Loading the archive…
Loading the archive…
OTIA serves the same sourced corpus three coequal ways. Every REST endpoint is CORS-enabled, read-only, and rate-limited; responses are JSON. No key required.
Indicators
| Method | Endpoint | Description |
|---|---|---|
| GET | /api/iocs?q=&type=&vendor=&active=&limit=&offset= | Search indicators. Filter by free text, type (ip/domain/url/md5/sha1/sha256/ssl/ja3/cve), vendor, or active state. |
| GET | /api/iocs/{id} | One indicator by its sha256-derived id, with source and first/last-seen dates. |
| GET | /api/sources | Every feed source with status, category, last fetch, and indicator count. |
ATT&CK entities
| Method | Endpoint | Description |
|---|---|---|
| GET | /api/actors?q= | Threat actors (intrusion sets). Add /{id} for one actor plus its relations. |
| GET | /api/malware?q= | Malware & tools. Add /{id} for one entry plus its relations. |
| GET | /api/techniques?q= | ATT&CK techniques. Add /{id} for one technique plus its relations. |
| GET | /api/reports?q=&year= | APT reports. Add /{id} for one report plus its linked actors. |
Cross-link & search
| Method | Endpoint | Description |
|---|---|---|
| GET | /api/search?q= | Global search across all entity kinds. Returns { kind, ref_id, name } hits. |
| GET | /api/graph?kind=&id= | The typed-edge neighborhood of one entity (actor/malware/technique/report). |
A public Model Context Protocol endpoint at /api/mcp lets an AI assistant query the archive as a tool. Point any MCP client at that URL — the same sourced facts, machine-addressable.
| Tool | Description |
|---|---|
| search_iocs | Search indicators by text, type, or vendor. |
| lookup_ioc | Fetch one indicator by id. |
| list_sources | List the feed sources and their status. |
| search_entities | Search actors, malware, techniques, and reports. |
| get_actor | One actor (e.g. G0032) with its relations. |
| get_malware | One malware/tool (e.g. S0154) with its relations. |
| get_technique | One technique (e.g. T1055) with its relations. |
| get_apt_report | One APT report with its linked actors. |