cURL
curl -X GET "https://app.cotool.ai/items/:id" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json"import requests
url = "https://app.cotool.ai/items/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.cotool.ai/items/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));HttpResponse<String> response = Unirest.get("https://app.cotool.ai/items/{id}")
.header("Authorization", "Bearer <token>")
.asString();package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.cotool.ai/items/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"id": "<string>",
"source": {
"url": "<string>",
"publisher": "<string>",
"publishTime": "<string>",
"language": "<string>",
"name": "<string>",
"license": "<string>"
},
"event": {
"title": "<string>",
"confidence": 0.5,
"eventFirstSeen": "<string>",
"eventLastSeen": "<string>"
},
"summary": "<string>",
"tldr": "<string>",
"attackPath": [
"<string>"
],
"classification": {
"attack": [
{
"technique": "<string>",
"subTechnique": "<string>",
"techniqueName": "<string>",
"confidence": 0.5,
"evidenceRef": "<string>"
}
],
"killChain": [],
"malware": [
{
"name": "<string>",
"confidence": 0.5,
"aliases": [
"<string>"
]
}
],
"actor": [
{
"name": "<string>",
"confidence": 0.5,
"aliases": [
"<string>"
]
}
],
"platforms": [],
"mappings": [
{
"framework": "<string>",
"id": "<string>",
"confidence": 0.5
}
]
},
"affectedProducts": [
{
"versions": [],
"vendor": "<string>",
"product": "<string>",
"confidence": 0.5
}
],
"iocs": {
"ipv4": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"ipv6": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"domains": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"urls": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"hashes": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"files": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"registryKeys": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"processes": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"certs": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"cloudIds": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"mobileIds": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
]
},
"provenance": {
"supportingPassages": [
{
"text": "<string>",
"sourceUrl": "<string>",
"charSpan": {
"start": 123,
"end": 123
}
}
]
},
"version": 123,
"externalId": "<string>",
"abstract": "<string>",
"lastUpdated": "<string>",
"createdAt": "<string>",
"addedToFeedAt": "<string>",
"canonicalKey": "<string>",
"duplicateOf": "<string>",
"tenantOverrides": "<unknown>"
}{
"error": "<string>",
"issues": [
{}
]
}{
"error": "<string>"
}{
"error": "<string>",
"missingPerms": [
"<string>"
]
}{
"error": "<string>"
}API Reference
Get specific intel item
Retrieves detailed information for a specific threat intelligence item by its ID
GET
/
items
/
{id}
cURL
curl -X GET "https://app.cotool.ai/items/:id" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json"import requests
url = "https://app.cotool.ai/items/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.cotool.ai/items/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));HttpResponse<String> response = Unirest.get("https://app.cotool.ai/items/{id}")
.header("Authorization", "Bearer <token>")
.asString();package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.cotool.ai/items/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"id": "<string>",
"source": {
"url": "<string>",
"publisher": "<string>",
"publishTime": "<string>",
"language": "<string>",
"name": "<string>",
"license": "<string>"
},
"event": {
"title": "<string>",
"confidence": 0.5,
"eventFirstSeen": "<string>",
"eventLastSeen": "<string>"
},
"summary": "<string>",
"tldr": "<string>",
"attackPath": [
"<string>"
],
"classification": {
"attack": [
{
"technique": "<string>",
"subTechnique": "<string>",
"techniqueName": "<string>",
"confidence": 0.5,
"evidenceRef": "<string>"
}
],
"killChain": [],
"malware": [
{
"name": "<string>",
"confidence": 0.5,
"aliases": [
"<string>"
]
}
],
"actor": [
{
"name": "<string>",
"confidence": 0.5,
"aliases": [
"<string>"
]
}
],
"platforms": [],
"mappings": [
{
"framework": "<string>",
"id": "<string>",
"confidence": 0.5
}
]
},
"affectedProducts": [
{
"versions": [],
"vendor": "<string>",
"product": "<string>",
"confidence": 0.5
}
],
"iocs": {
"ipv4": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"ipv6": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"domains": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"urls": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"hashes": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"files": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"registryKeys": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"processes": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"certs": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"cloudIds": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
],
"mobileIds": [
{
"value": "<string>",
"type": "<string>",
"normalizedValue": "<string>",
"firstSeen": "<string>",
"lastSeen": "<string>",
"ttlDays": 123,
"confidence": 0.5
}
]
},
"provenance": {
"supportingPassages": [
{
"text": "<string>",
"sourceUrl": "<string>",
"charSpan": {
"start": 123,
"end": 123
}
}
]
},
"version": 123,
"externalId": "<string>",
"abstract": "<string>",
"lastUpdated": "<string>",
"createdAt": "<string>",
"addedToFeedAt": "<string>",
"canonicalKey": "<string>",
"duplicateOf": "<string>",
"tenantOverrides": "<unknown>"
}{
"error": "<string>",
"issues": [
{}
]
}{
"error": "<string>"
}{
"error": "<string>",
"missingPerms": [
"<string>"
]
}{
"error": "<string>"
}Authorizations
API Key authentication for programmatic access. Include your API key in the Authorization header as: Bearer your_api_key_here
Path Parameters
Response
Successful response
Backwards-compatible intel item for read/API responses (tolerates legacy stored shapes).
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Maximum string length:
240Classification including ATT&CK mapping, kill chain phases, actors, malware, and platforms.
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Grouped IOCs (read-tolerant).
Show child attributes
Show child attributes
Provenance information tying claims to exact sources/passages.
Show child attributes
Show child attributes
Was this page helpful?
⌘I