# API Request ve Response Örnekleri



# Analyst Data

#### Add analyst data:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/analystData/add/{analystType}/{objectUUID}/{ObjectType}</p>

##### Response:

**<span style="text-decoration: underline; color: rgb(0, 0, 0);">200:</span>**

**<span style="text-decoration: underline; color: rgb(0, 0, 0);">AnalystNote:</span>**

```
{
  "note": "Provide more context",
  "language": "fr-BE",
  "note_type_name": "Note",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_type": "Attribute",
  "authors": "john.doe@admin.test",
  "org_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "orgc_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "created": "2024-03-19 11:10:24",
  "modified": "2024-03-19 11:10:24",
  "distribution": "0",
  "sharing_group_id": "1",
  "locked": true
}
```

**<span style="text-decoration: underline;">AnalystOpinion:</span>**

```
{
  "comment": "Provide more context",
  "opinion": 70,
  "note_type_name": "Opinion",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_type": "Attribute",
  "authors": "john.doe@admin.test",
  "org_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "orgc_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "created": "2024-03-19 11:10:24",
  "modified": "2024-03-19 11:10:24",
  "distribution": "0",
  "sharing_group_id": "1",
  "locked": true
}
```

<span style="text-decoration: underline;">**AnalystRelationship:**</span>

```
{
  "related_object_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "related_object_type": "Attribute",
  "relationship_type": "related-to",
  "note_type_name": "Relationship",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_type": "Attribute",
  "authors": "john.doe@admin.test",
  "org_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "orgc_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "created": "2024-03-19 11:10:24",
  "modified": "2024-03-19 11:10:24",
  "distribution": "0",
  "sharing_group_id": "1",
  "locked": true
}
```

<span style="text-decoration: underline;">**403:**</span>

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**Default:**</span>

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Edit analyst data:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/analystData/edit/{analystType}/{analystDataID}</p>

##### Response:

**<span style="text-decoration: underline; color: rgb(0, 0, 0);">200:</span>**

**<span style="text-decoration: underline; color: rgb(0, 0, 0);">AnalystNote:</span>**

```
{
  "note": "Provide more context",
  "language": "fr-BE",
  "note_type_name": "Note",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_type": "Attribute",
  "authors": "john.doe@admin.test",
  "org_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "orgc_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "created": "2024-03-19 11:10:24",
  "modified": "2024-03-19 11:10:24",
  "distribution": "0",
  "sharing_group_id": "1",
  "locked": true
}
```

**<span style="text-decoration: underline;">AnalystOpinion:</span>**

```
{
  "comment": "Provide more context",
  "opinion": 70,
  "note_type_name": "Opinion",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_type": "Attribute",
  "authors": "john.doe@admin.test",
  "org_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "orgc_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "created": "2024-03-19 11:10:24",
  "modified": "2024-03-19 11:10:24",
  "distribution": "0",
  "sharing_group_id": "1",
  "locked": true
}
```

<span style="text-decoration: underline;">**AnalystRelationship:**</span>

```
{
  "related_object_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "related_object_type": "Attribute",
  "relationship_type": "related-to",
  "note_type_name": "Relationship",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_type": "Attribute",
  "authors": "john.doe@admin.test",
  "org_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "orgc_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "created": "2024-03-19 11:10:24",
  "modified": "2024-03-19 11:10:24",
  "distribution": "0",
  "sharing_group_id": "1",
  "locked": true
}
```

<span style="text-decoration: underline;">**403:**</span>

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**Default:**</span>

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Delete Analyst data:

<p class="callout danger">DELETE</p>

<p class="callout info">https://misp.local/analystData/delete/{analystType}/{analystDataID}</p>

##### Response:

**<span style="text-decoration: underline; color: rgb(0, 0, 0);">200:</span>**

```
{
  "message": "Analyst Note deleted."
}
```

<span style="text-decoration: underline;">**403:**</span>

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**Default:**</span>

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### List Analyst data:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/analystData/delete/{analystType}/{analystDataID}</p>

##### Response:

**<span style="text-decoration: underline; color: rgb(0, 0, 0);">200:</span>**

```
[
  {
    "note": "Provide more context",
    "language": "fr-BE",
    "note_type_name": "Note",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "object_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "object_type": "Attribute",
    "authors": "john.doe@admin.test",
    "org_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "orgc_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "created": "2024-03-19 11:10:24",
    "modified": "2024-03-19 11:10:24",
    "distribution": "0",
    "sharing_group_id": "1",
    "locked": true
  }
]
```

<span style="text-decoration: underline;">**403:**</span>

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

<span style="text-decoration: underline;">**Default:**</span>

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}}
```

#### Get Analyst Data by ID:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/analystData/view/{analystType}/{analystDataID}</p>

##### Response:

**<span style="text-decoration: underline; color: rgb(0, 0, 0);">200:</span>**

**<span style="text-decoration: underline; color: rgb(0, 0, 0);">AnalystNote:</span>**

```
{
  "note": "Provide more context",
  "language": "fr-BE",
  "note_type_name": "Note",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_type": "Attribute",
  "authors": "john.doe@admin.test",
  "org_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "orgc_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "created": "2024-03-19 11:10:24",
  "modified": "2024-03-19 11:10:24",
  "distribution": "0",
  "sharing_group_id": "1",
  "locked": true
}
```

**<span style="text-decoration: underline;">AnalystOpinion:</span>**

```
{
  "comment": "Provide more context",
  "opinion": 70,
  "note_type_name": "Opinion",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_type": "Attribute",
  "authors": "john.doe@admin.test",
  "org_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "orgc_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "created": "2024-03-19 11:10:24",
  "modified": "2024-03-19 11:10:24",
  "distribution": "0",
  "sharing_group_id": "1",
  "locked": true
}
```

<span style="text-decoration: underline;">**AnalystRelationship:**</span>

```
{
  "related_object_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "related_object_type": "Attribute",
  "relationship_type": "related-to",
  "note_type_name": "Relationship",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_type": "Attribute",
  "authors": "john.doe@admin.test",
  "org_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "orgc_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "created": "2024-03-19 11:10:24",
  "modified": "2024-03-19 11:10:24",
  "distribution": "0",
  "sharing_group_id": "1",
  "locked": true
}
```

**403:**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**Default:**</span>

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

####  

# Attributes

#### \[restSearch\] Get a filtered and paginated list of attributes:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/attributes/restSearch</p>

##### Resquest:

