MISP

https://www.misp-project.org/documentation
Admin
MISP (Malware Information Sharing Platform & Threat Sharing) is an open-source threat intelligence...
Tokens:112,647
Snippets:431
Trust Score:9.6
Update:3 months ago
Show doc for...
Tokens:
Raw
### Get server setting response structure

Source: https://www.misp-project.org/documentation/openapi.html

Example JSON response structure returned when querying a server setting by name.

```json
{
  "level": 0,
  "value": "string",
  "errorMessage": "The currently set baseurl does not match the URL through which you have accessed the page. Disregard this if you are accessing the page via an alternate URL (for example via IP address).",
  "test": "testBaseURL",
  "type": "string",
  "null": true,
  "subGroup": "Enrichment",
  "cli_only": 1,
  "redacted": true,
  "optionsSource": { },
  "afterHook": "cleanCacheFiles",
  "error": 1,
  "tab": "MISP",
  "setting": "MISP.baseurl",
  "options": { }
}
```

--------------------------------

### Get Auth Keys Response Structure

Source: https://www.misp-project.org/documentation/openapi.html

Example JSON response returned when listing authentication keys.

```json
[
  {
    "AuthKey": {
      "id": "12345",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "authkey_start": "stri",
      "authkey_end": "stri",
      "created": "1617875568",
      "expiration": "1970-01-01 00:00:00",
      "read_only": true,
      "user_id": "12345",
      "comment": "string",
      "allowed_ips": [
        "127.0.0.1"
      ],
      "last_used": "1617875568"
    },
    "User": {
      "id": "12345",
      "email": "user@example.com"
    }
  }
]
```

--------------------------------

### Get user setting by ID response

Source: https://www.misp-project.org/documentation/openapi.html

Example response structure for retrieving a single user setting by its ID.

```json
{
  "UserSetting": {
    "id": "12345",
    "setting": "publish_alert_filter",
    "value": {
      "widget": "MispStatusWidget",
      "position": {
        "x": "0",
        "y": "0",
        "width": "2",
        "height": "2"
      }
    },
    "user_id": "12345",
    "timestamp": "1617875568"
  }
}
```

--------------------------------

### Get Noticelist Response JSON

Source: https://www.misp-project.org/documentation/openapi.html

Example JSON response structure for a successful noticelist retrieval.

```json
{
  * "Noticelist": {
    * "id": "3",
    * "name": "List of known domains to know external IP",
    * "type": "cidr",
    * "description": "string",
    * "version": "10",
    * "enabled": true,
    * "warninglist_entry_count": "1234",
    * "valid_attributes": "domain, hostname, domain|ip, uri, url",
    * "NoticelistEntry": [
      * {
        * "id": "1234",
        * "noticelist_id": "3",
        * "data": {
          * "scope": [
            * "attribute"
],
          * "field": [
            * "category"
],
          * "value": [
            * "Person"
],
          * "tags": [
            * "tlp:white"
],
          * "message": {
            * "en": "This attribute is likely to contain personal data and the data subject is likely to be directly identifiable."
}
}
}
]
}

}
```

--------------------------------

### Retrieve Noticelists JSON Response

Source: https://www.misp-project.org/documentation/openapi.html

Example of the JSON structure returned by the GET /noticelists endpoint.

```json
[
  {
    "Noticelist": {
      "id": "3",
      "name": "List of known domains to know external IP",
      "type": "cidr",
      "description": "string",
      "version": "10",
      "enabled": true,
      "warninglist_entry_count": "1234",
      "valid_attributes": "domain, hostname, domain|ip, uri, url",
      "NoticelistEntry": [
        {
          "id": "1234",
          "noticelist_id": "3",
          "data": {
            "scope": [
              "attribute"
            ],
            "field": [
              "category"
            ],
            "value": [
              "Person"
            ],
            "tags": [
              "tlp:white"
            ],
            "message": {
              "en": "This attribute is likely to contain personal data and the data subject is likely to be directly identifiable."
            }
          }
        }
      ]
    }
  }
]
```

--------------------------------

### Get Warninglist by ID Response

Source: https://www.misp-project.org/documentation/openapi.html

Example JSON response containing the full details of a specific warninglist, including its entries.

```json
{
  "Warninglist": {
    "id": "3",
    "name": "List of known domains to know external IP",
    "type": "cidr",
    "description": "string",
    "version": "10",
    "enabled": true,
    "warninglist_entry_count": "1234",
    "valid_attributes": "domain, hostname, domain|ip, uri, url",
    "WarninglistEntry": [
      {
        "id": "1234",
        "value": "10.128.0.0/24",
        "warninglist_id": "3"
      }
    ]
  }
}
```

