{"openapi":"3.1.0","info":{"title":"Mirage public API","summary":"Live honeypot threat intelligence from the OffSeq sensor fleet.","description":"Read-only access to Mirage, OffSeq's real-time honeypot threat intelligence. Every endpoint here works anonymously.\n\n## Access tiers\n- **Anonymous / free**: redacted output (attacker IPs masked to /16, honeypot identity never shown), look-back windows capped at 7 days.\n- **Premium**: full attacker IPs, unlocked cluster and campaign drill-downs, AI analysis and 365-day windows. Signed-in requests carry the `mirage_session` session cookie set at sign-in on mirage.offseq.com; premium is granted on request (sales@offseq.com).\n\n## Rate limits\nFixed one-minute windows per bucket, keyed by account or, for anonymous callers, client IP (an IPv6 /64). Responses carry `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset`; a 429 carries `Retry-After`.\n\n| Bucket | Anonymous | Free | Premium |\n|---|---|---|---|\n| `intel` | 120 | 120 | 600 |\n| `exposure` | 60 | 120 | 600 |\n| `phish` | 60 | 120 | 600 |\n| `analytics` | 30 | 120 | 600 |\n| `radar` | 30 | 120 | 600 |\n| `ioc` | 30 | 120 | 600 |\n| `ref` | 30 | 120 | 600 |\n| `feeds` | 600 | 600 | 600 |\n\n## Bulk data\nDaily snapshots of the community feed are published at [https://github.com/offseq/mirage-feed](https://github.com/offseq/mirage-feed). Data is CC BY 4.0: attribute OffSeq Cybersecurity.","contact":{"name":"OffSeq Cybersecurity","url":"https://offseq.com/contact","email":"sales@offseq.com"},"license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"version":"1.0.0"},"servers":[{"url":"https://mirage.offseq.com"}],"paths":{"/api/health":{"get":{"summary":"Readiness and freshness","tags":["Status"],"description":"`ok` is false (HTTP 503) when a hard dependency is down; `degraded` flags a stalled pipeline, `data_age_s` is the age of the newest event.","operationId":"readiness_and_freshness","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"ok":true,"degraded":false,"stale":[],"ts":1792958413,"lake_configured":true,"data_age_s":7.8,"feed":{"day":"2026-10-24","age_s":5098.9}}}}}}}},"/api/intel/summary":{"get":{"summary":"Global attack summary","tags":["Attacks"],"description":"Event, attacker and KEV totals plus the severity split for the window.","operationId":"global_attack_summary","parameters":[{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":1},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"intel","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"window_days":1,"totals":{"events":976268,"distinct_ips":7881,"kev_hits":182,"countries":104,"honeytokens":949,"kev_cves":7},"loot":{"honeytoken_triggers":949,"credential_reuse":4,"beacons":15,"oob_callbacks":0},"severity_breakdown":[{"severity":"medium","hits":529995},{"severity":"critical","hits":1159}]}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/intel/recent":{"get":{"summary":"Recent attack events","tags":["Attacks"],"description":"The redacted event stream, newest first. Attacker IPs are masked to /16 (`src_ip_masked`); premium callers also receive `src_ip`. Page with `before`.","operationId":"recent_attack_events","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","maximum":200,"minimum":1,"default":50},"description":"Maximum rows returned."},{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":1},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."},{"name":"before","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}]},"description":"Opaque `ts:event_id` cursor: pass `next_cursor` from the previous page."},{"name":"country","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}]},"description":"ISO 3166-1 alpha-2 source country, e.g. `CN`."},{"name":"asn","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}]},"description":"ASN number or organisation substring."},{"name":"service","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}]},"description":"Targeted service substring, e.g. `ssh`."},{"name":"tool","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}]},"description":"Attacker tool substring, e.g. `masscan`."},{"name":"mitre","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}]},"description":"ATT&CK technique id, e.g. `T1110`."},{"name":"cve","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}]},"description":"CVE id, exact or prefix."},{"name":"user_agent","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}]},"description":"User-agent / scanner substring."},{"name":"severities","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}]},"description":"Comma-separated severities: info, low, medium, high, critical."},{"name":"kev_only","in":"query","required":false,"schema":{"type":"boolean","default":false},"description":"Only events exploiting a CISA KEV CVE."