POSThttps://cs-testv2.cyware.com/ctixapi/ingestion/saved-searches/
Creates a saved search in Intel Exchange.
Body Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| type | string | optional | Pass the type of the saved search as basic or CQL. |
| name | string | required | Pass a name for the saved search. |
| description | string | optional | Pass the description of the saved search. |
| query | string | required | Pass the CQL query of the saved search. |
| shared_type | string | optional | Pass the privacy parameter of the saved search. |
| meta_data | string | optional | Pass the metadata of the saved search that helps in the transformation to the CQL query or threat data filters. |
Run it
Use the Request parameters panel to enter path IDs, query values, JSON body, and credentials. Then run any snippet below — all languages use the same values. Base URL: https://cs-testv2.cyware.com/ctixapi (change in API Settings).
Playground
Request parameters
Edit values here before running any snippet below (cURL, JavaScript, or Python). Code blocks are reference only — your inputs above are what gets sent.
CTIXConnect to Intel ExchangeRequired to change data
Credentials required for POSTOpen API (HMAC signature) · Get credentials from Cyware Admin → Open API → Generate Credentials.
Signature and Expires are generated when you run a request. Access ID and Secret Key stay in memory for this tab only.
Credentials from Authentication auto-fill here for this product. If fields are empty after connecting, refresh this page or open the product docs again.
Request body (JSON)Valid JSON
cURL
curl --request POST \
--url "https://cs-testv2.cyware.com/ctixapi/ingestion/saved-searches/?AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E" \
--data '{
"type": "",
"name": "Indicators from Cyware Feeds",
"description": "Indicator search",
"query": "type IN (\\\"indicator\\\",\\\"malware\\\",\\\"threat-actor\\\",\\\"vulnerability\\\",\\\"attack-pattern\\\",\\\"campaign\\\",\\\"course-of-action\\\",\\\"identity\\\",\\\"infrastructure\\\",\\\"intrusion-set\\\",\\\"location\\\",\\\"malware-analysis\\\",\\\"observed-data\\\",\\\"opinion\\\",\\\"tool\\\",\\\"report\\\",\\\"custom-object\\\",\\\"observable\\\",\\\"incident\\\",\\\"note\\\",\\\"grouping\\\")",
"shared_type": "private",
"meta_data": "{\\\"object_type\\\":[\\\"indicator\\\",\\\"malware\\\",\\\"threat-actor\\\",\\\"vulnerability\\\",\\\"attack-pattern\\\",\\\"campaign\\\",\\\"course-of-action\\\",\\\"identity\\\",\\\"infrastructure\\\",\\\"intrusion-set\\\",\\\"location\\\",\\\"malware-analysis\\\",\\\"observed-data\\\",\\\"opinion\\\",\\\"tool\\\",\\\"report\\\",\\\"custom-object\\\",\\\"observable\\\",\\\"incident\\\",\\\"note\\\",\\\"grouping\\\"],\\\"query\\\":[{\\\"length\\\":32,\\\"dataKey\\\":{\\\"id\\\":\\\"type\\\",\\\"type\\\":\\\"select\\\",\\\"subProperty\\\":true,\\\"addAll\\\":true,\\\"reset\\\":true,\\\"multiple\\\":true,\\\"value\\\":\\\"id\\\",\\\"label\\\":\\\"Object Type\\\"},\\\"key\\\":\\\"'Object Type'\\\",\\\"keyType\\\":\\\"select\\\",\\\"dataOperator\\\":{\\\"id\\\":\\\"=\\\",\\\"label\\\":\\\"=\\\"},\\\"operator\\\":\\\"=\\\",\\\"dataValue\\\":{\\\"id\\\":\\\"indicator\\\",\\\"name\\\":\\\"Indicator\\\"},\\\"value\\\":\\\"\\\\\\\"Indicator\\\\\\\"\\\",\\\"condition\\\":\\\"AND\\\"},{\\\"length\\\":25,\\\"dataKey\\\":{\\\"id\\\":\\\"source\\\",\\\"type\\\":\\\"select\\\",\\\"subProperty\\\":true,\\\"multiple\\\":true,\\\"subheading\\\":{\\\"key\\\":\\\"source_type\\\",\\\"mapper\\\":{\\\"CUSTOM_STIX_SOURCES\\\":\\\"STIX\\\",\\\"API_FEEDS\\\":\\\"APIs\\\",\\\"EMAIL_ACCOUNTS\\\":\\\"Email\\\",\\\"RSS_FEED\\\":\\\"RSS\\\",\\\"TWITTER_FEEDS\\\":\\\"X (Twitter)\\\",\\\"WEB_SCRAPPER\\\":\\\"Web Scraper\\\",\\\"MALWARE_SANDBOX\\\":\\\"Sandbox\\\",\\\"MISCELLANEOUS\\\":\\\"Miscellaneous\\\"}},\\\"api_component\\\":\\\"sources\\\",\\\"filters\\\":{\\\"sort\\\":\\\"name\\\"},\\\"label\\\":\\\"Source\\\"},\\\"key\\\":\\\"'Source'\\\",\\\"keyType\\\":\\\"select\\\",\\\"dataOperator\\\":{\\\"id\\\":\\\"=\\\",\\\"label\\\":\\\"=\\\"},\\\"operator\\\":\\\"=\\\",\\\"dataValue\\\":{\\\"id\\\":\\\"44b6ace6-0e76-4cc2-af54-85d0bc9f7cc5\\\",\\\"name\\\":\\\"Cyware Labs\\\",\\\"source_type\\\":\\\"TWITTER_FEEDS\\\"},\\\"value\\\":\\\"\\\\\\\"Cyware Labs\\\\\\\"\\\"}]}"
}'View-only example — running live API calls requires a role with snippet testing access.