--------------------------------

### GET /servers

Source: https://www.misp-project.org/documentation/openapi.html

Retrieves a list of all servers configured in the MISP instance.

```APIDOC
## GET /servers

### Description
Fetches a comprehensive list of servers, including associated organization and user details.

### Method
GET

### Endpoint
/servers

### Response
#### Success Response (200)
- **Server** (object) - Server configuration details
- **Organisation** (object) - Associated organization details
- **RemoteOrg** (object) - Remote organization details
- **User** (array) - List of users associated with the server

### Response Example
[
  {
    "Server": {
      "id": "12345",
      "name": "Phishing Server",
      "url": "https://misppriv.circl.lu"
    },
    "Organisation": {
      "id": "12345",
      "name": "ORGNAME"
    }
  }
]
```

--------------------------------

### POST /servers/startWorker/{workerType}

Source: https://www.misp-project.org/documentation/openapi.html

Starts a specific type of MISP worker.

```APIDOC
## POST /servers/startWorker/{workerType}

### Description
Starts a worker of the specified type.

### Method
POST

### Endpoint
/servers/startWorker/{workerType}

### Parameters
#### Path Parameters
- **workerType** (string) - Required - Worker type. Enum: "default", "email", "scheduler", "cache", "prio", "update"

### Response
#### Success Response (200)
- **saved** (boolean) - Status of the operation
- **success** (boolean) - Success indicator
- **name** (string) - Response name
- **message** (string) - Response message
- **url** (string) - Request URL

### Response Example
{
  "saved": true,
  "success": true,
  "name": "Worker start signal sent",
  "message": "Worker start signal sent",
  "url": "/servers/startWorker/email"
}
```

--------------------------------

### GET /noticelists

Source: https://www.misp-project.org/documentation/openapi.html

Retrieves a list of all available noticelists in the MISP instance.

```APIDOC
## GET /noticelists

### Description
Retrieves a list of noticelists to inform MISP users of legal, privacy, policy, or technical implications.

### Method
GET

### Endpoint
https://misp.local/noticelists

### Authorizations
- ApiKeyAuth

### Response
#### Success Response (200)
- **Noticelist** (array) - List of noticelist objects containing id, name, type, description, version, enabled status, entry count, and valid attributes.

#### Response Example
[
  {
    "Noticelist": {
      "id": "3",
      "name": "List of known domains to know external IP",
      "type": "cidr",
      "description": "string",
      "version": "10",
      "enabled": true,
      "warninglist_entry_count": "1234",
      "valid_attributes": "domain, hostname, domain|ip, uri, url",
      "NoticelistEntry": [
        {
          "id": "1234",
          "noticelist_id": "3",
          "data": {
            "scope": ["attribute"],
            "field": ["category"],
            "value": ["Person"],
            "tags": ["tlp:white"],
            "message": {
              "en": "This attribute is likely to contain personal data and the data subject is likely to be directly identifiable."
            }
          }
        }
      ]
    }
  }
]
```

--------------------------------

### GET /attributes

Source: https://www.misp-project.org/documentation/openapi.html

Retrieves a list of all attributes available in the system.

```APIDOC
## GET /attributes

### Description
Returns a list of attributes. Requires ApiKeyAuth.

### Method
GET

### Endpoint
https://misp.local/attributes

### Response
#### Success Response (200)
- **attributes** (array) - A list of attribute objects containing details like id, event_id, category, type, value, and associated tags.
```

--------------------------------

### Edit Server Response Example

Source: https://www.misp-project.org/documentation/openapi.html

The successful response returns the updated server object.

```json
{
  "Server": {
    "id": "12345",
    "name": "Phishing Server",
    "url": "https://misppriv.circl.lu",
    "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
    "org_id": "12345",
    "push": true,
    "pull": true,
    "push_sightings": true,
    "push_galaxy_clusters": true,
    "pull_galaxy_clusters": true,
    "lastpulledid": "12345",
    "lastpushedid": "12345",
    "organization": "string",
    "remote_org_id": "12345",
    "publish_without_email": true,
    "unpublish_event": true,
    "self_signed": true,
    "pull_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
    "push_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]}}",
    "cert_file": "string",
    "client_cert_file": "string",
    "internal": true,
    "skip_proxy": true,
    "caching_enabled": true,
    "priority": "1",
    "cache_timestamp": true
}
}
```

