takedown - Ticket is closed '500': description: Internal Server Error content: text/plain: schema: type: string example: Internal error x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/investigations/investigation/123/attachment' \ --header 'Authorization: Bearer ' \ --form 'file=@/path/to/evidence.pdf' /investigations/investigation/{investigation_id}/status/{status_action}/{status_creation_date}/attachment: post: operationId: uploadAttachmentAndAddToStatus summary: Upload attachment and add it to status tags: - Supported operations on Investigations description: | Permission Level Needed: Experts/Managers Upload attachment and add it to Status parameters: - name: investigation_id in: path required: true schema: type: string example: 123 - name: status_action in: path required: true schema: type: string example: INVESTIGATION_REQUESTED description: Status type ( INVESTIGATION_REQUESTED, INVESTIGATION_STARTED, SEARCHING_INFORMATION, OBTAINING_ITEMS, ANALYZING_ITEMS, VERIFYING_ITEMS, TESTING_ITEMS, WAITING_THREAT_ACTOR_RESPONSE, WAITING_CUSTOMER_RESPONSE, GENERATING_REPORT, INVESTIGATION_COMPLETED, INVESTIGATION_INTERRUPTED, INVESTIGATION_REOPENED ) - name: status_creation_date in: path required: true schema: type: integer example: 12676472 description: the creation date time in millis from the status action requestBody: required: true content: multipart/form-data: schema: properties: file: type: string format: binary description: The attachment file to be uploaded, the max size for the file name is 223 characters responses: '200': description: OK content: application/json: schema: type: object properties: attachment: type: object description: Attatchment object properties: url: type: string example: https://url_to_your_attachment.com/some/path/to/attachment.png fileName: type: string example: your_file_name.png date: type: integer example: 2178781 description: Date in millis metadata: type: object description: attachment metadata properties: byteSize: type: integer example: 16 contentType: type: string example: image/jpeg author: type: object description: upload author object properties: id: type: integer example: 1 isAnalyst: type: boolean example: false isEnable: type: boolean example: true '400': description: Bad Request content: text/plain: schema: type: string enum: - User(s) do not exist - Contract not found - Customer no have active contract to disable - Customer contract does not include access to investigations - Customer from investigation cannot be '*' '403': description: Forbidden content: text/plain: schema: type: string example: Not authorized '404': description: Not Found content: text/plain: schema: type: string enum: - Investigation with id not found - Investigation not found for reference - '405': description: Method Not Allowed content: text/plain: schema: type: string enum: - Invalid relation url submitted Only one relation url can be submitted for investigation! - Cannot open investigation because customer already has an opened investigation with reference . - Ticket has a open takedown - Ticket is closed - Some ids is invalid '500': description: Internal Server Error content: text/plain: schema: type: string example: Internal error x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/investigations/investigation/123/status/INVESTIGATION_REQUESTED/12676472/attachment' \ --header 'Authorization: Bearer ' \ --form 'file=@/path/to/status-attachment.pdf' /automations-api/catalog/describe: get: operationId: describeAutomationsCatalog summary: Describe Automations fields catalog tags: - Supported operations on Automations description: | Permission Level Needed: Viewers Get fields, conditions, values and types available for configuring and Automation ## Comparators Comparators define how a condition value is evaluated against item data. | Comparator | Behavior | |---|---| | `EQUAL` | Matches when the field equals one of the provided values. | | `NOT_EQUAL` | Matches when the field does not equal any provided value. An absent field does not satisfy the condition. | | `CONTAINS` | Matches when the field contains the provided substring. Matching is case-sensitive unless the field configuration specifies otherwise. | | `NOT_CONTAINS` | Matches when the field contains none of the provided substrings. An absent field does not satisfy the condition. | | `GREATER_THAN` | Matches when the field is numerically greater than the provided value. Applies to `NUMBER`, `PERCENTAGE`, and `DATE` fields. | | `GREATER_THAN_OR_EQUAL` | Matches when the field is greater than or equal to the provided value. | | `LESS_THAN` | Matches when the field is numerically less than the provided value. | | `LESS_THAN_OR_EQUAL` | Matches when the field is less than or equal to the provided value. | ## Data Types The `dataType` identifies the kind of data stored in a field and determines which comparisons are supported. | Data type | Description | |---|---| | `STRING` | Text values. Supports `EQUAL`, `NOT_EQUAL`, `CONTAINS`, and `NOT_CONTAINS`. | | `NUMBER` | Integer or decimal values. Supports numeric comparators and equality comparisons. | | `PERCENTAGE` | Decimal values from `0` to `1`; for example, `0.95` represents 95%. Supports the same comparisons as `NUMBER`. | | `ENUM` | A predefined set of values. Valid options are listed in `allowedValues`. | | `DATE` | Unix timestamps in milliseconds. Supports numeric comparisons for date ranges. | | `BOOLEAN` | `true` or `false`. Supports `EQUAL` and `NOT_EQUAL`. | ## Value Types The `valueType` identifies how many values a field can contain. | Value type | Description | |---|---| | `SCALAR` | A single atomic value. | | `LIST` | Multiple values. By default, a condition matches when any list value satisfies the comparator (OR logic). For example, `EQUAL` with the value `leaked` matches a list containing `leaked`. | ## Enum Validation For `ENUM` fields, `allowedValues.closed` determines whether custom values are accepted: * `closed: true` — Only values in `allowedValues.values` are valid. * `closed: false` — Listed values are suggestions; other values are also accepted. ## Required Fields The catalog's `required` property indicates whether an automation must include a condition for a field: * `required: true` — At least one condition for the field is mandatory. * `required: false` — The field is optional. ## Validation Rules When creating or updating an automation: * `DATE` values must be Unix timestamps in milliseconds. * Closed `ENUM` values must exactly match one of the predefined options. responses: '200': description: OK content: application/json: schema: type: object properties: catalog: type: array description: Match types catalog items items: $ref: "#/components/schemas/AutomationCatalogItem" example: catalog: - type: CREDENTIAL fields: - key: metadata.parser.format dataType: ENUM valueType: LIST comparators: - EQUAL - NOT_EQUAL allowedValues: values: - COMBOLIST - STEALER LOG - TABLE closed: true required: false actions: - group: annotation-TAG maxAllowed: UNLIMITED actions: - name: TAG arguments: tags: dataType: STRING valueType: LIST '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/AutomationError' x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/automations-api/catalog/describe' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /automations-api/list: get: operationId: listAutomations summary: List automations tags: - Supported operations on Automations description: | Permission Level Needed: Viewers Get paginated list of automations with optional filtering. parameters: - name: customerKey in: query required: true schema: type: string description: Customer key identifier - name: matchTypes in: query required: false schema: type: string description: Comma-separated list of match types to filter by (e.g., TICKET_DETECTION,CREDENTIAL) - name: status in: query required: false schema: type: string description: Filter by automation status (e.g., ACTIVE, INACTIVE) - name: text in: query required: false schema: type: string description: Text search filter by name or description - name: page in: query required: false schema: type: string default: "1" description: Page number for pagination - name: perPage in: query required: false schema: type: string default: "20" description: Number of items per page responses: '200': description: OK content: application/json: schema: type: object properties: automations: type: array description: List of automations items: $ref: '#/components/schemas/AutomationSummaryView' pagination: $ref: '#/components/schemas/AutomationPagination' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AutomationError' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/AutomationError' x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/automations-api/list?customerKey=cust_123456&matchTypes=CREDENTIAL&status=ACTIVE&page=1&perPage=20' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /automations-api/automation: post: operationId: createAutomation summary: Create a new automation tags: - Supported operations on Automations description: | Permission Level Needed: Managers Create a new automation with conditions and actions. This operation triggers a retroactive search and execution on existing values. New automations can be created while another retroactive execution is ongoig, but get their own retroactive execution enqueued. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AutomationManageRequestCreate' responses: '201': description: Created content: application/json: schema: $ref: '#/components/schemas/AutomationView' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AutomationError' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/AutomationError' x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/automations-api/automation' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "customer": "cust_123456", "matchType": "CREDENTIAL", "name": "Tag high-risk credentials", "description": "Automatically tag credentials with high risk scores", "priority": 1, "conditions": [ { "field": "metadata.parser.format", "comparator": "EQUAL", "values": ["COMBOLIST", "STEALER LOG"] } ], "actions": [ { "actionType": "TAG", "arguments": { "tags": ["high-risk", "credential-leak"] } } ] }' /automations-api/automation/{id}: get: operationId: getAutomation summary: Get automation by ID tags: - Supported operations on Automations description: | Permission Level Needed: Viewers Retrieve a specific automation by its ID. parameters: - name: id in: path required: true schema: type: integer description: Automation ID responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/AutomationView' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AutomationError' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/AutomationError' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/AutomationError' x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/automations-api/automation/123' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' put: operationId: updateAutomation summary: Update an automation tags: - Supported operations on Automations description: | Permission Level Needed: Managers Update an existing automation. Available updates are: - Name - Description - Priority - Conditions - Actions Updates do not trigger retroactive search and execution, only new values are affected by the change. parameters: - name: id in: path required: true schema: type: integer description: Automation ID requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AutomationManageRequestUpdate' responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/AutomationView' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AutomationError' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/AutomationError' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/AutomationError' x-codeSamples: - lang: cURL label: cURL source: | curl --request PUT \ --url 'https://api.axur.com/gateway/1.0/api/automations-api/automation/123' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "name": "Tag high-risk credentials", "description": "Automatically tag credentials with high risk scores", "priority": 1, "conditions": [ { "field": "metadata.parser.format", "comparator": "EQUAL", "values": ["COMBOLIST", "STEALER LOG"] } ], "actions": [ { "actionType": "TAG", "arguments": { "tags": ["high-risk", "credential-leak"] } } ] }' delete: operationId: deleteAutomation summary: Delete an automation tags: - Supported operations on Automations description: | Permission Level Needed: Managers Delete an automation permanently. parameters: - name: id in: path required: true schema: type: integer description: Automation ID responses: '204': description: No Content '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AutomationError' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/AutomationError' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/AutomationError' x-codeSamples: - lang: cURL label: cURL source: | curl --request DELETE \ --url 'https://api.axur.com/gateway/1.0/api/automations-api/automation/123' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /automations-api/automation/{id}/activate: patch: operationId: activateAutomation summary: Activate an automation tags: - Supported operations on Automations description: | Permission Level Needed: Managers Activate a deactivated automation. parameters: - name: id in: path required: true schema: type: integer description: Automation ID responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/AutomationView' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AutomationError' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/AutomationError' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/AutomationError' x-codeSamples: - lang: cURL label: cURL source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/automations-api/automation/123/activate' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /automations-api/automation/{id}/deactivate: patch: operationId: deactivateAutomation summary: Deactivate an automation tags: - Supported operations on Automations description: | Permission Level Needed: Managers Deactivate an active automation. parameters: - name: id in: path required: true schema: type: integer description: Automation ID responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/AutomationView' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AutomationError' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/AutomationError' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/AutomationError' x-codeSamples: - lang: cURL label: cURL source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/automations-api/automation/123/deactivate' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /automations-api/automation/{id}/item/{itemKey}/dry-run: get: operationId: dryRunAutomation summary: Dry run automation against an item tags: - Supported operations on Automations description: | Permission Level Needed: Viewers Test if an automation's conditions would match a specific item without executing the actions ## Match Definitions Automation conditions are evaluated using two levels of boolean logic: * Values in a single condition use `OR` logic. The condition matches when the field matches at least one provided value. ```text field EQUAL ["value1", "value2"] ``` Equivalent logic: `field equals "value1" OR field equals "value2"` * Conditions on different fields use `AND` logic. The item must satisfy every condition. ```text field1 EQUAL ["value1"] field2 CONTAINS ["text"] ``` Equivalent logic: `(field1 equals "value1") AND (field2 contains "text")` parameters: - name: id in: path required: true schema: type: integer description: Automation ID - name: itemKey in: path required: true schema: type: string description: Item key to test against responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/AutomationDryRunOutput' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/AutomationError' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/AutomationError' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/AutomationError' '502': description: Bad Gateway - Upstream service error content: application/json: schema: $ref: '#/components/schemas/AutomationError' x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/automations-api/automation/123/item/ticket-456/dry-run' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /customer-open-data/datasets: get: operationId: datasets summary: Get available datasets tags: - Supported operations on Open Data description: Get available datasets responses: '200': description: OK content: application/json: schema: type: array description: Datasets response items: $ref: '#/components/schemas/OpenDataDatasetsResult' '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/customer-open-data/datasets' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.7 source: | import requests url = 'https://api.axur.com/gateway/1.0/api/customer-open-data/datasets' token = '' headers = { 'Content-Type': 'application/json', 'Authorization': 'Bearer {}'.format(token) } result = requests.get(url, headers=headers) print(result.json()) - lang: cURL label: Bash cURL source: | TOKEN='' curl -s https://api.axur.com/gateway/1.0/api/customer-open-data/datasets \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" /customer-open-data/datasets/{dataset}: get: operationId: datasetId summary: Get available tables for a dataset parameters: - name: dataset in: path required: true schema: type: string tags: - Supported operations on Open Data description: Get available tables for a dataset responses: '200': description: OK content: application/json: schema: type: array description: Dataset tables response items: $ref: '#/components/schemas/schemas-OpenDataDatasetsResult' '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/customer-open-data/datasets/phishing' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.7 source: | import requests url = 'https://api.axur.com/gateway/1.0/api/customer-open-data/datasets/tickets' token = '' headers = { 'Content-Type': 'application/json', 'Authorization': 'Bearer {}'.format(token) } result = requests.get(url, headers=headers) print(result.json()) - lang: cURL label: Bash cURL source: | TOKEN='' curl -s https://api.axur.com/gateway/1.0/api/customer-open-data/datasets/tickets \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" /customer-open-data/datasets/{dataset}/dictionary: get: operationId: datasetDictionary summary: Get available dictionary for a dataset parameters: - name: dataset in: path required: true schema: type: string tags: - Supported operations on Open Data description: Get available dictionary for a dataset responses: '200': description: OK content: application/octet-stream: schema: type: string description: The dictionary file for download format: binary '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/customer-open-data/datasets/phishing/dictionary' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.7 source: | import requests url = 'https://api.axur.com/gateway/1.0/api/customer-open-data/datasets/tickets/dictionary' token = '' headers = { 'Content-Type': 'application/octet-stream', 'Authorization': 'Bearer {}'.format(token) } result = requests.get(url, headers=headers) print(result.json()) - lang: cURL label: Bash cURL source: | TOKEN='' curl -s https://api.axur.com/gateway/1.0/api/customer-open-data/datasets/tickets/dictionary \ -H "Content-Type: application/octet-stream" \ -H "Authorization: Bearer $TOKEN" /customer-open-data/datasets/{dataset}/{filename}: get: operationId: datasetTable summary: Get a dataset table file parameters: - name: dataset in: path required: true schema: type: string - name: filename in: path required: true schema: type: string tags: - Supported operations on Open Data description: Get a dataset table file responses: '200': description: OK content: application/octet-stream: schema: type: string description: Dataset file response format: binary '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/customer-open-data/datasets/phishing/data.parquet' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.7 source: | import requests url = 'https://api.axur.com/gateway/1.0/api/customer-open-data/datasets/tickets/tickets-2023.csv' token = '' headers = { 'Content-Type': 'application/octet-stream', 'Authorization': 'Bearer {}'.format(token) } result = requests.get(url, headers=headers) print(result.json()) - lang: cURL label: Bash cURL source: | TOKEN='' curl -s https://api.axur.com/gateway/1.0/api/customer-open-data/datasets/tickets/tickets-2023.csv \ -H "Content-Type: application/octet-stream" \ -H "Authorization: Bearer $TOKEN" /customer-open-data/datasets/{dataset}/current: get: operationId: datasetCurrentFile summary: Get last file added to a dataset parameters: - name: dataset in: path required: true schema: type: string tags: - Supported operations on Open Data description: Get last file added to a dataset responses: '200': description: OK content: application/json: schema: type: array description: Dataset file response items: $ref: '#/components/schemas/schemas-OpenDataDatasetsResult' '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/customer-open-data/datasets/phishing/current' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' - lang: Python label: Python 3.7 source: | import requests url = 'https://api.axur.com/gateway/1.0/api/customer-open-data/datasets/tickets/current' token = '' headers = { 'Content-Type': 'application/octet-stream', 'Authorization': 'Bearer {}'.format(token) } result = requests.get(url, headers=headers) print(result.json()) - lang: cURL label: Bash cURL source: | TOKEN='' curl -s https://api.axur.com/gateway/1.0/api/customer-open-data/datasets/tickets/current \ -H "Content-Type: application/octet-stream" \ -H "Authorization: Bearer $TOKEN" /ioc-core/iocs/report/stix: get: operationId: report summary: Gets a report of available IoCs tags: - Supported operations on IoC Feed description: | IoC's report DEPRECATION NOTICE: this endpoint has been replaced by the [TAXII Server IOCs collection](#operation/getCollectionObjects) and will be removed in a future version. deprecated: true parameters: - name: format in: query required: false example: STIX description: Response format ( `CSV`, `STIX`) schema: type: string - name: created in: query required: false example: 1697425200000,1697511599999 description: Timestamp (ms) frame in which to search for IoCs (start,end) schema: type: string - name: type in: query required: false example: sha256,domain,url description: IoC types to search for (`domain`, `filename`, `md5`, `sha1`, `sha256`, `url`) schema: type: string - name: tags in: query required: false example: containsAny(,string) description: Searches for IoCs with tags that match any string provided schema: type: string responses: '200': description: OK content: application/json: schema: type: object properties: type: type: string example: bundle description: bundle type spec_version: type: string example: 2 description: STIX format version id: type: string example: bundle--bf2fbac2-7fd7-4a59-90c6-5a6bdab95016 description: id of the bundle objects: type: array description: array of iocs items: type: object properties: type: type: string example: indicator id: type: string example: indicator--9179b88c6fcff2442330073d977969ce created: type: string example: '2023-10-16T19:00:08.000Z' modified: type: string example: '2023-10-16T19:00:08.000Z' pattern: type: string example: '[url:value = ''http://fb.100394003.help/'']' labels: type: array example: - phishing items: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/ioc-core/iocs/report/stix' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"type": "bundle", "id": "bundle--12345678-1234-1234-1234-123456789abc", "objects": []}' - lang: Python label: Python 3.7 source: | import requests PATH = 'https://api.axur.com/gateway/1.0/api/ioc-core/iocs/report/stix' token = '' created = 'created=1697425200000,1697511599999' headers = { 'Content-Type': 'application/json', 'Authorization': 'Bearer {}'.format(token) } url = PATH + '?' + created result = requests.get(url, headers=headers) print(result.json()) /vendor-monitor/customer-vendors-api/customer/{customer}/dark-web: get: operationId: searchDarkWeb summary: Get dark web mentions tags: - Supply Chain Intel description: | Retrieves dark web mentions associated with customer's vendors. parameters: - name: customer in: path required: true example: AXUR description: Customer identifier schema: type: string - name: assetKey in: query required: false example: AXRNTFX description: Filters results by asset key schema: type: string - name: page in: query required: false example: 1 description: Page number schema: type: integer - name: size in: query required: false example: 20 description: Page size. It supports sizes up to 20 schema: type: integer - name: lang in: query required: false example: pt description: Language used for translated fields. Default language is english schema: type: string responses: '200': description: OK content: application/json: schema: type: object properties: pagination: type: object properties: page: type: integer example: 1 size: type: integer example: 10 total: type: integer nullable: true example: 132 data: type: array description: List dark web mentions data items: type: object properties: assetKey: type: string example: AXRNTFX description: Asset identifier name: type: string example: Axur description: Vendor name total: type: integer example: 181 description: Total number of mentions identified summary: type: object description: AI-generated summary properties: content: type: string example: | This report analyzes various messages from deep and dark web sources mentioning "Axur." description: Threat analysis summary references: type: array description: References used to generate the report items: type: string example: https://one.axur.com/threat-hunting?query=id%3A20241030123917702127923647AAD2D1521037464&source=chat-message topActors: type: array description: Top threat actors mentioning the asset items: type: object properties: name: type: string example: SkynetBlackRobot description: Threat actor identifier mentions: type: integer example: 72 description: Total mentions associated with the actor platforms: type: array description: Platforms where the actor was identified items: type: string example: Telegram mentionsByChannel: type: array description: Distribution of mentions by communication channel items: type: object properties: channel: type: string example: Telegram description: Communication channel value: type: integer example: 166 description: Number of mentions identified in the channel lastUpdated: type: string format: date-time example: '2026-05-12T18:14:00.907Z' description: Last update timestamp '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/dark-web?assetKey=AXRNTFX&page=1&size=20' \ --header 'Authorization: Bearer ' - lang: Python label: Python 3.7 source: | import requests PATH = 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/dark-web' token = '' headers = { 'Authorization': 'Bearer {}'.format(token) } params = { 'assetKey': 'AXRNTFX', 'page': 1, 'size': 20 } result = requests.get(PATH, headers=headers, params=params) print(result.json()) /vendor-monitor/customer-vendors-api/customer/{customer}/corporate-credentials: get: operationId: searchCorporateCredentials summary: Get corporate credential tags: - Supply Chain Intel description: | Retrieves leaked corporate credentials associated with customer's vendors parameters: - name: customer in: path required: true example: AXUR description: Customer identifier schema: type: string - name: assetKey in: query required: false example: AXRNTFX description: Filters results by asset key schema: type: string - name: page in: query required: false example: 1 description: Page number schema: type: integer - name: size in: query required: false example: 20 description: Page size. It supports sizes up to 20 schema: type: integer responses: '200': description: OK content: application/json: schema: type: object properties: pagination: type: object properties: page: type: integer example: 1 size: type: integer example: 10 total: type: integer nullable: true example: 132 data: type: array description: List of corporate credentials data items: type: object properties: assetKey: type: string example: AXRNTFX description: Asset identifier name: type: string example: Axur description: Vendor name total: type: integer example: 7540 description: Total number of leaked credentials identified lastUpdated: type: string format: date-time example: '2026-05-08T20:15:30.397Z' description: Last update timestamp samples: type: array description: Sample leaked credentials items: type: object properties: username: type: string example: marcelo.breda@axur.com.br description: Username or email associated with the credential password: type: string example: v*********9 description: Masked leaked password date: type: integer format: int64 example: 1778266308120 description: Leak detection timestamp in milliseconds sources: type: array description: Sources where the leaked credentials were identified items: type: object properties: name: type: string example: Telegram description: Source name value: type: integer example: 5183 description: Number of occurrences identified in the source '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/corporate-credentials?assetKey=AXRNTFX&page=1&size=20' \ --header 'Authorization: Bearer ' - lang: Python label: Python 3.7 source: | import requests PATH = 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/corporate-credentials' token = '' headers = { 'Authorization': 'Bearer {}'.format(token) } params = { 'assetKey': 'AXRNTFX', 'page': 1, 'size': 20 } result = requests.get(PATH, headers=headers, params=params) print(result.json()) /vendor-monitor/customer-vendors-api/customer/{customer}/customer-credentials: get: operationId: searchCustomerCredentials summary: Get customer credentials tags: - Supply Chain Intel description: | Retrieves leaked customer credentials associated with customer's vendors. parameters: - name: customer in: path required: true example: AXUR description: Customer identifier schema: type: string - name: assetKey in: query required: false example: AXRNTFX description: Filters results by asset key schema: type: string - name: page in: query required: false example: 1 description: Page number schema: type: integer - name: size in: query required: false example: 20 description: Page size. It supports sizes up to 20 schema: type: integer responses: '200': description: OK content: application/json: schema: type: object properties: pagination: type: object properties: page: type: integer example: 1 size: type: integer example: 10 total: type: integer nullable: true example: 132 data: type: array description: List of customer credentials data items: type: object properties: assetKey: type: string example: AXRNTFX description: Asset identifier name: type: string example: Axur description: Vendor name total: type: integer example: 15377 description: Total number of leaked credentials identified lastUpdated: type: string format: date-time example: '2026-05-08T20:15:51.459Z' description: Last update timestamp samples: type: array description: Sample leaked credentials associated with the asset items: type: object properties: username: type: string example: makecadastro description: Username or email associated with the credential password: type: string example: B***************3 description: Masked leaked password date: type: string format: date-time example: '2026-05-08T15:13:13.528Z' description: Leak detection timestamp url: type: string example: chefwebcloud.chef.axr.com.br/Login description: URL associated with the leaked credential '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/customer-credentials?assetKey=AXRNTFX&page=1&size=20' \ --header 'Authorization: Bearer ' - lang: Python label: Python 3.7 source: | import requests PATH = 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/customer-credentials' token = '' headers = { 'Authorization': 'Bearer {}'.format(token) } params = { 'assetKey': 'AXRNTFX', 'page': 1, 'size': 20 } result = requests.get(PATH, headers=headers, params=params) print(result.json()) /vendor-monitor/customer-vendors-api/customer/{customer}/external-attack-surface: get: operationId: searchExternalAttackSurface summary: Get External Attack Surface tags: - Supply Chain Intel description: | Retrieves external attack surface findings associated with customer's vendors. parameters: - name: customer in: path required: true example: AXUR description: Customer identifier schema: type: string - name: assetKey in: query required: false example: AXRNTFX description: Filters results by asset key schema: type: string - name: page in: query required: false example: 1 description: Page number schema: type: integer - name: size in: query required: false example: 20 description: Page size. It supports sizes up to 20 schema: type: integer responses: '200': description: OK content: application/json: schema: type: object properties: pagination: type: object properties: page: type: integer example: 1 size: type: integer example: 10 total: type: integer nullable: true example: 1 data: type: array description: List of external attack surface data items: type: object properties: total: type: integer example: 2 description: Total number of exposed assets identified assetKey: type: string example: AXRNTFX description: Asset identifier name: type: string example: Axur description: Vendor name vulnerabilities: type: integer example: 24 description: Total number of vulnerabilities identified expiredCertificates: type: integer example: 0 description: Total number of expired SSL certificates identified lastUpdated: type: string format: date-time example: '2026-05-06T04:59:36.754Z' description: Last update timestamp assets: type: array description: Vulnerable exposed assets items: type: object properties: name: type: string example: telemetry.acronis.com description: Asset hostname ipAddress: type: string example: 137.117.182.202 description: Asset IP address port: type: string example: 443/nginx 1.18.0 description: Exposed port and detected service cve: type: string example: NGINX:CVE-2026-27654 description: Vulnerability identifier severity: type: string example: HIGH description: Vulnerability severity level cvss: type: string example: '8.8' description: CVSS score associated with the vulnerability link: type: string example: https://vulners.com/search?query=NGINX:CVE-2026-27654 description: External reference link for the vulnerability certificates: type: array description: SSL/TLS certificates associated with the assets items: type: object properties: ip: type: string example: 137.117.182.202 description: Asset IP address host: type: string example: telemetry.acronis.com description: Asset hostname expirationDate: type: string format: date-time example: '2026-06-29T23:59:59Z' description: SSL certificate expiration date isExpired: type: boolean example: false description: Indicates whether the certificate is expired '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/external-attack-surface?assetKey=AXRNTFX&page=1&size=20' \ --header 'Authorization: Bearer ' - lang: Python label: Python 3.7 source: | import requests PATH = 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/external-attack-surface' token = '' headers = { 'Authorization': 'Bearer {}'.format(token) } params = { 'assetKey': 'AXRNTFX', 'page': 1, 'size': 20 } result = requests.get(PATH, headers=headers, params=params) print(result.json()) /vendor-monitor/customer-vendors-api/customer/{customer}/threat-landscape: get: operationId: searchThreatLandscape summary: Get Threat Landscape tags: - Supply Chain Intel description: | Retrieves threat landscape information associated with a customer's vendors. parameters: - name: customer in: path required: true example: AXUR description: Customer identifier schema: type: string - name: assetKey in: query required: false example: AXRNTFX description: Filters results by asset key schema: type: string - name: page in: query required: false example: 1 description: Page number schema: type: integer - name: size in: query required: false example: 20 description: Page size. It supports sizes up to 20 schema: type: integer responses: '200': description: OK content: application/json: schema: type: object properties: pagination: type: object properties: page: type: integer example: 1 size: type: integer example: 10 total: type: integer nullable: true example: 1 data: type: array description: List of threat intelligence data items: type: object properties: assetKey: type: string example: AXRNTFX description: Asset identifier name: type: string example: Axur description: Vendor name total: type: integer example: 8 description: Total number of threat intelligence samples identified lastUpdated: type: string format: date-time example: '2026-05-06T04:59:36.754Z' description: Last update timestamp summary: type: object description: AI-generated threat intelligence summary properties: content: type: string example: The security landscape for Anydesk software gmbh is currently characterized by high-impact threats, predominantly involving exploitation of vulnerabilities and social engineering tactics. description: Summary content describing the threat landscape references: type: array description: References used to generate the summary items: type: string example: https://example.com/reference samples: type: array description: Threat intelligence samples related to the asset items: type: object properties: id: type: string example: ab831a60-b0da-4ba5-a618-813470082987 description: Unique identifier of the threat intelligence sample title: type: string example: MuddyWater Exploits Microsoft Teams for Espionage Disguised as Ransomware description: Threat intelligence sample title description: type: string example: MuddyWater, an Iranian state-sponsored group, is leveraging Microsoft Teams social engineering to conduct cyber-espionage under the guise of Chaos ransomware attacks. description: Detailed description of the threat intelligence sample publishedAt: type: integer format: int64 example: 1778025600000 description: Publication timestamp in milliseconds link: type: string example: teste/bulletins/ab831a60-b0da-4ba5-a618-813470082987 description: Relative link to the bulletin details vulnerabilitiesCount: type: integer example: 0 description: Number of vulnerabilities associated with the sample iocsCount: type: integer example: 23 description: Number of indicators of compromise identified attacksCount: type: integer example: 13 description: Number of attacks associated with the sample tags: type: array description: Tags categorizing the threat intelligence sample items: type: string example: CyberEspionage lastUpdate: type: integer format: int64 nullable: true example: 1778189745405 description: Last update timestamp in milliseconds critical: type: boolean example: false description: Indicates whether the threat intelligence sample is critical '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/threat-landscape?assetKey=AXRNTFX&page=1&size=20' \ --header 'Authorization: Bearer ' - lang: Python label: Python 3.7 source: | import requests PATH = 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/threat-landscape' token = '' headers = { 'Authorization': 'Bearer {}'.format(token) } params = { 'assetKey': 'AXRNTFX', 'page': 1, 'size': 20 } result = requests.get(PATH, headers=headers, params=params) print(result.json()) /vendor-monitor/customer-vendors-api/customer/{customer}/overview: get: operationId: searchOverview summary: Get Overview tags: - Supply Chain Intel description: | Retrieves overview from customer's vendors. parameters: - name: customer in: path required: true example: AXUR description: Customer identifier schema: type: string - name: assetKey in: query required: false example: AXRNTFX description: Filters results by asset key schema: type: string - name: page in: query required: false example: 1 description: Page number schema: type: integer - name: size in: query required: false example: 20 description: Page size. It supports sizes up to 20 schema: type: integer responses: '200': description: OK content: application/json: schema: type: object properties: pagination: type: object properties: page: type: integer example: 1 size: type: integer example: 10 total: type: integer nullable: true example: 1 data: type: array description: List of vendors overviews items: type: object properties: id: type: integer example: 205 description: Unique vendor identifier assetKey: type: string example: AXRNTFX description: Asset identifier name: type: string example: Axur description: Vendor name lastUpdate: type: string format: date-time example: '2026-04-17 09:00:06' description: Last update timestamp systemName: type: string example: Acronis description: Vendor system name mainDomain: type: string example: acronis.com description: Main vendor domain corporateName: type: string example: Acronis International GmbH description: Official corporate name about: type: object description: Vendor overview information properties: description: type: string example: Acronis is a global leader specializing in cybersecurity and data protection, offering integrated solutions that combine backup, disaster recovery, and advanced anti-ransomware technologies. description: Detailed vendor description trustCenter: type: string example: https://www.acronis.com/en/trust-center/ description: Vendor trust center URL segment: type: string example: TECHNOLOGY description: Business segment classification relatedDomains: type: object description: Related domains associated with the vendor properties: values: type: array description: List of related domains items: type: string example: acronis.cloud productsAndServices: type: object description: Products and services offered by the vendor properties: values: type: array description: List of products and services items: type: string example: Acronis Disaster Recovery overview: type: string example: A análise da postura de ameaça da Acronis revela um fornecedor com ampla presença em setores críticos e grande diversidade de produtos. description: Threat intelligence overview and security posture analysis '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/overview?assetKey=AXRNTFX&page=1&size=20' \ --header 'Authorization: Bearer ' - lang: Python label: Python 3.7 source: | import requests PATH = 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/overview' token = '' headers = { 'Authorization': 'Bearer {}'.format(token) } params = { 'assetKey': 'AXRNTFX', 'page': 1, 'size': 20 } result = requests.get(PATH, headers=headers, params=params) print(result.json()) /vendor-monitor/customer-vendors-api/customer/{customer}/indicators: get: operationId: searchIndicators summary: Get Indicators tags: - Supply Chain Intel description: | Retrieves indicators from customer's vendors. parameters: - name: customer in: path required: true example: AXUR description: Customer identifier schema: type: string - name: assetKey in: query required: false example: AXRNTFX description: Filters results by asset key schema: type: string - name: page in: query required: false example: 1 description: Page number schema: type: integer - name: size in: query required: false example: 20 description: Page size. It supports sizes up to 20 schema: type: integer responses: '200': description: OK content: application/json: schema: type: object properties: pagination: type: object properties: page: type: integer example: 2 size: type: integer example: 1 total: type: integer nullable: true example: 2 data: type: array description: List of asset indicators items: type: object properties: assetKey: type: string example: OTO description: Asset identifier name: type: string example: Axur description: Vendor name indicators: type: array description: List of security indicators associated with the asset items: type: object properties: type: type: string example: EXPIRED_CERTIFICATES description: Indicator type identifier primary: type: object description: Primary indicator metric properties: value: type: integer example: 0 description: Primary indicator value secondary: type: object description: Secondary indicator metric properties: value: type: integer example: 0 description: Secondary indicator value '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/indicators?assetKey=AXRNTFX&page=1&size=20' \ --header 'Authorization: Bearer ' - lang: Python label: Python 3.7 source: | import requests PATH = 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/indicators' token = '' headers = { 'Authorization': 'Bearer {}'.format(token) } params = { 'assetKey': 'AXRNTFX', 'page': 1, 'size': 20 } result = requests.get(PATH, headers=headers, params=params) print(result.json()) /vendor-monitor/customer-vendors-api/customer/{customer}/lookalike-domains: get: operationId: searchLookalikeDomains summary: Get lookalike domains tags: - Supply Chain Intel description: | Retrieves phishing and similar domain name (lookalike) detections associated with customer's vendors. parameters: - name: customer in: path required: true example: AXUR description: Customer identifier schema: type: string - name: assetKey in: query required: false example: AXRNTFX description: Filters results by asset key schema: type: string - name: page in: query required: false example: 1 description: Page number schema: type: integer - name: size in: query required: false example: 20 description: Page size. It supports sizes up to 20 schema: type: integer responses: '200': description: OK content: application/json: schema: type: object properties: pagination: type: object properties: page: type: integer example: 1 size: type: integer example: 20 total: type: integer nullable: true example: 1 data: type: array description: List of lookalike-domains data items: type: object properties: assetKey: type: string example: AXRNTFX description: Asset identifier name: type: string example: Axur description: Vendor name phishing: type: object description: Phishing detections for the asset properties: samples: type: array description: Sample cases (top 10) items: type: object properties: reference: type: string nullable: true example: chefwebcloud.chef.axr.com.br/Login description: Reference (URL) identifying the phishing case detectionDate: type: integer format: int64 nullable: true example: 1778266308120 description: Detection timestamp in milliseconds domainCreatedDate: type: integer format: int64 nullable: true example: 1776866308120 description: Domain creation timestamp in milliseconds threatCategory: type: string nullable: true example: CREDENTIALS_HARVESTING description: Threat category identified for the case riskScore: type: integer nullable: true example: 87 description: Risk score assigned to the case riskScoreBreakdown: type: object description: Risk factors identified by the AI inspection and their individual scores additionalProperties: type: number example: hasBrandImpersonationHigh: 0.92 brandMismatch: 0.35 threatIndicators: type: object description: Threat indicator counts, current vs. previous period properties: mailCapable: type: object description: Count of cases with mail-capable infrastructure (MX records configured) properties: current: type: integer example: 5 description: Count for the current period previous: type: integer example: 3 description: Count for the immediately preceding period newlyRegisteredDomain: type: object description: Count of cases involving newly registered domains properties: current: type: integer example: 5 description: Count for the current period previous: type: integer example: 3 description: Count for the immediately preceding period credentialsHarvesting: type: object description: Count of phishing cases involving credentials harvesting. Phishing-only; omitted from the similarDomainNames threatIndicators properties: current: type: integer example: 5 description: Count for the current period previous: type: integer example: 3 description: Count for the immediately preceding period paymentScam: type: object description: Count of phishing cases involving payment scams. Phishing-only; omitted from the similarDomainNames threatIndicators properties: current: type: integer example: 5 description: Count for the current period previous: type: integer example: 3 description: Count for the immediately preceding period socialEngineering: type: object description: Count of phishing cases involving social engineering. Phishing-only; omitted from the similarDomainNames threatIndicators properties: current: type: integer example: 5 description: Count for the current period previous: type: integer example: 3 description: Count for the immediately preceding period malwareTechnicalAbuse: type: object description: Count of phishing cases involving malware or technical abuse. Phishing-only; omitted from the similarDomainNames threatIndicators properties: current: type: integer example: 5 description: Count for the current period previous: type: integer example: 3 description: Count for the immediately preceding period activePhishing: type: object description: Total phishing case count, repeated here as a current/previous pair so every count behind the "Threat Indicators" chart can be read from this one object. Only present on the phishing section properties: current: type: integer example: 5 description: Count for the current period previous: type: integer example: 3 description: Count for the immediately preceding period detectionsPerDay: type: array description: Deduplicated detection counts per day, within the last 30 days items: type: object properties: day: type: integer format: int64 example: 1778198400000 description: Day timestamp in milliseconds count: type: integer example: 3 description: Number of detections on that day total: type: object description: Total number of cases, current vs. previous period properties: current: type: integer example: 5 description: Count for the current period previous: type: integer example: 3 description: Count for the immediately preceding period totalPastYear: type: integer format: int64 example: 42 description: Total number of cases detected in the past year lastUpdated: type: integer format: int64 nullable: true example: 1778266308120 description: Last update timestamp in milliseconds similarDomainNames: type: object description: Similar domain name (SDN) detections for the asset properties: samples: type: array description: Sample cases (top 10) items: type: object properties: domain: type: string nullable: true example: axvr.com.br description: Similar domain name identified domainCreatedDate: type: integer format: int64 nullable: true example: 1776866308120 description: Domain creation timestamp in milliseconds ipv4: type: array nullable: true description: IPv4 addresses associated with the domain items: type: string example: - 192.0.2.10 mx: type: array nullable: true description: Mail exchange (MX) records associated with the domain items: type: string example: - mx.axvr.com.br nameservers: type: array nullable: true description: Name servers associated with the domain items: type: string example: - ns1.axvr.com.br openPorts: type: array nullable: true description: Open ports identified on the domain items: type: integer example: - 80 - 443 threatIndicators: type: object description: Threat indicator counts, current vs. previous period. The four threatCategory-based indicators (credentialsHarvesting, paymentScam, socialEngineering, malwareTechnicalAbuse) are phishing-only and are omitted for similar domain names properties: mailCapable: type: object description: Count of cases with mail-capable infrastructure (MX records configured) properties: current: type: integer example: 5 description: Count for the current period previous: type: integer example: 3 description: Count for the immediately preceding period newlyRegisteredDomain: type: object description: Count of cases involving newly registered domains properties: current: type: integer example: 5 description: Count for the current period previous: type: integer example: 3 description: Count for the immediately preceding period detectionsPerDay: type: array description: Deduplicated detection counts per day, within the last 30 days items: type: object properties: day: type: integer format: int64 example: 1778198400000 description: Day timestamp in milliseconds count: type: integer example: 1 description: Number of detections on that day total: type: object description: Total number of cases, current vs. previous period properties: current: type: integer example: 5 description: Count for the current period previous: type: integer example: 3 description: Count for the immediately preceding period totalPastYear: type: integer format: int64 example: 8 description: Total number of cases detected in the past year lastUpdated: type: integer format: int64 nullable: true example: 1778266308120 description: Last update timestamp in milliseconds '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/lookalike-domains?assetKey=AXRNTFX&page=1&size=20' \ --header 'Authorization: Bearer ' - lang: Python label: Python 3.7 source: | import requests PATH = 'https://api.axur.com/gateway/1.0/api/vendor-monitor/customer-vendors-api/customer/AXUR/lookalike-domains' token = '' headers = { 'Authorization': 'Bearer {}'.format(token) } params = { 'assetKey': 'AXRNTFX', 'page': 1, 'size': 20 } result = requests.get(PATH, headers=headers, params=params) print(result.json()) /vendor-monitor/history/customer-vendor: get: tags: - Supply Chain Intel operationId: getCustomerVendorHistory summary: List Asset-specific history entries description: Retrieves Asset-specific history entries visible to the authenticated requester. security: - bearerAuth: [ ] parameters: - $ref: "#/components/parameters/VendorMonitorSections" - $ref: "#/components/parameters/Customers" - $ref: "#/components/parameters/Assets" - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" responses: '200': description: Asset-specific history entries returned successfully. content: application/json: schema: $ref: "#/components/schemas/VendorMonitorHistoryResponse" '400': description: Invalid query parameter, invalid section, or validation error. content: application/json: schema: type: object required: - code - message - context properties: code: type: string message: type: string context: type: object additionalProperties: true examples: invalidSection: summary: Unknown section value: code: history.invalid.section message: "Unmapped section 'unknown'. Valid sections are: deep-dark-web, attack-surface, bulletins, critical-bulletins, corporate-credentials, customer-credentials" context: section: unknown validSections: deep-dark-web, attack-surface, bulletins, critical-bulletins, corporate-credentials, customer-credentials invalidQueryParameter: summary: Non-numeric page size value: code: history.invalid.query.parameter message: Invalid history query parameter. context: parameter: pageSize value: abc validation: summary: Negative page size value: code: error.validation.field.non.negative message: "" context: field: HistoryRequest.size '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/vendor-monitor/history/customer-vendor?customers=CUST&assets=ASSET&pageNumber=1&pageSize=20' \ --header 'Authorization: Bearer ' - lang: Python label: Python 3.7 source: | import requests PATH = 'https://api.axur.com/gateway/1.0/api/vendor-monitor/history/customer-vendor' token = '' headers = { 'Authorization': 'Bearer {}'.format(token) } params = { 'customers': ['CUST'], 'assets': ['ASSET'], 'pageNumber': 1, 'pageSize': 20 } result = requests.get(PATH, headers=headers, params=params) print(result.json()) /vendor-monitor/history/vendor: get: tags: - Supply Chain Intel operationId: getVendorHistory summary: List vendor history entries description: Retrieves Vendor-wide history entries associated with assets visible to the authenticated requester. security: - bearerAuth: [ ] parameters: - $ref: "#/components/parameters/VendorMonitorSections" - $ref: "#/components/parameters/Customers" - $ref: "#/components/parameters/Assets" - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" responses: '200': description: Vendor-wide history entries returned successfully. content: application/json: schema: $ref: "#/components/schemas/VendorMonitorHistoryResponse" '400': description: Invalid query parameter, invalid section, or validation error. content: application/json: schema: type: object required: - code - message - context properties: code: type: string message: type: string context: type: object additionalProperties: true examples: invalidSection: summary: Unknown section value: code: history.invalid.section message: "Unmapped section 'unknown'. Valid sections are: deep-dark-web, attack-surface, bulletins, critical-bulletins, corporate-credentials, customer-credentials" context: section: unknown validSections: deep-dark-web, attack-surface, bulletins, critical-bulletins, corporate-credentials, customer-credentials invalidQueryParameter: summary: Non-numeric page size value: code: history.invalid.query.parameter message: Invalid history query parameter. context: parameter: pageSize value: abc validation: summary: Negative page size value: code: error.validation.field.non.negative message: "" context: field: HistoryRequest.size '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/vendor-monitor/history/vendor?customers=CUST&assets=ASSET&pageNumber=1&pageSize=20' \ --header 'Authorization: Bearer ' - lang: Python label: Python 3.7 source: | import requests PATH = 'https://api.axur.com/gateway/1.0/api/vendor-monitor/history/vendor' token = '' headers = { 'Authorization': 'Bearer {}'.format(token) } params = { 'customers': ['CUST'], 'assets': ['ASSET'], 'pageNumber': 1, 'pageSize': 20 } result = requests.get(PATH, headers=headers, params=params) print(result.json()) /easm/account/stats: get: operationId: getAccountStats summary: Get account statistics tags: - Account description: | Returns account-level statistics including last discovery time and last scan time for exposure detection. parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: last_discovery_at: type: string example: 2026-06-14T18:23:59Z description: Date of last discovery last_scan_at: type: string example: 2026-06-14T18:42:09Z description: Date of last scan '403': description: Forbidden '404': description: Not found x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/account/stats?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/assets: post: operationId: getAssetsList summary: List assets tags: - EASM Assets description: | Retrieves a paginated list of discovered assets with support for filtering, sorting, and searching. Assets can be filtered by tags, technologies, ports, providers, and more. parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/GetAssetsListRequestBody' responses: '200': description: A successful response content: application/json: schema: $ref: '#/components/schemas/GetAssetsListResponseBody' '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/easm/assets?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"limit":50,"offset":0,"sort":{"field":"IP_ADDRESS","direction":"DESC"},"filters":{"search":"test","status":"offline","providers":["Microsoft Azure","Oracle Cloud","Cloudflare"]}}' /easm/assets/business-impact: patch: operationId: updateAssetsBusinessImpact summary: Update business impact scores tags: - EASM Assets description: | Updates the manual business impact scores for one or more assets. The overall business impact score is calculated from both system-generated and manual scores. parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object properties: business_impact: type: array items: type: object properties: asset_id: type: string description: Asset id. manual_business_impact_score: type: integer description: New manual business impact score value. required: - asset_id - manual_business_impact_score required: - business_impact responses: '200': description: A successful response content: application/json: schema: type: object properties: results: type: array items: type: object properties: asset_id: type: string business_impact_score: type: integer manual_business_impact_score: type: integer system_business_impact_score: type: integer '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/easm/assets/business-impact?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"business_impact": [{"asset_id": "","manual_business_impact_score": 70}]}' /easm/assets/count: get: operationId: getAssetsCount summary: Get asset count tags: - EASM Assets description: | Returns the total count of discovered assets, optionally filtered by a time period to show newly discovered assets. parameters: - $ref: '#/components/parameters/axurTenantKey' - name: period in: query required: false example: 7d description: Period of the search (7d means seven days) schema: type: string responses: '200': description: OK content: application/json: schema: type: object properties: count: type: integer '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/assets/count?axur_tenant_key=&period=7d' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/assets/download: post: operationId: requestAssetsCsv summary: Download assets as CSV tags: - EASM Assets description: | Exports assets to a CSV file with support for the same filtering and sorting options as the list assets endpoint. parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object properties: filters: $ref: '#/components/schemas/GetAssetsListFilters' sort: $ref: '#/components/schemas/EasmAssetSort' responses: '200': description: A successful response content: text/csv: schema: type: string example: | Asset ID,Asset Type,Domain Name,IP Address,Target,Status,First Seen,Last Seen,Exposures,Business Impact Score,System Tags,Custom Tags '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/easm/assets/download?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"sort":{"field":"IP_ADDRESS","direction":"DESC"},"filters":{"search":"test","status":"offline","providers":["Microsoft Azure","Oracle Cloud","Cloudflare"]}}' /easm/assets/exposureRanking: get: operationId: getAssetsExposureRanking summary: Rank assets by exposure tags: - EASM Assets description: | Returns assets ranked by their exposure count and business impact. parameters: - $ref: '#/components/parameters/axurTenantKey' - name: limit in: query required: false example: 100 description: Limit of results schema: type: integer responses: '200': description: OK content: application/json: schema: type: object properties: assets: type: array items: $ref: '#/components/schemas/EasmAssetView' '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/assets/exposureRanking?axur_tenant_key=&limit=100' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/assets/scan: post: operationId: startAssetScan summary: Initiate asset scan tags: - EASM Assets description: | Triggers an immediate security scan of specified assets to identify exposures and vulnerabilities. parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object properties: ids: type: array description: Assets ids items: type: string required: - ids responses: '201': description: A successful response content: application/json: schema: type: object properties: message: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/easm/assets/scan?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"ids": ["461cfb50-09a3-45a8-9be6-f9506bab6360"]}' /easm/assets/tags: post: operationId: associatesTagsToAssets summary: Attach tags to assets tags: - EASM Assets description: | Associates one or more tags with specified assets for organization and filtering purposes. parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object properties: asset_tags: type: array items: type: object properties: asset_id: type: string tags: type: array items: type: string required: - asset_id - tags required: - asset_tags responses: '200': description: A successful response content: application/json: schema: type: object properties: message: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/easm/assets/tags?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"asset_tags": [{"asset_id": "461cfb50-09a3-45a8-9be6-f9506bab6360","tags": ["test", "other-tag"]}]}' /easm/assets/{assetId}: get: operationId: getAsset summary: Get asset details tags: - EASM Assets description: | Retrieves detailed information about a specific asset, including its exposures, technologies, certificates, and DNS records. parameters: - $ref: '#/components/parameters/axurTenantKey' - name: assetId in: path required: true example: 461cfb50-09a3-45a8-9be6-f9506bab6360 description: Asset id schema: type: string responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/EasmAssetView' '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/assets/{assetId}?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/exposures: post: operationId: getExposuresList summary: List exposures tags: - EASM Exposures description: | Retrieves a paginated list of security exposures with support for filtering by severity, status, type, assigned user, and more. Includes sorting options. parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object properties: filters: $ref: '#/components/schemas/GetExposuresListFilters' limit: type: integer description: Limit of results offset: type: integer description: Offset of results sort: $ref: '#/components/schemas/EasmExposureSort' required: - limit - offset responses: '200': description: A successful response content: application/json: schema: $ref: '#/components/schemas/GetExposuresResponseBody' '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/easm/exposures?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"limit":50,"offset":0,"sort":{"field":"TITLE","direction":"DESC"},"filters":{"search":"test"}}' patch: operationId: updateExposuresBulk summary: Bulk update exposures tags: - EASM Exposures description: | Assigns a user or updates the status for multiple exposures in a single operation. parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object properties: ids: type: array description: Exposures ids items: type: string payload: type: object properties: assigned_to: type: string description: User id status: type: string description: New status enum: - new - reopened - in_progress - investigating - false_positive - risk_accepted - resolved - validated required: - ids - payload responses: '200': description: A successful response content: application/json: schema: type: object properties: message: type: string updated_count: type: integer '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/easm/exposures?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"ids": ["461cfb50-09a3-45a8-9be6-f9506bab6360"],"payload": {"assigned_to": "0000","status": "new"}}' /easm/exposures/audit-logs/{id}: get: operationId: getExposureAuditLogs summary: Get exposure audit logs tags: - EASM Exposures description: | Retrieves the audit trail for an exposure, showing all changes made including status updates, assignments, and modifications. parameters: - $ref: '#/components/parameters/axurTenantKey' - name: id in: path required: true example: 461cfb50-09a3-45a8-9be6-f9506bab6360 description: Exposure id schema: type: string responses: '200': description: OK content: application/json: schema: type: object properties: audit_logs: type: array items: type: object properties: account_id: type: string audit_type: type: string changed_by: type: string created_at: type: string exposure_id: type: string new_value: type: string previous_value: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/exposures/audit-logs/{id}?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/exposures/comments/{exposureId}: get: operationId: getExposureCommentsById summary: List exposure comments tags: - EASM Exposures description: | Retrieves all comments and discussions related to a specific exposure. parameters: - $ref: '#/components/parameters/axurTenantKey' - name: exposureId in: path required: true example: 461cfb50-09a3-45a8-9be6-f9506bab6360 description: Exposure id schema: type: string responses: '200': description: OK content: application/json: schema: type: object properties: exposure_comments: type: array items: type: object properties: account_id: type: string comments: type: string created_at: type: string created_by: type: string exposure_id: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/exposures/comments/{exposureId}?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' post: operationId: createExposureComments summary: Add exposure comment tags: - EASM Exposures description: | Adds a new comment to an exposure for team collaboration and documentation. parameters: - $ref: '#/components/parameters/axurTenantKey' - name: exposureId in: path required: true example: 461cfb50-09a3-45a8-9be6-f9506bab6360 description: Exposure id schema: type: string requestBody: required: true content: text/plain: schema: type: string responses: '200': description: A successful response content: application/json: schema: type: object '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/easm/exposures/comments/{exposureId}?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '' /easm/exposures/download: post: operationId: getExposuresCsv summary: Download exposures as CSV tags: - EASM Exposures description: | Exports exposures to a CSV file with support for the same filtering and sorting options as the list exposures endpoint. parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object properties: filters: $ref: '#/components/schemas/GetExposuresListFilters' sort: $ref: '#/components/schemas/EasmExposureSort' responses: '200': description: A successful response content: text/csv: schema: type: string example: | Exposure ID,Title,Type,Severity,Status,First Seen,Last Seen,Assigned To,Feasibility Score,Business Impact Score,Risk Score,Exposure URL,Reference,Related Assets '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/easm/exposures/download?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"sort":{"field":"TITLE","direction":"DESC"},"filters":{"search":"test"}}' /easm/exposures/hostnames: get: operationId: getExposureHostnames summary: List exposure hostnames tags: - EASM Exposures description: | Returns all unique hostnames that have associated exposures. parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: hostnames: type: array items: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/exposures/hostnames?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/exposures/ip-addresses: get: operationId: getExposureIpAddresses summary: List exposure IP addresses tags: - EASM Exposures description: | Returns all unique IP addresses that have associated exposures. parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: ip_addresses: type: array items: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/exposures/ip-addresses?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/exposures/types: get: operationId: getExposureTypes summary: List exposure types tags: - EASM Exposures description: | Returns all types of exposures detected in the system. parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: exposure_types: type: array items: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/exposures/types?