> ## Documentation Index > Fetch the complete documentation index at: https://docs.cotool.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get specific intel item > Retrieves detailed information for a specific threat intelligence item by its ID ## OpenAPI ````yaml https://app.cotool.ai/api/docs/openapi.json get /api/intel/items/{id} openapi: 3.1.0 info: title: Cotool API version: 1.0.0 description: >- The Cotool REST API. Authenticate with an API key from `/settings/api-keys` sent as `Authorization: Bearer `. Authentication, error formats, pagination, and common integration recipes are documented in the [API overview](https://docs.cotool.ai/api-reference/introduction). Endpoints marked **Deprecated** keep working; each one's description names its replacement. servers: - url: https://app.cotool.ai description: Production server security: - ApiKeyAuth: [] tags: - name: Agents description: Create, update, run, and version agents. - name: Agent Runs description: Inspect agent runs, submit feedback, and read evaluation metrics. - name: Agent Triggers description: Webhook, schedule, and integration triggers that start agent runs. - name: Agents as Code description: Validate agents and skills defined as YAML in a Git repository. - name: Skills description: Reusable instructions and tool grants attached to agents. - name: Chat description: Chat sessions and their transcripts. - name: Alerts description: Alert triage, routing, and escalation notifications. - name: Output Destinations description: Webhook, Slack, Jira, and Linear destinations for agent output. - name: Detections description: Detection agents, detection hits, and the Cotool detection library. - name: Hunt description: Autonomous hunt threats, gaps, and settings. - name: Intel description: Threat-intelligence feed items, indicators, and sources. - name: Threat Model description: The organization threat model and its version history. - name: MITRE Coverage description: MITRE ATT&CK coverage across detections. - name: Tools description: Connected tool integrations and captured tool output. - name: CLIs description: Connected CLI integrations. - name: Artifacts description: Files and reports produced by agent runs. - name: Audit Logs description: Organization audit log export and event catalog. - name: Users description: Users, memberships, and the current session. - name: Roles description: Role-based permissions. - name: Organizations description: Organization-level metrics. paths: /api/intel/items/{id}: get: tags: - Intel summary: Get specific intel item description: >- Retrieves detailed information for a specific threat intelligence item by its ID parameters: - in: path name: id schema: type: string required: true responses: '200': description: Successful response content: application/json: schema: type: object properties: id: type: string externalId: type: string source: type: object properties: url: type: string format: uri name: type: string publisher: type: string publishTime: type: string tlp: type: string enum: - CLEAR - GREEN - AMBER - AMBER+STRICT - RED license: type: string language: type: string required: - url - publisher - publishTime - language event: type: object properties: title: type: string eventFirstSeen: type: string eventLastSeen: type: string severity: type: string enum: - none - low - medium - high - critical confidence: type: number minimum: 0 maximum: 1 status: type: string enum: - active - corrected - retracted required: - title - severity - confidence - status summary: type: string abstract: type: string tldr: type: string maxLength: 240 attackPath: type: array items: type: string classification: type: object properties: attack: type: array items: type: object properties: technique: type: string subTechnique: type: string description: >- Sub-technique ID when applicable (e.g., T1059.001). techniqueName: type: string description: >- Resolved human-readable technique name. Omit when unknown. confidence: type: number minimum: 0 maximum: 1 evidenceRef: type: string description: >- Optional reference to supporting evidence (e.g., passage index or quote id). description: >- ATT&CK technique mapping with confidence. Include techniqueName when resolvable. killChain: type: array items: type: string enum: - reconnaissance - weaponization - delivery - exploitation - installation - c2 - actions description: >- Relevant kill chain phases demonstrated in the content. Return [] when not evidenced. malware: type: array items: type: object properties: name: type: string description: Malware family/tool name. confidence: type: number minimum: 0 maximum: 1 aliases: type: array items: type: string description: Known aliases for the malware family/tool. required: - name description: Malware identification claim. actor: type: array items: type: object properties: name: type: string description: Threat actor/group name. confidence: type: number minimum: 0 maximum: 1 aliases: type: array items: type: string description: Known aliases for the actor/group. required: - name description: Threat actor attribution claim. platforms: type: array items: type: string enum: - windows - linux - macos - ios - android - aws - gcp - azure - o365 - okta - kubernetes description: >- Affected platforms/environments. Return [] when not stated. mappings: type: array items: type: object properties: framework: type: string description: Framework name (e.g., NIST, CIS). id: type: string description: Framework control/technique