--------------------------------

### GET /servers/getVersion

Source: https://www.misp-project.org/documentation/openapi.html

Retrieves the current version of the MISP instance and associated permissions.

```APIDOC
## GET /servers/getVersion

### Description
Retrieves the current version of the MISP instance and associated permissions.

### Method
GET

### Endpoint
https://misp.local/servers/getVersion

### Response
#### Success Response (200)
- **version** (string) - The current version of the MISP instance.
- **perm_sync** (boolean) - Sync permission status.
- **perm_sighting** (boolean) - Sighting permission status.
- **perm_galaxy_editor** (boolean) - Galaxy editor permission status.
- **request_encoding** (array) - Supported request encodings.

#### Response Example
{
  "version": "2.4.142",
  "perm_sync": true,
  "perm_sighting": true,
  "perm_galaxy_editor": true,
  "request_encoding": ["gzip"]
}
```

--------------------------------

### Add Server Response JSON

Source: https://www.misp-project.org/documentation/openapi.html

Example JSON response returned after successfully adding a server.

```json
{
  "Server": {
    "id": "12345",
    "name": "Phishing Server",
    "url": "https://misppriv.circl.lu",
    "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
    "org_id": "12345",
    "push": true,
    "pull": true,
    "push_sightings": true,
    "push_galaxy_clusters": true,
    "pull_galaxy_clusters": true,
    "lastpulledid": "12345",
    "lastpushedid": "12345",
    "organization": "string",
    "remote_org_id": "12345",
    "publish_without_email": true,
    "unpublish_event": true,
    "self_signed": true,
    "pull_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
    "push_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]}}",
    "cert_file": "string",
    "client_cert_file": "string",
    "internal": true,
    "skip_proxy": true,
    "caching_enabled": true,
    "priority": "1",
    "cache_timestamp": true
}

}
```

--------------------------------

### Add Event Response Sample

Source: https://www.misp-project.org/documentation/openapi.html

Example of a successful 200 OK response containing the created event object.

```json
{
  "Event": {
    "id": "12345",
    "org_id": "12345",
    "distribution": "4",
    "info": "logged source ip",
    "orgc_id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "date": "1991-01-15",
    "published": false,
    "analysis": "0",
    "attribute_count": "321",
    "timestamp": "1617875568",
    "sharing_group_id": "1",
    "proposal_email_lock": true,
    "locked": true,
    "threat_level_id": "1",
    "publish_timestamp": "1617875568",
    "sighting_timestamp": "1617875568",
    "disable_correlation": false,
    "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "event_creator_email": "user@example.com",
    "Feed": {
      "id": "3",
      "name": "CIRCL OSINT Feed",
      "provider": "CIRCL",
      "url": "https://www.circl.lu/doc/misp/feed-osint",
      "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
      "enabled": true,
      "distribution": "4",
      "sharing_group_id": "1",
      "tag_id": "12345",
      "default": true,
      "source_format": "1",
      "fixed_event": true,
      "delta_merge": true,
      "event_id": "12345",
      "publish": false,
      "override_ids": true,
      "settings": "{\"csv\":{\"value\":\"\",\"delimiter\":\"\"},\"common\":{\"excluderegex\":\"\"},\"disable_correlation\":\"1\"}",
      "input_source": "local",
      "delete_local_file": true,
      "lookup_visible": true,
      "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n",
      "caching_enabled": true,
      "force_to_ids": true,
      "orgc_id": "12345",
      "cache_timestamp": "1617875568"
},
    "Org": {
      "id": "12345",
      "name": "ORGNAME",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
},
    "Orgc": {
      "id": "12345",
      "name": "ORGNAME",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
},
    "Attribute": [
      {
        "id": "12345",
        "event_id": "12345",
        "object_id": "12345",
        "object_relation": "sensor",
        "category": "Internal reference",
        "type": "md5",
        "value": "127.0.0.1",
        "to_ids": true
```

--------------------------------

### Get Organisation Response JSON

Source: https://www.misp-project.org/documentation/openapi.html

Example JSON response structure for retrieving an organization by its ID.

```json
{
  "id": "12345",
  "name": "ORGNAME",
  "date_created": "2021-06-14 14:29:19",
  "date_modified": "2021-06-14 14:29:19",
  "description": "string",
  "type": "ADMIN",
  "nationality": "string",
  "sector": "string",
  "created_by": "12345",
  "uuid": "string",
  "contacts": "string",
  "local": true,
  "restricted_to_domain": [
    "example.com"
],
  "landingpage": "string",
  "user_count": "3",
  "created_by_email": "string"

}
```

