Updates sighting SDO in the initiated detailed submission.
Path Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| intel-id | string | optional | Pass the unique ID of the intel submission. |
| sighting-id | string | optional | Pass the Sighting ID. |
Body Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| created_by_ref | object | optional | Pass the object ID and name of the Identity SDO being referred. |
| revoked | boolean | optional | Pass true to specify if the SDO is revoked. Else pass false. |
| labels | array | optional | Pass the list of IDs and names of the labels attached to the SDO. |
| custom_properties | array | optional | Pass the list of unique identifiers for the custom property, type, name, and the value to add. |
| external_references | object | optional | Pass the list of STIX standard formats to send the external references. |
| tlp | object | optional | Pass the list that contains the UI label and the value of TLP. |
| name | string | required | Pass the name of the SDO. |
| description | string | optional | Pass the description of the SDO. |
| first_seen | number | optional | Pass the date and time the SDO first appeared. |
| last_seen | number | optional | Pass the date and time the SDO first appeared. |
| count | number | optional | Pass the number of times the SDO was referenced. |
| sighting_of_ref | object | optional | Pass the list that contains references to the SDO that was sighted with values such as the |
| observed_data_refs | array | optional | Pass of observed-data object references. |
| where_sighted_refs | array | optional | Pass the list that contains references to the identity or location objects. |
| summary | boolean | optional | Pass true if the sighting should be considered summary data, else pass false. |
Run it
Use the Request parameters panel to enter path IDs, query values, JSON body, and credentials. Then run any snippet below — all languages use the same values. Base URL: https://cs-testv2.cyware.com/ctixapi (change in API Settings).
Playground
Request parameters
Edit values here before running any snippet below (cURL, JavaScript, or Python). Code blocks are reference only — your inputs above are what gets sent.
Open API (HMAC signature) · Get credentials from Cyware Admin → Open API → Generate Credentials.
Signature and Expires are generated when you run a request. Access ID and Secret Key stay in memory for this tab only.
Credentials from Authentication auto-fill here for this product. If fields are empty after connecting, refresh this page or open the product docs again.
curl --request PUT \
--url "https://cs-testv2.cyware.com/ctixapi/ingestion/shareable-intel/{intel-id}/sighting/{sighting-id}/?AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E" \
--data '{
"created_by_ref": {},
"revoked": false,
"labels": [
{}
],
"custom_properties": [
{}
],
"external_references": {},
"tlp": {},
"name": "sight 1",
"description": "sight desc",
"first_seen": 1630434600,
"last_seen": 1631039400,
"count": 23,
"sighting_of_ref": {},
"observed_data_refs": [
{}
],
"where_sighted_refs": [
{}
],
"summary": true
}'View-only example — running live API calls requires a role with snippet testing access.
const url = "https://cs-testv2.cyware.com/ctixapi/ingestion/shareable-intel/{intel-id}/sighting/{sighting-id}/?AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E";
const response = await fetch(url, {
method: "PUT",
headers: {},
body: JSON.stringify({
"created_by_ref": {},
"revoked": false,
"labels": [
{}
],
"custom_properties": [
{}
],
"external_references": {},
"tlp": {},
"name": "sight 1",
"description": "sight desc",
"first_seen": 1630434600,
"last_seen": 1631039400,
"count": 23,
"sighting_of_ref": {},
"observed_data_refs": [
{}
],
"where_sighted_refs": [
{}
],
"summary": true
}),
});
const text = await response.text();
let data;
try { data = JSON.parse(text); } catch { data = text; }
console.log(response.status, data);View-only example — running live API calls requires a role with snippet testing access.
import requests
url = "https://cs-testv2.cyware.com/ctixapi/ingestion/shareable-intel/{intel-id}/sighting/{sighting-id}/"
params = {
"AccessID": "<your access id>",
"Signature": "<your signature>",
"Expires": "<your expires>"
}
headers = {}
payload = {
"created_by_ref": {},
"revoked": false,
"labels": [
{}
],
"custom_properties": [
{}
],
"external_references": {},
"tlp": {},
"name": "sight 1",
"description": "sight desc",
"first_seen": 1630434600,
"last_seen": 1631039400,
"count": 23,
"sighting_of_ref": {},
"observed_data_refs": [
{}
],
"where_sighted_refs": [
{}
],
"summary": true
}
response = requests.request("PUT", url, params=params, headers=headers, json=payload)
print(response.status_code)
print(response.text)View-only example — running live API calls requires a role with snippet testing access.
{
"created_by_ref": {},
"revoked": false,
"labels": [
{}
],
"custom_properties": [
{}
],
"external_references": {},
"tlp": {},
"name": "sight 1",
"description": "sight desc",
"first_seen": 1630434600,
"last_seen": 1631039400,
"count": 23,
"sighting_of_ref": {},
"observed_data_refs": [
{}
],
"where_sighted_refs": [
{}
],
"summary": true
}View-only example — running live API calls requires a role with snippet testing access.
{
"id": "sighting--cb1a0203-e9ea-4616-9367-eabd0b61a7d7",
"created_by_ref": {},
"tlp": {},
"revoked": false,
"labels": [
{}
],
"external_references": {},
"custom_properties": [
{}
],
"name": "sight 1",
"description": "sight desc",
"first_seen": 1630434600,
"last_seen": 1631039400,
"count": 23,
"sighting_of_ref": {},
"observed_data_refs": [
{}
],
"where_sighted_refs": [
{}
],
"summary": true
}View-only example — running live API calls requires a role with snippet testing access.