},{"name":"honey_only","in":"query","required":false,"schema":{"type":"boolean","default":false},"description":"Only events that touched a honeytoken."},{"name":"bucket_start","in":"query","required":false,"schema":{"anyOf":[{"type":"number"},{"type":"null"}]},"description":"Window floor, unix seconds."},{"name":"bucket_end","in":"query","required":false,"schema":{"anyOf":[{"type":"number"},{"type":"null"}]},"description":"Window ceiling, unix seconds."}],"x-rate-limit-bucket":"intel","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"results":[{"event_id":"d-93da4828edc4bdb338c0bfbabdd63b97","session_id":"1be73b3175144ab980c84ba9f134637c","ts":1792958406.16,"event_type":"sslvpn_login_attempt","severity":"medium","severity_rank":2,"product":"Citrix NetScaler Gateway","service":"https","kev":false,"mitre":["T1110"],"mitre_primary":"T1110","mitre_primary_name":"Brute Force","tags":["citrix","netscaler","sslvpn"],"src_ip_masked":"203.0.113.x","country":"CH","asn":64500,"as_org":"HOSTING","as_name":"EXAMPLE HOSTING S.R.L.","method":"POST","path":"/cgi/login","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","request_sha256":"d0fc93745b2601f929bd4a18d7763e597996c3722146de68ec90a1eedaa24955","ja4":"t13i190900_9dc949149365_e7c285222651","tool":"browser","automated":false,"iocs":[{"type":"cred_access","value":"admin:admin123","technique":"T1110"}],"honeytoken":false,"lat":46.8,"lon":8.2}],"next_cursor":"1792958406.16:d-93da4828edc4bdb338c0bfbabdd63b97"}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/intel/map":{"get":{"summary":"Attack origin points","tags":["Attacks"],"description":"Recent attacks as source coordinates (country centroids) for plotting.","operationId":"attack_origin_points","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","maximum":1000,"minimum":1,"default":300},"description":"Maximum rows returned."},{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":1},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"intel","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"results":[{"lat":46.8,"lon":8.2,"severity":"medium","country":"CH","cve_id":null,"kev":false,"ts":1792958406.16}]}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/intel/timeline":{"get":{"summary":"Attack volume over time","tags":["Attacks"],"description":"Hits, distinct attackers and KEV hits per bucket: hourly up to 2 days, daily beyond.","operationId":"attack_volume_over_time","parameters":[{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":7},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"intel","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"granularity":"hour","results":[{"bucket":1792785600.0,"hits":47860,"distinct_ips":3098,"kev_hits":39}]}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/intel/top/{dimension}":{"get":{"summary":"Top values for a dimension","tags":["Attacks"],"description":"Ranked counts for one dimension. `cves` rows carry the OWASP Top 10 category; `techniques` rows carry the ATT&CK name.","operationId":"top_values_for_a_dimension","parameters":[{"name":"dimension","in":"path","required":true,"schema":{"type":"string","enum":["cves","countries","asns","techniques","products","services","tools","user_agents","paths"]},"description":"Dimension to rank."},{"name":"limit","in":"query","required":false,"schema":{"type":"integer","maximum":100,"minimum":1,"default":15},"description":"Maximum rows returned."},{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":7},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"intel","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"dimension":"countries","results":[{"key":"US","hits":184960},{"key":"SG","hits":107715}]}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/intel/iocs":{"get":{"summary":"Recent indicators","tags":["Attacks"],"description":"Indicators extracted from recent attacks (credentials tried, download URLs, hashes), newest first.","operationId":"recent_indicators","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","maximum":200,"minimum":1,"default":50},"description":"Maximum rows returned."},{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":7},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."},{"name":"before","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}]},"description":"Opaque `ts:event_id` cursor: pass `next_cursor` from the previous page."}],"x-rate-limit-bucket":"intel","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"results":[{"ts":1792958416.3,"src_ip_masked":"198.51.x.x","country":"HK","severity":"medium","iocs":[{"type":"cred_access","value":"camera:P@ssw0rd123","technique":"T1110"}]}],"next_cursor":"1792958416.3:d-db11987bf2021c6429927c6187fa1678"}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/intel/cve/{cve_id}":{"get":{"summary":"Honeypot context for a CVE","tags":["Attacks"],"description":"What the sensor fleet captured for one CVE: hits, attackers, sessions, top countries, networks, techniques, products and request paths.","operationId":"honeypot_context_for_a_cve","parameters":[{"name":"cve_id","in":"path","required":true,"schema":{"type":"string"},"description":"CVE id, e.g. `CVE-2024-4577`."