identifier. confidence: type: number minimum: 0 maximum: 1 description: Optional confidence in mapping in [0,1]. required: - framework - id description: Mapping to other security frameworks. description: >- Mappings to other frameworks (e.g., NIST, CIS). Return [] when not applicable. required: - attack - killChain - malware - actor - platforms - mappings description: >- Classification including ATT&CK mapping, kill chain phases, actors, malware, and platforms. affectedProducts: type: array items: type: object properties: vendor: type: string product: type: string versions: type: array items: type: string default: [] confidence: type: number minimum: 0 maximum: 1 description: Optional confidence in product impact in [0,1]. required: - versions description: >- Affected vendor/product versions relevant for scoping detections. iocs: type: object properties: ipv4: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. ipv6: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. domains: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. urls: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. hashes: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. files: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. registryKeys: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. processes: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. certs: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. cloudIds: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. mobileIds: type: array items: type: object properties: type: type: string value: type: string description: Indicator value string as observed. normalizedValue: type: string description: >- Optional normalized form (e.g., lowercase domain without trailing dot). firstSeen: type: string description: >- ISO-8601 timestamp when IOC was first observed. Omit when unknown. lastSeen: type: string description: >- ISO-8601 timestamp when IOC was last observed. Omit when unknown. ttlDays: type: number description: >- Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown. status: type: string enum: - active - revoked - superseded - expired confidence: type: number minimum: 0 maximum: 1 indicatorRole: type: string enum: - compromise - relevance - reference description: >- 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'. required: - value description: >- A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence. description: Grouped IOCs (read-tolerant). provenance: type: object properties: supportingPassages: type: array items: type: object properties: text: type: string description: >- Exact quoted text supporting a technical claim. Do not paraphrase. sourceUrl: type: string format: uri description: >- Optional URL if the passage is from a different source. charSpan: type: object properties: start: type: number description: >- Start character offset (inclusive) of quoted span within content. end: type: number description: >- End character offset (exclusive) of quoted span within the analyzed content. required: - start - end description: >- Character span for the quoted passage within the analyzed content. required: - text description: >- Supporting evidence passages used to justify extracted claims. description: >- Evidence snippets grounding technical claims and mappings. Use [] when no precise evidence exists. required: - supportingPassages description: >- Provenance information tying claims to exact sources/passages. version: type: integer exclusiveMinimum: 0 lastUpdated: type: string createdAt: type: string addedToFeedAt: type: string canonicalKey: type: string duplicateOf: type: string tenantOverrides: {} required: - id - source - event - summary - tldr - attackPath - classification - affectedProducts - iocs - provenance - version description: >- Backwards-compatible intel item for read/API responses (tolerates legacy stored shapes). '400': description: Bad request — input validation failed or the request was malformed content: application/json: schema: $ref: '#/components/schemas/ValidationError' '401': description: Unauthorized — missing or invalid API key / session content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Forbidden — the authenticated user lacks the required permissions content: application/json: schema: $ref: '#/components/schemas/PermissionError' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/Error' x-codeSamples: - lang: shell label: cURL source: |- curl -X GET "https://app.cotool.ai/api/intel/items/:id" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" components: schemas: ValidationError: type: object properties: error: type: string description: Error message describing what went wrong issues: type: array description: >- Detailed validation issues, present when request or response schema validation fails items: type: object additionalProperties: true required: - error Error: type: object properties: error: type: string description: Error message describing what went wrong required: - error PermissionError: type: object properties: error: type: string description: Error message describing what went wrong missingPerms: type: array description: Permissions the authenticated user is missing for this operation items: type: string required: - error securitySchemes: ApiKeyAuth: type: http scheme: bearer bearerFormat: API Key description: >- API Key authentication for programmatic access. Include your API key in the Authorization header as: `Bearer your_api_key_here` ````