```
{
  "page": 1,
  "limit": 0,
  "value": "127.0.0.1",
  "value1": "127.0.0.1",
  "value2": "127.0.0.1",
  "type": "md5",
  "category": "Internal reference",
  "org": "12345",
  "tags": [
    "tlp:amber"
  ],
  "from": "string",
  "to": "string",
  "last": 0,
  "eventid": "12345",
  "withAttachments": false,
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "publish_timestamp": "1617875568",
  "published": false,
  "timestamp": "1617875568",
  "attribute_timestamp": "1617875568",
  "enforceWarninglist": true,
  "to_ids": true,
  "deleted": false,
  "event_timestamp": "1617875568",
  "threat_level_id": "1",
  "eventinfo": "string",
  "sharinggroup": [
    "1"
  ],
  "decayingModel": "string",
  "score": "string",
  "first_seen": "string",
  "last_seen": "string",
  "includeEventUuid": false,
  "includeEventTags": false,
  "includeProposals": false,
  "requested_attributes": [
    "id"
  ],
  "includeContext": true,
  "headerless": true,
  "includeWarninglistHits": true,
  "attackGalaxy": "mitre-attack",
  "object_relation": "filepath",
  "includeSightings": true,
  "includeCorrelations": true,
  "modelOverrides": {
    "lifetime": 3,
    "decay_speed": 2.3,
    "threshold": 30,
    "default_base_score": 80,
    "base_score_config": {
      "estimative-language:confidence-in-analytic-judgment": 0.25,
      "estimative-language:likelihood-probability": 0.25,
      "phishing:psychological-acceptability": 0.25,
      "phishing:state": 0.2
    }
  },
  "includeDecayScore": false,
  "includeFullModel": false,
  "excludeDecayed": false,
  "returnFormat": "json"
}
```

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
{
  "response": {
    "Attribute": [
      {
        "id": "12345",
        "event_id": "12345",
        "object_id": "12345",
        "object_relation": "sensor",
        "category": "Internal reference",
        "type": "md5",
        "value": "127.0.0.1",
        "to_ids": true,
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "logged source ip",
        "deleted": false,
        "disable_correlation": false,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000",
        "data": "string",
        "event_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "decay_score": [
          {
            "score": 10.5,
            "base_score": 80,
            "decayed": true,
            "DecayingModel": {
              "id": "12345",
              "name": "Phishing model"
            }
          }
        ],
        "Event": {
          "id": "12345",
          "org_id": "12345",
          "distribution": "0",
          "info": "logged source ip",
          "orgc_id": "12345",
          "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
          "date": "1991-01-15",
          "published": false,
          "analysis": "0",
          "attribute_count": "321",
          "timestamp": "1617875568",
          "sharing_group_id": "1",
          "proposal_email_lock": true,
          "locked": true,
          "threat_level_id": "1",
          "publish_timestamp": "1617875568",
          "sighting_timestamp": "1617875568",
          "disable_correlation": false,
          "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
          "event_creator_email": "user@example.com"
        },
        "Object": {
          "id": "12345",
          "name": "ail-leak",
          "meta-category": "string",
          "description": "string",
          "template_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
          "template_version": "1",
          "event_id": "12345",
          "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
          "timestamp": "1617875568",
          "distribution": "0",
          "sharing_group_id": "1",
          "comment": "string",
          "deleted": true,
          "first_seen": "1581984000000000",
          "last_seen": "1581984000000000",
          "Attribute": [
            {
              "id": "12345",
              "event_id": "12345",
              "object_id": "12345",
              "object_relation": "sensor",
              "category": "Internal reference",
              "type": "md5",
              "value": "127.0.0.1",
              "to_ids": true,
              "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
              "timestamp": "1617875568",
              "distribution": "0",
              "sharing_group_id": "1",
              "comment": "logged source ip",
              "deleted": false,
              "disable_correlation": false,
              "first_seen": "1581984000000000",
              "last_seen": "1581984000000000"
            }
          ]
        },
        "Tag": [
          {
            "id": "12345",
            "name": "tlp:white",
            "colour": "#ffffff",
            "exportable": true,
            "org_id": "12345",
            "user_id": "12345",
            "hide_tag": false,
            "numerical_value": "12345",
            "is_galaxy": true,
            "is_custom_galaxy": true,
            "inherited": 1
          }
        ]
      }
    ]
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Add an attribute:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/attributes/add/{eventId}</p>

##### Resquest:

```
{
  "event_id": "12345",
  "object_id": "12345",
  "object_relation": "sensor",
  "category": "Internal reference",
  "type": "md5",
  "value": "127.0.0.1",
  "to_ids": true,
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "timestamp": "1617875568",
  "distribution": "0",
  "sharing_group_id": "1",
  "comment": "logged source ip",
  "deleted": false,
  "disable_correlation": false,
  "first_seen": "1581984000000000",
  "last_seen": "1581984000000000"
}
```

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
{
  "Attribute": {
    "id": "12345",
    "event_id": "12345",
    "object_id": "12345",
    "object_relation": "sensor",
    "category": "Internal reference",
    "type": "md5",
    "value": "127.0.0.1",
    "to_ids": true,
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "timestamp": "1617875568",
    "distribution": "0",
    "sharing_group_id": "1",
    "comment": "logged source ip",
    "deleted": false,
    "disable_correlation": false,
    "first_seen": "1581984000000000",
    "last_seen": "1581984000000000"
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Edit an attribute:

<p class="callout warning">PUT</p>

<p class="callout info">https://misp.local/attributes/edit/{attributeId}</p>

##### Resquest:

```
{
  "id": "12345",
  "event_id": "12345",
  "object_id": "12345",
  "object_relation": "sensor",
  "category": "Internal reference",
  "type": "md5",
  "value": "127.0.0.1",
  "to_ids": true,
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "timestamp": "1617875568",
  "distribution": "0",
  "sharing_group_id": "1",
  "comment": "logged source ip",
  "deleted": false,
  "disable_correlation": false,
  "first_seen": "1581984000000000",
  "last_seen": "1581984000000000"
}
```

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
{
  "Attribute": {
    "id": "12345",
    "event_id": "12345",
    "object_id": "12345",
    "object_relation": "sensor",
    "category": "Internal reference",
    "type": "md5",
    "value": "127.0.0.1",
    "to_ids": true,
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "timestamp": "1617875568",
    "distribution": "0",
    "sharing_group_id": "1",
    "comment": "logged source ip",
    "deleted": false,
    "disable_correlation": false,
    "first_seen": "1581984000000000",
    "last_seen": "1581984000000000"
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">404:</span>**

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Delete an attribute:

<p class="callout danger">DELETE</p>

<p class="callout info">https://misp.local/attributes/delete/{attributeId}</p>

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
{
  "message": "Attribute deleted."
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">404:</span>**

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Restore an attribute:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/attributes/restore/{attributeId}</p>

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
{
  "Attribute": {
    "id": "12345",
    "event_id": "12345",
    "object_id": "12345",
    "object_relation": "sensor",
    "category": "Internal reference",
    "type": "md5",
    "value": "127.0.0.1",
    "to_ids": true,
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "timestamp": "1617875568",
    "distribution": "0",
    "sharing_group_id": "1",
    "comment": "logged source ip",
    "deleted": false,
    "disable_correlation": false,
    "first_seen": "1581984000000000",
    "last_seen": "1581984000000000"
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">404:</span>**

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Add a tag to an attribute:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/attributes/addTag/{attributeId}/{tagId}/local:{local}</p>

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
{
  "saved": true,
  "success": "Tag added.",
  "check_publish": true,
  "errors": "Tag could not be added."
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">404:</span>**

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Remove a tag from an attribute:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/attributes/removeTag/{attributeId}/{tagId}</p>

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
{
  "saved": true,
  "success": "Tag removed.",
  "check_publish": true,
  "errors": "Tag could not be added."
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">404:</span>**

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Get a list of attributes:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/attributes</p>

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
[
  {
    "id": "12345",
    "event_id": "12345",
    "object_id": "12345",
    "object_relation": "sensor",
    "category": "Internal reference",
    "type": "md5",
    "value": "127.0.0.1",
    "to_ids": true,
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "timestamp": "1617875568",
    "distribution": "0",
    "sharing_group_id": "1",
    "comment": "logged source ip",
    "deleted": false,
    "disable_correlation": false,
    "first_seen": "1581984000000000",
    "last_seen": "1581984000000000"
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Get the count of attributes per category:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/attributes/attributeStatistics/{context}/{percentage}</p>

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
[
  {
    "Antivirus detection": "10"
  },
  {
    "Artifacts dropped": "20"
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Get a list of the available attribute types:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/attributes/describeTypes</p>

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
{
  "sane_defaults": {
    "md5": {
      "default_category": "Payload delivery",
      "to_ids": 1
    },
    "pdb": {
      "default_category": "Artifacts dropped",
      "to_ids": 0
    }
  },
  "types": [
    "md5"
  ],
  "categories": [
    "Internal reference"
  ],
  "category_type_mappings": {
    "Internal reference": [
      "text",
      "link",
      "comment",
      "other"
    ],
    "Antivirus detection": [
      "link",
      "comment",
      "text",
      "hex",
      "other"
    ]
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

####  

# Events

#### \[restSearch\] Get a filtered and paginated list of events:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/events/restSearch</p>

##### Request:

```
{
  "page": 1,
  "limit": 0,
  "value": "127.0.0.1",
  "type": "md5",
  "category": "Internal reference",
  "org": "12345",
  "tags": [
    "tlp:amber"
  ],
  "event_tags": [
    "tlp:amber"
  ],
  "searchall": "malware",
  "from": "string",
  "to": "string",
  "last": 0,
  "eventid": "12345",
  "withAttachments": false,
  "sharinggroup": [
    "1"
  ],
  "metadata": true,
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "publish_timestamp": "1617875568",
  "timestamp": "1617875568",
  "published": false,
  "enforceWarninglist": true,
  "sgReferenceOnly": true,
  "requested_attributes": [
    "id"
  ],
  "includeContext": true,
  "headerless": true,
  "includeWarninglistHits": true,
  "attackGalaxy": "mitre-attack",
  "to_ids": true,
  "deleted": false,
  "excludeLocalTags": true,
  "date": "string",
  "includeSightingdb": true,
  "tag": "tlp:white",
  "object_relation": "filepath",
  "threat_level_id": "1",
  "returnFormat": "json"
}
```

##### Resquest:

**<span style="text-decoration: underline;">200:</span>**

