{"openapi":"3.0.3","info":{"title":"CyberRamen Tools API","version":"1","description":"Free, no-auth, pure-logic security transforms. Deterministic; nothing stored or forwarded. Guide with live examples: https://cyberramen.com/en/api","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"contact":{"email":"hello@cyberramen.com"}},"servers":[{"url":"https://cyberramen.com/api/tools"}],"tags":[{"name":"tools"}],"paths":{"/defang":{"get":{"operationId":"get_defang","summary":"Defang URLs, domains, IPs and emails (idempotent).","tags":["tools"],"parameters":[{"name":"input","in":"query","required":true,"description":"Text containing indicators (up to 8 KB).","schema":{"type":"string"},"example":"http://evil.example.com/x"},{"name":"mode","in":"query","required":false,"description":"Direction.","schema":{"type":"string","enum":["defang","refang"]},"example":"defang"}],"responses":{"200":{"description":"OK \u2014 fields: mode, input, result","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}},"post":{"operationId":"post_defang","summary":"Defang URLs, domains, IPs and emails (idempotent). (JSON body; use for large inputs)","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"input":{"type":"string","description":"Text containing indicators (up to 8 KB).","example":"http://evil.example.com/x"},"mode":{"type":"string","enum":["defang","refang"],"description":"Direction.","example":"defang"}},"required":["input"]}}}},"responses":{"200":{"description":"OK \u2014 fields: mode, input, result","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/refang":{"get":{"operationId":"get_refang","summary":"Reverse a defanged indicator ([.] (.) {.} [dot] (dot) [at] [://] hxxp h**p).","tags":["tools"],"parameters":[{"name":"input","in":"query","required":true,"description":"Defanged text (up to 8 KB).","schema":{"type":"string"},"example":"hxxp://evil[.]example[.]com/x"}],"responses":{"200":{"description":"OK \u2014 fields: mode, input, result","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}},"post":{"operationId":"post_refang","summary":"Reverse a defanged indicator ([.] (.) {.} [dot] (dot) [at] [://] hxxp h**p). (JSON body; use for large inputs)","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"input":{"type":"string","description":"Defanged text (up to 8 KB).","example":"hxxp://evil[.]example[.]com/x"}},"required":["input"]}}}},"responses":{"200":{"description":"OK \u2014 fields: mode, input, result","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/hash-id":{"get":{"operationId":"get_hash_id","summary":"Guess a hash type from length/charset or crypt(3) prefix (heuristic).","tags":["tools"],"parameters":[{"name":"input","in":"query","required":true,"description":"The hash (up to 256 chars).","schema":{"type":"string"},"example":"5d41402abc4b2a76b9719d911017c592"}],"responses":{"200":{"description":"OK \u2014 fields: input, length, candidates, note","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}},"post":{"operationId":"post_hash_id","summary":"Guess a hash type from length/charset or crypt(3) prefix (heuristic). (JSON body; use for large inputs)","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"input":{"type":"string","description":"The hash (up to 256 chars).","example":"5d41402abc4b2a76b9719d911017c592"}},"required":["input"]}}}},"responses":{"200":{"description":"OK \u2014 fields: input, length, candidates, note","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/cidr":{"get":{"operationId":"get_cidr","summary":"IPv4 or IPv6 subnet math.","tags":["tools"],"parameters":[{"name":"input","in":"query","required":true,"description":"CIDR notation (up to 64 chars).","schema":{"type":"string"},"example":"10.0.0.0/24"}],"responses":{"200":{"description":"OK \u2014 fields: input, network, prefix, netmask, first_host|first_address, last_host|last_address, num_addresses, family","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}},"post":{"operationId":"post_cidr","summary":"IPv4 or IPv6 subnet math. (JSON body; use for large inputs)","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"input":{"type":"string","description":"CIDR notation (up to 64 chars).","example":"10.0.0.0/24"}},"required":["input"]}}}},"responses":{"200":{"description":"OK \u2014 fields: input, network, prefix, netmask, first_host|first_address, last_host|last_address, num_addresses, family","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/timestamp":{"get":{"operationId":"get_timestamp","summary":"Normalise an epoch (s/ms/\u00b5s/ns by digit count) or date string to ISO 8601 / RFC 2822.","tags":["tools"],"parameters":[{"name":"input","in":"query","required":true,"description":"Epoch or date string (up to 64 chars).","schema":{"type":"string"},"example":"1700000000"}],"responses":{"200":{"description":"OK \u2014 fields: input, detected_unit, epoch_seconds, iso8601_utc, rfc2822, date_utc, weekday","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}},"post":{"operationId":"post_timestamp","summary":"Normalise an epoch (s/ms/\u00b5s/ns by digit count) or date string to ISO 8601 / RFC 2822. (JSON body; use for large inputs)","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"input":{"type":"string","description":"Epoch or date string (up to 64 chars).","example":"1700000000"}},"required":["input"]}}}},"responses":{"200":{"description":"OK \u2014 fields: input, detected_unit, epoch_seconds, iso8601_utc, rfc2822, date_utc, weekday","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/ioc-extract":{"get":{"operationId":"get_ioc_extract","summary":"Extract and de-duplicate URLs, IPv4s, domains, emails and MD5/SHA-1/SHA-256 from free text.","tags":["tools"],"parameters":[{"name":"input","in":"query","required":true,"description":"Free text (up to 200 KB).","schema":{"type":"string"},"example":"see 8.8.8.8 and evil[.]com"}],"responses":{"200":{"description":"OK \u2014 fields: counts, iocs, warnings, note","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}},"post":{"operationId":"post_ioc_extract","summary":"Extract and de-duplicate URLs, IPv4s, domains, emails and MD5/SHA-1/SHA-256 from free text. (JSON body; use for large inputs)","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"input":{"type":"string","description":"Free text (up to 200 KB).","example":"see 8.8.8.8 and evil[.]com"}},"required":["input"]}}}},"responses":{"200":{"description":"OK \u2014 fields: counts, iocs, warnings, note","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/cvss":{"get":{"operationId":"get_cvss","summary":"CVSS v3.1/v3.0 base score, or CVSS v4.0 (B/BT/BE/BTE) with the FIRST reference algorithm.","tags":["tools"],"parameters":[{"name":"vector","in":"query","required":true,"description":"Full vector starting with CVSS:3.1/, CVSS:3.0/ or CVSS:4.0/ (up to 256 chars).","schema":{"type":"string"},"example":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"responses":{"200":{"description":"OK \u2014 fields: vector, version, base_score|score, severity, scope|score_type, macro_vector (v4)","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}},"post":{"operationId":"post_cvss","summary":"CVSS v3.1/v3.0 base score, or CVSS v4.0 (B/BT/BE/BTE) with the FIRST reference algorithm. (JSON body; use for large inputs)","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"vector":{"type":"string","description":"Full vector starting with CVSS:3.1/, CVSS:3.0/ or CVSS:4.0/ (up to 256 chars).","example":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}},"required":["vector"]}}}},"responses":{"200":{"description":"OK \u2014 fields: vector, version, base_score|score, severity, scope|score_type, macro_vector (v4)","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/hash":{"get":{"operationId":"get_hash","summary":"Digests of a text (UTF-8 bytes).","tags":["tools"],"parameters":[{"name":"input","in":"query","required":true,"description":"Text to hash (up to 200 KB).","schema":{"type":"string"},"example":"hello"},{"name":"algo","in":"query","required":false,"description":"One algorithm; omit for all.","schema":{"type":"string","enum":["md5","sha1","sha256","sha384","sha512","sha3-256","sha3-512","crc32b"]},"example":"sha256"}],"responses":{"200":{"description":"OK \u2014 fields: input_bytes, encoding, hashes","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}},"post":{"operationId":"post_hash","summary":"Digests of a text (UTF-8 bytes). (JSON body; use for large inputs)","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"input":{"type":"string","description":"Text to hash (up to 200 KB).","example":"hello"},"algo":{"type":"string","enum":["md5","sha1","sha256","sha384","sha512","sha3-256","sha3-512","crc32b"],"description":"One algorithm; omit for all.","example":"sha256"}},"required":["input"]}}}},"responses":{"200":{"description":"OK \u2014 fields: input_bytes, encoding, hashes","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/base64":{"get":{"operationId":"get_base64","summary":"Base64 encode/decode, UTF-8 safe, standard or URL-safe alphabet.","tags":["tools"],"parameters":[{"name":"input","in":"query","required":true,"description":"Text or base64 (up to 200 KB).","schema":{"type":"string"},"example":"aGVsbG8gd29ybGQ"},{"name":"mode","in":"query","required":false,"description":"Direction.","schema":{"type":"string","enum":["encode","decode"]},"example":"decode"},{"name":"urlsafe","in":"query","required":false,"description":"Emit the URL-safe alphabet without padding (encode only).","schema":{"type":"boolean"},"example":"1"}],"responses":{"200":{"description":"OK \u2014 fields: