### Get server setting response structure Source: https://www.misp-project.org/documentation/openapi.html Example JSON response structure returned when querying a server setting by name. ```json { "level": 0, "value": "string", "errorMessage": "The currently set baseurl does not match the URL through which you have accessed the page. Disregard this if you are accessing the page via an alternate URL (for example via IP address).", "test": "testBaseURL", "type": "string", "null": true, "subGroup": "Enrichment", "cli_only": 1, "redacted": true, "optionsSource": { }, "afterHook": "cleanCacheFiles", "error": 1, "tab": "MISP", "setting": "MISP.baseurl", "options": { } } ``` -------------------------------- ### Get Auth Keys Response Structure Source: https://www.misp-project.org/documentation/openapi.html Example JSON response returned when listing authentication keys. ```json [ { "AuthKey": { "id": "12345", "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b", "authkey_start": "stri", "authkey_end": "stri", "created": "1617875568", "expiration": "1970-01-01 00:00:00", "read_only": true, "user_id": "12345", "comment": "string", "allowed_ips": [ "127.0.0.1" ], "last_used": "1617875568" }, "User": { "id": "12345", "email": "user@example.com" } } ] ``` -------------------------------- ### Get user setting by ID response Source: https://www.misp-project.org/documentation/openapi.html Example response structure for retrieving a single user setting by its ID. ```json { "UserSetting": { "id": "12345", "setting": "publish_alert_filter", "value": { "widget": "MispStatusWidget", "position": { "x": "0", "y": "0", "width": "2", "height": "2" } }, "user_id": "12345", "timestamp": "1617875568" } } ``` -------------------------------- ### Get Noticelist Response JSON Source: https://www.misp-project.org/documentation/openapi.html Example JSON response structure for a successful noticelist retrieval. ```json { * "Noticelist": { * "id": "3", * "name": "List of known domains to know external IP", * "type": "cidr", * "description": "string", * "version": "10", * "enabled": true, * "warninglist_entry_count": "1234", * "valid_attributes": "domain, hostname, domain|ip, uri, url", * "NoticelistEntry": [ * { * "id": "1234", * "noticelist_id": "3", * "data": { * "scope": [ * "attribute" ], * "field": [ * "category" ], * "value": [ * "Person" ], * "tags": [ * "tlp:white" ], * "message": { * "en": "This attribute is likely to contain personal data and the data subject is likely to be directly identifiable." } } } ] } } ``` -------------------------------- ### Retrieve Noticelists JSON Response Source: https://www.misp-project.org/documentation/openapi.html Example of the JSON structure returned by the GET /noticelists endpoint. ```json [ { "Noticelist": { "id": "3", "name": "List of known domains to know external IP", "type": "cidr", "description": "string", "version": "10", "enabled": true, "warninglist_entry_count": "1234", "valid_attributes": "domain, hostname, domain|ip, uri, url", "NoticelistEntry": [ { "id": "1234", "noticelist_id": "3", "data": { "scope": [ "attribute" ], "field": [ "category" ], "value": [ "Person" ], "tags": [ "tlp:white" ], "message": { "en": "This attribute is likely to contain personal data and the data subject is likely to be directly identifiable." } } } ] } } ] ``` -------------------------------- ### Get Warninglist by ID Response Source: https://www.misp-project.org/documentation/openapi.html Example JSON response containing the full details of a specific warninglist, including its entries. ```json { "Warninglist": { "id": "3", "name": "List of known domains to know external IP", "type": "cidr", "description": "string", "version": "10", "enabled": true, "warninglist_entry_count": "1234", "valid_attributes": "domain, hostname, domain|ip, uri, url", "WarninglistEntry": [ { "id": "1234", "value": "10.128.0.0/24", "warninglist_id": "3" } ] } } ``` -------------------------------- ### GET /servers Source: https://www.misp-project.org/documentation/openapi.html Retrieves a list of all servers configured in the MISP instance. ```APIDOC ## GET /servers ### Description Fetches a comprehensive list of servers, including associated organization and user details. ### Method GET ### Endpoint /servers ### Response #### Success Response (200) - **Server** (object) - Server configuration details - **Organisation** (object) - Associated organization details - **RemoteOrg** (object) - Remote organization details - **User** (array) - List of users associated with the server ### Response Example [ { "Server": { "id": "12345", "name": "Phishing Server", "url": "https://misppriv.circl.lu" }, "Organisation": { "id": "12345", "name": "ORGNAME" } } ] ``` -------------------------------- ### POST /servers/startWorker/{workerType} Source: https://www.misp-project.org/documentation/openapi.html Starts a specific type of MISP worker. ```APIDOC ## POST /servers/startWorker/{workerType} ### Description Starts a worker of the specified type. ### Method POST ### Endpoint /servers/startWorker/{workerType} ### Parameters #### Path Parameters - **workerType** (string) - Required - Worker type. Enum: "default", "email", "scheduler", "cache", "prio", "update" ### Response #### Success Response (200) - **saved** (boolean) - Status of the operation - **success** (boolean) - Success indicator - **name** (string) - Response name - **message** (string) - Response message - **url** (string) - Request URL ### Response Example { "saved": true, "success": true, "name": "Worker start signal sent", "message": "Worker start signal sent", "url": "/servers/startWorker/email" } ``` -------------------------------- ### GET /noticelists Source: https://www.misp-project.org/documentation/openapi.html Retrieves a list of all available noticelists in the MISP instance. ```APIDOC ## GET /noticelists ### Description Retrieves a list of noticelists to inform MISP users of legal, privacy, policy, or technical implications. ### Method GET ### Endpoint https://misp.local/noticelists ### Authorizations - ApiKeyAuth ### Response #### Success Response (200) - **Noticelist** (array) - List of noticelist objects containing id, name, type, description, version, enabled status, entry count, and valid attributes. #### Response Example [ { "Noticelist": { "id": "3", "name": "List of known domains to know external IP", "type": "cidr", "description": "string", "version": "10", "enabled": true, "warninglist_entry_count": "1234", "valid_attributes": "domain, hostname, domain|ip, uri, url", "NoticelistEntry": [ { "id": "1234", "noticelist_id": "3", "data": { "scope": ["attribute"], "field": ["category"], "value": ["Person"], "tags": ["tlp:white"], "message": { "en": "This attribute is likely to contain personal data and the data subject is likely to be directly identifiable." } } } ] } } ] ``` -------------------------------- ### GET /attributes Source: https://www.misp-project.org/documentation/openapi.html Retrieves a list of all attributes available in the system. ```APIDOC ## GET /attributes ### Description Returns a list of attributes. Requires ApiKeyAuth. ### Method GET ### Endpoint https://misp.local/attributes ### Response #### Success Response (200) - **attributes** (array) - A list of attribute objects containing details like id, event_id, category, type, value, and associated tags. ``` -------------------------------- ### Edit Server Response Example Source: https://www.misp-project.org/documentation/openapi.html The successful response returns the updated server object. ```json { "Server": { "id": "12345", "name": "Phishing Server", "url": "https://misppriv.circl.lu", "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f", "org_id": "12345", "push": true, "pull": true, "push_sightings": true, "push_galaxy_clusters": true, "pull_galaxy_clusters": true, "lastpulledid": "12345", "lastpushedid": "12345", "organization": "string", "remote_org_id": "12345", "publish_without_email": true, "unpublish_event": true, "self_signed": true, "pull_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}", "push_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]}}", "cert_file": "string", "client_cert_file": "string", "internal": true, "skip_proxy": true, "caching_enabled": true, "priority": "1", "cache_timestamp": true } } ``` -------------------------------- ### GET /servers/getVersion Source: https://www.misp-project.org/documentation/openapi.html Retrieves the current version of the MISP instance and associated permissions. ```APIDOC ## GET /servers/getVersion ### Description