```
{
  "response": [
    {
      "Event": {
        "id": "12345",
        "org_id": "12345",
        "distribution": "0",
        "info": "logged source ip",
        "orgc_id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "date": "1991-01-15",
        "published": false,
        "analysis": "0",
        "attribute_count": "321",
        "timestamp": "1617875568",
        "sharing_group_id": "1",
        "proposal_email_lock": true,
        "locked": true,
        "threat_level_id": "1",
        "publish_timestamp": "1617875568",
        "sighting_timestamp": "1617875568",
        "disable_correlation": false,
        "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "event_creator_email": "user@example.com",
        "Feed": {
          "id": "3",
          "name": "CIRCL OSINT Feed",
          "provider": "CIRCL",
          "url": "https://www.circl.lu/doc/misp/feed-osint",
          "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
          "enabled": true,
          "distribution": "0",
          "sharing_group_id": "1",
          "tag_id": "12345",
          "default": true,
          "source_format": "1",
          "fixed_event": true,
          "delta_merge": true,
          "event_id": "12345",
          "publish": false,
          "override_ids": true,
          "settings": "{\"csv\":{\"value\":\"\",\"delimiter\":\"\"},\"common\":{\"excluderegex\":\"\"},\"disable_correlation\":\"1\"}",
          "input_source": "local",
          "delete_local_file": true,
          "lookup_visible": true,
          "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n",
          "caching_enabled": true,
          "force_to_ids": true,
          "orgc_id": "12345",
          "cache_timestamp": "1617875568"
        },
        "Org": {
          "id": "12345",
          "name": "ORGNAME",
          "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
        },
        "Orgc": {
          "id": "12345",
          "name": "ORGNAME",
          "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
        },
        "Attribute": [
          {
            "id": "12345",
            "event_id": "12345",
            "object_id": "12345",
            "object_relation": "sensor",
            "category": "Internal reference",
            "type": "md5",
            "value": "127.0.0.1",
            "to_ids": true,
            "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
            "timestamp": "1617875568",
            "distribution": "0",
            "sharing_group_id": "1",
            "comment": "logged source ip",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "1581984000000000",
            "last_seen": "1581984000000000"
          }
        ],
        "ShadowAttribute": [
          {
            "id": "12345",
            "event_id": "12345",
            "object_id": "12345",
            "object_relation": "sensor",
            "category": "Internal reference",
            "type": "md5",
            "value": "127.0.0.1",
            "to_ids": true,
            "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
            "timestamp": "1617875568",
            "distribution": "0",
            "sharing_group_id": "1",
            "comment": "logged source ip",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "1581984000000000",
            "last_seen": "1581984000000000"
          }
        ],
        "RelatedEvent": [
          {}
        ],
        "Galaxy": [
          {
            "id": "12345",
            "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
            "name": "Ransomware",
            "type": "ransomware",
            "description": "Ransomware galaxy based on ...",
            "version": "1",
            "icon": "globe",
            "namespace": "misp",
            "kill_chain_order": {
              "fraud-tactics": [
                "Initiation",
                "Target Compromise",
                "Perform Fraud",
                "Obtain Fraudulent Assets",
                "Assets Transfer",
                "Monetisation"
              ]
            }
          }
        ],
        "Object": [
          {
            "id": "12345",
            "name": "ail-leak",
            "meta-category": "string",
            "description": "string",
            "template_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
            "template_version": "1",
            "event_id": "12345",
            "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
            "timestamp": "1617875568",
            "distribution": "0",
            "sharing_group_id": "1",
            "comment": "string",
            "deleted": true,
            "first_seen": "1581984000000000",
            "last_seen": "1581984000000000",
            "Attribute": [
              {
                "id": "12345",
                "event_id": "12345",
                "object_id": "12345",
                "object_relation": "sensor",
                "category": "Internal reference",
                "type": "md5",
                "value": "127.0.0.1",
                "to_ids": true,
                "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
                "timestamp": "1617875568",
                "distribution": "0",
                "sharing_group_id": "1",
                "comment": "logged source ip",
                "deleted": false,
                "disable_correlation": false,
                "first_seen": "1581984000000000",
                "last_seen": "1581984000000000"
              }
            ]
          }
        ],
        "EventReport": [
          {
            "id": "12345",
            "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
            "event_id": "12345",
            "name": "Report of the incident",
            "content": "string",
            "distribution": "0",
            "sharing_group_id": "1",
            "timestamp": "1617875568",
            "deleted": false
          }
        ],
        "Tag": [
          {
            "id": "12345",
            "name": "tlp:white",
            "colour": "#ffffff",
            "exportable": true,
            "org_id": "12345",
            "user_id": "12345",
            "hide_tag": false,
            "numerical_value": "12345",
            "is_galaxy": true,
            "is_custom_galaxy": true,
            "inherited": 1
          }
        ],
        "Event": {
          "id": "12345",
          "timestamp": "1617875568",
          "sighting_timestamp": "1617875568",
          "published": false,
          "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
          "orgc_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
        }
      }
    }
  ]
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Add event:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/events/add</p>

##### Request: 

```
{
  "org_id": "12345",
  "distribution": "0",
  "info": "logged source ip",
  "orgc_id": "12345",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "date": "1991-01-15",
  "published": false,
  "analysis": "0",
  "attribute_count": "321",
  "timestamp": "1617875568",
  "sharing_group_id": "1",
  "proposal_email_lock": true,
  "locked": true,
  "threat_level_id": "1",
  "publish_timestamp": "1617875568",
  "sighting_timestamp": "1617875568",
  "disable_correlation": false,
  "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "event_creator_email": "user@example.com"
}
```

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
{
  "Event": {
    "id": "12345",
    "org_id": "12345",
    "distribution": "0",
    "info": "logged source ip",
    "orgc_id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "date": "1991-01-15",
    "published": false,
    "analysis": "0",
    "attribute_count": "321",
    "timestamp": "1617875568",
    "sharing_group_id": "1",
    "proposal_email_lock": true,
    "locked": true,
    "threat_level_id": "1",
    "publish_timestamp": "1617875568",
    "sighting_timestamp": "1617875568",
    "disable_correlation": false,
    "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "event_creator_email": "user@example.com",
    "Feed": {
      "id": "3",
      "name": "CIRCL OSINT Feed",
      "provider": "CIRCL",
      "url": "https://www.circl.lu/doc/misp/feed-osint",
      "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
      "enabled": true,
      "distribution": "0",
      "sharing_group_id": "1",
      "tag_id": "12345",
      "default": true,
      "source_format": "1",
      "fixed_event": true,
      "delta_merge": true,
      "event_id": "12345",
      "publish": false,
      "override_ids": true,
      "settings": "{\"csv\":{\"value\":\"\",\"delimiter\":\"\"},\"common\":{\"excluderegex\":\"\"},\"disable_correlation\":\"1\"}",
      "input_source": "local",
      "delete_local_file": true,
      "lookup_visible": true,
      "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n",
      "caching_enabled": true,
      "force_to_ids": true,
      "orgc_id": "12345",
      "cache_timestamp": "1617875568"
    },
    "Org": {
      "id": "12345",
      "name": "ORGNAME",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
    },
    "Orgc": {
      "id": "12345",
      "name": "ORGNAME",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
    },
    "Attribute": [
      {
        "id": "12345",
        "event_id": "12345",
        "object_id": "12345",
        "object_relation": "sensor",
        "category": "Internal reference",
        "type": "md5",
        "value": "127.0.0.1",
        "to_ids": true,
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "logged source ip",
        "deleted": false,
        "disable_correlation": false,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000"
      }
    ],
    "ShadowAttribute": [
      {
        "id": "12345",
        "event_id": "12345",
        "object_id": "12345",
        "object_relation": "sensor",
        "category": "Internal reference",
        "type": "md5",
        "value": "127.0.0.1",
        "to_ids": true,
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "logged source ip",
        "deleted": false,
        "disable_correlation": false,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000"
      }
    ],
    "RelatedEvent": [
      {}
    ],
    "Galaxy": [
      {
        "id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "name": "Ransomware",
        "type": "ransomware",
        "description": "Ransomware galaxy based on ...",
        "version": "1",
        "icon": "globe",
        "namespace": "misp",
        "kill_chain_order": {
          "fraud-tactics": [
            "Initiation",
            "Target Compromise",
            "Perform Fraud",
            "Obtain Fraudulent Assets",
            "Assets Transfer",
            "Monetisation"
          ]
        }
      }
    ],
    "Object": [
      {
        "id": "12345",
        "name": "ail-leak",
        "meta-category": "string",
        "description": "string",
        "template_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "template_version": "1",
        "event_id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "string",
        "deleted": true,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000",
        "Attribute": [
          {
            "id": "12345",
            "event_id": "12345",
            "object_id": "12345",
            "object_relation": "sensor",
            "category": "Internal reference",
            "type": "md5",
            "value": "127.0.0.1",
            "to_ids": true,
            "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
            "timestamp": "1617875568",
            "distribution": "0",
            "sharing_group_id": "1",
            "comment": "logged source ip",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "1581984000000000",
            "last_seen": "1581984000000000"
          }
        ]
      }
    ],
    "EventReport": [
      {
        "id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "event_id": "12345",
        "name": "Report of the incident",
        "content": "string",
        "distribution": "0",
        "sharing_group_id": "1",
        "timestamp": "1617875568",
        "deleted": false
      }
    ],
    "Tag": [
      {
        "id": "12345",
        "name": "tlp:white",
        "colour": "#ffffff",
        "exportable": true,
        "org_id": "12345",
        "user_id": "12345",
        "hide_tag": false,
        "numerical_value": "12345",
        "is_galaxy": true,
        "is_custom_galaxy": true,
        "inherited": 1
      }
    ]
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Edit event:

<p class="callout warning">PUT</p>

<p class="callout info">https://misp.local/events/edit/{eventId}</p>

##### Request: 

```
{
  "org_id": "12345",
  "distribution": "0",
  "info": "logged source ip",
  "orgc_id": "12345",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "date": "1991-01-15",
  "published": false,
  "analysis": "0",
  "attribute_count": "321",
  "timestamp": "1617875568",
  "sharing_group_id": "1",
  "proposal_email_lock": true,
  "locked": true,
  "threat_level_id": "1",
  "publish_timestamp": "1617875568",
  "sighting_timestamp": "1617875568",
  "disable_correlation": false,
  "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "event_creator_email": "user@example.com"
}
```

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
{
  "Event": {
    "id": "12345",
    "org_id": "12345",
    "distribution": "0",
    "info": "logged source ip",
    "orgc_id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "date": "1991-01-15",
    "published": false,
    "analysis": "0",
    "attribute_count": "321",
    "timestamp": "1617875568",
    "sharing_group_id": "1",
    "proposal_email_lock": true,
    "locked": true,
    "threat_level_id": "1",
    "publish_timestamp": "1617875568",
    "sighting_timestamp": "1617875568",
    "disable_correlation": false,
    "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "event_creator_email": "user@example.com",
    "Feed": {
      "id": "3",
      "name": "CIRCL OSINT Feed",
      "provider": "CIRCL",
      "url": "https://www.circl.lu/doc/misp/feed-osint",
      "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
      "enabled": true,
      "distribution": "0",
      "sharing_group_id": "1",
      "tag_id": "12345",
      "default": true,
      "source_format": "1",
      "fixed_event": true,
      "delta_merge": true,
      "event_id": "12345",
      "publish": false,
      "override_ids": true,
      "settings": "{\"csv\":{\"value\":\"\",\"delimiter\":\"\"},\"common\":{\"excluderegex\":\"\"},\"disable_correlation\":\"1\"}",
      "input_source": "local",
      "delete_local_file": true,
      "lookup_visible": true,
      "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n",
      "caching_enabled": true,
      "force_to_ids": true,
      "orgc_id": "12345",
      "cache_timestamp": "1617875568"
    },
    "Org": {
      "id": "12345",
      "name": "ORGNAME",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
    },
    "Orgc": {
      "id": "12345",
      "name": "ORGNAME",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
    },
    "Attribute": [
      {
        "id": "12345",
        "event_id": "12345",
        "object_id": "12345",
        "object_relation": "sensor",
        "category": "Internal reference",
        "type": "md5",
        "value": "127.0.0.1",
        "to_ids": true,
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "logged source ip",
        "deleted": false,
        "disable_correlation": false,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000"
      }
    ],
    "ShadowAttribute": [
      {
        "id": "12345",
        "event_id": "12345",
        "object_id": "12345",
        "object_relation": "sensor",
        "category": "Internal reference",
        "type": "md5",
        "value": "127.0.0.1",
        "to_ids": true,
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "logged source ip",
        "deleted": false,
        "disable_correlation": false,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000"
      }
    ],
    "RelatedEvent": [
      {}
    ],
    "Galaxy": [
      {
        "id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "name": "Ransomware",
        "type": "ransomware",
        "description": "Ransomware galaxy based on ...",
        "version": "1",
        "icon": "globe",
        "namespace": "misp",
        "kill_chain_order": {
          "fraud-tactics": [
            "Initiation",
            "Target Compromise",
            "Perform Fraud",
            "Obtain Fraudulent Assets",
            "Assets Transfer",
            "Monetisation"
          ]
        }
      }
    ],
    "Object": [
      {
        "id": "12345",
        "name": "ail-leak",
        "meta-category": "string",
        "description": "string",
        "template_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "template_version": "1",
        "event_id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "string",
        "deleted": true,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000",
        "Attribute": [
          {
            "id": "12345",
            "event_id": "12345",
            "object_id": "12345",
            "object_relation": "sensor",
            "category": "Internal reference",
            "type": "md5",
            "value": "127.0.0.1",
            "to_ids": true,
            "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
            "timestamp": "1617875568",
            "distribution": "0",
            "sharing_group_id": "1",
            "comment": "logged source ip",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "1581984000000000",
            "last_seen": "1581984000000000"
          }
        ]
      }
    ],
    "EventReport": [
      {
        "id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "event_id": "12345",
        "name": "Report of the incident",
        "content": "string",
        "distribution": "0",
        "sharing_group_id": "1",
        "timestamp": "1617875568",
        "deleted": false
      }
    ],
    "Tag": [
      {
        "id": "12345",
        "name": "tlp:white",
        "colour": "#ffffff",
        "exportable": true,
        "org_id": "12345",
        "user_id": "12345",
        "hide_tag": false,
        "numerical_value": "12345",
        "is_galaxy": true,
        "is_custom_galaxy": true,
        "inherited": 1
      }
    ]
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Delete event:

<p class="callout danger">DELETE</p>

<p class="callout info">https://misp.local/events/delete/{eventId}</p>

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
{
  "saved": true,
  "success": true,
  "name": "Event deleted.",
  "message": "Could not delete Event",
  "url": "/events/delete/1",
  "errors": "Event was not deleted."
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Get a list of events:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/events</p>