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/exposures/{exposureId}: get: operationId: getExposureById summary: Get exposure details tags: - EASM Exposures description: | Retrieves detailed information about a specific security exposure, including affected assets, severity, status, and remediation guidance. parameters: - $ref: '#/components/parameters/axurTenantKey' - name: exposureId in: path required: true example: 461cfb50-09a3-45a8-9be6-f9506bab6360 description: Exposure id schema: type: string responses: '200': description: OK content: application/json: schema: type: object properties: assigned_to: type: string business_impact: type: string business_impact_score: type: integer description: type: string exposure_type: type: string feasibility_score: type: integer first_seen_at: type: string group_key: type: string id: type: string last_seen_at: type: string metadata: type: object properties: cvss_score: type: number epss_score: type: number exploit_ref_count: type: integer is_kev: type: boolean port: type: number protocol: type: string priority: type: integer proof: type: string reference: type: string related_assets: type: object properties: asset_id: type: string asset_type: type: string business_impact_score: type: integer custom_tags: type: array items: type: string domain_name: type: string exposures: type: integer first_seen_at: type: string ip_address: type: string last_seen_at: type: string manual_business_impact_score: type: integer ports: type: array items: type: integer seed_id: type: string status: type: string system_business_impact_score: type: integer system_tags: type: array items: type: string target: type: string remediation: type: string risk_score: type: integer severity: type: integer status: type: string title: type: string value: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/exposures/{exposureId}?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/exposures/{id}: patch: operationId: updateExposure summary: Update exposure tags: - EASM Exposures description: | Updates an exposure's fields such as status, priority, assigned user, or adds/removes tags. Creates audit log entries for tracking changes. parameters: - $ref: '#/components/parameters/axurTenantKey' - name: id in: path required: true example: 461cfb50-09a3-45a8-9be6-f9506bab6360 description: Exposure id schema: type: string requestBody: required: true content: application/json: schema: type: object properties: assigned_to: type: string description: User id status: type: string description: New status enum: - new - reopened - in_progress - investigating - false_positive - risk_accepted - resolved - validated responses: '200': description: A successful response '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request PATCH \ --url 'https://api.axur.com/gateway/1.0/api/easm/exposures/{id}?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"assigned_to": "0000","status": "new"}' /easm/exposures/metrics/counts-by-period: get: operationId: getExposureMetricsCountByPeriod summary: Get exposure counts by time period tags: - EASM Exposures description: | Returns aggregated exposure counts grouped by time periods for trend analysis and reporting. parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: count_24h: type: integer count_7d: type: integer count_30d: type: integer hourly_counts: type: array items: type: integer '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/exposures/metrics/counts-by-period?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/exposures/metrics/risk-matrix: get: operationId: getExposureMetricsRiskMatrix summary: Get exposure risk matrix tags: - EASM Exposures description: | Returns a matrix showing exposure distribution across business impact (x-axis) and feasibility/exploitability (y-axis). parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: matrix: type: array items: type: object properties: business_impact: type: string count: type: integer feasibility: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/exposures/metrics/risk-matrix?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/exposures/metrics/severity-priority-matrix: get: operationId: getExposureMetricsSeverityPriorityMatrix summary: Get severity-priority risk matrix tags: - EASM Exposures description: | Returns a matrix showing exposure distribution across severity and priority levels. parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: matrix: type: array items: type: object properties: priority: type: string count: type: integer severity: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/exposures/metrics/severity-priority-matrix?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/exposures/metrics/user-assigned: get: operationId: getExposureMetricsUserAssigned summary: Get user workload metrics tags: - EASM Exposures description: | Returns exposure counts for the current user, grouped by risk score buckets. parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: counts: type: object properties: total: type: integer low: type: integer medium: type: integer high: type: integer critical: type: integer found_before_7_days: type: integer found_within_7_days: type: integer '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/exposures/metrics/user-assigned?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/policy: get: operationId: getAccountPolicy summary: Get account policy tags: - EASM Policies description: | Retrieves the security policy configuration for the account, including exposure severity mappings and automated response settings. parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: policy: $ref: '#/components/schemas/EasmPolicy' '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/policy?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' put: operationId: updateAccountPolicy summary: Update account policy tags: - EASM Policies description: | Updates the security policy configuration for the account. Changes are validated and applied to exposure detection and prioritization. parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object properties: policy: $ref: '#/components/schemas/EasmPolicy' responses: '200': description: OK content: application/json: schema: type: object properties: policy: $ref: '#/components/schemas/EasmPolicy' '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request PUT \ --url 'https://api.axur.com/gateway/1.0/api/easm/policy?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "policy": { "certificates": { "expiring": { "days_until_expiration": 0, "enabled": true }, "self_signed": { "enabled": true }, "weak_encryption": { "enabled": true }, "wildcard": { "enabled": true } }, "dns_hygiene": { "dangling_cnames": { "alert_on_non_existent": true, "alert_on_orphaned": true, "enabled": true }, "dmarc_records": { "alert_on_missing": true, "alert_on_weak": true, "enabled": true }, "expiring_domains": { "alert_on_expired": true, "alert_on_expiring_soon": true, "days_until_expiration": 0, "enabled": true }, "lame_delegation": { "enabled": true }, "spf_records": { "alert_on_missing": true, "alert_on_weak": true, "enabled": true }, "zone_transfers": { "enabled": true } }, "open_ports": { "custom_port_ranges": [ "string" ], "enabled": true, "exclude_ports": [ "string" ], "scan_type": "string" }, "vulnerabilities": { "cisa_kev": true, "cvss_min_threshold": 0, "enabled": true, "epss_min_threshold": 0, "include_unscored": true } } }' /easm/ports: get: operationId: getPortFilter summary: List open ports tags: - EASM Filters description: | Returns all open network ports discovered across assets. parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: ports: type: array items: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/ports?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/providers: get: operationId: getProvidersFilter summary: List cloud providers tags: - EASM Filters description: | Returns all cloud providers detected across assets. parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: providers: type: array items: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/providers?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/tags: get: operationId: getTagsFilter summary: List tags tags: - EASM Filters description: | Returns all available tags that have been applied to assets in the system. parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: tags: type: array items: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/tags?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/tags/type/{type}: get: operationId: getTagsByTypeFilter summary: List tags by type tags: - EASM Filters description: | Returns tags filtered by their type category. parameters: - $ref: '#/components/parameters/axurTenantKey' - name: type in: path required: true example: some_type description: Tag type schema: type: string responses: '200': description: OK content: application/json: schema: type: object properties: tags: type: array items: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/tags/type/{type}?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/technologies: get: operationId: getTechnologiesFilter summary: List technologies tags: - EASM Filters description: | Returns a list of all detected technologies across assets. parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: technologies: type: array items: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/technologies?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/version: get: operationId: getEasmApiVersion summary: Get API version tags: - EASM API Version description: | Returns the current version of the Attack Surface Management API parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: version: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/version?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/user: get: operationId: getCurrentUserData summary: Get current user tags: - EASM Users description: | Returns the current user's information based on the user ID extracted from the JWT token. parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: axur_user_id: type: string notification_settings: type: object properties: enabled: type: boolean '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/user?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' put: operationId: updateUser summary: Update current user tags: - EASM Users description: | Updates the current user's notification settings. The user is identified from the JWT token. parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object properties: notification_settings: type: object properties: enabled: type: boolean responses: '200': description: OK content: application/json: schema: type: object properties: axur_user_id: type: string notification_settings: type: object properties: enabled: type: boolean '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request PUT \ --url 'https://api.axur.com/gateway/1.0/api/easm/user?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "notification_settings": { "enabled": true } }' /easm/seeds: post: operationId: createEasmSeed summary: Create discovery seeds tags: - EASM Seeds description: | Creates one or more seeds for asset discovery. Seeds are the starting points for discovering your attack surface (domains, IP addresses, IP ranges, CIDRs, or ASNs). parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object properties: description: type: string related_discovery_settings: type: object properties: m_and_a: type: object properties: mode: type: string whois: type: object properties: mode: type: string policy: $ref: '#/components/schemas/EasmPolicy' seed_names: type: array items: type: string responses: '200': description: A successful response content: application/json: schema: type: object properties: invalid: type: object properties: id: type: string message: type: string seed_name: type: string valid: type: object properties: id: type: string message: type: string seed_name: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/easm/seeds?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "description": "string", "policy": { "certificates": {"expiring": {"days_until_expiration": 30, "enabled": true}}, "dns_hygiene": {"dmarc_records": {"alert_on_missing": true, "enabled": true}}, "open_ports": {"enabled": true, "scan_type": "full"}, "vulnerabilities": {"cvss_min_threshold": 7, "epss_min_threshold": 0.1, "enabled": true} }, "related_discovery_settings": { "m_and_a": { "mode": "string" }, "whois": { "mode": "string" } }, "seed_names": [ "string" ] }' /easm/seeds/remove: post: operationId: deleteEasmSeed summary: Delete seeds tags: - EASM Seeds description: | Deletes one or more seeds by their IDs. This will stop discovery for the specified seeds. parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object properties: ids: type: array items: type: string responses: '200': description: A successful response '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/easm/seeds/remove?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"ids": ["string"]}' /easm/seeds/list: post: operationId: listEasmSeeds summary: List seeds with filtering tags: - EASM Seeds description: | Retrieves seeds with support for filtering by status (active/inactive/pending/rejected), source (manual/whois/m_and_a), parent seed, sorting, and pagination. Use this to list both regular seeds and suggested seeds. parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object properties: limit: type: integer offset: type: integer search: type: string sort_by: type: string sort_direction: type: string enum: - ASC - DESC sources: type: array items: type: string status: type: array items: type: string type: type: array items: type: string responses: '200': description: A successful response content: application/json: schema: type: object properties: has_more: type: boolean limit: type: integer offset: type: integer total_count: type: integer results: type: array items: $ref: '#/components/schemas/EasmSeedView' '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/easm/seeds/list?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "limit": 0, "offset": 0, "search": "string", "sort_by": "string", "sort_direction": "string", "sources": [ "string" ], "status": [ "string" ], "type": [ "string" ] }' /easm/seeds/scan: post: operationId: startSeedScan summary: Initiate seed scan tags: - EASM Seeds description: | Triggers an immediate scan of specified seeds to discover assets. parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object properties: ids: type: array description: Seeds ids items: type: string responses: '201': description: A successful response content: application/json: schema: type: object properties: message: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/easm/seeds/scan?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"ids": ["string"]}' /easm/seeds/sources: get: operationId: listSeedsSources summary: List seed sources tags: - EASM Seeds description: | Returns the distinct sources present across seeds in the account (e.g. manual, whois, m_and_a). parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: sources: type: array items: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/seeds/sources?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/seeds/status: post: operationId: updateSeedStatus summary: Change seed status tags: - EASM Seeds description: | Changes the status of one or more seeds. Actions: 'accept' (pending→active), 'reject' (pending→rejected), 'activate' (inactive/rejected→active), 'deactivate' (active→inactive). parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object properties: action: type: string enum: - accept - reject - activate - deactivate seed_ids: type: array items: type: string responses: '200': description: A successful response content: application/json: schema: type: object properties: message: type: string processed_count: type: integer '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/easm/seeds/status?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"action": "string","seed_ids": ["string"]}' /easm/seeds/types: get: operationId: listSeedsTypes summary: List seed types tags: - EASM Seeds description: | Returns the distinct seed types present in the account (e.g. domain, ipv4, cidr). parameters: - $ref: '#/components/parameters/axurTenantKey' responses: '200': description: OK content: application/json: schema: type: object properties: types: type: array items: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/seeds/types?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/seeds/validate: post: operationId: validateSeeds summary: Validate seeds tags: - EASM Seeds description: | Validates seed names to ensure they are in the correct format before creation. Returns validation results for each seed. parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object properties: seed_names: type: array items: type: string responses: '200': description: A successful response content: application/json: schema: type: object properties: results: type: array items: type: object properties: seed_name: type: string type: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request POST \ --url 'https://api.axur.com/gateway/1.0/api/easm/seeds/validate?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{"seed_names": ["string"]}' /easm/seeds/{id}: get: operationId: getSeedById summary: Get seed by ID tags: - EASM Seeds description: | Retrieves a single seed by its ID. parameters: - $ref: '#/components/parameters/axurTenantKey' - name: id in: path required: true example: 461cfb50-09a3-45a8-9be6-f9506bab6360 description: Seed id schema: type: string responses: '200': description: OK content: application/json: schema: type: object properties: result: $ref: '#/components/schemas/EasmSeedView' '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/seeds/{id}?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' put: operationId: updateSeed summary: Update a seed tags: - EASM Seeds description: | Updates the configuration of an existing seed, such as its name or description. parameters: - $ref: '#/components/parameters/axurTenantKey' - name: id in: path required: true example: 461cfb50-09a3-45a8-9be6-f9506bab6360 description: Seed id schema: type: string requestBody: required: true content: application/json: schema: type: object properties: description: type: string related_discovery_settings: type: object properties: m_and_a: type: object properties: mode: type: string whois: type: object properties: mode: type: string policy: $ref: '#/components/schemas/EasmPolicy' seed_name: type: string type: type: string responses: '200': description: A successful response content: application/json: schema: type: object properties: result: type: object properties: description: type: string id: type: string related_discovery_settings: type: object properties: m_and_a: type: object properties: mode: type: string whois: type: object properties: mode: type: string seed_name: type: string type: type: string '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request PUT \ --url 'https://api.axur.com/gateway/1.0/api/easm/seeds/{id}?