},{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":90},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"intel","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"cve_id":"CVE-2024-4577","window_days":7,"captured":{"hits":387,"distinct_ips":41,"sessions":120,"kev":true,"first_seen":1792281721.86,"last_seen":1792957636.41},"countries":[{"key":"US","hits":210}],"asns":[{"key":"AS64500","hits":150}],"mitre":[{"key":"T1190","hits":387}],"products":[],"top_paths":[{"key":"/php-cgi/php-cgi.exe","hits":300}],"nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4577"}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/intel/entity/{kind}/{value}":{"get":{"summary":"Profile of a network, country or /16","tags":["Attacks"],"description":"Aggregate profile for one ASN, source country or attacker /16: volume, timeline, CVEs, techniques, services and sample /16 networks. Never a raw IP.","operationId":"profile_of_a_network_country_or_16","parameters":[{"name":"kind","in":"path","required":true,"schema":{"type":"string","enum":["asn","country","net"]},"description":"Entity kind."},{"name":"value","in":"path","required":true,"schema":{"type":"string"},"description":"`AS14061` / `14061`, an ISO-2 country code, or a /16 such as `203.0.x.x`."},{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":90},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"intel","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"kind":"asn","value":"AS64500","window_days":7,"source":"daily","captured":{"hits":307355,"distinct_ips":1406,"kev_hits":391,"first_seen":1792281721.86,"last_seen":1792957636.41},"timeline":[{"bucket":1792368000,"hits":16684}],"sample_nets":["203.0.x.x","198.51.x.x"],"cves":[{"key":"CVE-2024-4577","hits":387}],"mitre":[{"key":"T1110","hits":212337}],"services":[{"key":"vnc","hits":175704}],"countries":[{"key":"US","hits":184960}],"org":"Example Hosting LLC"}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/intel/session/{session_id}":{"get":{"summary":"One attacker session","tags":["Attacks"],"description":"Redacted events of one session. Anonymous callers get the first 5 events and no verdict; signed-in callers get the full session and its AI verdict.","operationId":"one_attacker_session","parameters":[{"name":"session_id","in":"path","required":true,"schema":{"type":"string"},"description":"Session id from an event's `session_id`."}],"x-rate-limit-bucket":"intel","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"session_id":"1be73b3175144ab980c84ba9f134637c","events":[{"event_id":"d-93da4828edc4bdb338c0bfbabdd63b97","session_id":"1be73b3175144ab980c84ba9f134637c","ts":1792958406.16,"event_type":"sslvpn_login_attempt","severity":"medium","severity_rank":2,"product":"Citrix NetScaler Gateway","service":"https","kev":false,"mitre":["T1110"],"mitre_primary":"T1110","mitre_primary_name":"Brute Force","tags":["citrix","netscaler","sslvpn"],"src_ip_masked":"203.0.113.x","country":"CH","asn":64500,"as_org":"HOSTING","as_name":"EXAMPLE HOSTING S.R.L.","method":"POST","path":"/cgi/login","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","request_sha256":"d0fc93745b2601f929bd4a18d7763e597996c3722146de68ec90a1eedaa24955","ja4":"t13i190900_9dc949149365_e7c285222651","tool":"browser","automated":false,"iocs":[{"type":"cred_access","value":"admin:admin123","technique":"T1110"}],"honeytoken":false,"lat":46.8,"lon":8.2}],"verdict":null,"total_events":12,"truncated":true}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/ioc":{"get":{"summary":"Look up an indicator","tags":["Attacks"],"description":"Classify a pasted hash, URL, domain, IP, CVE, JA4 or IOC value and report what the fleet captured of it: hits, attackers, matched indicators, CVEs, techniques, services and networks. IPs in values are masked to /16 unless the caller is premium; an IP the free public lists carry comes back in full with `published`, and a masked address (`203.0.x.x`) counts its /16. `found: false` when unseen.","operationId":"look_up_an_indicator","parameters":[{"name":"q","in":"query","required":true,"schema":{"type":"string","minLength":3,"maxLength":512},"description":"The indicator, 3-512 characters, e.g. `CVE-2024-4577` or `203.0.113.7`."