JavaScript
const url = "https://cs-testv2.cyware.com/ctixapi/ingestion/saved-searches/?AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E";
const response = await fetch(url, {
method: "POST",
headers: {},
body: JSON.stringify({
"type": "",
"name": "Indicators from Cyware Feeds",
"description": "Indicator search",
"query": "type IN (\\\"indicator\\\",\\\"malware\\\",\\\"threat-actor\\\",\\\"vulnerability\\\",\\\"attack-pattern\\\",\\\"campaign\\\",\\\"course-of-action\\\",\\\"identity\\\",\\\"infrastructure\\\",\\\"intrusion-set\\\",\\\"location\\\",\\\"malware-analysis\\\",\\\"observed-data\\\",\\\"opinion\\\",\\\"tool\\\",\\\"report\\\",\\\"custom-object\\\",\\\"observable\\\",\\\"incident\\\",\\\"note\\\",\\\"grouping\\\")",
"shared_type": "private",
"meta_data": "{\\\"object_type\\\":[\\\"indicator\\\",\\\"malware\\\",\\\"threat-actor\\\",\\\"vulnerability\\\",\\\"attack-pattern\\\",\\\"campaign\\\",\\\"course-of-action\\\",\\\"identity\\\",\\\"infrastructure\\\",\\\"intrusion-set\\\",\\\"location\\\",\\\"malware-analysis\\\",\\\"observed-data\\\",\\\"opinion\\\",\\\"tool\\\",\\\"report\\\",\\\"custom-object\\\",\\\"observable\\\",\\\"incident\\\",\\\"note\\\",\\\"grouping\\\"],\\\"query\\\":[{\\\"length\\\":32,\\\"dataKey\\\":{\\\"id\\\":\\\"type\\\",\\\"type\\\":\\\"select\\\",\\\"subProperty\\\":true,\\\"addAll\\\":true,\\\"reset\\\":true,\\\"multiple\\\":true,\\\"value\\\":\\\"id\\\",\\\"label\\\":\\\"Object Type\\\"},\\\"key\\\":\\\"'Object Type'\\\",\\\"keyType\\\":\\\"select\\\",\\\"dataOperator\\\":{\\\"id\\\":\\\"=\\\",\\\"label\\\":\\\"=\\\"},\\\"operator\\\":\\\"=\\\",\\\"dataValue\\\":{\\\"id\\\":\\\"indicator\\\",\\\"name\\\":\\\"Indicator\\\"},\\\"value\\\":\\\"\\\\\\\"Indicator\\\\\\\"\\\",\\\"condition\\\":\\\"AND\\\"},{\\\"length\\\":25,\\\"dataKey\\\":{\\\"id\\\":\\\"source\\\",\\\"type\\\":\\\"select\\\",\\\"subProperty\\\":true,\\\"multiple\\\":true,\\\"subheading\\\":{\\\"key\\\":\\\"source_type\\\",\\\"mapper\\\":{\\\"CUSTOM_STIX_SOURCES\\\":\\\"STIX\\\",\\\"API_FEEDS\\\":\\\"APIs\\\",\\\"EMAIL_ACCOUNTS\\\":\\\"Email\\\",\\\"RSS_FEED\\\":\\\"RSS\\\",\\\"TWITTER_FEEDS\\\":\\\"X (Twitter)\\\",\\\"WEB_SCRAPPER\\\":\\\"Web Scraper\\\",\\\"MALWARE_SANDBOX\\\":\\\"Sandbox\\\",\\\"MISCELLANEOUS\\\":\\\"Miscellaneous\\\"}},\\\"api_component\\\":\\\"sources\\\",\\\"filters\\\":{\\\"sort\\\":\\\"name\\\"},\\\"label\\\":\\\"Source\\\"},\\\"key\\\":\\\"'Source'\\\",\\\"keyType\\\":\\\"select\\\",\\\"dataOperator\\\":{\\\"id\\\":\\\"=\\\",\\\"label\\\":\\\"=\\\"},\\\"operator\\\":\\\"=\\\",\\\"dataValue\\\":{\\\"id\\\":\\\"44b6ace6-0e76-4cc2-af54-85d0bc9f7cc5\\\",\\\"name\\\":\\\"Cyware Labs\\\",\\\"source_type\\\":\\\"TWITTER_FEEDS\\\"},\\\"value\\\":\\\"\\\\\\\"Cyware Labs\\\\\\\"\\\"}]}"