--------------------------------

### POST /servers/createSync

Source: https://www.misp-project.org/documentation/openapi.html

Creates a new server synchronization configuration.

```APIDOC
## POST /servers/createSync

### Description
Creates a new server synchronization configuration.

### Method
POST

### Endpoint
https://misp.local/servers/createSync

### Response
#### Success Response (200)
- **Server** (object) - The created server sync object

#### Response Example
{
  "Server": {
    "url": "https://misppriv.circl.lu",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
    "Organisation": {
      "name": "ORGNAME",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
    }
  }
}
```

--------------------------------

### Get current instance settings and diagnostics

Source: https://www.misp-project.org/documentation/openapi.html

Provides a comprehensive diagnostic report including PHP settings, GPG status, STIX/Cybox library versions, and database health.

```json
{
  * "version": {
    * "current": "v2.4.142",
    * "newest": "v2.4.142",
    * "upToDate": "same"
},
  * "phpSettings": {
    * "max_execution_time": {
      * "explanation": "The maximum duration that a script can run (does not affect the background workers). A too low number will break long running scripts like comprehensive API exports",
      * "recommended": 300,
      * "unit": "seconds",
      * "value": 300
},
    * "memory_limit": {
      * "explanation": "The maximum duration that a script can run (does not affect the background workers). A too low number will break long running scripts like comprehensive API exports",
      * "recommended": 300,
      * "unit": "seconds",
      * "value": 300
},
    * "upload_max_filesize": {
      * "explanation": "The maximum duration that a script can run (does not affect the background workers). A too low number will break long running scripts like comprehensive API exports",
      * "recommended": 300,
      * "unit": "seconds",
      * "value": 300
},
    * "post_max_size": {
      * "explanation": "The maximum duration that a script can run (does not affect the background workers). A too low number will break long running scripts like comprehensive API exports",
      * "recommended": 300,
      * "unit": "seconds",
      * "value": 300
}
},
  * "gpgStatus": "FAIL: Failed to load GnuPG",
  * "proxyStatus": "not configured (so not tested)",
  * "zmqStatus": 1,
  * "stix": {
    * "operational": 1,
    * "stix": {
      * "version": "1.2.0.11",
      * "expected": ">1.2.0.9",
      * "status": 1
},
    * "cybox": {
      * "version": "1.2.0.11",
      * "expected": ">1.2.0.9",
      * "status": 1
},
    * "mixbox": {
      * "version": "1.2.0.11",
      * "expected": ">1.2.0.9",
      * "status": 1
},
    * "maec": {
      * "version": "1.2.0.11",
      * "expected": ">1.2.0.9",
      * "status": 1
},
    * "stix2": {
      * "version": "1.2.0.11",
      * "expected": ">1.2.0.9",
      * "status": 1
},
    * "pymisp": {
      * "version": "1.2.0.11",
      * "expected": ">1.2.0.9",
      * "status": 1
}
},
  * "moduleStatus": {
    * "Enrichment": 1,
    * "Import": 1,
    * "Export": 1,
    * "Cortex": 1
},
  * "writeableDirs": {
    * "/tmp": 0,
    * "/var/www/MISP/app/tmp": 0,
    * "/var/www/MISP/app/files": 0,
    * "/var/www/MISP/app/files/scripts/tmp": 0
},
  * "writeableFiles": {
    * "/var/www/MISP/app/Config/config.php": 0,
    * "/var/www/MISP/.git/ORIG_HEAD": 2
},
  * "readableFiles": {
    * "/var/www/MISP/app/files/scripts/stixtest.py": 0
},
  * "dbDiagnostics": {
    * "admin_settings": {
      * "table": "admin_settings",
      * "used": "0.03 MB",
      * "reclaimable": "0 MB",
      * "data_in_bytes": 16384,
      * "index_in_bytes": 16384,
      * "reclaimable_in_bytes": 0
},
    * "allowedlist": {
      * "table": "allowedlist",
      * "used": "0.02 MB",
      * "reclaimable": "0 MB",
      * "data_in_bytes": 16384,
      * "index_in_bytes": 0,
      * "reclaimable_in_bytes": 0
}
},
  * "dbSchemaDiagnostics": {
    * "dataSource": "Database/Mysql",
    * "actual_db_version": "68",
    * "checked_table_column": [
      * "column_name"
],
    * "diagnostic": { },
    * "diagnostic_index": {
      * "event_reports": {
        * "event_id": {

