CTIX
Network live
CTIXPOST

Get Nominal Threat Data List

Source docs
POSThttps://cs-testv2.cyware.com/ctixapi/ingestion/threat-data/list/

Returns a list of threat data objects that are accessible to use in the threat investigations canvas with limited details of the objects.

Query Parameters

NameTypeRequiredDescription
componentstringrequired

Pass investigation to retrieve threat data objects that are accessible to use in threat investigations.

nominalstringrequired

Pass true to retrieve limited details of the threat data objects.

pagestringoptional

Pass the page number to retrieve records.

page_sizestringoptional

Pass the number of records to retrieve on each page.

Body Parameters

NameTypeRequiredDescription
querystringrequired

Pass the CQL query to filter threat data objects.

Run it

Use the Request parameters panel to enter path IDs, query values, JSON body, and credentials. Then run any snippet below — all languages use the same values. Base URL: https://cs-testv2.cyware.com/ctixapi (change in API Settings).

Playground

Request parameters

Edit values here before running any snippet below (cURL, JavaScript, or Python). Code blocks are reference only — your inputs above are what gets sent.

CTIXConnect to Intel ExchangeRequired to change data
Credentials required for POST

Open API (HMAC signature) · Get credentials from Cyware Admin → Open API → Generate Credentials.

Signature and Expires are generated when you run a request. Access ID and Secret Key stay in memory for this tab only.

Credentials from Authentication auto-fill here for this product. If fields are empty after connecting, refresh this page or open the product docs again.

Query Parameters
Request body (JSON)Valid JSON
cURL
curl --request POST \
  --url "https://cs-testv2.cyware.com/ctixapi/ingestion/threat-data/list/?component=investigation&nominal=true&AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E" \
  --data '{
  "query": "type = \"indicator\" AND AND value contains (\"1.1\")"
}'

View-only example — running live API calls requires a role with snippet testing access.

JavaScript
const url = "https://cs-testv2.cyware.com/ctixapi/ingestion/threat-data/list/?component=investigation&nominal=true&AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E";

const response = await fetch(url, {
  method: "POST",
  headers: {},
  body: JSON.stringify({
    "query": "type = \"indicator\" AND AND value contains (\"1.1\")"
  }),
});

const text = await response.text();
let data;
try { data = JSON.parse(text); } catch { data = text; }
console.log(response.status, data);

View-only example — running live API calls requires a role with snippet testing access.

Python
import requests

url = "https://cs-testv2.cyware.com/ctixapi/ingestion/threat-data/list/"
params = {
    "component": "investigation",
    "nominal": "true",
    "AccessID": "<your access id>",
    "Signature": "<your signature>",
    "Expires": "<your expires>"
}
headers = {}
payload = {
  "query": "type = \"indicator\" AND AND value contains (\"1.1\")"
}
response = requests.request("POST", url, params=params, headers=headers, json=payload)
print(response.status_code)
print(response.text)

View-only example — running live API calls requires a role with snippet testing access.

Request Body
{
  "query": "type = \"indicator\" AND AND value contains (\"1.1\")"
}

View-only example — running live API calls requires a role with snippet testing access.

Example Response
{
  "next": {},
  "page_size": 10,
  "previous": {},
  "results": [
    {}
  ],
  "total": 1
}

View-only example — running live API calls requires a role with snippet testing access.