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
[
  {
    "id": "12345",
    "org_id": "12345",
    "distribution": "0",
    "info": "logged source ip",
    "orgc_id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "date": "1991-01-15",
    "published": false,
    "analysis": "0",
    "attribute_count": "321",
    "timestamp": "1617875568",
    "sharing_group_id": "1",
    "proposal_email_lock": true,
    "locked": true,
    "threat_level_id": "1",
    "publish_timestamp": "1617875568",
    "sighting_timestamp": "1617875568",
    "disable_correlation": false,
    "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "event_creator_email": "user@example.com",
    "Feed": {
      "id": "3",
      "name": "CIRCL OSINT Feed",
      "provider": "CIRCL",
      "url": "https://www.circl.lu/doc/misp/feed-osint",
      "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
      "enabled": true,
      "distribution": "0",
      "sharing_group_id": "1",
      "tag_id": "12345",
      "default": true,
      "source_format": "1",
      "fixed_event": true,
      "delta_merge": true,
      "event_id": "12345",
      "publish": false,
      "override_ids": true,
      "settings": "{\"csv\":{\"value\":\"\",\"delimiter\":\"\"},\"common\":{\"excluderegex\":\"\"},\"disable_correlation\":\"1\"}",
      "input_source": "local",
      "delete_local_file": true,
      "lookup_visible": true,
      "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n",
      "caching_enabled": true,
      "force_to_ids": true,
      "orgc_id": "12345",
      "cache_timestamp": "1617875568"
    },
    "Org": {
      "id": "12345",
      "name": "ORGNAME",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
    },
    "Orgc": {
      "id": "12345",
      "name": "ORGNAME",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
    },
    "Attribute": [
      {
        "id": "12345",
        "event_id": "12345",
        "object_id": "12345",
        "object_relation": "sensor",
        "category": "Internal reference",
        "type": "md5",
        "value": "127.0.0.1",
        "to_ids": true,
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "logged source ip",
        "deleted": false,
        "disable_correlation": false,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000"
      }
    ],
    "ShadowAttribute": [
      {
        "id": "12345",
        "event_id": "12345",
        "object_id": "12345",
        "object_relation": "sensor",
        "category": "Internal reference",
        "type": "md5",
        "value": "127.0.0.1",
        "to_ids": true,
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "logged source ip",
        "deleted": false,
        "disable_correlation": false,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000"
      }
    ],
    "RelatedEvent": [
      {}
    ],
    "Galaxy": [
      {
        "id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "name": "Ransomware",
        "type": "ransomware",
        "description": "Ransomware galaxy based on ...",
        "version": "1",
        "icon": "globe",
        "namespace": "misp",
        "kill_chain_order": {
          "fraud-tactics": [
            "Initiation",
            "Target Compromise",
            "Perform Fraud",
            "Obtain Fraudulent Assets",
            "Assets Transfer",
            "Monetisation"
          ]
        }
      }
    ],
    "Object": [
      {
        "id": "12345",
        "name": "ail-leak",
        "meta-category": "string",
        "description": "string",
        "template_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "template_version": "1",
        "event_id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "string",
        "deleted": true,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000",
        "Attribute": [
          {
            "id": "12345",
            "event_id": "12345",
            "object_id": "12345",
            "object_relation": "sensor",
            "category": "Internal reference",
            "type": "md5",
            "value": "127.0.0.1",
            "to_ids": true,
            "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
            "timestamp": "1617875568",
            "distribution": "0",
            "sharing_group_id": "1",
            "comment": "logged source ip",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "1581984000000000",
            "last_seen": "1581984000000000"
          }
        ]
      }
    ],
    "EventReport": [
      {
        "id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "event_id": "12345",
        "name": "Report of the incident",
        "content": "string",
        "distribution": "0",
        "sharing_group_id": "1",
        "timestamp": "1617875568",
        "deleted": false
      }
    ],
    "Tag": [
      {
        "id": "12345",
        "name": "tlp:white",
        "colour": "#ffffff",
        "exportable": true,
        "org_id": "12345",
        "user_id": "12345",
        "hide_tag": false,
        "numerical_value": "12345",
        "is_galaxy": true,
        "is_custom_galaxy": true,
        "inherited": 1
      }
    ]
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

##### Search events:

<p class="callout info">POST</p>

<p class="callout info">[https://misp.local/events/index](https://misp.local/events/index)</p>

##### Request:

```
{
  "page": 1,
  "limit": 0,
  "sort": "timestamp",
  "direction": "asc",
  "minimal": false,
  "attribute": "covert channel",
  "eventid": "12345",
  "datefrom": "2021-03-05",
  "dateuntil": "2021-03-05",
  "org": "CIRCL",
  "eventinfo": "Phishing campaing",
  "tag": "tlp:white",
  "tags": [
    "tlp:amber",
    "cycat:scope=\"exploit\""
  ],
  "distribution": "0",
  "sharinggroup": "1",
  "analysis": "0",
  "threatlevel": "1",
  "email": "admin@admin.test",
  "hasproposal": "1",
  "timestamp": "1",
  "publish_timestamp": "1",
  "searchDatefrom": "2020-01-20",
  "searchDateuntil": "2020-01-20"
}
```

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
[
  {
    "id": "12345",
    "org_id": "12345",
    "distribution": "0",
    "info": "logged source ip",
    "orgc_id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "date": "1991-01-15",
    "published": false,
    "analysis": "0",
    "attribute_count": "321",
    "timestamp": "1617875568",
    "sharing_group_id": "1",
    "proposal_email_lock": true,
    "locked": true,
    "threat_level_id": "1",
    "publish_timestamp": "1617875568",
    "sighting_timestamp": "1617875568",
    "disable_correlation": false,
    "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "event_creator_email": "user@example.com",
    "Feed": {
      "id": "3",
      "name": "CIRCL OSINT Feed",
      "provider": "CIRCL",
      "url": "https://www.circl.lu/doc/misp/feed-osint",
      "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
      "enabled": true,
      "distribution": "0",
      "sharing_group_id": "1",
      "tag_id": "12345",
      "default": true,
      "source_format": "1",
      "fixed_event": true,
      "delta_merge": true,
      "event_id": "12345",
      "publish": false,
      "override_ids": true,
      "settings": "{\"csv\":{\"value\":\"\",\"delimiter\":\"\"},\"common\":{\"excluderegex\":\"\"},\"disable_correlation\":\"1\"}",
      "input_source": "local",
      "delete_local_file": true,
      "lookup_visible": true,
      "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n",
      "caching_enabled": true,
      "force_to_ids": true,
      "orgc_id": "12345",
      "cache_timestamp": "1617875568"
    },
    "Org": {
      "id": "12345",
      "name": "ORGNAME",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
    },
    "Orgc": {
      "id": "12345",
      "name": "ORGNAME",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
    },
    "Attribute": [
      {
        "id": "12345",
        "event_id": "12345",
        "object_id": "12345",
        "object_relation": "sensor",
        "category": "Internal reference",
        "type": "md5",
        "value": "127.0.0.1",
        "to_ids": true,
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "logged source ip",
        "deleted": false,
        "disable_correlation": false,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000"
      }
    ],
    "ShadowAttribute": [
      {
        "id": "12345",
        "event_id": "12345",
        "object_id": "12345",
        "object_relation": "sensor",
        "category": "Internal reference",
        "type": "md5",
        "value": "127.0.0.1",
        "to_ids": true,
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "logged source ip",
        "deleted": false,
        "disable_correlation": false,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000"
      }
    ],
    "RelatedEvent": [
      {}
    ],
    "Galaxy": [
      {
        "id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "name": "Ransomware",
        "type": "ransomware",
        "description": "Ransomware galaxy based on ...",
        "version": "1",
        "icon": "globe",
        "namespace": "misp",
        "kill_chain_order": {
          "fraud-tactics": [
            "Initiation",
            "Target Compromise",
            "Perform Fraud",
            "Obtain Fraudulent Assets",
            "Assets Transfer",
            "Monetisation"
          ]
        }
      }
    ],
    "Object": [
      {
        "id": "12345",
        "name": "ail-leak",
        "meta-category": "string",
        "description": "string",
        "template_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "template_version": "1",
        "event_id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "string",
        "deleted": true,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000",
        "Attribute": [
          {
            "id": "12345",
            "event_id": "12345",
            "object_id": "12345",
            "object_relation": "sensor",
            "category": "Internal reference",
            "type": "md5",
            "value": "127.0.0.1",
            "to_ids": true,
            "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
            "timestamp": "1617875568",
            "distribution": "0",
            "sharing_group_id": "1",
            "comment": "logged source ip",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "1581984000000000",
            "last_seen": "1581984000000000"
          }
        ]
      }
    ],
    "EventReport": [
      {
        "id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "event_id": "12345",
        "name": "Report of the incident",
        "content": "string",
        "distribution": "0",
        "sharing_group_id": "1",
        "timestamp": "1617875568",
        "deleted": false
      }
    ],
    "Tag": [
      {
        "id": "12345",
        "name": "tlp:white",
        "colour": "#ffffff",
        "exportable": true,
        "org_id": "12345",
        "user_id": "12345",
        "hide_tag": false,
        "numerical_value": "12345",
        "is_galaxy": true,
        "is_custom_galaxy": true,
        "inherited": 1
      }
    ]
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Get event by ID:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/events/view/{eventId}</p>