}),
});
const text = await response.text();
let data;
try { data = JSON.parse(text); } catch { data = text; }
console.log(response.status, data);View-only example — running live API calls requires a role with snippet testing access.
Python
import requests
url = "https://cs-testv2.cyware.com/ctixapi/ingestion/saved-searches/"
params = {
"AccessID": "<your access id>",
"Signature": "<your signature>",
"Expires": "<your expires>"
}
headers = {}
payload = {
"type": "",
"name": "Indicators from Cyware Feeds",
"description": "Indicator search",
"query": "type IN (\\\"indicator\\\",\\\"malware\\\",\\\"threat-actor\\\",\\\"vulnerability\\\",\\\"attack-pattern\\\",\\\"campaign\\\",\\\"course-of-action\\\",\\\"identity\\\",\\\"infrastructure\\\",\\\"intrusion-set\\\",\\\"location\\\",\\\"malware-analysis\\\",\\\"observed-data\\\",\\\"opinion\\\",\\\"tool\\\",\\\"report\\\",\\\"custom-object\\\",\\\"observable\\\",\\\"incident\\\",\\\"note\\\",\\\"grouping\\\")",
"shared_type": "private",
"meta_data": "{\\\"object_type\\\":[\\\"indicator\\\",\\\"malware\\\",\\\"threat-actor\\\",\\\"vulnerability\\\",\\\"attack-pattern\\\",\\\"campaign\\\",\\\"course-of-action\\\",\\\"identity\\\",\\\"infrastructure\\\",\\\"intrusion-set\\\",\\\"location\\\",\\\"malware-analysis\\\",\\\"observed-data\\\",\\\"opinion\\\",\\\"tool\\\",\\\"report\\\",\\\"custom-object\\\",\\\"observable\\\",\\\"incident\\\",\\\"note\\\",\\\"grouping\\\"],\\\"query\\\":[{\\\"length\\\":32,\\\"dataKey\\\":{\\\"id\\\":\\\"type\\\",\\\"type\\\":\\\"select\\\",\\\"subProperty\\\":true,\\\"addAll\\\":true,\\\"reset\\\":true,\\\"multiple\\\":true,\\\"value\\\":\\\"id\\\",\\\"label\\\":\\\"Object Type\\\"},\\\"key\\\":\\\"'Object Type'\\\",\\\"keyType\\\":\\\"select\\\",\\\"dataOperator\\\":{\\\"id\\\":\\\"=\\\",\\\"label\\\":\\\"=\\\"},\\\"operator\\\":\\\"=\\\",\\\"dataValue\\\":{\\\"id\\\":\\\"indicator\\\",\\\"name\\\":\\\"Indicator\\\"},\\\"value\\\":\\\"\\\\\\\"Indicator\\\\\\\"\\\",\\\"condition\\\":\\\"AND\\\"},{\\\"length\\\":25,\\\"dataKey\\\":{\\\"id\\\":\\\"source\\\",\\\"type\\\":\\\"select\\\",\\\"subProperty\\\":true,\\\"multiple\\\":true,\\\"subheading\\\":{\\\"key\\\":\\\"source_type\\\",\\\"mapper\\\":{\\\"CUSTOM_STIX_SOURCES\\\":\\\"STIX\\\",\\\"API_FEEDS\\\":\\\"APIs\\\",\\\"EMAIL_ACCOUNTS\\\":\\\"Email\\\",\\\"RSS_FEED\\\":\\\"RSS\\\",\\\"TWITTER_FEEDS\\\":\\\"X (Twitter)\\\",\\\"WEB_SCRAPPER\\\":\\\"Web Scraper\\\",\\\"MALWARE_SANDBOX\\\":\\\"Sandbox\\\",\\\"MISCELLANEOUS\\\":\\\"Miscellaneous\\\"}},\\\"api_component\\\":\\\"sources\\\",\\\"filters\\\":{\\\"sort\\\":\\\"name\\\"},\\\"label\\\":\\\"Source\\\"},\\\"key\\\":\\\"'Source'\\\",\\\"keyType\\\":\\\"select\\\",\\\"dataOperator\\\":{\\\"id\\\":\\\"=\\\",\\\"label\\\":\\\"=\\\"},\\\"operator\\\":\\\"=\\\",\\\"dataValue\\\":{\\\"id\\\":\\\"44b6ace6-0e76-4cc2-af54-85d0bc9f7cc5\\\",\\\"name\\\":\\\"Cyware Labs\\\",\\\"source_type\\\":\\\"TWITTER_FEEDS\\\"},\\\"value\\\":\\\"\\\\\\\"Cyware Labs\\\\\\\"\\\"}]}"