Retrieves the current version of the MISP instance and associated permissions. ### Method GET ### Endpoint https://misp.local/servers/getVersion ### Response #### Success Response (200) - **version** (string) - The current version of the MISP instance. - **perm_sync** (boolean) - Sync permission status. - **perm_sighting** (boolean) - Sighting permission status. - **perm_galaxy_editor** (boolean) - Galaxy editor permission status. - **request_encoding** (array) - Supported request encodings. #### Response Example { "version": "2.4.142", "perm_sync": true, "perm_sighting": true, "perm_galaxy_editor": true, "request_encoding": ["gzip"] } ``` -------------------------------- ### Add Server Response JSON Source: https://www.misp-project.org/documentation/openapi.html Example JSON response returned after successfully adding a server. ```json { "Server": { "id": "12345", "name": "Phishing Server", "url": "https://misppriv.circl.lu", "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f", "org_id": "12345", "push": true, "pull": true, "push_sightings": true, "push_galaxy_clusters": true, "pull_galaxy_clusters": true, "lastpulledid": "12345", "lastpushedid": "12345", "organization": "string", "remote_org_id": "12345", "publish_without_email": true, "unpublish_event": true, "self_signed": true, "pull_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}", "push_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]}}", "cert_file": "string", "client_cert_file": "string", "internal": true, "skip_proxy": true, "caching_enabled": true, "priority": "1", "cache_timestamp": true } } ``` -------------------------------- ### Add Event Response Sample Source: https://www.misp-project.org/documentation/openapi.html Example of a successful 200 OK response containing the created event object. ```json { "Event": { "id": "12345", "org_id": "12345", "distribution": "4", "info": "logged source ip", "orgc_id": "12345", "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b", "date": "1991-01-15", "published": false, "analysis": "0", "attribute_count": "321", "timestamp": "1617875568", "sharing_group_id": "1", "proposal_email_lock": true, "locked": true, "threat_level_id": "1", "publish_timestamp": "1617875568", "sighting_timestamp": "1617875568", "disable_correlation": false, "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b", "event_creator_email": "user@example.com", "Feed": { "id": "3", "name": "CIRCL OSINT Feed", "provider": "CIRCL", "url": "https://www.circl.lu/doc/misp/feed-osint", "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}", "enabled": true, "distribution": "4", "sharing_group_id": "1", "tag_id": "12345", "default": true, "source_format": "1", "fixed_event": true, "delta_merge": true, "event_id": "12345", "publish": false, "override_ids": true, "settings": "{\"csv\":{\"value\":\"\",\"delimiter\":\"\"},\"common\":{\"excluderegex\":\"\"},\"disable_correlation\":\"1\"}", "input_source": "local", "delete_local_file": true, "lookup_visible": true, "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n", "caching_enabled": true, "force_to_ids": true, "orgc_id": "12345", "cache_timestamp": "1617875568" }, "Org": { "id": "12345", "name": "ORGNAME", "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b" }, "Orgc": { "id": "12345", "name": "ORGNAME", "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b" }, "Attribute": [ { "id": "12345", "event_id": "12345", "object_id": "12345", "object_relation": "sensor", "category": "Internal reference", "type": "md5", "value": "127.0.0.1", "to_ids": true ``` -------------------------------- ### Get Organisation Response JSON Source: https://www.misp-project.org/documentation/openapi.html Example JSON response structure for retrieving an organization by its ID. ```json { "id": "12345", "name": "ORGNAME", "date_created": "2021-06-14 14:29:19", "date_modified": "2021-06-14 14:29:19", "description": "string", "type": "ADMIN", "nationality": "string", "sector": "string", "created_by": "12345", "uuid": "string", "contacts": "string", "local": true, "restricted_to_domain": [ "example.com" ], "landingpage": "string", "user_count": "3", "created_by_email": "string" } ``` -------------------------------- ### POST /servers/createSync Source: https://www.misp-project.org/documentation/openapi.html