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
{
  "Event": {
    "id": "12345",
    "org_id": "12345",
    "distribution": "0",
    "info": "logged source ip",
    "orgc_id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "date": "1991-01-15",
    "published": false,
    "analysis": "0",
    "attribute_count": "321",
    "timestamp": "1617875568",
    "sharing_group_id": "1",
    "proposal_email_lock": true,
    "locked": true,
    "threat_level_id": "1",
    "publish_timestamp": "1617875568",
    "sighting_timestamp": "1617875568",
    "disable_correlation": false,
    "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "event_creator_email": "user@example.com",
    "Feed": {
      "id": "3",
      "name": "CIRCL OSINT Feed",
      "provider": "CIRCL",
      "url": "https://www.circl.lu/doc/misp/feed-osint",
      "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
      "enabled": true,
      "distribution": "0",
      "sharing_group_id": "1",
      "tag_id": "12345",
      "default": true,
      "source_format": "1",
      "fixed_event": true,
      "delta_merge": true,
      "event_id": "12345",
      "publish": false,
      "override_ids": true,
      "settings": "{\"csv\":{\"value\":\"\",\"delimiter\":\"\"},\"common\":{\"excluderegex\":\"\"},\"disable_correlation\":\"1\"}",
      "input_source": "local",
      "delete_local_file": true,
      "lookup_visible": true,
      "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n",
      "caching_enabled": true,
      "force_to_ids": true,
      "orgc_id": "12345",
      "cache_timestamp": "1617875568"
    },
    "Org": {
      "id": "12345",
      "name": "ORGNAME",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
    },
    "Orgc": {
      "id": "12345",
      "name": "ORGNAME",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
    },
    "Attribute": [
      {
        "id": "12345",
        "event_id": "12345",
        "object_id": "12345",
        "object_relation": "sensor",
        "category": "Internal reference",
        "type": "md5",
        "value": "127.0.0.1",
        "to_ids": true,
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "logged source ip",
        "deleted": false,
        "disable_correlation": false,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000"
      }
    ],
    "ShadowAttribute": [
      {
        "id": "12345",
        "event_id": "12345",
        "object_id": "12345",
        "object_relation": "sensor",
        "category": "Internal reference",
        "type": "md5",
        "value": "127.0.0.1",
        "to_ids": true,
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "logged source ip",
        "deleted": false,
        "disable_correlation": false,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000"
      }
    ],
    "RelatedEvent": [
      {}
    ],
    "Galaxy": [
      {
        "id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "name": "Ransomware",
        "type": "ransomware",
        "description": "Ransomware galaxy based on ...",
        "version": "1",
        "icon": "globe",
        "namespace": "misp",
        "kill_chain_order": {
          "fraud-tactics": [
            "Initiation",
            "Target Compromise",
            "Perform Fraud",
            "Obtain Fraudulent Assets",
            "Assets Transfer",
            "Monetisation"
          ]
        }
      }
    ],
    "Object": [
      {
        "id": "12345",
        "name": "ail-leak",
        "meta-category": "string",
        "description": "string",
        "template_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "template_version": "1",
        "event_id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "string",
        "deleted": true,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000",
        "Attribute": [
          {
            "id": "12345",
            "event_id": "12345",
            "object_id": "12345",
            "object_relation": "sensor",
            "category": "Internal reference",
            "type": "md5",
            "value": "127.0.0.1",
            "to_ids": true,
            "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
            "timestamp": "1617875568",
            "distribution": "0",
            "sharing_group_id": "1",
            "comment": "logged source ip",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "1581984000000000",
            "last_seen": "1581984000000000"
          }
        ]
      }
    ],
    "EventReport": [
      {
        "id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "event_id": "12345",
        "name": "Report of the incident",
        "content": "string",
        "distribution": "0",
        "sharing_group_id": "1",
        "timestamp": "1617875568",
        "deleted": false
      }
    ],
    "Tag": [
      {
        "id": "12345",
        "name": "tlp:white",
        "colour": "#ffffff",
        "exportable": true,
        "org_id": "12345",
        "user_id": "12345",
        "hide_tag": false,
        "numerical_value": "12345",
        "is_galaxy": true,
        "is_custom_galaxy": true,
        "inherited": 1
      }
    ]
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Publish an event:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/events/publish/{eventId}</p>

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
{
  "name": "Publish",
  "message": "Job queued",
  "url": "https://misp.local/events/alert/1",
  "id": "string"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Unpublish an event:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/events/addTag/{eventId}/{tagId}/local:{local}</p>

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
{
  "saved": true,
  "success": true,
  "name": "Event unpublished.",
  "message": "Event unpublished.",
  "url": "/events/unpublish/1"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Add event tag:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/events/addTag/{eventId}/{tagId}/local:{local}</p>

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
{
  "saved": true,
  "success": "Tag added.",
  "check_publish": true,
  "errors": "Tag could not be added."
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Remove event tag:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/events/removeTag/{eventId}/{tagId}</p>

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
{
  "saved": true,
  "success": "Tag removed.",
  "check_publish": true,
  "errors": "Tag could not be added."
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

####  

####  

# Galaxies

#### Get galaxies:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/galaxies</p>

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
[
  {
    "Galaxy": {
      "id": "12345",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "name": "Ransomware",
      "type": "ransomware",
      "description": "Ransomware galaxy based on ...",
      "version": "1",
      "icon": "globe",
      "namespace": "misp",
      "kill_chain_order": {
        "fraud-tactics": [
          "Initiation",
          "Target Compromise",
          "Perform Fraud",
          "Obtain Fraudulent Assets",
          "Assets Transfer",
          "Monetisation"
        ]
      }
    }
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Search galaxies:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/galaxies</p>

##### Request:

```
{
  "value": "botnet"
}
```

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
[
  {
    "Galaxy": {
      "id": "12345",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "name": "Ransomware",
      "type": "ransomware",
      "description": "Ransomware galaxy based on ...",
      "version": "1",
      "icon": "globe",
      "namespace": "misp",
      "kill_chain_order": {
        "fraud-tactics": [
          "Initiation",
          "Target Compromise",
          "Perform Fraud",
          "Obtain Fraudulent Assets",
          "Assets Transfer",
          "Monetisation"
        ]
      }
    }
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Get galaxy by ID:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/galaxies</p>

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
{
  "Galaxy": {
    "id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "name": "Ransomware",
    "type": "ransomware",
    "description": "Ransomware galaxy based on ...",
    "version": "1",
    "icon": "globe",
    "namespace": "misp",
    "kill_chain_order": {
      "fraud-tactics": [
        "Initiation",
        "Target Compromise",
        "Perform Fraud",
        "Obtain Fraudulent Assets",
        "Assets Transfer",
        "Monetisation"
      ]
    }
  },
  "GalaxyCluster": [
    {
      "id": "12345",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "collection_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "type": "mitre-enterprise-attack-attack-pattern",
      "value": "Brute Force - T1110",
      "tag_name": "tlp:white",
      "description": "Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained...",
      "galaxy_id": "12345",
      "source": "https://github.com/mitre/cti",
      "authors": [
        "MITRE"
      ],
      "version": "1",
      "distribution": "0",
      "sharing_group_id": "1",
      "org_id": "12345",
      "orgc_id": "12345",
      "default": true,
      "locked": true,
      "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "extends_version": "1",
      "published": false,
      "deleted": false,
      "GalaxyElement": [
        {
          "id": "12345",
          "galaxy_cluster_id": "12345",
          "key": "categories",
          "value": "Military"
        }
      ]
    }
  ]
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Force update the galaxies with the galaxy json definitions:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/galaxies/update</p>

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
{
  "saved": true,
  "success": true,
  "name": "Galaxies updated.",
  "message": "Galaxies updated.",
  "url": "/galaxies/update"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">404:</span>**

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Delete a galaxy:

<p class="callout danger">DELETE</p>

<p class="callout info">https://misp.local/galaxies/delete/{galaxyId}</p>

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
{
  "saved": true,
  "success": true,
  "name": "Galaxy deleted",
  "message": "Galaxy deleted",
  "url": "/galaxies/delete"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">404:</span>**

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Import a galaxy cluster:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/galaxies/import</p>

##### Request:

```
[
  {
    "GalaxyCluster": {
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "collection_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "type": "mitre-enterprise-attack-attack-pattern",
      "value": "Brute Force - T1110",
      "tag_name": "tlp:white",
      "description": "Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained...",
      "galaxy_id": "12345",
      "source": "https://github.com/mitre/cti",
      "authors": [
        "MITRE"
      ],
      "version": "1",
      "distribution": "0",
      "sharing_group_id": "1",
      "org_id": "12345",
      "orgc_id": "12345",
      "default": true,
      "locked": true,
      "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "extends_version": "1",
      "published": false,
      "deleted": false,
      "GalaxyElement": [
        {
          "id": "12345",
          "galaxy_cluster_id": "12345",
          "key": "categories",
          "value": "Military"
        }
      ]
    },
    "Galaxy": {
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
    }
  }
]
```

