CTIX
Network live
CTIXPOST

Import Intel

Source docs
POSThttps://cs-testv2.cyware.com/ctixapi/conversion/import/{format}/

Imports threat data to Intel Exchange.

The formats supported for import are as follows:

TEXT
MISP
misp
.json
misp


Open IOC
openioc
.xml
openioc


STIX 1.x
stix1
.xml
.xml


STIX 2.1
stix2
.json
Stix2


STIX 2.0
stix20
.json
Stix2


STIX 1.x URL
stix1url
URL
url


CSV (Recorded Future)
csv-recorded-future
.csv
csv


CSV (Cyware)
cy-csv
.csv
csv

Optionally, you can specify a collection to which the file is imported. If no collection is specified, the data is imported to the default collection. To retrieve import collections, use the Get Source Collections endpoint.

NOTE For STIX 1.x URL, the body must include the URL value. For more information, see the example request.

Path Parameters

NameTypeRequiredDescription
formatstringoptional

Pass the format for the import. Refer to preceding table for more information.

Query Parameters

NameTypeRequiredDescription
versionstringoptional

If the format (path variable) value is stix1 or stix2, enter the STIX version.

Body Parameters

NameTypeRequiredDescription
filefileoptional

Select the file to be imported.

collection_idtextoptional

Enter the ID of the collection to which the file is imported. To retrieve the collection_id, use the Get Source Collections endpoint. Data is imported to both the default collection as well as this specified collection.

Run it

Use the Request parameters panel to enter path IDs, query values, JSON body, and credentials. Then run any snippet below — all languages use the same values. Base URL: https://cs-testv2.cyware.com/ctixapi (change in API Settings).

Playground

Request parameters

Edit values here before running any snippet below (cURL, JavaScript, or Python). Code blocks are reference only — your inputs above are what gets sent.

CTIXConnect to Intel ExchangeRequired to change data
Credentials required for POST

Open API (HMAC signature) · Get credentials from Cyware Admin → Open API → Generate Credentials.

Signature and Expires are generated when you run a request. Access ID and Secret Key stay in memory for this tab only.

Credentials from Authentication auto-fill here for this product. If fields are empty after connecting, refresh this page or open the product docs again.

Path Parameters
Query Parameters
Form data (multipart upload)
cURL
curl --request POST \
  --url "https://cs-testv2.cyware.com/ctixapi/conversion/import/stix2/?version=2.1&AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E" \
  --form 'file=@/path/to/your/file' \
  --form 'collection_id=603dd2cf-2c3e-4a6b-8200-505d3586df1f'

View-only example — running live API calls requires a role with snippet testing access.

JavaScript
const url = "https://cs-testv2.cyware.com/ctixapi/conversion/import/stix2/?version=2.1&AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E";
const formData = new FormData();
formData.append("file", fileInput.files[0]); // select <input type="file" id="fileInput">
formData.append("collection_id", "603dd2cf-2c3e-4a6b-8200-505d3586df1f");
const response = await fetch(url, {
  method: "POST",
  body: formData,
});
const text = await response.text();
console.log(response.status, text);

View-only example — running live API calls requires a role with snippet testing access.

Python
import requests

url = "https://cs-testv2.cyware.com/ctixapi/conversion/import/stix2/"
params = {
    "version": "2.1",
    "AccessID": "<your access id>",
    "Signature": "<your signature>",
    "Expires": "<your expires>"
}
headers = {}
files = {}
data = {}
files["file"] = open("/path/to/your/file", "rb")
data["collection_id"] = "603dd2cf-2c3e-4a6b-8200-505d3586df1f"
response = requests.request("POST", url, params=params, headers=headers, files=files, data=data)
print(response.status_code)
print(response.text)

View-only example — running live API calls requires a role with snippet testing access.

Form Fields
file: (file upload)
collection_id: 603dd2cf-2c3e-4a6b-8200-505d3586df1f
Example Response
{
  "details": "You will be notified once file got uploaded."
}

View-only example — running live API calls requires a role with snippet testing access.