},{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":30},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"ioc","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"kind":"url","window_days":30,"found":true,"query":"http://203.0.x.x/bins/x86","hits":412,"capped":false,"first_seen":1792281721.86,"last_seen":1792957636.41,"distinct_ips":37,"matches":[{"type":"download_url","value":"http://203.0.x.x/bins/x86","technique":"T1105","hits":412}],"cves":[{"key":"CVE-2023-1389","hits":120,"kev":true}],"techniques":[{"key":"T1105","hits":412,"name":"Ingress Tool Transfer"}],"services":[{"key":"http","hits":412}],"countries":[{"key":"NL","hits":200}],"asns":[{"asn":64500,"key":"EXAMPLE HOSTING","name":"Example Hosting B.V.","category":"hosting","hits":300}],"sample_nets":["198.51.x.x"]}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/phish/summary":{"get":{"summary":"Phishing summary","tags":["Phishing"],"description":"Scans, domains, URLs, brands and samples, with severity and attack-type splits.","operationId":"phishing_summary","parameters":[{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":7},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"phish","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"window_days":7,"totals":{"scans":2,"distinct_ips":1,"distinct_domains":4,"distinct_urls":3,"brands":1,"samples":1},"severity_breakdown":[{"severity":"critical","hits":2}],"attack_types":[{"key":"phishing","hits":2}],"gating":{"tier":"anon","authed":false,"premium":false}}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/phish/brands":{"get":{"summary":"Impersonated brands","tags":["Phishing"],"description":"Brands ranked by phishing lures.","operationId":"impersonated_brands","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","maximum":100,"minimum":1,"default":20},"description":"Maximum rows returned."},{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":30},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"phish","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"results":[{"key":"Google","hits":1,"distinct_ips":1}]}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/phish/timeline":{"get":{"summary":"Phishing volume over time","tags":["Phishing"],"description":"Lures per bucket.","operationId":"phishing_volume_over_time","parameters":[{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":7},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"phish","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"granularity":"hour","results":[{"bucket":1792785600.0,"hits":2}],"gating":{"tier":"anon","authed":false,"premium":false}}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/phish/map":{"get":{"summary":"Phishing origin points","tags":["Phishing"],"description":"Phishing sources as country-centroid coordinates.","operationId":"phishing_origin_points","parameters":[{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":30},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"phish","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"window_days":30,"results":[{"country":"US","lat":37.1,"lon":-95.7,"hits":2,"senders":1}]}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/exposure/summary":{"get":{"summary":"Exposure summary","tags":["Exposure"],"description":"Findings, exposed hosts, services, CVEs and KEV hits, with the top exposed services.","operationId":"exposure_summary","parameters":[{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":7},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"exposure","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"window_days":7,"totals":{"findings":5447,"exposed_hosts":2702,"services":38,"cves":160,"kev_hits":100,"gov_hosts":9,"countries":27},"severity_breakdown":[{"severity":"critical","hits":305}],"top_services":[{"service":"http","hits":3635,"hosts":1911,"max_severity_rank":4,"kev":true}],"gating":{"tier":"anon","authed":false,"premium":false}}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/exposure/services":{"get":{"summary":"Exposed services","tags":["Exposure"],"description":"Services ranked by exposed hosts.","operationId":"exposed_services","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","maximum":100,"minimum":1,"default":20},"description":"Maximum rows returned."},{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":30},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"exposure","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"results":[{"key":"http","hits":3635,"hosts":1911,"max_severity_rank":4,"kev":true}]}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/exposure/cves":{"get":{"summary":"Exposed CVEs","tags":["Exposure"],"description":"CVEs found on exposed hosts, with CVSS, EPSS, KEV and the affected services.","operationId":"exposed_cves","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","maximum":100,"minimum":1,"default":20},"description":"Maximum rows returned."