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
{
  "saved": true,
  "success": true,
  "name": "'Galaxy clusters imported. 1 imported, 0 ignored, 0 failed.",
  "message": "'Galaxy clusters imported. 1 imported, 0 ignored, 0 failed.",
  "url": "/galaxies/import"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">404:</span>**

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Export galaxy clusters

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/galaxies/export/{galaxyId}</p>

##### Request:

```
{
  "Galaxy": {
    "default": true,
    "custom": true,
    "distribution": "0",
    "format": "default",
    "download": true
  }
}
```

##### Response:

**<span style="text-decoration: underline;">200:</span>**

**<span style="text-decoration: underline;">GalaxyMispFormat:</span>**

```
{
  "name": "Ransomware",
  "type": "ransomware",
  "authors": [
    "MITRE"
  ],
  "version": true,
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "source": "https://github.com/mitre/cti",
  "values": [
    {
      "description": "Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained...",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "value": "Brute Force - T1110",
      "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "extends_Version": "1",
      "meta": [
        {
          "categories": "botnet"
        },
        {
          "refs": "http://example.com"
        },
        {
          "aliases": [
            "malware",
            "win32",
            "windows"
          ]
        },
        {
          "topics": [
            "Windows",
            "Malware"
          ]
        }
      ]
    }
  ]
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">404:</span>**

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Attach the galaxy cluster tag a given entity

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/galaxies/attachCluster/{attachTargetId}/{attachTargetType}/local:{local}</p>

##### Request:

```
{
  "Galaxy": {
    "target_id": 1235
  }
}
```

##### Response:

**<span style="text-decoration: underline;">200:</span>**

```
{
  "saved": true,
  "success": "Cluster attached.",
  "check_publish": true
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">404:</span>**

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

####  

# Galaxy Cluster

#### Add galaxy cluster:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/galaxies</p>

##### Request: 

```
{
  "id": "12345",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "collection_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "type": "mitre-enterprise-attack-attack-pattern",
  "value": "Brute Force - T1110",
  "tag_name": "tlp:white",
  "description": "Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained...",
  "galaxy_id": "12345",
  "source": "https://github.com/mitre/cti",
  "authors": [
    "MITRE"
  ],
  "version": "1",
  "distribution": "0",
  "sharing_group_id": "1",
  "org_id": "12345",
  "orgc_id": "12345",
  "default": true,
  "locked": true,
  "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "extends_version": "1",
  "published": false,
  "deleted": false,
  "GalaxyElement": [
    {
      "id": "12345",
      "galaxy_cluster_id": "12345",
      "key": "categories",
      "value": "Military"
    }
  ]
}
```

##### Response:

<span style="text-decoration: underline;">**200:**</span>

```
{
  "GalaxyCluster": {
    "id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "collection_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "type": "mitre-enterprise-attack-attack-pattern",
    "value": "Brute Force - T1110",
    "tag_name": "tlp:white",
    "description": "Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained...",
    "galaxy_id": "12345",
    "source": "https://github.com/mitre/cti",
    "authors": [
      "MITRE"
    ],
    "version": "1",
    "distribution": "0",
    "sharing_group_id": "1",
    "org_id": "12345",
    "orgc_id": "12345",
    "default": true,
    "locked": true,
    "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "extends_version": "1",
    "published": false,
    "deleted": false,
    "GalaxyElement": [
      {
        "id": "12345",
        "galaxy_cluster_id": "12345",
        "key": "categories",
        "value": "Military"
      }
    ]
  }
}
```

<span style="text-decoration: underline;">**403:**</span>

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

<span style="text-decoration: underline;">**Default:**</span>

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Edit galaxy cluster

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/galaxy\_clusters/add/{galaxyId}</p>

##### Request: 

```
{
  "id": "12345",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "collection_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "type": "mitre-enterprise-attack-attack-pattern",
  "value": "Brute Force - T1110",
  "tag_name": "tlp:white",
  "description": "Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained...",
  "galaxy_id": "12345",
  "source": "https://github.com/mitre/cti",
  "authors": [
    "MITRE"
  ],
  "version": "1",
  "distribution": "0",
  "sharing_group_id": "1",
  "org_id": "12345",
  "orgc_id": "12345",
  "default": true,
  "locked": true,
  "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "extends_version": "1",
  "published": false,
  "deleted": false,
  "GalaxyElement": [
    {
      "id": "12345",
      "galaxy_cluster_id": "12345",
      "key": "categories",
      "value": "Military"
    }
  ]
}
```

##### Response:

<span style="text-decoration: underline;">**200:**</span>

```
{
  "GalaxyCluster": {
    "id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "collection_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "type": "mitre-enterprise-attack-attack-pattern",
    "value": "Brute Force - T1110",
    "tag_name": "tlp:white",
    "description": "Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained...",
    "galaxy_id": "12345",
    "source": "https://github.com/mitre/cti",
    "authors": [
      "MITRE"
    ],
    "version": "1",
    "distribution": "0",
    "sharing_group_id": "1",
    "org_id": "12345",
    "orgc_id": "12345",
    "default": true,
    "locked": true,
    "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "extends_version": "1",
    "published": false,
    "deleted": false,
    "GalaxyElement": [
      {
        "id": "12345",
        "galaxy_cluster_id": "12345",
        "key": "categories",
        "value": "Military"
      }
    ]
  }
}
```

<span style="text-decoration: underline;">**403:**</span>

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

<span style="text-decoration: underline;">**Default:**</span>

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Get galaxy clusters:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/galaxy\_clusters/add/{galaxyId}</p>

##### Response:

<span style="text-decoration: underline;">**200:**</span>

```
[
  {
    "GalaxyCluster": {
      "id": "12345",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "collection_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "type": "mitre-enterprise-attack-attack-pattern",
      "value": "Brute Force - T1110",
      "tag_name": "tlp:white",
      "description": "Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained...",
      "galaxy_id": "12345",
      "source": "https://github.com/mitre/cti",
      "authors": [
        "MITRE"
      ],
      "version": "1",
      "distribution": "0",
      "sharing_group_id": "1",
      "org_id": "12345",
      "orgc_id": "12345",
      "default": true,
      "locked": true,
      "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "extends_version": "1",
      "published": false,
      "deleted": false,
      "GalaxyElement": [
        {
          "id": "12345",
          "galaxy_cluster_id": "12345",
          "key": "categories",
          "value": "Military"
        }
      ]
    }
  }
]
```

**403:**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

<span style="text-decoration: underline;">**Default:**</span>

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Search galaxy clusters:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/galaxy\_clusters/add/{galaxyId}</p>

##### Request:

```
{
  "context": "all",
  "searchall": "botnet"
}
```

##### Response:

<span style="text-decoration: underline;">**200:**</span>

```
[
  {
    "GalaxyCluster": {
      "id": "12345",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "collection_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "type": "mitre-enterprise-attack-attack-pattern",
      "value": "Brute Force - T1110",
      "tag_name": "tlp:white",
      "description": "Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained...",
      "galaxy_id": "12345",
      "source": "https://github.com/mitre/cti",
      "authors": [
        "MITRE"
      ],
      "version": "1",
      "distribution": "0",
      "sharing_group_id": "1",
      "org_id": "12345",
      "orgc_id": "12345",
      "default": true,
      "locked": true,
      "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "extends_version": "1",
      "published": false,
      "deleted": false,
      "GalaxyElement": [
        {
          "id": "12345",
          "galaxy_cluster_id": "12345",
          "key": "categories",
          "value": "Military"
        }
      ]
    }
  }
]
```

**403:**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

<span style="text-decoration: underline;">**Default:**</span>

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Get galaxy cluster by ID:

<p class="callout success">Get</p>

<p class="callout info">https://misp.local/galaxy\_clusters/view/{galaxyClusterId}</p>