Creates a new server synchronization configuration. ```APIDOC ## POST /servers/createSync ### Description Creates a new server synchronization configuration. ### Method POST ### Endpoint https://misp.local/servers/createSync ### Response #### Success Response (200) - **Server** (object) - The created server sync object #### Response Example { "Server": { "url": "https://misppriv.circl.lu", "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b", "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f", "Organisation": { "name": "ORGNAME", "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b" } } } ``` -------------------------------- ### Get current instance settings and diagnostics Source: https://www.misp-project.org/documentation/openapi.html Provides a comprehensive diagnostic report including PHP settings, GPG status, STIX/Cybox library versions, and database health. ```json { * "version": { * "current": "v2.4.142", * "newest": "v2.4.142", * "upToDate": "same" }, * "phpSettings": { * "max_execution_time": { * "explanation": "The maximum duration that a script can run (does not affect the background workers). A too low number will break long running scripts like comprehensive API exports", * "recommended": 300, * "unit": "seconds", * "value": 300 }, * "memory_limit": { * "explanation": "The maximum duration that a script can run (does not affect the background workers). A too low number will break long running scripts like comprehensive API exports", * "recommended": 300, * "unit": "seconds", * "value": 300 }, * "upload_max_filesize": { * "explanation": "The maximum duration that a script can run (does not affect the background workers). A too low number will break long running scripts like comprehensive API exports", * "recommended": 300, * "unit": "seconds", * "value": 300 }, * "post_max_size": { * "explanation": "The maximum duration that a script can run (does not affect the background workers). A too low number will break long running scripts like comprehensive API exports", * "recommended": 300, * "unit": "seconds", * "value": 300 } }, * "gpgStatus": "FAIL: Failed to load GnuPG", * "proxyStatus": "not configured (so not tested)", * "zmqStatus": 1, * "stix": { * "operational": 1, * "stix": { * "version": "1.2.0.11", * "expected": ">1.2.0.9", * "status": 1 }, * "cybox": { * "version": "1.2.0.11", * "expected": ">1.2.0.9", * "status": 1 }, * "mixbox": { * "version": "1.2.0.11", * "expected": ">1.2.0.9", * "status": 1 }, * "maec": { * "version": "1.2.0.11", * "expected": ">1.2.0.9", * "status": 1 }, * "stix2": { * "version": "1.2.0.11", * "expected": ">1.2.0.9", * "status": 1 }, * "pymisp": { * "version": "1.2.0.11", * "expected": ">1.2.0.9", * "status": 1 } }, * "moduleStatus": { * "Enrichment": 1, * "Import": 1, * "Export": 1, * "Cortex": 1 }, * "writeableDirs": { * "/tmp": 0, * "/var/www/MISP/app/tmp": 0, * "/var/www/MISP/app/files": 0, * "/var/www/MISP/app/files/scripts/tmp": 0 }, * "writeableFiles": { * "/var/www/MISP/app/Config/config.php": 0, * "/var/www/MISP/.git/ORIG_HEAD": 2 }, * "readableFiles": { * "/var/www/MISP/app/files/scripts/stixtest.py": 0 }, * "dbDiagnostics": { * "admin_settings": { * "table": "admin_settings", * "used": "0.03 MB", * "reclaimable": "0 MB", * "data_in_bytes": 16384, * "index_in_bytes": 16384, * "reclaimable_in_bytes": 0 }, * "allowedlist": { * "table": "allowedlist", * "used": "0.02 MB", * "reclaimable": "0 MB", * "data_in_bytes": 16384, * "index_in_bytes": 0, * "reclaimable_in_bytes": 0 } }, * "dbSchemaDiagnostics": { * "dataSource": "Database/Mysql", * "actual_db_version": "68", * "checked_table_column": [ * "column_name" ], * "diagnostic": { }, * "diagnostic_index": { * "event_reports": { * "event_id": { ``` -------------------------------- ### POST /admin/users/add Source: https://www.misp-project.org/documentation/openapi.html Creates a new user account in the system. Requires an API key for authorization. ```APIDOC ## POST /admin/users/add ### Description Adds a new user to the MISP instance with the provided configuration details. ### Method POST ### Endpoint /admin/users/add ### Parameters #### Request Body - **org_id** (string) - Required - Organization ID - **server_id** (string) - Required - Server ID - **email** (string) - Required - User