mode, variant, result|result_hex, is_text","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}},"post":{"operationId":"post_base64","summary":"Base64 encode/decode, UTF-8 safe, standard or URL-safe alphabet. (JSON body; use for large inputs)","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"input":{"type":"string","description":"Text or base64 (up to 200 KB).","example":"aGVsbG8gd29ybGQ"},"mode":{"type":"string","enum":["encode","decode"],"description":"Direction.","example":"decode"},"urlsafe":{"type":"boolean","description":"Emit the URL-safe alphabet without padding (encode only).","example":"1"}},"required":["input"]}}}},"responses":{"200":{"description":"OK \u2014 fields: mode, variant, result|result_hex, is_text","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/url-parse":{"get":{"operationId":"get_url_parse","summary":"URL components, query parameters (duplicates kept), defanged copy and triage flags.","tags":["tools"],"parameters":[{"name":"input","in":"query","required":true,"description":"URL (defanged accepted; bare host assumed http) (up to 4 KB).","schema":{"type":"string"},"example":"hxxps://login.example[.]com:8443/a.php?u=1"}],"responses":{"200":{"description":"OK \u2014 fields: scheme, host, host_type, registrable_domain, port, path, query_params, defanged, flags","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}},"post":{"operationId":"post_url_parse","summary":"URL components, query parameters (duplicates kept), defanged copy and triage flags. (JSON body; use for large inputs)","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"input":{"type":"string","description":"URL (defanged accepted; bare host assumed http) (up to 4 KB).","example":"hxxps://login.example[.]com:8443/a.php?u=1"}},"required":["input"]}}}},"responses":{"200":{"description":"OK \u2014 fields: scheme, host, host_type, registrable_domain, port, path, query_params, defanged, flags","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/jwt-decode":{"get":{"operationId":"get_jwt_decode","summary":"Decode a JWT header/payload with exp/nbf status. No signature verification.","tags":["tools"],"parameters":[{"name":"input","in":"query","required":true,"description":"Compact JWS token (Bearer prefix tolerated) (up to 16 KB).","schema":{"type":"string"},"example":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ4In0.sig"}],"responses":{"200":{"description":"OK \u2014 fields: header, payload, alg, times, status, warnings, note","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}},"post":{"operationId":"post_jwt_decode","summary":"Decode a JWT header/payload with exp/nbf status. No signature verification. (JSON body; use for large inputs)","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"input":{"type":"string","description":"Compact JWS token (Bearer prefix tolerated) (up to 16 KB).","example":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ4In0.sig"}},"required":["input"]}}}},"responses":{"200":{"description":"OK \u2014 fields: header, payload, alg, times, status, warnings, note","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/cert-decode":{"get":{"operationId":"get_cert_decode","summary":"X.509 certificate summary from PEM or bare base64 DER (first certificate of a chain).","tags":["tools"],"parameters":[{"name":"input","in":"query","required":true,"description":"PEM or base64 DER (up to 64 KB).","schema":{"type":"string"},"example":"-----BEGIN CERTIFICATE-----\u2026"}],"responses":{"200":{"description":"OK \u2014 fields: subject, issuer, san, not_before, not_after, status, days_remaining, key, validation, fingerprints","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}},"post":{"operationId":"post_cert_decode","summary":"X.509 certificate summary from PEM or bare base64 DER (first certificate of a chain). (JSON body; use for large inputs)","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"input":{"type":"string","description":"PEM or base64 DER (up to 64 KB).","example":"-----BEGIN CERTIFICATE-----\u2026"}},"required":["input"]}}}},"responses":{"200":{"description":"OK \u2014 fields: subject, issuer, san, not_before, not_after, status, days_remaining, key, validation, fingerprints","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/stix":{"get":{"operationId":"get_stix","summary":"STIX 2.1 bundle of indicators/vulnerabilities from a list of IOCs (stable UUIDv5 ids, TLP 2.0 marking).","tags":["tools"],"parameters":[{"name":"input","in":"query","required":true,"description":"IOCs separated by newlines, commas or spaces (up to 200 KB).","schema":{"type":"string"},"example":"evil[.]com,8.8.8.8,CVE-2021-44228"},{"name":"tlp","in":"query","required":false,"description":"TLP 2.0 marking.","schema":{"type":"string","enum":["clear","green","amber","amber+strict","red"]},"example":"amber"},{"name":"labels","in":"query","required":false,"description":"Comma