}
response = requests.request("POST", url, params=params, headers=headers, json=payload)
print(response.status_code)
print(response.text)View-only example — running live API calls requires a role with snippet testing access.
Request Body
{
"type": "",
"name": "Indicators from Cyware Feeds",
"description": "Indicator search",
"query": "type IN (\\\"indicator\\\",\\\"malware\\\",\\\"threat-actor\\\",\\\"vulnerability\\\",\\\"attack-pattern\\\",\\\"campaign\\\",\\\"course-of-action\\\",\\\"identity\\\",\\\"infrastructure\\\",\\\"intrusion-set\\\",\\\"location\\\",\\\"malware-analysis\\\",\\\"observed-data\\\",\\\"opinion\\\",\\\"tool\\\",\\\"report\\\",\\\"custom-object\\\",\\\"observable\\\",\\\"incident\\\",\\\"note\\\",\\\"grouping\\\")",
"shared_type": "private",
"meta_data": "{\\\"object_type\\\":[\\\"indicator\\\",\\\"malware\\\",\\\"threat-actor\\\",\\\"vulnerability\\\",\\\"attack-pattern\\\",\\\"campaign\\\",\\\"course-of-action\\\",\\\"identity\\\",\\\"infrastructure\\\",\\\"intrusion-set\\\",\\\"location\\\",\\\"malware-analysis\\\",\\\"observed-data\\\",\\\"opinion\\\",\\\"tool\\\",\\\"report\\\",\\\"custom-object\\\",\\\"observable\\\",\\\"incident\\\",\\\"note\\\",\\\"grouping\\\"],\\\"query\\\":[{\\\"length\\\":32,\\\"dataKey\\\":{\\\"id\\\":\\\"type\\\",\\\"type\\\":\\\"select\\\",\\\"subProperty\\\":true,\\\"addAll\\\":true,\\\"reset\\\":true,\\\"multiple\\\":true,\\\"value\\\":\\\"id\\\",\\\"label\\\":\\\"Object Type\\\"},\\\"key\\\":\\\"'Object Type'\\\",\\\"keyType\\\":\\\"select\\\",\\\"dataOperator\\\":{\\\"id\\\":\\\"=\\\",\\\"label\\\":\\\"=\\\"},\\\"operator\\\":\\\"=\\\",\\\"dataValue\\\":{\\\"id\\\":\\\"indicator\\\",\\\"name\\\":\\\"Indicator\\\"},\\\"value\\\":\\\"\\\\\\\"Indicator\\\\\\\"\\\",\\\"condition\\\":\\\"AND\\\"},{\\\"length\\\":25,\\\"dataKey\\\":{\\\"id\\\":\\\"source\\\",\\\"type\\\":\\\"select\\\",\\\"subProperty\\\":true,\\\"multiple\\\":true,\\\"subheading\\\":{\\\"key\\\":\\\"source_type\\\",\\\"mapper\\\":{\\\"CUSTOM_STIX_SOURCES\\\":\\\"STIX\\\",\\\"API_FEEDS\\\":\\\"APIs\\\",\\\"EMAIL_ACCOUNTS\\\":\\\"Email\\\",\\\"RSS_FEED\\\":\\\"RSS\\\",\\\"TWITTER_FEEDS\\\":\\\"X (Twitter)\\\",\\\"WEB_SCRAPPER\\\":\\\"Web Scraper\\\",\\\"MALWARE_SANDBOX\\\":\\\"Sandbox\\\",\\\"MISCELLANEOUS\\\":\\\"Miscellaneous\\\"}},\\\"api_component\\\":\\\"sources\\\",\\\"filters\\\":{\\\"sort\\\":\\\"name\\\"},\\\"label\\\":\\\"Source\\\"},\\\"key\\\":\\\"'Source'\\\",\\\"keyType\\\":\\\"select\\\",\\\"dataOperator\\\":{\\\"id\\\":\\\"=\\\",\\\"label\\\":\\\"=\\\"},\\\"operator\\\":\\\"=\\\",\\\"dataValue\\\":{\\\"id\\\":\\\"44b6ace6-0e76-4cc2-af54-85d0bc9f7cc5\\\",\\\"name\\\":\\\"Cyware Labs\\\",\\\"source_type\\\":\\\"TWITTER_FEEDS\\\"},\\\"value\\\":\\\"\\\\\\\"Cyware Labs\\\\\\\"\\\"}]}"