email address - **autoalert** (boolean) - Required - Auto alert setting - **authkey** (string) - Optional - API auth key - **invited_by** (string) - Required - User ID of the inviter - **gpgkey** (string) - Optional - GPG key - **certif_public** (string) - Optional - Public certificate - **nids_sid** (string) - Required - NIDS SID - **termsaccepted** (boolean) - Required - Terms accepted status - **newsread** (string) - Required - News read timestamp - **role_id** (string) - Required - Role ID - **change_pw** (string) - Required - Password change required flag - **contactalert** (boolean) - Required - Contact alert setting - **disabled** (boolean) - Required - Disabled status - **expiration** (string) - Optional - Expiration date-time - **current_login** (string) - Required - Current login timestamp - **last_login** (string) - Required - Last login timestamp - **force_logout** (boolean) - Required - Force logout status - **date_created** (string) - Required - Creation timestamp - **date_modified** (string) - Required - Modification timestamp ### Request Example { "org_id": "12345", "server_id": "12345", "email": "user@example.com", "autoalert": true, "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f", "invited_by": "12345", "gpgkey": "string", "certif_public": "string", "nids_sid": "4000000", "termsaccepted": true, "newsread": "1617875568", "role_id": "3", "change_pw": "0", "contactalert": true, "disabled": true, "expiration": "2019-08-24T14:15:22Z", "current_login": "1617875568", "last_login": "1617875568", "force_logout": true, "date_created": "1617875568", "date_modified": "1617875568" } ### Response #### Success Response (200) - **id** (string) - The ID of the created user #### Response Example { "id": "12345", "org_id": "12345", "email": "user@example.com" } ``` -------------------------------- ### GET /servers/getSetting/{settingName} Source: https://www.misp-project.org/documentation/openapi.html Retrieves the value and details of a specific MISP server setting by its name. ```APIDOC ## GET /servers/getSetting/{settingName} ### Description Retrieves the configuration details for a specific server setting. ### Method GET ### Endpoint /servers/getSetting/{settingName} ### Parameters #### Path Parameters - **settingName** (string) - Required - The name of the setting to retrieve (e.g., MISP.background_jobs). ### Response #### Success Response (200) - **level** (integer) - Setting level - **value** (string) - The value of the setting - **errorMessage** (string) - Error message if applicable - **test** (string) - Test identifier - **type** (string) - Data type - **null** (boolean) - Null status - **subGroup** (string) - Setting subgroup - **cli_only** (integer) - CLI only flag - **redacted** (boolean) - Redaction status - **optionsSource** (object) - Source of options - **afterHook** (string) - Hook executed after change - **error** (integer) - Error code - **tab** (string) - UI tab location - **setting** (string) - Setting name - **options** (object) - Available options ``` -------------------------------- ### Add Auth Key Response Sample Source: https://www.misp-project.org/documentation/openapi.html Example of the successful 200 response returned after adding an authentication key. ```json { "AuthKey": { "id": "12345", "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b", "authkey_start": "stri", "authkey_end": "stri", "created": "1617875568", "expiration": "1970-01-01 00:00:00", "read_only": true, "user_id": "12345", "comment": "string", "allowed_ips": [ "127.0.0.1" ], "last_used": "1617875568" } } ``` -------------------------------- ### Get Sightings by Event ID Response Source: https://www.misp-project.org/documentation/openapi.html Example JSON response structure for a successful retrieval of sightings associated with a specific event ID. ```json [ { "id": "12345", "attribute_id": "12345", "event_id": "12345", "org_id": "12345", "date_sighting": "1617875568", "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b", "source": "string", "type": "string", "attribute_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b", "Organisation": { "id": "12345", "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b", "name": "ORGNAME" } } ] ``` -------------------------------- ### Retrieve User