```

--------------------------------

### POST /admin/users/add

Source: https://www.misp-project.org/documentation/openapi.html

Creates a new user account in the system. Requires an API key for authorization.

```APIDOC
## POST /admin/users/add

### Description
Adds a new user to the MISP instance with the provided configuration details.

### Method
POST

### Endpoint
/admin/users/add

### Parameters
#### Request Body
- **org_id** (string) - Required - Organization ID
- **server_id** (string) - Required - Server ID
- **email** (string) - Required - User email address
- **autoalert** (boolean) - Required - Auto alert setting
- **authkey** (string) - Optional - API auth key
- **invited_by** (string) - Required - User ID of the inviter
- **gpgkey** (string) - Optional - GPG key
- **certif_public** (string) - Optional - Public certificate
- **nids_sid** (string) - Required - NIDS SID
- **termsaccepted** (boolean) - Required - Terms accepted status
- **newsread** (string) - Required - News read timestamp
- **role_id** (string) - Required - Role ID
- **change_pw** (string) - Required - Password change required flag
- **contactalert** (boolean) - Required - Contact alert setting
- **disabled** (boolean) - Required - Disabled status
- **expiration** (string) - Optional - Expiration date-time
- **current_login** (string) - Required - Current login timestamp
- **last_login** (string) - Required - Last login timestamp
- **force_logout** (boolean) - Required - Force logout status
- **date_created** (string) - Required - Creation timestamp
- **date_modified** (string) - Required - Modification timestamp

### Request Example
{
  "org_id": "12345",
  "server_id": "12345",
  "email": "user@example.com",
  "autoalert": true,
  "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
  "invited_by": "12345",
  "gpgkey": "string",
  "certif_public": "string",
  "nids_sid": "4000000",
  "termsaccepted": true,
  "newsread": "1617875568",
  "role_id": "3",
  "change_pw": "0",
  "contactalert": true,
  "disabled": true,
  "expiration": "2019-08-24T14:15:22Z",
  "current_login": "1617875568",
  "last_login": "1617875568",
  "force_logout": true,
  "date_created": "1617875568",
  "date_modified": "1617875568"
}

### Response
#### Success Response (200)
- **id** (string) - The ID of the created user

#### Response Example
{
  "id": "12345",
  "org_id": "12345",
  "email": "user@example.com"
}
```

--------------------------------

### GET /servers/getSetting/{settingName}

Source: https://www.misp-project.org/documentation/openapi.html

Retrieves the value and details of a specific MISP server setting by its name.

```APIDOC
## GET /servers/getSetting/{settingName}

### Description
Retrieves the configuration details for a specific server setting.

### Method
GET

### Endpoint
/servers/getSetting/{settingName}

### Parameters
#### Path Parameters
- **settingName** (string) - Required - The name of the setting to retrieve (e.g., MISP.background_jobs).

### Response
#### Success Response (200)
- **level** (integer) - Setting level
- **value** (string) - The value of the setting
- **errorMessage** (string) - Error message if applicable
- **test** (string) - Test identifier
- **type** (string) - Data type
- **null** (boolean) - Null status
- **subGroup** (string) - Setting subgroup
- **cli_only** (integer) - CLI only flag
- **redacted** (boolean) - Redaction status
- **optionsSource** (object) - Source of options
- **afterHook** (string) - Hook executed after change
- **error** (integer) - Error code
- **tab** (string) - UI tab location
- **setting** (string) - Setting name
- **options** (object) - Available options
```

--------------------------------

### Add Auth Key Response Sample

Source: https://www.misp-project.org/documentation/openapi.html

Example of the successful 200 response returned after adding an authentication key.

```json
{
  "AuthKey": {
    "id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "authkey_start": "stri",
    "authkey_end": "stri",
    "created": "1617875568",
    "expiration": "1970-01-01 00:00:00",
    "read_only": true,
    "user_id": "12345",
    "comment": "string",
    "allowed_ips": [
      "127.0.0.1"
    ],
    "last_used": "1617875568"
  }
}
```