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "description": "string", "policy": { "certificates": {"expiring": {"days_until_expiration": 30, "enabled": true}}, "dns_hygiene": {"dmarc_records": {"alert_on_missing": true, "enabled": true}}, "open_ports": {"enabled": true, "scan_type": "full"}, "vulnerabilities": {"cvss_min_threshold": 7, "epss_min_threshold": 0.1, "enabled": true} }, "related_discovery_settings": { "m_and_a": { "mode": "string" }, "whois": { "mode": "string" } }, "seed_name": "string", "type": "string" }' /easm/seeds/{id}/policy: get: operationId: getPolicyBySeedId summary: Get policy by seed ID tags: - EASM Seeds description: | Retrieves the policy associated with a specific seed by its ID. parameters: - $ref: '#/components/parameters/axurTenantKey' - name: id in: path required: true example: 461cfb50-09a3-45a8-9be6-f9506bab6360 description: Seed id schema: type: string responses: '200': description: OK content: application/json: schema: type: object properties: policy: $ref: '#/components/schemas/EasmPolicy' '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request GET \ --url 'https://api.axur.com/gateway/1.0/api/easm/seeds/{id}/policy?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' /easm/seeds/policy: put: operationId: updateSeedPolicy summary: Updates the policy associated with one or more seeds by their IDs. tags: - EASM Seeds description: | Updates the policy associated with one or more seeds by their IDs. parameters: - $ref: '#/components/parameters/axurTenantKey' requestBody: required: true content: application/json: schema: type: object required: - seed_ids - policy properties: policy: $ref: '#/components/schemas/EasmPolicy' seed_ids: type: array items: type: string responses: '200': description: A successful response content: application/json: schema: type: object properties: policy: $ref: '#/components/schemas/EasmPolicy' '403': description: Forbidden x-codeSamples: - lang: cURL label: cURL source: | curl --request PUT \ --url 'https://api.axur.com/gateway/1.0/api/easm/seeds/policy?axur_tenant_key=' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "policy": { "certificates": { "expiring": { "days_until_expiration": 0, "enabled": true }, "self_signed": { "enabled": true }, "weak_encryption": { "enabled": true }, "wildcard": { "enabled": true } }, "dns_hygiene": { "dangling_cnames": { "alert_on_non_existent": true, "alert_on_orphaned": true, "enabled": true }, "dmarc_records": { "alert_on_missing": true, "alert_on_weak": true, "enabled": true }, "expiring_domains": { "alert_on_expired": true, "alert_on_expiring_soon": true, "days_until_expiration": 0, "enabled": true }, "lame_delegation": { "enabled": true }, "spf_records": { "alert_on_missing": true, "alert_on_weak": true, "enabled": true }, "zone_transfers": { "enabled": true } }, "open_ports": { "custom_port_ranges": [ "string" ], "enabled": true, "exclude_ports": [ "string" ], "scan_type": "string" }, "vulnerabilities": { "cisa_kev": true, "cvss_min_threshold": 0, "enabled": true, "epss_min_threshold": 0, "include_unscored": true } }, "seed_ids": [ "string" ] }' components: securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT apiKey: type: apiKey in: header name: Authorization parameters: axurTenantKey: name: axur_tenant_key in: query required: false example: ABCD description: The `axur_tenant_key` path parameter is optional and is used to indicate the tenant in which the operation will be executed. A user may have access to more than one tenant; if this parameter is not sent, the operation will be executed in the user's primary tenant. schema: type: string VendorMonitorSections: name: sections in: query description: Filter by one or more history sections. Repeat the query parameter for multiple values. required: false style: form explode: true schema: type: array items: $ref: "#/components/schemas/VendorMonitorSection" example: - deep-dark-web - bulletins Customers: name: customers in: query description: Filter by one or more customer keys. Repeat the query parameter for multiple values. required: false style: form explode: true schema: type: array items: type: string pattern: "^[A-Z0-9]+$" example: - CUST1 - CSTB Assets: name: assets in: query description: Filter by one or more asset keys. Repeat the query parameter for multiple values. required: false style: form explode: true schema: type: array items: type: string example: - ASSET1 - FOO PageSize: name: pageSize in: query description: Number of entries per page. Defaults to 10 and is capped at 100. required: false schema: type: integer minimum: 0 maximum: 100 default: 10 example: 10 PageNumber: name: pageNumber in: query description: Page number. Defaults to 1. required: false schema: type: integer minimum: 0 default: 1 example: 2 schemas: AssetsApiMonitoringLimit: type: object properties: total: type: integer nullable: true example: 200 usage: type: integer nullable: true example: 30 isUnlimited: type: boolean example: false isLimitExceeded: type: boolean example: false isMonitoringEnabled: type: boolean example: true AssetsApiMonitoringAvailabilityItem: type: object properties: id: type: string example: phishing limit: $ref: '#/components/schemas/AssetsApiMonitoringLimit' AssetsApiMonitoringAvailabilityResponse: type: object properties: customerKey: type: string example: ACME monitoring: type: array items: $ref: '#/components/schemas/AssetsApiMonitoringAvailabilityItem' AssetsApiProperty: type: object description: > Property key-value pair for PATCH add/remove endpoints. Keys must use **camelCase** (e.g. `tins`, `nameVariations`, `appIdsGooglePlay`). required: - key - value properties: key: type: string description: > Property key in camelCase. example: officialWebsite value: nullable: true oneOf: - type: string - type: number - type: integer - type: boolean - type: object - type: array AssetsApiAsset: type: object properties: assetKey: type: string example: ACME01 name: type: string example: example.com type: type: string example: DOMAIN customerKey: type: string example: ACME customerName: type: string example: Acme Corporation status: type: string example: ACTIVE statusReason: type: string description: | Reason for the current asset status. Possible values: - `NONE` — No specific reason; the asset is in its normal state. - `DUPLICATED` — The asset was deactivated because it is a duplicate of another asset. - `REQUESTED_BY_USER` — The asset was deactivated at the user's request. enum: - NONE - DUPLICATED - REQUESTED_BY_USER example: NONE monitoring: type: array items: type: string example: - phishing - malware properties: type: object nullable: true additionalProperties: true capabilities: type: object nullable: true description: "Asset capabilities. Only present for BRAND assets." properties: takedown: type: object properties: enabled: type: boolean example: true properties: type: object nullable: true description: "Takedown properties. Present when takedown has been configured." properties: country: type: string description: "ISO 3166-1 alpha-2 country code." example: BR corporateName: type: string description: "Legal corporate name." example: Axur S.A. registrationNumber: type: string description: "Brand registration number." example: '900000000' registrationUrl: type: string format: uri description: "URL of the registration authority record." example: https://busca.inpi.gov.br/pePI/servlet/MarcasServletController?Action=detail&CodPedido=900000000 registrationCategory: type: string description: "Registration category code." example: '25' registrationOffice: type: string description: "Name of the registration office." example: INPI noBrandRegistration: type: boolean description: "Whether the brand has no formal registration. When `true`, registration fields are absent and `legalExistenceDetails` is present instead." example: false legalExistenceDetails: type: string description: "Text explaining the legal existence of the brand. Present when `noBrandRegistration` is `true`." example: "Company incorporated in 2015, no trademark registration filed yet." brandRegistryFiles: type: array description: "List of uploaded brand registry file URLs. Populated via the `POST /assets/{assetKey}/capabilities/takedown/brand-registry-files` endpoint." items: type: string format: uri example: - "https://storage.example.com/brand-registry/acme-registration.pdf" AssetsApiPagination: type: object properties: page: type: integer example: 1 perPage: type: integer example: 20 total: type: integer nullable: true example: 154 AssetsApiRetrieveAssetsResponse: type: object properties: assets: type: array items: $ref: '#/components/schemas/AssetsApiAsset' pagination: $ref: '#/components/schemas/AssetsApiPagination' AssetsApiCreateAssetRequest: type: object description: | Create payload for Assets. Supported `type` values: `BRAND`, `DOMAIN`, `VIP`, `THIRD_PARTY_PAGE`, `APP`, `TRACKING_TOKEN`, `BIN`, `IP`. Monitoring examples by type: - `BRAND`: `phishing`, `malware`, `paid-search`, `fraudulent-brand-use`, `fake-social-media-profile`, `fake-mobile-app`, `similar-domain-name`, `unauthorized-distribution`, `unauthorized-sale`, `dw-activity`, `other-sensitive-data` - `DOMAIN`: `credentials:user`, `credentials:employee`, `code-secret-leak`, `mentions`, `cti:infrastructure` - `THIRD_PARTY_PAGE`: `credentials:employee` - `APP`: `credentials:user` - `TRACKING_TOKEN`: `database-exposure` - `BIN`: `credit-card-exposure` - `IP`: `cti:infrastructure` - `VIP`: `executives` Property examples by type: - `BRAND`: `officialWebsite`, `brandSize`, `nameVariations`, `tins`, `appIdsGooglePlay`, `primaryLocale`, `additionalLocale` - `DOMAIN`: `employeeCredentialUniquenessCriteria`, `userCredentialUniquenessCriteria` - `THIRD_PARTY_PAGE`: `employeeCredentialUniquenessCriteria` - `APP`: `userCredentialUniquenessCriteria` - `TRACKING_TOKEN`: `tokenName` - `BIN`: `incompleteCreditCardEnabled`, `creditCardUniquenessCriteria` - `VIP`: `vipNameVariations`, `vipEmails`, `vipPhones`, `vipAssociatedBrand`, `vipLinkedinProfiles`, `vipInstagramProfiles`, `vipFacebookProfiles`, `vipTwitterProfiles`, `vipOtherSocialProfiles`, `vipNameSimilarityEnabled`, `vipCreditCardSlots`, `vipPassportNumbers`, `vipPersonalIdNumber`, `vipTaxpayerId`, `vipDriversLicenseNumber` > **Note:** `logos` and `brandRegistryFiles` are managed via their own dedicated endpoints and should not be sent as properties here. For `VIP`, `vipProfilePictures` is rejected with `400`; upload pictures with `POST /assets-api/assets/{assetKey}/face-pictures` after the asset is created and remove them with `PATCH /assets-api/assets/{assetKey}/face-pictures/remove`. Required properties by type: - `BRAND`: `nameVariations` (array, at least one value) and `primaryLocale` (array of locale strings, e.g. `["BR:pt"]`) are **required**. Additionally, at least one of `officialWebsite` or `logos` must be provided — if `officialWebsite` is not set, `logos` becomes required (and vice-versa). Omitting both returns `400` with code `asset.missingRequiredProperty`. Note: `logos` must be uploaded via the `POST /assets/{assetKey}/logos` endpoint. - Other types: no required properties. Capabilities (BRAND only): - You can optionally include a `capabilities` object to enable takedown in the same request. - This avoids a separate `POST /capabilities/takedown/enable` call after creation. - Structure: `capabilities.takedown.enabled` (boolean) and `capabilities.takedown.properties` (takedown details). Name behavior: - For `TRACKING_TOKEN`, `name` must not be sent. It is generated by the backend. - For all other supported types, `name` is required. required: - type oneOf: - required: - type properties: type: type: string enum: - TRACKING_TOKEN - required: - type - name properties: type: type: string enum: - BRAND - DOMAIN - VIP - THIRD_PARTY_PAGE - APP - BIN - IP properties: type: type: string example: DOMAIN name: type: string example: example.com status: type: string example: ACTIVE statusReason: type: string description: | Reason for the current asset status. Possible values: - `NONE` — No specific reason; the asset is in its normal state. - `DUPLICATED` — The asset was deactivated because it is a duplicate of another asset. - `REQUESTED_BY_USER` — The asset was deactivated at the user's request. enum: - NONE - DUPLICATED - REQUESTED_BY_USER example: NONE monitoring: type: array items: type: string example: - phishing properties: type: object additionalProperties: true description: | Asset properties (key/value). Available keys depend on the asset `type`. For `BRAND`, the following properties are **required**: `nameVariations` (array of strings, at least one value) and `primaryLocale` (array of locale strings, e.g. `["BR:pt"]`). Omitting them returns `400`. **Quantity limits for `BRAND`:** `nameVariations` max 3, `primaryLocale` max 2 (same country prefix), `additionalLocale` max 4 (max 2 per country prefix). Exceeding these returns `400`. capabilities: type: object nullable: true description: | Asset capabilities to enable on creation. Only applicable to `BRAND` assets. Allows enabling takedown capability in the same create request, avoiding a separate `POST /capabilities/takedown/enable` call. properties: takedown: type: object properties: enabled: type: boolean description: "Set to `true` to enable takedown capability on creation." example: true properties: type: object nullable: true description: "Takedown properties. Required when enabling takedown." properties: country: type: string description: "ISO 3166-1 alpha-2 country code." example: BR corporateName: type: string description: "Legal corporate name." example: Axur S.A. noBrandRegistration: type: boolean description: "Set to `true` when the brand has no formal registration. When `true`, registration fields are not needed (silently discarded if sent) and `legalExistenceDetails` becomes required. When omitted or `false`, registration fields are required." default: false example: false legalExistenceDetails: type: string description: "Text explaining the legal existence of the brand. Required when `noBrandRegistration` is `true`. Cannot be blank." example: "Company incorporated in 2015, CNPJ 12.123.678/0001-90, no trademark registration filed yet." registrationNumber: type: string description: "Brand registration number. Required when the brand has a registration." example: '900000000' registrationUrl: type: string format: uri description: "URL of the registration authority record. Required when the brand has a registration." example: https://busca.inpi.gov.br/pePI/servlet/MarcasServletController?Action=detail&CodPedido=900000000 registrationCategory: type: string description: "Registration category code. Required when the brand has a registration." example: '25' registrationOffice: type: string description: "Name of the registration office. Required when the brand has a registration." example: INPI instagram: type: string format: uri description: "Instagram profile URL. Must match `https://instagram.com/...` or `https://www.instagram.com/...`." example: https://www.instagram.com/axaboratech facebook: type: string format: uri description: "Facebook page URL. Must match `https://facebook.com/...` or `https://fb.com/...` (subdomains accepted)." example: https://www.facebook.com/axaboratech tiktok: type: string format: uri description: "TikTok profile URL. Must match `https://tiktok.com/...` or `https://www.tiktok.com/...`." example: https://www.tiktok.com/@axaboratech x: type: string format: uri description: "X (formerly Twitter) profile URL. Must match `https://x.com/...` or `https://twitter.com/...