Setting JSON Response Source: https://www.misp-project.org/documentation/openapi.html Example JSON structure returned when successfully fetching a user setting. ```json { "UserSetting": { "id": "12345", "setting": "publish_alert_filter", "value": { "widget": "MispStatusWidget", "position": { "x": "0", "y": "0", "width": "2", "height": "2" } }, "user_id": "12345", "timestamp": "1617875568" } } ``` -------------------------------- ### REST Search Response Example Source: https://www.misp-project.org/documentation/openapi.html Example JSON response structure returned by the /events/restSearch endpoint. ```json { "response": [ { "Event": { "id": "12345", "org_id": "12345", "distribution": "4", "info": "logged source ip", "orgc_id": "12345", "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b", "date": "1991-01-15", "published": false, "analysis": "0", "attribute_count": "321" ``` -------------------------------- ### POST /servers/import Source: https://www.misp-project.org/documentation/openapi.html Imports a new server configuration into the MISP instance. ```APIDOC ## POST /servers/import ### Description Imports a server configuration into MISP. Requires an API key for authentication. ### Method POST ### Endpoint https://misp.local/servers/import ### Parameters #### Request Body - **name** (string) - Required - Server name (max 255 characters) - **url** (string) - Required - Server URL - **uuid** (string) - Required - Server UUID - **authkey** (string) - Required - Authentication key (40 characters) - **Organisation** (object) - Required - Organization details ### Request Example { "name": "Phishing Server", "url": "https://misppriv.circl.lu", "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b", "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f", "Organisation": { "name": "ORGNAME" } } ### Response #### Success Response (200) - **Server** (object) - The imported server object details #### Response Example { "Server": { "id": "12345", "name": "Phishing Server", "url": "https://misppriv.circl.lu", "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f", "org_id": "12345", "push": true, "pull": true, "push_sightings": true, "push_galaxy_clusters": true, "pull_galaxy_clusters": true, "lastpulledid": "12345", "lastpushedid": "12345", "organization": "string", "remote_org_id": "12345", "publish_without_email": true, "unpublish_event": true, "self_signed": true, "pull_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}", "push_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]}}", "cert_file": "string", "client_cert_file": "string", "internal": true, "skip_proxy": true, "caching_enabled": true, "priority": "1", "cache_timestamp": true } } ``` -------------------------------- ### GET /taxonomies Source: https://www.misp-project.org/documentation/openapi.html Retrieves a list of all available taxonomies. ```APIDOC ## GET /taxonomies ### Description Retrieves a list of all available taxonomies used for classification. ### Method GET ### Endpoint https://misp.local/taxonomies ### Response #### Success Response (200) - **Taxonomy** (object) - The taxonomy details. - **total_count** (integer) - Total count of taxonomies. - **current_count** (integer) - Current count of taxonomies. #### Response Example [ { "Taxonomy": { "id": "12345", "namespace": "tlp", "description": "Disclosure is not limited...", "version": "5", "enabled": true, "exclusive": true, "required": true }, "total_count": 0, "current_count": 0 } ] ``` -------------------------------- ### GET /auth_keys Source: https://www.misp-project.org/documentation/openapi.html Retrieves a list of authentication keys. ```APIDOC ## GET /auth_keys ### Description Retrieves all authentication keys associated with the user. ### Method GET ### Endpoint https://misp.local/auth_keys ### Response #### Success Response (200) - **AuthKey** (object) - The authentication key details. - **User** (object) - The user associated with the key. ``` -------------------------------- ### POST /galaxies/import Source: https://www.misp-project.org/documentation/openapi.html Import a galaxy cluster into the system. ```APIDOC ## POST /galaxies/import ### Description Import a galaxy cluster. ### Method POST ### Endpoint https://misp.local/galaxies/import ### Request Body - **GalaxyCluster** (array) - Required - Array of GalaxyCluster objects. ### Response #### Success Response (200) - **saved** (boolean) - Indicates if the operation was saved. - **success** (boolean) - Indicates if the operation was successful. - **name** (string) - Status message. - **message** (string) - Detailed status message. - **url** (string) - The endpoint URL. #### Response Example { "saved": true, "success": true, "name": "'Galaxy clusters imported. 