--------------------------------

### Get Sightings by Event ID Response

Source: https://www.misp-project.org/documentation/openapi.html

Example JSON response structure for a successful retrieval of sightings associated with a specific event ID.

```json
[
  {
    "id": "12345",
    "attribute_id": "12345",
    "event_id": "12345",
    "org_id": "12345",
    "date_sighting": "1617875568",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "source": "string",
    "type": "string",
    "attribute_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "Organisation": {
      "id": "12345",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "name": "ORGNAME"
    }
  }
]
```

--------------------------------

### Retrieve User Setting JSON Response

Source: https://www.misp-project.org/documentation/openapi.html

Example JSON structure returned when successfully fetching a user setting.

```json
{
  "UserSetting": {
    "id": "12345",
    "setting": "publish_alert_filter",
    "value": {
      "widget": "MispStatusWidget",
      "position": {
        "x": "0",
        "y": "0",
        "width": "2",
        "height": "2"
}
},
    "user_id": "12345",
    "timestamp": "1617875568"
}

}
```

--------------------------------

### REST Search Response Example

Source: https://www.misp-project.org/documentation/openapi.html

Example JSON response structure returned by the /events/restSearch endpoint.

```json
{
  "response": [
    {
      "Event": {
        "id": "12345",
        "org_id": "12345",
        "distribution": "4",
        "info": "logged source ip",
        "orgc_id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "date": "1991-01-15",
        "published": false,
        "analysis": "0",
        "attribute_count": "321"
```

--------------------------------

### POST /servers/import

Source: https://www.misp-project.org/documentation/openapi.html

Imports a new server configuration into the MISP instance.

```APIDOC
## POST /servers/import

### Description
Imports a server configuration into MISP. Requires an API key for authentication.

### Method
POST

### Endpoint
https://misp.local/servers/import

### Parameters
#### Request Body
- **name** (string) - Required - Server name (max 255 characters)
- **url** (string) - Required - Server URL
- **uuid** (string) - Required - Server UUID
- **authkey** (string) - Required - Authentication key (40 characters)
- **Organisation** (object) - Required - Organization details

### Request Example
{
  "name": "Phishing Server",
  "url": "https://misppriv.circl.lu",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
  "Organisation": {
    "name": "ORGNAME"
  }
}

### Response
#### Success Response (200)
- **Server** (object) - The imported server object details

#### Response Example
{
  "Server": {
    "id": "12345",
    "name": "Phishing Server",
    "url": "https://misppriv.circl.lu",
    "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
    "org_id": "12345",
    "push": true,
    "pull": true,
    "push_sightings": true,
    "push_galaxy_clusters": true,
    "pull_galaxy_clusters": true,
    "lastpulledid": "12345",
    "lastpushedid": "12345",
    "organization": "string",
    "remote_org_id": "12345",
    "publish_without_email": true,
    "unpublish_event": true,
    "self_signed": true,
    "pull_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
    "push_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]}}",
    "cert_file": "string",
    "client_cert_file": "string",
    "internal": true,
    "skip_proxy": true,
    "caching_enabled": true,
    "priority": "1",
    "cache_timestamp": true
  }
}
```

--------------------------------

### GET /taxonomies

Source: https://www.misp-project.org/documentation/openapi.html

Retrieves a list of all available taxonomies.

```APIDOC
## GET /taxonomies

### Description
Retrieves a list of all available taxonomies used for classification.

### Method
GET

### Endpoint
https://misp.local/taxonomies

### Response
#### Success Response (200)
- **Taxonomy** (object) - The taxonomy details.
- **total_count** (integer) - Total count of taxonomies.
- **current_count** (integer) - Current count of taxonomies.

#### Response Example
[
  {
    "Taxonomy": {
      "id": "12345",
      "namespace": "tlp",
      "description": "Disclosure is not limited...",
      "version": "5",
      "enabled": true,
      "exclusive": true,
      "required": true
    },
    "total_count": 0,
    "current_count": 0
  }
]
```

--------------------------------

### GET /auth_keys

Source: https://www.misp-project.org/documentation/openapi.html

Retrieves a list of authentication keys.

```APIDOC
## GET /auth_keys

### Description
Retrieves all authentication keys associated with the user.

### Method
GET

### Endpoint
https://misp.local/auth_keys

### Response
#### Success Response (200)
- **AuthKey** (object) - The authentication key details.
- **User** (object) - The user associated with the key.
```