},{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":30},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"exposure","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"window_days":7,"results":[{"cve":"CVE-2019-11043","exposed_hosts":12,"cvss":9.8,"cvss_source":"nvd","epss":0.99748,"max_severity_rank":4,"kev":true,"services":["nginx"]}]}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/exposure/service":{"get":{"summary":"One exposed service","tags":["Exposure"],"description":"Hosts, severity split, CVEs and countries for one service.","operationId":"one_exposed_service","parameters":[{"name":"name","in":"query","required":true,"schema":{"type":"string","minLength":1,"maxLength":120},"description":"Service name, e.g. `grafana`."},{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":30},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"exposure","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"service":"grafana","hosts":62,"hits":98,"kev":false,"window_days":7,"severity_breakdown":[{"severity":"high","hits":20}],"cves":[],"countries":[{"key":"DE","hits":14}],"gating":{"tier":"anon","authed":false,"premium":false}}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/exposure/timeline":{"get":{"summary":"Exposure findings over time","tags":["Exposure"],"description":"Findings, distinct hosts and KEV hits per bucket.","operationId":"exposure_findings_over_time","parameters":[{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":7},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"exposure","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"granularity":"hour","results":[{"bucket":1792785600.0,"hits":7,"distinct_ips":5,"distinct_hosts":5,"kev_hits":2}]}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/intel/clusters":{"get":{"summary":"Attacker clusters","tags":["Actors"],"description":"Behavioural actor clusters (shared tool, technique and network). Premium unlocks `sample_ips`, `cves` and `ai_summary`; other callers see `locked: true`.","operationId":"attacker_clusters","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","maximum":100,"minimum":1,"default":50},"description":"Maximum rows returned."}],"x-rate-limit-bucket":"analytics","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"results":[{"cluster_id":"2998bbbd6ea1","signature":{"tool":"unknown","mitre":"T1110","asorg":"Example Hosting GmbH","asn":64500,"mitre_name":"Brute Force"},"events":6549666,"sessions":6548573,"distinct_ips":100,"countries":["DE","GB","US"],"max_severity":"high","first_seen":1791745548.09,"last_seen":1792958142.43,"name":"Hosted Brute-Force Harvester","locked":true}],"gating":{"tier":"anon","authed":false,"locked":true}}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/intel/campaigns":{"get":{"summary":"Attack campaigns","tags":["Actors"],"description":"Campaigns: one indicator seen across many sensors and attackers. Premium unlocks the shared indicator (`key`) and `sample_ips`.","operationId":"attack_campaigns","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","maximum":100,"minimum":1,"default":50},"description":"Maximum rows returned."}],"x-rate-limit-bucket":"analytics","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"results":[{"campaign_id":"4de4a8c7d41c","ioc_type":"download_url","sensor_count":5,"distinct_ips":32,"countries":["BR","CN","DE"],"events":205,"first_seen":1792736517.91,"last_seen":1792948792.62,"locked":true}],"gating":{"tier":"anon","authed":false,"locked":true}}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/intel/graph":{"get":{"summary":"Infrastructure graph","tags":["Actors"],"description":"Nodes (masked attacker /16s, tools, indicators) and weighted edges linking them.","operationId":"infrastructure_graph","parameters":[{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":7},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"analytics","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"nodes":[{"id":"ip:203.0.x.x","label":"203.0.x.x","type":"actor","weight":44,"severity":"medium"},{"id":"tool:browser","label":"browser","type":"tool","weight":155}],"edges":[{"source":"ip:203.0.x.x","target":"tool:browser"}],"window_days":7}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/intel/navigator":{"get":{"summary":"ATT&CK Navigator layer","tags":["Actors"],"description":"Observed techniques as a MITRE ATT&CK Navigator layer, scored by hit count. Load it straight into the Navigator.","operationId":"att_ck_navigator_layer","parameters":[{"name":"days","in":"query","required":false,"schema":{"type":"integer","maximum":365,"minimum":1,"default":30},"description":"Look-back window in days. Clamped to the caller's tier: 7 for anonymous and free accounts, 365 for premium."