{"openapi":"3.0.3","info":{"title":"Intellescope API","version":"2026-07-26","description":"Authenticate with Authorization: Bearer <personal_api_token_or_service_principal_secret>. Keys inherit the caller's role permissions. Requires persistence (DATABASE_URL).\n\nDeprecation policy: /docs/api/deprecation\nOEM metering: unique observables per month (soft-cap). Outcome POST is free.\nSandbox: Authorization Bearer pk_test_… returns synthetic verdicts without quota.","x-deprecation-policy":"/docs/api/deprecation"},"servers":[{"url":"/","description":"Current deployment"}],"paths":{"/api/v1/verdicts":{"post":{"summary":"Compute an OEM verdict for one observable (unique-observable meter).","tags":["Tenant inventory"],"description":"Headers: Idempotency-Key. Body: type, value, format?=json|stix. Sandbox: pk_test_.","responses":{"200":{"description":"OK"}}}},"/api/v1/verdicts/{id}":{"get":{"summary":"Retrieve a previously computed OEM verdict.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}}},"/api/v1/verdicts/{id}/outcome":{"post":{"summary":"Report resolution outcome — free, unmetered.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}}},"/api/v1/batches":{"post":{"summary":"Submit an async batch of observables (202 + poll).","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}}},"/api/v1/batches/{id}":{"get":{"summary":"Poll batch job status.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}}},"/api/v1/batches/{id}/results":{"get":{"summary":"Retrieve completed batch verdicts.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}}},"/api/v1/usage":{"get":{"summary":"Unique-observable usage for the current billing month.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}}},"/api/v1/openapi":{"get":{"summary":"Published OpenAPI 3.0 document (unauthenticated).","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}}},"/api/v1/indicators":{"get":{"summary":"List indicators in the tenant inventory (paginated).","tags":["Tenant inventory"],"description":"Query: limit (1–100, default 50), cursor (page token)","responses":{"200":{"description":"OK"}}},"post":{"summary":"Submit an indicator with required analytical context.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}}},"/api/v1/indicators/{id}":{"get":{"summary":"Fetch one indicator with attached evidence claims.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}},"patch":{"summary":"Update curation fields or transition state (published / deprecated).","tags":["Tenant inventory"],"description":"Body: description?, tags?, activityClass?, state?: \"published\"|\"deprecated\"","responses":{"200":{"description":"OK"}}},"delete":{"summary":"Soft-delete an indicator by deprecating it. Evidence is retained.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}}},"/api/v1/evidence":{"get":{"summary":"List evidence claims (optionally filtered to one indicator).","tags":["Tenant inventory"],"description":"Query: limit, cursor (page token), indicatorId. Evidence is append-only — no PATCH/DELETE.","responses":{"200":{"description":"OK"}}}},"/api/v1/cases":{"get":{"summary":"List cases.","tags":["Tenant inventory"],"description":"Query: limit, cursor (page token)","responses":{"200":{"description":"OK"}}},"post":{"summary":"Create a case.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}}},"/api/v1/cases/{id}":{"get":{"summary":"Fetch one case.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}},"patch":{"summary":"Update case assignment / status fields.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}},"delete":{"summary":"Soft-delete a case by moving it to cold. History is retained.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}}},"/api/v1/dispositions":{"get":{"summary":"List closed-loop disposition outcomes.","tags":["Tenant inventory"],"description":"Query: limit, cursor (page token), indicatorId","responses":{"200":{"description":"OK"}}}},"/api/v1/sources":{"get":{"summary":"List contributing sources and reliability metadata.","tags":["Tenant inventory"],"description":"Query: limit, cursor (page token)","responses":{"200":{"description":"OK"}}}},"/api/v1/threat-groups":{"get":{"summary":"List threat group records.","tags":["Tenant inventory"],"description":"Query: limit, cursor (page token)","responses":{"200":{"description":"OK"}}}},"/api/v1/threat-groups/{id}":{"get":{"summary":"Fetch one threat group.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}},"patch":{"summary":"Update threat group metadata (name, aliases, techniques).","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}}},"/api/v1/campaigns":{"get":{"summary":"List campaigns.","tags":["Tenant inventory"],"description":"Query: limit, cursor (page token)","responses":{"200":{"description":"OK"}}}},"/api/v1/campaigns/{id}":{"get":{"summary":"Fetch one campaign.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}},"patch":{"summary":"Update campaign fields.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}},"delete":{"summary":"Hard-delete a campaign record.","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}}},"/api/v1/audit":{"get":{"summary":"List audit events (own events unless admin).","tags":["Tenant inventory"],"description":"Query: limit, cursor (page token). Audit is append-only — no PATCH/DELETE.","responses":{"200":{"description":"OK"}}}},"/api/v1/users/me":{"get":{"summary":"Export the authenticated user's personal data (GDPR Art. 15).","tags":["Tenant inventory"],"responses":{"200":{"description":"OK"}}}}},"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","description":"pk_live_… production · pk_test_… sandbox"}}},"security":[{"bearerAuth":[]}]}