--------------------------------

### POST /galaxies/import

Source: https://www.misp-project.org/documentation/openapi.html

Import a galaxy cluster into the system.

```APIDOC
## POST /galaxies/import

### Description
Import a galaxy cluster.

### Method
POST

### Endpoint
https://misp.local/galaxies/import

### Request Body
- **GalaxyCluster** (array) - Required - Array of GalaxyCluster objects.

### Response
#### Success Response (200)
- **saved** (boolean) - Indicates if the operation was saved.
- **success** (boolean) - Indicates if the operation was successful.
- **name** (string) - Status message.
- **message** (string) - Detailed status message.
- **url** (string) - The endpoint URL.

#### Response Example
{
  "saved": true,
  "success": true,
  "name": "'Galaxy clusters imported. 1 imported, 0 ignored, 0 failed.",
  "message": "'Galaxy clusters imported. 1 imported, 0 ignored, 0 failed.",
  "url": "/galaxies/import"
}
```

--------------------------------

### GET /sharing_groups

Source: https://www.misp-project.org/documentation/openapi.html

Retrieves a list of all sharing groups.

```APIDOC
## GET /sharing_groups

### Description
Retrieves a list of all sharing groups available in the MISP instance.

### Method
GET

### Endpoint
/sharing_groups

### Response
#### Success Response (200)
- **response** (array) - List of sharing group objects

#### Response Example
{
  "response": [
    {
      "SharingGroup": {
        "id": "1",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "name": "Banking Sharing Group",
        "description": "Banking Institutions of X Sharing Group",
        "releasability": "string",
        "local": true,
        "active": true,
        "org_count": "6"
      },
      "Organisation": {
        "id": "12345",
        "name": "ORGNAME",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
      },
      "editable": true,
      "deletable": true
    }
  ]
}
```

--------------------------------

### GET /servers/serverSettings

Source: https://www.misp-project.org/documentation/openapi.html

Retrieves detailed server settings, diagnostics, and system health information.

```APIDOC
## GET /servers/serverSettings

### Description
Retrieves detailed server settings, diagnostics, and system health information including PHP settings, GPG status, and database diagnostics.

### Method
GET

### Endpoint
https://misp.local/servers/serverSettings

### Response
#### Success Response (200)
- **version** (object) - Versioning details including current and newest versions.
- **phpSettings** (object) - Configuration details for PHP.
- **gpgStatus** (string) - Status of GnuPG.
- **zmqStatus** (integer) - Status of ZMQ.
- **stix** (object) - STIX/Cybox/MAEC compatibility status.
- **moduleStatus** (object) - Status of various modules.

#### Response Example
{
  "version": {
    "current": "v2.4.142",
    "newest": "v2.4.142",
    "upToDate": "same"
  },
  "gpgStatus": "FAIL: Failed to load GnuPG",
  "zmqStatus": 1
}
```

--------------------------------

### GET /eventReports/index

Source: https://www.misp-project.org/documentation/openapi.html

Retrieves a list of all available event reports.

```APIDOC
## GET /eventReports/index

### Description
Retrieves a list of Event Reports.

### Method
GET

### Endpoint
https://misp.local/eventReports/index

### Response
#### Success Response (200)
- **EventReport** (object) - List of event reports

#### Response Example
[
  {
    "EventReport": {
      "id": "12345",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "event_id": "12345",
      "name": "Report of the incident",
      "content": "string",
      "distribution": "4",
      "sharing_group_id": "1",
      "timestamp": "1617875568",
      "deleted": false
    }
  }
]
```

--------------------------------

### Perform API Request with cURL

Source: https://www.misp-project.org/documentation/openapi.html

Example of a cURL request including Authorization, Accept, and Content-Type headers.

```bash
curl  --header "Authorization: YOUR_API_KEY" \
      --header "Accept: application/json" \
      --header "Content-Type: application/json" https://<misp url>/ 
```

--------------------------------

### GET /user_settings

Source: https://www.misp-project.org/documentation/openapi.html

Retrieves the settings configured for the current user.

```APIDOC
## GET /user_settings

### Description
Retrieves a list of user settings, which allow customization of MISP features and UI elements.

### Method
GET

### Endpoint
/user_settings

### Response
#### Success Response (200)
- **UserSetting** (object) - The user setting configuration object

#### Response Example
[
  {
    "UserSetting": {
      "id": "12345",
      "setting": "publish_alert_filter",
      "value": {
        "widget": "MispStatusWidget",
        "position": {
          "x": "0",
          "y": "0",
          "width": "2",
          "height": "2"
        }
      },
      "user_id": "12345",
      "timestamp": "1617875568"
    }
  }
]
```