`." example: https://x.com/axaboratech AssetsApiMonitoringActionRequest: type: object required: - monitoring properties: monitoring: type: array description: | Examples by type: - BRAND: `phishing`, `malware` - DOMAIN: `credentials:user`, `mentions` - APP: `credentials:user` - BIN: `credit-card-exposure` items: type: string minItems: 1 AssetsApiPropertiesActionRequest: type: object required: - properties properties: properties: type: array description: | Property key/value entries to add or remove. **Quantity limits for `BRAND`:** `nameVariations` max 3, `primaryLocale` max 2 (same country prefix), `additionalLocale` max 4 (max 2 per country prefix). Exceeding these returns `400` with code `asset.property.quantityExceeded`. Example keys by type: - BRAND: `officialWebsite`, `brandSize`, `nameVariations`, `tins`, `appIdsGooglePlay`, `primaryLocale`, `additionalLocale` - DOMAIN: `employeeCredentialUniquenessCriteria`, `userCredentialUniquenessCriteria` - THIRD_PARTY_PAGE: `employeeCredentialUniquenessCriteria` - APP: `userCredentialUniquenessCriteria` - TRACKING_TOKEN: `tokenName` - BIN: `incompleteCreditCardEnabled`, `creditCardUniquenessCriteria` - VIP: `vipNameVariations`, `vipEmails`, `vipPhones`, `vipAssociatedBrand`, `vipLinkedinProfiles`, `vipInstagramProfiles`, `vipFacebookProfiles`, `vipTwitterProfiles`, `vipOtherSocialProfiles`, `vipNameSimilarityEnabled`, `vipCreditCardSlots`, `vipPassportNumbers`, `vipPersonalIdNumber`, `vipTaxpayerId`, `vipDriversLicenseNumber` For `VIP`, `vipProfilePictures` is rejected with `400` (`asset.property.invalid`); use `POST /assets-api/assets/{assetKey}/face-pictures` to add pictures and `PATCH /assets-api/assets/{assetKey}/face-pictures/remove` to remove them. minItems: 1 items: $ref: '#/components/schemas/AssetsApiProperty' AssetsApiRemoveLogosRequest: type: object required: - logos properties: logos: type: array minItems: 1 items: type: string format: uri AssetsApiRemoveFacePicturesRequest: type: object required: - facePictures properties: facePictures: type: array minItems: 1 items: type: string format: uri AssetsApiSafeShareForm: type: object description: Generated SafeShare form of a VIP asset. properties: link: type: string format: uri description: Link the VIP opens to sign the SafeShare form. example: https://safe-share.axur.com/vip/xxx AssetsApiDeactivateAssetsRequest: type: object required: - keys properties: keys: type: array minItems: 1 items: type: string AssetsApiDeactivateAssetsResponse: type: object properties: assets: type: array items: $ref: '#/components/schemas/AssetsApiAsset' AssetsApiError: type: object description: | Standard error response for Assets API endpoints. The `code` field contains a machine-readable error identifier for programmatic handling. See the Error Codes section in the Assets tag for the full list of common codes. properties: code: type: string description: Machine-readable error code (e.g., `asset.category.invalid`, `param.invalid`, `asset.permission.denied`). example: asset.category.invalid message: type: string description: | Human-readable error description. **Note:** some error messages may contain unresolved format placeholders (e.g., `%s`) instead of the actual values. Always use the `code` field for programmatic error handling. example: Invalid asset category context: type: object description: Additional context about the error (e.g., which field or value caused it). additionalProperties: true AssetsApiEnableCapabilityRequest: type: object properties: properties: type: object description: | Capability-specific properties for takedown. Always required: `country`, `corporateName`. Brand with registration (default): `registrationNumber`, `registrationUrl`, `registrationCategory`, `registrationOffice`. Brand without registration: set `noBrandRegistration` to `true` and provide `legalExistenceDetails`. Registration fields are not needed and are silently discarded. Optional: `instagram`, `facebook`, `tiktok`, `x`. properties: country: type: string description: "ISO 3166-1 alpha-2 country code." example: BR corporateName: type: string description: "Legal corporate name. Cannot be blank." example: Axur S.A. noBrandRegistration: type: boolean description: "Set to `true` when the brand has no formal registration. When `true`, registration fields are not needed (silently discarded if sent) and `legalExistenceDetails` becomes required. When omitted or `false`, registration fields are required." default: false example: false legalExistenceDetails: type: string description: "Text explaining the legal existence of the brand. Required when `noBrandRegistration` is `true`. Cannot be blank." example: "Company incorporated in 2015, CNPJ 12.345.678/0001-90, no trademark registration filed yet." registrationNumber: type: string description: "Brand registration number. Required when the brand has a registration. Cannot be blank." example: '900000000' registrationUrl: type: string format: uri description: "URL of the registration authority record. Required when the brand has a registration. Must be a valid URL with scheme and host. URLs without protocol are auto-prefixed with `https://`." example: https://busca.inpi.gov.br/pePI/servlet/MarcasServletController?Action=detail&CodPedido=900000000 registrationCategory: type: string description: "Registration category code. Required when the brand has a registration. Cannot be blank." example: '25' registrationOffice: type: string description: "Name of the registration office. Required when the brand has a registration. Cannot be blank." example: INPI instagram: type: string format: uri description: "Instagram profile URL. Must match `https://instagram.com/...` or `https://www.instagram.com/...`. URLs without protocol are auto-prefixed with `https://`." example: https://www.instagram.com/axaboratech facebook: type: string format: uri description: "Facebook page URL. Must match `https://facebook.com/...` or `https://fb.com/...` (subdomains accepted). URLs without protocol are auto-prefixed with `https://`." example: https://www.facebook.com/axaboratech tiktok: type: string format: uri description: "TikTok profile URL. Must match `https://tiktok.com/...` or `https://www.tiktok.com/...`. URLs without protocol are auto-prefixed with `https://`." example: https://www.tiktok.com/@axaboratech x: type: string format: uri description: "X (formerly Twitter) profile URL. Must match `https://x.com/...` or `https://twitter.com/...` (both domains accepted). URLs without protocol are auto-prefixed with `https://`." example: https://x.com/axaboratech AssetsApiRemoveBrandRegistryFilesRequest: type: object required: - files properties: files: type: array minItems: 1 items: type: string format: uri description: "List of brand registry file URLs to remove." CreditManagementCustomerSettingsResponse: type: object properties: customerKey: type: string example: ACME customerName: type: string example: Acme Corporation maximumLimit: type: integer nullable: true example: 1000 unlimited: type: boolean example: false productLimits: type: array nullable: true items: type: object properties: product: type: string example: BRAND_PROTECTION limit: type: integer nullable: true example: 560 status: type: string enum: - LIMITED - UNLIMITED - DISABLED CreditManagementProductLimitsRequest: type: object properties: limits: type: array items: type: object properties: product: type: string example: BRAND_PROTECTION limit: type: integer nullable: true example: 560 status: type: string enum: - LIMITED - UNLIMITED - DISABLED CreditManagementMonthlyPartnerReportResponse: type: object properties: mainCustomer: $ref: '#/components/schemas/CreditManagementCreditUsage' tenants: type: array items: $ref: '#/components/schemas/CreditManagementCreditUsage' totalUsage: type: integer example: 2600 CreditManagementTenantReportResponse: type: object properties: customer: $ref: '#/components/schemas/CreditManagementTenantCreditUsage' voucher: $ref: '#/components/schemas/CreditManagementVoucherDiscount' finalAmount: type: integer example: 950 minLimitAdjustment: allOf: - $ref: '#/components/schemas/CreditManagementMinLimitAdjustment' nullable: true CreditManagementTenantCreditUsage: type: object properties: customerKey: type: string example: ACME customerName: type: string example: Acme Corporation createdAt: type: integer format: int64 example: 1713225600000 usageByProduct: type: array nullable: true items: $ref: '#/components/schemas/CreditManagementExternalProductUsage' example: - offering: Brand Protection creditsPerCycle: 35 - offering: Cyber Threat Intel (CTI) creditsPerCycle: 48 - offering: Deep & Dark Web creditsPerCycle: 35 usage: type: integer format: int64 example: 1200 finalAmount: type: integer format: int64 example: 1150 hasVoucher: type: boolean example: true monthlyLimit: type: integer nullable: true example: 3000 unlimited: type: boolean example: false voucher: $ref: '#/components/schemas/CreditManagementVoucherDiscount' billingPeriod: $ref: '#/components/schemas/CreditManagementBillingPeriod' billingCountry: type: string example: BR CreditManagementCreditUsage: type: object properties: customerKey: type: string example: ACME customerName: type: string example: Acme Corporation createdAt: type: integer format: int64 example: 1713225600000 usageByProduct: type: array nullable: true items: $ref: '#/components/schemas/CreditManagementExternalProductUsage' example: - offering: Brand Protection creditsPerCycle: 35 - offering: Cyber Threat Intel (CTI) creditsPerCycle: 48 - offering: Deep & Dark Web creditsPerCycle: 35 usage: type: integer format: int64 example: 1200 finalAmount: type: integer format: int64 example: 1150 hasVoucher: type: boolean example: true monthlyLimit: type: integer nullable: true example: 3000 unlimited: type: boolean example: false voucher: $ref: '#/components/schemas/CreditManagementVoucherDiscount' billingPeriod: $ref: '#/components/schemas/CreditManagementBillingPeriod' billingCountry: type: string example: "BR" CreditManagementExternalProductUsage: type: object properties: offering: type: string example: Brand Protection creditsPerCycle: type: integer format: int64 example: 35 CreditManagementVoucherDiscount: type: object properties: applied: type: boolean example: true voucherCode: type: string nullable: true example: SPRING10 discountType: type: string nullable: true enum: - PERCENTAGE - FIXED_AMOUNT discountValue: type: number nullable: true example: 10 activationDate: type: string nullable: true format: date example: '2026-02-01' remainingDays: type: integer example: 12 billingReferenceMonth: type: string nullable: true example: '2026-02' CreditManagementBillingPeriod: type: object properties: start: type: string format: date example: '2026-02-01' end: type: string format: date example: '2026-02-29' CreditManagementUsageBreakdown: type: object properties: products: type: array items: $ref: '#/components/schemas/CreditManagementUsageBreakdownProduct' CreditManagementUsageBreakdownProduct: type: object properties: product: type: string nullable: true example: DATA_LEAKAGE totalUsage: type: integer format: int64 example: 450 totalUsageByTier: type: object nullable: true additionalProperties: type: integer format: int64 modules: type: array items: $ref: '#/components/schemas/CreditManagementUsageBreakdownModule' CreditManagementUsageBreakdownModule: type: object properties: productModule: type: string nullable: true example: credentials:user totalUsage: type: integer format: int64 example: 120 totalUsageByTier: type: object nullable: true additionalProperties: type: integer format: int64 items: type: array items: $ref: '#/components/schemas/CreditManagementUsageBreakdownItem' CreditManagementUsageBreakdownItem: type: object properties: id: type: string example: ASSET-KEY-01 usage: type: integer format: int64 example: 42 tier: type: string nullable: true enum: - ASSET - STARTER - BUSINESS - CORPORATE - ENTERPRISE CreditManagementMinLimitAdjustment: type: object properties: before: type: integer format: int64 example: 780 after: type: integer format: int64 example: 1000 minLimit: type: integer format: int64 example: 1000 CreditManagementError: type: object properties: code: type: string example: invalid.param message: type: string example: Invalid request parameter context: type: object additionalProperties: true CustomersApiCustomerLite: type: object properties: name: type: string example: Acme Corp key: type: string example: ACME active: type: boolean example: true suspended: type: boolean example: false category: type: string example: MSSP_TENANT parentCustomerKey: type: string nullable: true example: AXURP childTenantCount: type: integer example: 3 AutomationCatalogItem: type: object properties: type: type: string description: Detection type affected by the automation example: TICKET_DETECTION fields: type: array description: Configurable match conditions items: $ref: '#/components/schemas/AutomationCatalogField' actions: type: array description: Configurable actions to execute on matched items items: $ref: '#/components/schemas/AutomationActionGroup' AutomationCatalogField: type: object properties: key: type: string example: metadata.parser.format dataType: type: string description: Type of the values provided for matching example: ENUM valueType: type: string description: Type of the value the match field accepts example: LIST comparators: type: array description: Available comparation operators for the field items: type: string example: - EQUAL - NOT_EQUAL - CONTAINS - NOT_CONTAINS allowedValues: type: object description: Available fields for `ENUM` data types properties: values: type: array items: type: string example: - COMBOLIST - STEALER LOG - TABLE closed: type: boolean description: Informs if the field only allows the described values or a free text example: true required: type: boolean description: Informs if the automation is required to have a condition for the field example: false AutomationActionGroup: type: object properties: group: type: string example: annotation-TAG maxAllowed: type: string example: UNLIMITED description: How many actions of the group are allowed per automation actions: type: array description: Actions inside the group items: $ref: '#/components/schemas/AutomationAction' AutomationAction: type: object properties: name: type: string example: TAG arguments: type: object description: Map of argument names to their metadata format additionalProperties: $ref: '#/components/schemas/AutomationActionArgumentMetadata' AutomationActionArgumentMetadata: type: object properties: dataType: type: string example: STRING valueType: type: string example: LIST AutomationManageRequestCreate: type: object required: - customer - matchType - name - priority - conditions - actions properties: customer: type: string description: Customer key identifier example: "cust_123456" matchType: type: string description: Type of items to match (e.g., CREDENTIAL, TICKET_DETECTION) example: "CREDENTIAL" name: type: string description: Automation name example: "Tag high-risk credentials" description: type: string description: Automation description example: "Automatically tag credentials with high risk scores" priority: type: integer description: Automation execution priority example: 1 conditions: type: array description: List of conditions to match items: $ref: '#/components/schemas/AutomationConditionInput' actions: type: array description: List of actions to execute when matched items: $ref: '#/components/schemas/AutomationActionInput' AutomationManageRequestUpdate: type: object required: - name - conditions - actions properties: name: type: string description: Automation name example: "Tag high-risk credentials" description: type: string description: Automation description example: "Automatically tag credentials with high risk scores" priority: type: integer description: Automation execution priority (optional) example: 1 conditions: type: array description: List of conditions to match items: $ref: '#/components/schemas/AutomationConditionInput' actions: type: array description: List of actions to execute when matched items: $ref: '#/components/schemas/AutomationActionInput' AutomationConditionInput: type: object required: - field - comparator - values properties: field: type: string description: Field key to evaluate example: "metadata.parser.format" comparator: type: string description: Comparison operator example: "EQUAL" enum: - EQUAL - NOT_EQUAL - CONTAINS - NOT_CONTAINS - GREATER_THAN - LESS_THAN - GREATER_THAN_OR_EQUAL - LESS_THAN_OR_EQUAL values: type: array items: type: string description: Values to compare against example: ["COMBOLIST", "STEALER LOG"] AutomationActionInput: type: object required: - actionType - arguments properties: actionType: type: string description: Type of action to execute example: "TAG" arguments: type: object description: Arguments for the action additionalProperties: {} example: tags: ["high-risk", "credential-leak"] AutomationView: type: object properties: id: type: integer description: Automation unique identifier example: 123 customerKey: type: string description: Customer key identifier example: "cust_123456" matchType: type: string description: Type of items this automation matches example: "CREDENTIAL" name: type: string description: Automation name example: "Tag high-risk credentials" description: type: string description: Automation description example: "Automatically tag credentials with high risk scores" active: type: boolean description: Whether the automation is active example: true deleted: type: boolean description: Whether the automation is deleted example: false priority: type: integer description: Automation execution priority example: 1 conditions: type: array description: List of conditions items: $ref: '#/components/schemas/AutomationConditionOutput' actions: type: array description: List of actions items: $ref: '#/components/schemas/AutomationActionOutput' createdAt: type: integer format: int64 description: Creation timestamp (milliseconds since epoch) example: 1629820800000 updatedAt: type: integer format: int64 description: Last update timestamp (milliseconds since epoch) example: 1629820800000 executionsLast30Days: type: integer description: Number of executions in the last 30 days example: 42 lastChange: $ref: '#/components/schemas/AutomationLastChange' AutomationSummaryView: type: object properties: id: type: integer description: Automation unique identifier example: 123 customerKey: type: string description: Customer key identifier example: "cust_123456" matchType: type: string description: Type of items this automation matches example: "CREDENTIAL" name: type: string description: Automation name example: "Tag high-risk credentials" description: type: string description: Automation description example: "Automatically tag credentials with high risk scores" active: type: boolean description: Whether the automation is active example: true deleted: type: boolean description: Whether the automation is deleted example: false priority: type: integer description: Automation execution priority example: 1 createdAt: type: integer format: int64 description: Creation timestamp (milliseconds since epoch) example: 1629820800000 updatedAt: type: integer format: int64 description: Last update timestamp (milliseconds since epoch) example: 1629820800000 executionsLast30Days: type: integer description: Number of executions in the last 30 days example: 42 lastChange: $ref: '#/components/schemas/AutomationLastChange' AutomationConditionOutput: type: object properties: field: type: string description: Field key being evaluated example: "metadata.parser.format" comparator: type: string description: Comparison operator used example: "EQUAL" values: type: array items: type: string description: Values being compared example: ["COMBOLIST"] AutomationActionOutput: type: object properties: order: type: integer description: Order of execution example: 1 actionType: type: string