}],"x-rate-limit-bucket":"analytics","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"name":"OffSeq Mirage – observed ATT&CK","versions":{"attack":"20","navigator":"5.2.0","layer":"4.5"},"domain":"enterprise-attack","description":"Honeypot-observed techniques, last 7d","techniques":[{"techniqueID":"T1110","score":6065184,"comment":"6065184 hits (OffSeq honeypots)"}]}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/radar/cve/{cve_id}":{"get":{"summary":"CVE enrichment","tags":["Enrichment"],"description":"OffSeq Radar record (title, CVSS, EPSS, KEV, vendor, references) plus the reference record (KEV entry, EPSS, CVSS, ATT&CK mapping, CWEs). Premium adds the AI analysis.","operationId":"cve_enrichment","parameters":[{"name":"cve_id","in":"path","required":true,"schema":{"type":"string"},"description":"CVE id, e.g. `CVE-2021-44228`."}],"x-rate-limit-bucket":"radar","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"cve":{"cve_id":"CVE-2021-44228","title":"Apache Log4j2 Remote Code Execution Vulnerability","cvss":10.0,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","severity":"critical","cwes":["CWE-20","CWE-400","CWE-502"],"vendor":"Apache","product":"Log4j2","published":"2021-12-10T00:00:00.000Z","known_exploited":true,"epss":0.99999,"cvss_source":"nvd","references":[{"title":null,"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","type":"advisory"}]},"premium":false,"ref":{"cve_id":"CVE-2021-44228","kev":{"added":"2021-12-10","ransomware":true},"epss":{"score":0.99999,"percentile":1.0},"cvss":{"score":10.0,"version":"3.1"}}}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/ref/sources":{"get":{"tags":["Reference"],"summary":"Reference datasets and versions","description":"Every reference dataset with its licence and attribution notice, and the loaded versions.","operationId":"reference_datasets_and_versions","x-rate-limit-bucket":"ref","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"sources":[{"id":"attack","title":"MITRE ATT&CK® (Enterprise, ICS, Mobile)","homepage":"https://attack.mitre.org/","licence":"MITRE ATT&CK Terms of Use"}],"versions":{"attack":{"version":"20.0","built":"2026-10-24T17:51:07Z"}}}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/ref/technique/{tid}":{"get":{"tags":["Reference"],"summary":"ATT&CK technique","description":"Technique with tactics, mitigations, detections, groups, D3FEND and NIST 800-53 mappings.","operationId":"att_ck_technique","parameters":[{"name":"tid","in":"path","required":true,"schema":{"type":"string"},"description":"Technique id, e.g. `T1110` or `T1110.001`."}],"x-rate-limit-bucket":"ref","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"id":"T1110","name":"Brute Force","domain":"enterprise","url":"https://attack.mitre.org/techniques/T1110/","is_subtechnique":false,"tactics":[{"id":"TA0006","shortname":"credential-access","name":"Credential Access"}],"mitigations":[{"id":"M1032","name":"Multi-factor Authentication"}]}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/ref/attack/matrix":{"get":{"tags":["Reference"],"summary":"ATT&CK matrix","description":"Tactic columns with their technique ids, and an id→name map.","operationId":"att_ck_matrix","parameters":[{"name":"domain","in":"query","required":false,"schema":{"type":"string","pattern":"^(enterprise|ics|mobile)$","default":"enterprise"},"description":"ATT&CK domain."}],"x-rate-limit-bucket":"ref","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"domain":"enterprise","version":"20.0","tactics":[{"id":"TA0043","shortname":"reconnaissance","name":"Reconnaissance","techniques":["T1589"]}],"names":{"T1589":"Gather Victim Identity Information"}}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/ref/cwe/{cid}":{"get":{"tags":["Reference"],"summary":"CWE weakness","description":"Weakness with OWASP mapping, Top 25 rank, parent and related CAPEC patterns.","operationId":"cwe_weakness","parameters":[{"name":"cid","in":"path","required":true,"schema":{"type":"string"},"description":"CWE id, e.g. `CWE-79` or `79`."}],"x-rate-limit-bucket":"ref","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","short_name":"Cross-site Scripting","abstraction":"Base","top25":{"year":"2025","rank":1},"owasp":{"top10-2025":{"id":"A05","name":"Injection"}}}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/ref/capec/{cid}":{"get":{"tags":["Reference"],"summary":"CAPEC attack pattern","description":"Attack pattern with severity, related CWEs and ATT&CK techniques.","operationId":"capec_attack_pattern","parameters":[{"name":"cid","in":"path","required":true,"schema":{"type":"string"},"description":"CAPEC id, e.g. `CAPEC-66` or `66`."}],"x-rate-limit-bucket":"ref","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"id":"CAPEC-66","name":"SQL Injection","abstraction":"Standard","severity":"High","cwes":["CWE-89","CWE-1286"],"attack":[],"url":"https://capec.mitre.org/data/definitions/66.html"}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/ref/owasp":{"get":{"tags":["Reference"],"summary":"OWASP Top 10 lists","description":"OWASP Top 10 2021, 2025 and API Security 2023 categories with their CWE ids.","operationId":"owasp_top_10_lists","parameters":[{"name":"list","in":"query","required":false,"schema":{"anyOf":[{"type":"string"},{"type":"null"}]},"description":"One list only: `top10-2021`, `top10-2025` or `api-2023`."