--------------------------------

### GET /servers/getInstanceUUID

Source: https://www.misp-project.org/documentation/openapi.html

Retrieves the UUID of the current MISP instance.

```APIDOC
## GET /servers/getInstanceUUID

### Description
Retrieves the UUID of the current MISP instance.

### Method
GET

### Endpoint
https://misp.local/servers/getInstanceUUID

### Response
#### Success Response (200)
- **uuid** (string) - The instance UUID

#### Response Example
{
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
}
```

--------------------------------

### GET /admin/users

Source: https://www.misp-project.org/documentation/openapi.html

Retrieves a list of all users registered in the system.

```APIDOC
## GET /admin/users

### Description
Retrieves a list of users including their associated roles and organization details.

### Method
GET

### Endpoint
/admin/users

### Response
#### Success Response (200)
- **User** (object) - User account details
- **Role** (object) - Role permissions associated with the user
- **Organisation** (object) - Organization details

#### Response Example
[
  {
    "User": {
      "id": "12345",
      "email": "user@example.com"
    },
    "Role": {
      "name": "ORGNAME"
    },
    "Organisation": {
      "name": "ORGNAME"
    }
  }
]
```

--------------------------------

### GET /events

Source: https://www.misp-project.org/documentation/openapi.html

Retrieves a list of all events with their extended properties.

```APIDOC
## GET /events

### Description
Fetches a comprehensive list of events including metadata, organization details, attributes, and associated tags.

### Method
GET

### Endpoint
/events

### Response
#### Success Response (200)
- **events** (array) - A list of event objects containing details like id, uuid, info, and associated attributes.

#### Response Example
[
  {
    "id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "info": "logged source ip",
    "published": false
  }
]
```

--------------------------------

### Search Events Response Sample

Source: https://www.misp-project.org/documentation/openapi.html

Example JSON response structure for a successful event search query.

```json
[
  {
    "id": "12345",
    "distribution": "4",
    "sharing_group_id": "1",
    "timestamp": "1617875568",
    "deleted": false
},
    {
    "Tag": [
      {
        "id": "12345",
        "name": "tlp:white",
        "colour": "#ffffff",
        "exportable": true,
        "org_id": "12345",
        "user_id": "12345",
        "hide_tag": false,
        "numerical_value": "12345",
        "is_galaxy": true,
        "is_custom_galaxy": true,
        "inherited": 1
}
]
}

]
```

--------------------------------

### GET /taxonomies/view/{taxonomyId}

Source: https://www.misp-project.org/documentation/openapi.html

Retrieves the details of a specific taxonomy by its ID.

```APIDOC
## GET /taxonomies/view/{taxonomyId}

### Description
Retrieves the full details and entries of a specific taxonomy identified by its numeric ID.

### Method
GET

### Endpoint
https://misp.local/taxonomies/view/{taxonomyId}

### Parameters
#### Path Parameters
- **taxonomyId** (string) - Required - Numeric ID of the taxonomy (max 10 characters, numeric).

### Response
#### Success Response (200)
- **Taxonomy** (object) - The taxonomy metadata.
- **entries** (array) - List of taxonomy entries.

#### Response Example
{
  "Taxonomy": {
    "id": "12345",
    "namespace": "tlp",
    "description": "Disclosure is not limited...",
    "version": "5",
    "enabled": true,
    "exclusive": true,
    "required": true
  },
  "entries": [
    {
      "tag": "tlp:white",
      "expanded": "string",
      "description": "string",
      "exclusive_predicate": true,
      "existing_tag": true
    }
  ]
}
```

--------------------------------

### POST /servers/cache

Source: https://www.misp-project.org/documentation/openapi.html

Initiates a server caching job.

```APIDOC
## POST /servers/cache

### Description
Initiates a server caching job.

### Method
POST

### Endpoint
https://misp.local/servers/cache

### Response
#### Success Response (200)
- **saved** (boolean) - Status of the save operation
- **success** (boolean) - Status of the operation
- **name** (string) - Description of the initiated job
- **message** (string) - Description of the initiated job
- **url** (string) - The endpoint URL

#### Response Example
{
  "saved": true,
  "success": true,
  "name": "Server caching job initiated.",
  "message": "Server caching job initiated.",
  "url": "/servers/cache"
}
```
Tokens:
Raw