1 imported, 0 ignored, 0 failed.", "message": "'Galaxy clusters imported. 1 imported, 0 ignored, 0 failed.", "url": "/galaxies/import" } ``` -------------------------------- ### GET /sharing_groups Source: https://www.misp-project.org/documentation/openapi.html Retrieves a list of all sharing groups. ```APIDOC ## GET /sharing_groups ### Description Retrieves a list of all sharing groups available in the MISP instance. ### Method GET ### Endpoint /sharing_groups ### Response #### Success Response (200) - **response** (array) - List of sharing group objects #### Response Example { "response": [ { "SharingGroup": { "id": "1", "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b", "name": "Banking Sharing Group", "description": "Banking Institutions of X Sharing Group", "releasability": "string", "local": true, "active": true, "org_count": "6" }, "Organisation": { "id": "12345", "name": "ORGNAME", "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b" }, "editable": true, "deletable": true } ] } ``` -------------------------------- ### GET /servers/serverSettings Source: https://www.misp-project.org/documentation/openapi.html Retrieves detailed server settings, diagnostics, and system health information. ```APIDOC ## GET /servers/serverSettings ### Description Retrieves detailed server settings, diagnostics, and system health information including PHP settings, GPG status, and database diagnostics. ### Method GET ### Endpoint https://misp.local/servers/serverSettings ### Response #### Success Response (200) - **version** (object) - Versioning details including current and newest versions. - **phpSettings** (object) - Configuration details for PHP. - **gpgStatus** (string) - Status of GnuPG. - **zmqStatus** (integer) - Status of ZMQ. - **stix** (object) - STIX/Cybox/MAEC compatibility status. - **moduleStatus** (object) - Status of various modules. #### Response Example { "version": { "current": "v2.4.142", "newest": "v2.4.142", "upToDate": "same" }, "gpgStatus": "FAIL: Failed to load GnuPG", "zmqStatus": 1 } ``` -------------------------------- ### GET /eventReports/index Source: https://www.misp-project.org/documentation/openapi.html Retrieves a list of all available event reports. ```APIDOC ## GET /eventReports/index ### Description Retrieves a list of Event Reports. ### Method GET ### Endpoint https://misp.local/eventReports/index ### Response #### Success Response (200) - **EventReport** (object) - List of event reports #### Response Example [ { "EventReport": { "id": "12345", "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b", "event_id": "12345", "name": "Report of the incident", "content": "string", "distribution": "4", "sharing_group_id": "1", "timestamp": "1617875568", "deleted": false } } ] ``` -------------------------------- ### Perform API Request with cURL Source: https://www.misp-project.org/documentation/openapi.html Example of a cURL request including Authorization, Accept, and Content-Type headers. ```bash curl --header "Authorization: YOUR_API_KEY" \ --header "Accept: application/json" \ --header "Content-Type: application/json" https:/// ``` -------------------------------- ### GET /user_settings Source: https://www.misp-project.org/documentation/openapi.html Retrieves the settings configured for the current user. ```APIDOC ## GET /user_settings ### Description Retrieves a list of user settings, which allow customization of MISP features and UI elements. ### Method GET ### Endpoint /user_settings ### Response #### Success Response (200) - **UserSetting** (object) - The user setting configuration object #### Response Example [ { "UserSetting": { "id": "12345", "setting": "publish_alert_filter", "value": { "widget": "MispStatusWidget", "position": { "x": "0", "y": "0", "width": "2", "height": "2" } }, "user_id": "12345", "timestamp": "1617875568" } } ] ``` -------------------------------- ### GET /servers/getInstanceUUID Source: https://www.misp-project.org/documentation/openapi.html Retrieves the UUID of the current MISP instance. ```APIDOC ## GET /servers/getInstanceUUID ### Description Retrieves the UUID of the current MISP instance. ### Method GET ### Endpoint https://misp.local/servers/getInstanceUUID ### Response #### Success Response (200) - **uuid** (string) - The instance UUID #### Response Example { "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b" } ``` -------------------------------- ### GET /admin/users Source: https://www.misp-project.org/documentation/openapi.html Retrieves a list of all users registered in the system. ```APIDOC ## GET /admin/users ### Description Retrieves a list of users including their associated roles and organization details. ### Method GET ### Endpoint /admin/users ### Response #### Success Response (200) - **User** (object) - User account details - **Role** (object) - Role permissions associated with the user - **Organisation** (object) - Organization details #### Response Example [ { "User": { "id": "12345", "email": "user@example.com" }, "Role": { "name": "ORGNAME" }, "Organisation": { "name": "ORGNAME" } } ] ``` -------------------------------- ### GET /events Source: https://www.misp-project.org/documentation/openapi.html Retrieves a list of all events with their extended properties. ```APIDOC ## GET /events ### Description Fetches a comprehensive list of events including metadata, organization details, attributes, and associated tags. ### Method GET ### Endpoint /events ### Response #### Success Response (200) - **events** (array) - A list of event objects containing details like id, uuid, info, and associated attributes. #### Response Example [ { "id": "12345", "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b", "info": "logged source ip", "published": false } ] ``` -------------------------------- ### Search Events Response Sample Source: https://www.misp-project.org/documentation/openapi.html Example JSON response structure for a successful event search query. ```json [ { "id": "12345", "distribution": "4", "sharing_group_id": "1", "timestamp": "1617875568", "deleted": false }, { "Tag": [ { "id": "12345", "name": "tlp:white", "colour": "#ffffff", "exportable": true, "org_id": "12345", "user_id": "12345", "hide_tag": false, "numerical_value": "12345", "is_galaxy": true, "is_custom_galaxy": true, "inherited": 1 } ] } ] ``` -------------------------------- ### GET /taxonomies/view/{taxonomyId} Source: https://www.misp-project.org/documentation/openapi.html Retrieves the details of a specific taxonomy by its ID. ```APIDOC ## GET /taxonomies/view/{taxonomyId} ### Description Retrieves the full details and entries of a specific taxonomy identified by its numeric ID. ### Method GET ### Endpoint https://misp.local/taxonomies/view/{taxonomyId} ### Parameters #### Path Parameters - **taxonomyId** (string) - Required - Numeric ID of the taxonomy (max 10 characters, numeric). ### Response #### Success Response (200) - **Taxonomy** (object) - The taxonomy metadata. - **entries** (array) - List of taxonomy entries. #### Response Example { "Taxonomy": { "id": "12345", "namespace": "tlp", "description": "Disclosure is not limited...", "version": "5", "enabled": true, "exclusive": true, "required": true }, "entries": [ { "tag": "tlp:white", "expanded": "string", "description": "string", "exclusive_predicate": true, "existing_tag": true } ] } ``` -------------------------------- ### POST /servers/cache Source: https://www.misp-project.org/documentation/openapi.html Initiates a server caching job. ```APIDOC ## POST /servers/cache ### Description Initiates a server caching job. ### Method POST ### Endpoint https://misp.local/servers/cache ### Response #### Success Response (200) - **saved** (boolean) - Status of the save operation - **success** (boolean) - Status of the operation - **name** (string) - Description of the initiated job - **message** (string) - Description of the initiated job - **url** (string) - The endpoint URL #### Response Example { "saved": true, "success": true, "name": "Server caching job initiated.", "message": "Server caching job initiated.", "url": "/servers/cache" } ```