}],"x-rate-limit-bucket":"ref","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"top10-2025":[{"id":"A01","name":"Broken Access Control","cwes":[22,23,35],"url":"https://owasp.org/Top10/2025/A01_2025-Broken_Access_Control/"}]}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/ref/cve/{cve_id}":{"get":{"tags":["Reference"],"summary":"CVE reference record","description":"KEV entry, EPSS, CVSS, ATT&CK mapping and CWEs for a CVE.","operationId":"cve_reference_record","parameters":[{"name":"cve_id","in":"path","required":true,"schema":{"type":"string"},"description":"CVE id, e.g. `CVE-2021-44228`."}],"x-rate-limit-bucket":"ref","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"cve_id":"CVE-2021-44228","kev":{"added":"2021-12-10","due":"2021-12-24","ransomware":true,"vendor":"Apache","product":"Log4j2"},"epss":{"score":0.99999,"percentile":1.0},"cvss":{"score":10.0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"attack":{"class":"Code Execution","exploitation":[{"id":"T1190","name":"Exploit Public-Facing Application"}]}}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/ref/asn/{asn}":{"get":{"tags":["Reference"],"summary":"Autonomous system","description":"ASN handle, name, country and category.","operationId":"autonomous_system","parameters":[{"name":"asn","in":"path","required":true,"schema":{"type":"string"},"description":"ASN, e.g. `AS14061` or `14061`."}],"x-rate-limit-bucket":"ref","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"asn":14061,"handle":"DIGITALOCEAN-ASN","name":"DigitalOcean LLC","country":"US","category":"hosting"}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/ref/country/{cc}":{"get":{"tags":["Reference"],"summary":"Country","description":"ISO codes, region and flag.","operationId":"country","parameters":[{"name":"cc","in":"path","required":true,"schema":{"type":"string"},"description":"ISO 3166-1 alpha-2 code, e.g. `LV`."}],"x-rate-limit-bucket":"ref","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"code":"LV","name":"Latvia","alpha3":"LVA","numeric":"428","region":"Europe","subregion":"Northern Europe","flag":"🇱🇻"}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/ref/port/{port}":{"get":{"tags":["Reference"],"summary":"IANA port","description":"IANA service name for a port.","operationId":"iana_port","parameters":[{"name":"port","in":"path","required":true,"schema":{"type":"integer"},"description":"Port number, e.g. `22`."},{"name":"proto","in":"query","required":false,"schema":{"type":"string","pattern":"^(tcp|udp|sctp)$","default":"tcp"},"description":"Transport protocol."}],"x-rate-limit-bucket":"ref","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"service":"ssh","description":"The Secure Shell (SSH) Protocol"}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/api/ref/batch":{"post":{"tags":["Reference"],"summary":"Batch reference lookup","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Batch"},"example":{"techniques":["T1110"],"cves":["CVE-2021-44228"],"asns":["14061"],"ports":[22]}}},"required":true},"description":"Compact records for up to 200 ids per kind in one call, keyed by the requested id. Unknown ids are omitted. Read-only.","operationId":"batch_reference_lookup","x-rate-limit-bucket":"ref","responses":{"200":{"description":"OK","content":{"application/json":{"example":{"techniques":{"T1110":{"id":"T1110","name":"Brute Force"}},"cwes":{},"cves":{"CVE-2021-44228":{"cve_id":"CVE-2021-44228"}},"asns":{"14061":{"asn":14061,"name":"DigitalOcean LLC"}},"ports":{"22":{"service":"ssh"}}}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/feed/cves.json":{"get":{"summary":"CVE corpus (JSON)","tags":["Feeds"],"description":"Every CVE observed exploited or exposed, with status, counts, CVSS, EPSS and KEV.","operationId":"cve_corpus_json","x-rate-limit-bucket":"feeds","responses":{"200":{"description":"OK","content":{"application/json":{"example":[{"cve":"CVE-2024-4577","status":"exploited","honeypot_attacks":1752,"attacker_sources":110,"exposed_hosts":0,"cvss":9.8,"cvss_source":"nvd","epss":0.99987,"kev":true,"last_seen":"2026-10-24T21:02:00Z","url":"https://mirage.offseq.com/cve/CVE-2024-4577"}]}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/feed/cves.csv":{"get":{"summary":"CVE corpus (CSV)","tags":["Feeds"],"description":"The CVE corpus rows as CSV.","operationId":"cve_corpus_csv","x-rate-limit-bucket":"feeds","responses":{"200":{"description":"OK","content":{"text/csv":{"example":"cve,status,honeypot_attacks,attacker_sources,exposed_hosts,cvss,epss,kev,last_seen,url\nCVE-2024-4577,exploited,1752,110,0,9.8,0.99987,True,2026-10-24T21:02:00Z,https://mirage.offseq.com/cve/CVE-2024-4577\n"}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/feed/cves.stix":{"get":{"summary":"CVE