}View-only example — running live API calls requires a role with snippet testing access.
Example Response
{
"created_by": {},
"description": "Indicator search",
"editable": true,
"id": "c0658427-1c73-4409-b60a-8285d2b49f7e",
"is_threat_data_search": true,
"meta_data": "{\"object_type\":[\"indicator\",\"malware\",\"threat-actor\",\"vulnerability\",\"attack-pattern\",\"campaign\",\"course-of-action\",\"identity\",\"infrastructure\",\"intrusion-set\",\"location\",\"malware-analysis\",\"observed-data\",\"opinion\",\"tool\",\"report\",\"custom-object\",\"observable\",\"incident\",\"note\",\"grouping\"],\"query\":[{\"length\":32,\"dataKey\":{\"id\":\"type\",\"type\":\"select\",\"subProperty\":true,\"addAll\":true,\"reset\":true,\"multiple\":true,\"value\":\"id\",\"label\":\"Object Type\"},\"key\":\"'Object Type'\",\"keyType\":\"select\",\"dataOperator\":{\"id\":\"=\",\"label\":\"=\"},\"operator\":\"=\",\"dataValue\":{\"id\":\"indicator\",\"name\":\"Indicator\"},\"value\":\"\\\"Indicator\\\"\",\"condition\":\"AND\"},{\"length\":25,\"dataKey\":{\"id\":\"source\",\"type\":\"select\",\"subProperty\":true,\"multiple\":true,\"subheading\":{\"key\":\"source_type\",\"mapper\":{\"CUSTOM_STIX_SOURCES\":\"STIX\",\"API_FEEDS\":\"APIs\",\"EMAIL_ACCOUNTS\":\"Email\",\"RSS_FEED\":\"RSS\",\"TWITTER_FEEDS\":\"X (Twitter)\",\"WEB_SCRAPPER\":\"Web Scraper\",\"MALWARE_SANDBOX\":\"Sandbox\",\"MISCELLANEOUS\":\"Miscellaneous\"}},\"api_component\":\"sources\",\"filters\":{\"sort\":\"name\"},\"label\":\"Source\"},\"key\":\"'Source'\",\"keyType\":\"select\",\"dataOperator\":{\"id\":\"=\",\"label\":\"=\"},\"operator\":\"=\",\"dataValue\":{\"id\":\"44b6ace6-0e76-4cc2-af54-85d0bc9f7cc5\",\"name\":\"Cyware Labs\",\"source_type\":\"TWITTER_FEEDS\"},\"value\":\"\\\"Cyware Labs\\\"\"}]}",
"name": "Indicators from Cyware Feeds",
"order": -1,
"pinned": false,
"query": "type IN (\"indicator\",\"malware\",\"threat-actor\",\"vulnerability\",\"attack-pattern\",\"campaign\",\"course-of-action\",\"identity\",\"infrastructure\",\"intrusion-set\",\"location\",\"malware-analysis\",\"observed-data\",\"opinion\",\"tool\",\"report\",\"custom-object\",\"observable\",\"incident\",\"note\",\"grouping\")",
"shared_type": "global",
"shared_users": [],
"type": "cql"
}View-only example — running live API calls requires a role with snippet testing access.