Creates an IOC parsing task to extract STIX objects from free text data or a web page.
NOTE Currently, this API endpoint does not support parsing IOCs from files such as PDF, CSV, XLS, and others.
Body Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| data | string | required | Pass the free text data within 50,000 characters or a web page URL to extract STIX objects. If the number of characters in the passed text data or the web page exceeds the character limit, then the initial 50,000 characters are parsed. |
| url | boolean | optional | Pass |
Run it
Use the Request parameters panel to enter path IDs, query values, JSON body, and credentials. Then run any snippet below — all languages use the same values. Base URL: https://cs-testv2.cyware.com/ctixapi (change in API Settings).
Playground
Request parameters
Edit values here before running any snippet below (cURL, JavaScript, or Python). Code blocks are reference only — your inputs above are what gets sent.
Open API (HMAC signature) · Get credentials from Cyware Admin → Open API → Generate Credentials.
Signature and Expires are generated when you run a request. Access ID and Secret Key stay in memory for this tab only.
Credentials from Authentication auto-fill here for this product. If fields are empty after connecting, refresh this page or open the product docs again.
curl --request POST \
--url "https://cs-testv2.cyware.com/ctixapi/conversion/quick-intel/free-text/?AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E" \
--data '{
"data": "1.2.3.11, 1.1.2.1, domain.com",
"url": true
}'View-only example — running live API calls requires a role with snippet testing access.
const url = "https://cs-testv2.cyware.com/ctixapi/conversion/quick-intel/free-text/?AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E";
const response = await fetch(url, {
method: "POST",
headers: {},
body: JSON.stringify({
"data": "1.2.3.11, 1.1.2.1, domain.com",
"url": true
}),
});
const text = await response.text();
let data;
try { data = JSON.parse(text); } catch { data = text; }
console.log(response.status, data);View-only example — running live API calls requires a role with snippet testing access.
import requests
url = "https://cs-testv2.cyware.com/ctixapi/conversion/quick-intel/free-text/"
params = {
"AccessID": "<your access id>",
"Signature": "<your signature>",
"Expires": "<your expires>"
}
headers = {}
payload = {
"data": "1.2.3.11, 1.1.2.1, domain.com",
"url": true
}
response = requests.request("POST", url, params=params, headers=headers, json=payload)
print(response.status_code)
print(response.text)View-only example — running live API calls requires a role with snippet testing access.
{
"data": "1.2.3.11, 1.1.2.1, domain.com",
"url": true
}View-only example — running live API calls requires a role with snippet testing access.
{
"task_id": "4310c8e6-c26e-4526-a3b2-7445c6798511"
}View-only example — running live API calls requires a role with snippet testing access.