description: Type of action example: "TAG" arguments: type: object description: Action arguments additionalProperties: {} example: tags: ["high-risk"] AutomationLastChange: type: object properties: author: type: object properties: userId: type: integer internal: type: boolean external: type: boolean eventTime: type: integer format: int64 description: Timestamp of last change example: 1629820800000 AutomationPagination: type: object properties: total: type: integer description: Total number of items example: 100 page: type: integer description: Current page number example: 1 perPage: type: integer description: Items per page example: 20 AutomationDryRunOutput: type: object properties: matched: type: boolean description: Whether the automation conditions matched the item example: true conditions: type: array description: Detailed outcome for each condition items: $ref: '#/components/schemas/AutomationConditionOutcome' AutomationConditionOutcome: type: object properties: field: type: string description: Field that was evaluated example: "metadata.parser.format" matched: type: boolean description: Whether this condition matched example: true reason: type: string description: Explanation of the match result example: "matched" comparator: type: string description: The comparison operator used example: "EQUAL" values: type: array items: type: string description: Values being compared in the condition example: ["COMBOLIST"] actualValue: description: The actual value from the item being tested example: "COMBOLIST" AutomationError: type: object required: - status - message properties: status: type: integer description: HTTP status code example: 400 message: type: string description: Error message describing what went wrong example: "Invalid automation name" code: type: string description: Error code for programmatic handling example: "INVALID_REQUEST" details: type: object description: Additional error context or field-specific errors additionalProperties: {} example: field: "name" constraint: "must not be empty" timestamp: type: integer format: int64 description: Error timestamp in milliseconds since epoch example: 1629820800000 ExpirationDateView: type: object properties: month: type: integer example: 2 description: Expiration month of the credit card year: type: integer example: 2032 description: Expiration year of the credit card SourceView: type: object properties: name: type: string example: Deep/Dark Web description: Source name where the leak was detected url: type: string example: Telegram description: URL of the source where the leak was detected sourceType: type: string example: Deep/Dark Web - Telegram description: Type of the source where the leak was detected OpenDataDatasetsResult: type: object description: Open Data Datasets Result properties: dataset: type: string example: tickets description: Dataset id createdAt: type: integer example: 169893289310 description: The date on when the dataset was created schemas-OpenDataDatasetsResult: type: object description: Open Data Datasets Result properties: filename: type: string example: tickets_22-11-2023.csv description: table id createdAt: type: integer example: 169893289310 description: The date on when the table was created CreditCardDetectionView: type: object properties: cardNumber: type: integer example: 1234567891011121 description: Credit card number securityCode: type: integer example: 123 description: Credit card security code (CVV) detectedAt: type: integer description: Detection timestamp in milliseconds expirationDate: $ref: '#/components/schemas/ExpirationDateView' source: $ref: '#/components/schemas/SourceView' EasmFirstSeenAt: type: integer description: Number of days (example - 7 days, the value should be 7) EasmAssetView: type: object properties: asset_id: type: string asset_type: type: string business_impact_score: type: integer certificates: type: array items: type: object properties: fingerprint: type: string issuer: type: string valid_from: type: string valid_to: type: string cloud_provider: type: string custom_tags: type: array items: type: string dns_records: type: array items: type: object properties: domain_name: type: string record_type: type: string ttl: type: integer value: type: string domain_expiration_date: type: string domain_name: type: string exposures: type: integer first_seen_at: type: string ip_address: type: string last_seen_at: type: string manual_business_impact_score: type: integer ports: type: array items: type: integer seed_id: type: string status: type: string system_business_impact_score: type: integer system_tags: type: array items: type: string target: type: string technologies: type: array items: type: object properties: name: type: string type: type: string version: type: string EasmBusinessImpact: type: array description: Array of business impact items: type: object properties: min: type: integer max: type: integer GetAssetsListFilters: type: object properties: asset_type: type: array description: Array of asset types ("A", "AAAA", "CNAME", ...) items: type: string business_impact: $ref: '#/components/schemas/EasmBusinessImpact' first_seen_at: $ref: '#/components/schemas/EasmFirstSeenAt' ports: type: array description: Open ports (80, 8080, 443, ...) items: type: integer providers: type: array description: Providers type ("Microsoft Azure", "Oracle Cloud", "Cloudflare", ...) items: type: string search: type: string description: Text to be searched in some asset properties status: type: string description: Asset status enum: - online - offline tags: type: array description: Asset tags items: type: string technologies: type: array description: Array of technologies ("CloudFlare", "Jenkins", "Metabase", ...) items: type: string GetAssetsListRequestBody: type: object properties: filters: $ref: '#/components/schemas/GetAssetsListFilters' limit: type: integer description: Limit of results offset: type: integer description: Offset of results sort: $ref: '#/components/schemas/EasmAssetSort' required: - limit - offset GetAssetsListResponseBody: type: object properties: assets: type: array items: type: object properties: asset_id: type: string asset_type: type: string business_impact_score: type: integer custom_tags: type: array items: type: string domain_name: type: string exposures: type: integer first_seen_at: type: string ip_address: type: string last_seen_at: type: string manual_business_impact_score: type: integer ports: type: array items: type: integer seed_id: type: string status: type: string system_business_impact_score: type: integer system_tags: type: array items: type: string target: type: string has_more: type: boolean limit: type: integer offset: type: integer total_count: type: integer EasmDirection: type: string description: Sorting direction enum: - ASC - DESC EasmAssetSort: type: object description: Sorting values properties: direction: $ref: '#/components/schemas/EasmDirection' field: type: string description: Sorting field enum: - HOSTNAME - IP_ADDRESS - FIRST_SEEN_AT - LAST_SEEN_AT - EXPOSURES - BUSINESS_IMPACT EasmExposureSort: type: object description: Sorting values properties: direction: $ref: '#/components/schemas/EasmDirection' field: type: string description: Sorting field enum: - TITLE - RISK_SCORE - STATUS - FIRST_SEEN_AT - LAST_SEEN_AT - ASSIGNED_TO - ASSET_COUNT - SEVERITY - PRIORITY - CREATED_AT GetExposuresListFilters: type: object description: Filter values properties: asset_id: type: array description: Asset ids to use in the filter. items: type: string asset_tags: type: array description: Asset tags to use in the filter. items: type: string assigned_to: type: array description: Users ids to use in the filter. items: type: string business_impact: $ref: '#/components/schemas/EasmBusinessImpact' exposure_type: type: array description: Exposure type to use in the filter (CVE, Open ports, ...). items: type: string feasibility: type: array description: Array of feasibilities items: type: object properties: min: type: integer max: type: integer first_seen_at: $ref: '#/components/schemas/EasmFirstSeenAt' hosts: type: array description: Hosts to use in the filter. items: type: string ip_addresses: type: array description: Ip's to use in the filter. items: type: string priority: type: array description: Array of priorities items: type: object properties: min: type: integer max: type: integer risk_score: type: array description: Array of risk scores items: type: object properties: min: type: integer max: type: integer search: type: string description: Text to be searched in some exposures properties severity: type: array description: Array of severities items: type: object properties: min: type: integer max: type: integer status: type: array description: Statuses to use in the filter. items: type: string enum: - new - reopened - in_progress - investigating - false_positive - risk_accepted - resolved - validated ExposuresResponseBody: type: object properties: assigned_to: type: string business_impact_score: type: integer feasibility_score: type: integer first_seen_at: type: string id: type: string last_seen_at: type: string priority: type: integer related_assets: type: array items: type: object properties: custom_tags: type: array items: type: string domain_name: type: string ip_address: type: string system_tags: type: array items: type: string risk_score: type: integer severity: type: integer status: type: string title: type: string GetExposuresResponseBody: type: object properties: exposures: $ref: '#/components/schemas/ExposuresResponseBody' has_more: type: boolean limit: type: integer offset: type: integer total_count: type: integer EasmPolicy: type: object properties: certificates: type: object properties: expiring: type: object properties: days_until_expiration: type: integer format: integer enabled: type: boolean self_signed: type: object properties: enabled: type: boolean weak_encryption: type: object properties: enabled: type: boolean wildcard: type: object properties: enabled: type: boolean dns_hygiene: type: object properties: dangling_cnames: type: object properties: alert_on_non_existent: type: boolean alert_on_orphaned: type: boolean enabled: type: boolean dmarc_records: type: object properties: alert_on_missing: type: boolean alert_on_weak: type: boolean enabled: type: boolean expiring_domains: type: object properties: alert_on_expired: type: boolean alert_on_expiring_soon: type: boolean days_until_expiration: type: integer enabled: type: boolean lame_delegation: type: object properties: enabled: type: boolean spf_records: type: object properties: alert_on_missing: type: boolean alert_on_weak: type: boolean enabled: type: boolean zone_transfers: type: object properties: enabled: type: boolean open_ports: type: object properties: custom_port_ranges: type: array items: type: string enabled: type: boolean exclude_ports: type: array items: type: string scan_type: type: string vulnerabilities: type: object properties: cisa_kev: type: boolean cvss_min_threshold: type: integer enabled: type: boolean epss_min_threshold: type: number include_unscored: type: boolean EasmSeedView: type: object properties: confidence_score: type: integer confidence_score_reason: type: string created_at: type: string description: type: string id: type: string last_scanned: type: string parent_seed_id: type: string parent_seed_name: type: string related_discovery_settings: type: object properties: m_and_a: type: object properties: mode: type: string whois: type: object properties: mode: type: string seed_name: type: string sources: type: array items: type: string status: type: string type: type: string updated_at: type: string VendorMonitorHistoryResponse: type: object required: - data - pagination properties: data: type: array items: $ref: "#/components/schemas/VendorMonitorHistoryEntry" pagination: $ref: "#/components/schemas/VendorMonitorPagePaginationMetadata" example: data: - id: 4 assetKey: value: AST11 customerKey: value: TAGG type: bulletins source: new-bulletins createdAt: 4000 samples: - id: b-2 title: bulletin 2 published: 1759343400000 lastUpdate: 1759343500000 link: /bulletins/b-2 pagination: type: page page: 2 size: 10 total: 32 offset: 10 VendorMonitorHistoryEntry: type: object required: - id - assetKey - customerKey - type - source - createdAt - samples properties: id: type: integer format: int64 assetKey: $ref: "#/components/schemas/AssetKey" customerKey: $ref: "#/components/schemas/CustomerKey" type: $ref: "#/components/schemas/VendorMonitorSection" source: type: string description: History source identifier, such as new-bulletins, new-mentions, or new-credentials. createdAt: type: integer format: int64 description: Creation timestamp in milliseconds since the Unix epoch. samples: type: array description: Section-specific history samples. items: oneOf: - $ref: "#/components/schemas/ExpiredCertificateHistorySample" - $ref: "#/components/schemas/VulnerabilitiesHistorySample" - $ref: "#/components/schemas/CriticalInsightHistorySample" - $ref: "#/components/schemas/InsightHistorySample" - $ref: "#/components/schemas/CustomerCredentialHistorySample" - $ref: "#/components/schemas/CorporateCredentialHistorySample" - $ref: "#/components/schemas/ThreatActorHistorySample" VendorMonitorPagePaginationMetadata: type: object required: - type - page - size - total - offset properties: type: type: string enum: - page page: type: integer minimum: 1 size: type: integer minimum: 0 maximum: 100 total: type: integer minimum: 0 offset: type: integer minimum: 0 VendorMonitorSection: type: string enum: - deep-dark-web - attack-surface - bulletins - critical-bulletins - corporate-credentials - customer-credentials AssetKey: type: object required: - value properties: value: type: string CustomerKey: type: object required: - value properties: value: type: string pattern: "^[A-Z0-9]+$" ExpiredCertificateHistorySample: type: object required: - ip - domain properties: ip: type: string domain: type: string nullable: false serialNumber: type: string nullable: true subject: type: string nullable: true issuer: type: string nullable: true signatureAlgorithm: type: string nullable: true validFrom: type: integer format: int64 nullable: true validTo: type: integer format: int64 nullable: true example: ip: 192.0.2.10 domain: example.com serialNumber: "00A1" subject: example.com issuer: Example CA signatureAlgorithm: SHA256withRSA validFrom: 1704067200000 validTo: 1735689600000 VulnerabilitiesHistorySample: type: object required: - ip - domain properties: ip: type: string nullable: false domain: type: string nullable: false portNumber: type: integer nullable: false vulnerabilityId: type: string nullable: false cvss: type: string nullable: false example: ip: 192.0.2.10 domain: example.com portNumber: 443 vulnerabilityId: CVE-1234 cvss: 9.1 CriticalInsightHistorySample: type: object required: - id - link properties: id: type: string title: type: string nullable: true published: type: integer format: int64 nullable: true lastUpdate: type: integer format: int64 nullable: true tags: type: array nullable: true items: type: string link: type: string example: id: critical-insight-1 title: Critical bulletin published: 1759343400000 lastUpdate: 1759343500000 tags: - ransomware link: /bulletins/critical-insight-1 InsightHistorySample: type: object required: - id - link properties: id: type: string title: type: string nullable: true published: type: integer format: int64 nullable: true lastUpdate: type: integer format: int64 nullable: true tags: type: array nullable: true items: type: string link: type: string example: id: insight-1 title: Bulletin published: 1759343400000 lastUpdate: 1759343500000 tags: - ransomware link: /bulletins/insight-1 CustomerCredentialHistorySample: type: object required: - username - password - date properties: username: type: string password: type: string description: Masked password. date: type: integer format: int64 url: type: string nullable: true example: username: mic******@axur.com password: "&**********a" date: 1761909905682 url: https://example.com/access CorporateCredentialHistorySample: type: object required: - username - password - date properties: username: type: string password: type: string description: Masked password. date: type: integer format: int64 example: username: mic******@axur.com password: "&**********a" date: 1761909905682 ThreatActorHistorySample: type: object required: - username - activeOn - mentions properties: username: type: string nullable: true activeOn: type: array items: type: string mentions: type: integer format: int32 example: username: Actor Name activeOn: - Telegram mentions: 10 x-tagGroups: - name: Axur Platform API tags: - Axur Platform API - Authentication - Permission levels - Customers - Assets - Credit Management - Tickets Api Operations - Integration Feed - Filter Operations - Ticket Operations - Axur Platform webhooks - Safelist operations - Users - API Fields Description - CSV Ticket Extraction Sample - Exposure Api Operations - Web complaints API - name: Credit Card Exposure for Application tags: - Credit Card Exposure for Application - Getting started with Credit Card Exposure for Application - Supported operations on Credit Card Exposure for Application - name: Cyber Threat Intel (CTI) TAXII Server tags: - Cyber Threat Intel (CTI) TAXII Server - Supported operations on Cyber Threat Intel (CTI) TAXII Server - IoC Collection - name: Threat Hunting tags: - Threat Hunting - Supported operations on Threat Hunting - name: Investigations tags: - Investigations - Supported operations on Investigations - name: Automations tags: - Automations - Supported operations on Automations - name: Open Data tags: - Open Data - Supported operations on Open Data - name: IoC Feed tags: - IoC Feed - Supported operations on IoC Feed - name: Supply Chain Intel tags: - Supply Chain Intel - name: EASM operations tags: - EASM operations (Introduction) - Account - EASM Assets - EASM Exposures - EASM Policies - EASM Filters - EASM API Version - EASM Users - EASM Seeds - name: '' tags: - Changelog