corpus (STIX 2.1)","tags":["Feeds"],"description":"A STIX 2.1 bundle of vulnerability objects with `x_offseq_*` counts. No attacker IPs.","operationId":"cve_corpus_stix_2_1","x-rate-limit-bucket":"feeds","responses":{"200":{"description":"OK","content":{"application/stix+json":{"example":{"type":"bundle","id":"bundle--a19be3d5-fcca-548c-8ee8-d26d788cdb4d","objects":[{"type":"vulnerability","spec_version":"2.1","id":"vulnerability--4bd4d9d1-8e23-55fd-afd6-62e6058c0972","name":"CVE-2024-4577","x_offseq_status":"exploited","x_offseq_honeypot_attacks":1752}]}}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/feed/asns.json":{"get":{"summary":"Attacker networks (JSON)","tags":["Feeds"],"description":"Top attacker ASNs by observed volume.","operationId":"attacker_networks_json","x-rate-limit-bucket":"feeds","responses":{"200":{"description":"OK","content":{"application/json":{"example":[{"asn":64500,"org":"Example Hosting GmbH","attacks":2328127,"attacker_sources":151,"last_seen":"2026-10-25T19:44:15Z","url":"https://mirage.offseq.com/asn/AS64500"}]}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/feed/asns.csv":{"get":{"summary":"Attacker networks (CSV)","tags":["Feeds"],"description":"The attacker-network rows as CSV.","operationId":"attacker_networks_csv","x-rate-limit-bucket":"feeds","responses":{"200":{"description":"OK","content":{"text/csv":{"example":"asn,org,attacks,attacker_sources,last_seen,url\n64500,Example Hosting GmbH,2328127,151,2026-10-25T19:44:15Z,https://mirage.offseq.com/asn/AS64500\n"}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/feed/services.json":{"get":{"summary":"Services (JSON)","tags":["Feeds"],"description":"Per-service (protocol/port) attack volume.","operationId":"services_json","x-rate-limit-bucket":"feeds","responses":{"200":{"description":"OK","content":{"application/json":{"example":[{"service":"vnc","attacks":3866137,"attacker_sources":1381,"last_seen":"2026-10-25T19:44:15Z","url":"https://mirage.offseq.com/service/vnc"}]}},"headers":{"X-RateLimit-Limit":{"$ref":"#/components/headers/X-RateLimit-Limit"},"X-RateLimit-Remaining":{"$ref":"#/components/headers/X-RateLimit-Remaining"},"X-RateLimit-Reset":{"$ref":"#/components/headers/X-RateLimit-Reset"}}},"429":{"$ref":"#/components/responses/RateLimited"}}}}},"components":{"schemas":{"Batch":{"properties":{"techniques":{"items":{"type":"string","maxLength":32},"type":"array","maxItems":200,"title":"Techniques"},"cwes":{"items":{"type":"string","maxLength":32},"type":"array","maxItems":200,"title":"Cwes"},"cves":{"items":{"type":"string","maxLength":32},"type":"array","maxItems":200,"title":"Cves"},"asns":{"items":{"type":"string","maxLength":32},"type":"array","maxItems":200,"title":"Asns"},"ports":{"items":{"type":"integer"},"type":"array","maxItems":200,"title":"Ports"}},"type":"object","title":"Batch"}},"headers":{"X-RateLimit-Limit":{"description":"Requests allowed in the current minute for this bucket.","schema":{"type":"integer"}},"X-RateLimit-Remaining":{"description":"Requests left in the current minute.","schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Unix time the window resets.","schema":{"type":"integer"}}},"responses":{"RateLimited":{"description":"Rate limit exceeded for this bucket.","headers":{"Retry-After":{"description":"Seconds until the window resets.","schema":{"type":"integer"}}},"content":{"application/json":{"example":{"detail":"rate limit exceeded; slow down or upgrade for higher limits"}}}}},"securitySchemes":{"session":{"type":"apiKey","in":"cookie","name":"mirage_session","description":"Optional. Signed-in session; premium sessions unlock reveal-level detail."}}},"tags":[{"name":"Attacks","description":"Live honeypot attack telemetry: totals, the redacted event stream, top lists, per-CVE and per-network context."},{"name":"Actors","description":"Precomputed attacker clusters and campaigns, the infrastructure graph and the observed ATT&CK layer."},{"name":"Exposure","description":"Internet-exposure findings: exposed services and CVEs seen by internet-wide scanning."},{"name":"Phishing","description":"Phishing-plane aggregates: impersonated brands, volume over time."},{"name":"Enrichment","description":"CVE enrichment from OffSeq Radar plus KEV, EPSS and CVSS."},{"name":"Reference","description":"Static reference data (ATT&CK, CWE, CAPEC, OWASP, KEV, ASN, country, IANA ports). No honeypot data."},{"name":"Feeds","description":"Daily-aggregated, edge-cached feeds as JSON, CSV and STIX 2.1. Counts only, no attacker IPs."},{"name":"Status","description":"Service readiness and data freshness."}],"externalDocs":{"description":"Daily community feed on GitHub","url":"https://github.com/offseq/mirage-feed"},"security":[{},{"session":[]}]}