list of indicator_types (JSON array accepted on POST).","schema":{"type":"string"},"example":"malicious-activity"},{"name":"confidence","in":"query","required":false,"description":"0\u2013100 (default 50).","schema":{"type":"integer"},"example":"80"},{"name":"valid_days","in":"query","required":false,"description":"Sets valid_until.","schema":{"type":"integer"},"example":"30"},{"name":"producer","in":"query","required":false,"description":"Adds an identity object and created_by_ref.","schema":{"type":"string"},"example":"Blue Team"}],"responses":{"200":{"description":"OK \u2014 fields: bundle, counts, unrecognized, note","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}},"post":{"operationId":"post_stix","summary":"STIX 2.1 bundle of indicators/vulnerabilities from a list of IOCs (stable UUIDv5 ids, TLP 2.0 marking). (JSON body; use for large inputs)","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"input":{"type":"string","description":"IOCs separated by newlines, commas or spaces (up to 200 KB).","example":"evil[.]com,8.8.8.8,CVE-2021-44228"},"tlp":{"type":"string","enum":["clear","green","amber","amber+strict","red"],"description":"TLP 2.0 marking.","example":"amber"},"labels":{"type":"string","description":"Comma list of indicator_types (JSON array accepted on POST).","example":"malicious-activity"},"confidence":{"type":"integer","description":"0\u2013100 (default 50).","example":"80"},"valid_days":{"type":"integer","description":"Sets valid_until.","example":"30"},"producer":{"type":"string","description":"Adds an identity object and created_by_ref.","example":"Blue Team"}},"required":["input"]}}}},"responses":{"200":{"description":"OK \u2014 fields: bundle, counts, unrecognized, note","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/spf":{"get":{"operationId":"get_spf","summary":"Analyse an SPF record text (no DNS): all qualifier, lookups, duplicates, unknown terms.","tags":["tools"],"parameters":[{"name":"input","in":"query","required":true,"description":"One or more TXT strings, newline-separated (up to 8 KB).","schema":{"type":"string"},"example":"v=spf1 include:_spf.google.com ~all"}],"responses":{"200":{"description":"OK \u2014 fields: found, record, valid, issues, recommendations, lookups, all_qualifier, records_count","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}},"post":{"operationId":"post_spf","summary":"Analyse an SPF record text (no DNS): all qualifier, lookups, duplicates, unknown terms. (JSON body; use for large inputs)","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"input":{"type":"string","description":"One or more TXT strings, newline-separated (up to 8 KB).","example":"v=spf1 include:_spf.google.com ~all"}},"required":["input"]}}}},"responses":{"200":{"description":"OK \u2014 fields: found, record, valid, issues, recommendations, lookups, all_qualifier, records_count","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}}},"/dmarc":{"get":{"operationId":"get_dmarc","summary":"Analyse a DMARC record text (no DNS): policy, sp, pct, rua, alignment, tag order, duplicates.","tags":["tools"],"parameters":[{"name":"input","in":"query","required":true,"description":"One or more TXT strings, newline-separated (up to 8 KB).","schema":{"type":"string"},"example":"v=DMARC1; p=reject; rua=mailto:d@example.com"}],"responses":{"200":{"description":"OK \u2014 fields: found, record, policy, subdomain_policy, pct, valid, issues, recommendations, tags","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}},"post":{"operationId":"post_dmarc","summary":"Analyse a DMARC record text (no DNS): policy, sp, pct, rua, alignment, tag order, duplicates. (JSON body; use for large inputs)","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"input":{"type":"string","description":"One or more TXT strings, newline-separated (up to 8 KB).","example":"v=DMARC1; p=reject; rua=mailto:d@example.com"}},"required":["input"]}}}},"responses":{"200":{"description":"OK \u2014 fields: found, record, policy, subdomain_policy, pct, valid, issues, recommendations, tags","headers":{"X-RateLimit-Limit":{"schema":{"type":"integer"}},"X-RateLimit-Remaining":{"schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Epoch seconds when the window resets","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"400":{"$ref":"#/components/responses/Error"},"429":{"$ref":"#/components/responses/RateLimited"}}}}},"components":{"responses":{"Error":{"description":"Input could not be processed","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}},"required":["error"]}}}},"RateLimited":{"description":"Rate limit exceeded (120/min). Retry-After header tells when.","headers":{"Retry-After":{"schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}}}}}