##### Response:

<span style="text-decoration: underline;">**200:**</span>

```
{
  "GalaxyCluster": {
    "id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "collection_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "type": "mitre-enterprise-attack-attack-pattern",
    "value": "Brute Force - T1110",
    "tag_name": "tlp:white",
    "description": "Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained...",
    "galaxy_id": "12345",
    "source": "https://github.com/mitre/cti",
    "authors": [
      "MITRE"
    ],
    "version": "1",
    "distribution": "0",
    "sharing_group_id": "1",
    "org_id": "12345",
    "orgc_id": "12345",
    "default": true,
    "locked": true,
    "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "extends_version": "1",
    "published": false,
    "deleted": false,
    "GalaxyElement": [
      {
        "id": "12345",
        "galaxy_cluster_id": "12345",
        "key": "categories",
        "value": "Military"
      }
    ],
    "Galaxy": {
      "id": "12345",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "name": "Ransomware",
      "type": "ransomware",
      "description": "Ransomware galaxy based on ...",
      "version": "1",
      "icon": "globe",
      "namespace": "misp",
      "kill_chain_order": {
        "fraud-tactics": [
          "Initiation",
          "Target Compromise",
          "Perform Fraud",
          "Obtain Fraudulent Assets",
          "Assets Transfer",
          "Monetisation"
        ]
      }
    },
    "GalaxyClusterRelation": [
      {
        "id": "12345",
        "galaxy_cluster_id": "12345",
        "key": "categories",
        "value": "Military"
      }
    ],
    "Org": {
      "id": "12345",
      "name": "ORGNAME",
      "date_created": "2021-06-14 14:29:19",
      "date_modified": "2021-06-14 14:29:19",
      "description": "string",
      "type": "ADMIN",
      "nationality": "string",
      "sector": "string",
      "created_by": "12345",
      "uuid": "string",
      "contacts": "string",
      "local": true,
      "restricted_to_domain": [
        "example.com"
      ],
      "landingpage": "string",
      "user_count": "3",
      "created_by_email": "string"
    },
    "Orgc": {
      "id": "12345",
      "name": "ORGNAME",
      "date_created": "2021-06-14 14:29:19",
      "date_modified": "2021-06-14 14:29:19",
      "description": "string",
      "type": "ADMIN",
      "nationality": "string",
      "sector": "string",
      "created_by": "12345",
      "uuid": "string",
      "contacts": "string",
      "local": true,
      "restricted_to_domain": [
        "example.com"
      ],
      "landingpage": "string",
      "user_count": "3",
      "created_by_email": "string"
    },
    "tag_count": 0,
    "tag_id": "12345"
  }
}
```

**403:**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

<span style="text-decoration: underline;">**Default:**</span>

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Publish galaxy cluster:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/galaxy\_clusters/publish/{galaxyClusterId}</p>

##### Response:

<span style="text-decoration: underline;">**200:**</span>

```
{
  "message": "Publish job queued. Job ID: 4e9d26c275a7b190fcab10029df8c6b6"
}
```

**403:**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

<span style="text-decoration: underline;">**Default:**</span>

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Unpublish galaxy cluster:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/galaxy\_clusters/unpublish/{galaxyClusterId}</p>

##### Response:

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "GalaxyCluster unpublished",
  "message": "GalaxyCluster unpublished",
  "url": "/galaxy_clusters/publish/1"
}
```

**403:**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

<span style="text-decoration: underline;">**Default:**</span>

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Delete galaxy cluster:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/galaxy\_clusters/unpublish/{galaxyClusterId}</p>

##### Response:

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Galaxy cluster successfuly soft deleted.",
  "message": "Galaxy cluster successfuly soft deleted.",
  "url": "/galaxy_clusters/delete/1"
}
```

**403:**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

<span style="text-decoration: underline;">**Default:**</span>

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Restore galaxy cluster:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/galaxy\_clusters/unpublish/{galaxyClusterId}</p>

##### Response:

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "GalaxyCluster restored",
  "message": "GalaxyCluster restored",
  "url": "/galaxy_clusters/restore/1"
}
```

**403:**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

<span style="text-decoration: underline;">**Default:**</span>

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

####  

# Users

#### Reset user password:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/users/initiatePasswordReset/{userId}/{firstTimeReset}</p>

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
{
  "saved": true,
  "success": "New credentials sent."
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Add user:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/users/initiatePasswordReset/{userId}/{firstTimeReset}</p>

##### Request:

```
{
  "org_id": "12345",
  "server_id": "12345",
  "email": "user@example.com",
  "autoalert": true,
  "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
  "invited_by": "12345",
  "gpgkey": "string",
  "certif_public": "string",
  "nids_sid": "4000000",
  "termsaccepted": true,
  "newsread": "1617875568",
  "role_id": "3",
  "change_pw": "0",
  "contactalert": true,
  "disabled": true,
  "expiration": "2019-08-24T14:15:22Z",
  "current_login": "1617875568",
  "last_login": "1617875568",
  "force_logout": true,
  "date_created": "1617875568",
  "date_modified": "1617875568"
}
```

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
{
  "id": "12345",
  "org_id": "12345",
  "server_id": "12345",
  "email": "user@example.com",
  "autoalert": true,
  "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
  "invited_by": "12345",
  "gpgkey": "string",
  "certif_public": "string",
  "nids_sid": "4000000",
  "termsaccepted": true,
  "newsread": "1617875568",
  "role_id": "3",
  "change_pw": "0",
  "contactalert": true,
  "disabled": true,
  "expiration": "2019-08-24T14:15:22Z",
  "current_login": "1617875568",
  "last_login": "1617875568",
  "force_logout": true,
  "date_created": "1617875568",
  "date_modified": "1617875568"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Edit user:

<p class="callout warning">PUT</p>

<p class="callout info">https://misp.local/admin/users/edit/{userId}</p>

##### Request:

```
{
  "id": "12345",
  "org_id": "12345",
  "server_id": "12345",
  "email": "user@example.com",
  "autoalert": true,
  "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
  "invited_by": "12345",
  "gpgkey": "string",
  "certif_public": "string",
  "nids_sid": "4000000",
  "termsaccepted": true,
  "newsread": "1617875568",
  "role_id": "3",
  "change_pw": "0",
  "contactalert": true,
  "disabled": true,
  "expiration": "2019-08-24T14:15:22Z",
  "current_login": "1617875568",
  "last_login": "1617875568",
  "force_logout": true,
  "date_created": "1617875568",
  "date_modified": "1617875568"
}
```

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
{
  "id": "12345",
  "org_id": "12345",
  "server_id": "12345",
  "email": "user@example.com",
  "autoalert": true,
  "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
  "invited_by": "12345",
  "gpgkey": "string",
  "certif_public": "string",
  "nids_sid": "4000000",
  "termsaccepted": true,
  "newsread": "1617875568",
  "role_id": "3",
  "change_pw": "0",
  "contactalert": true,
  "disabled": true,
  "expiration": "2019-08-24T14:15:22Z",
  "current_login": "1617875568",
  "last_login": "1617875568",
  "force_logout": true,
  "date_created": "1617875568",
  "date_modified": "1617875568"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Delete user:

<p class="callout danger">DELETE</p>

<p class="callout info">https://misp.local/admin/users/delete/{userId}</p>

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
{
  "saved": true,
  "success": true,
  "name": "User deleted.",
  "message": "User deleted.",
  "url": "/admin/users/delete/1"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Get users:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/admin/users</p>

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
[
  {
    "User": {
      "id": "12345",
      "org_id": "12345",
      "server_id": "12345",
      "email": "user@example.com",
      "autoalert": true,
      "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
      "invited_by": "12345",
      "gpgkey": "string",
      "certif_public": "string",
      "nids_sid": "4000000",
      "termsaccepted": true,
      "newsread": "1617875568",
      "role_id": "3",
      "change_pw": "0",
      "contactalert": true,
      "disabled": true,
      "expiration": "2019-08-24T14:15:22Z",
      "current_login": "1617875568",
      "last_login": "1617875568",
      "force_logout": true,
      "date_created": "1617875568",
      "date_modified": "1617875568"
    },
    "Role": {
      "id": "3",
      "name": "ORGNAME",
      "perm_add": true,
      "perm_modify": true,
      "perm_modify_org": true,
      "perm_publish": true,
      "perm_delegate": true,
      "perm_sync": true,
      "perm_admin": true,
      "perm_audit": true,
      "perm_auth": true,
      "perm_site_admin": true,
      "perm_regexp_access": true,
      "perm_tagger": true,
      "perm_template": true,
      "perm_sharing_group": true,
      "perm_tag_editor": true,
      "perm_sighting": true,
      "perm_object_template": true,
      "perm_publish_zmq": true,
      "perm_publish_kafka": true,
      "perm_decaying": true,
      "perm_galaxy_editor": true,
      "default_role": true,
      "memory_limit": "string",
      "max_execution_time": "string",
      "restricted_to_site_admin": true,
      "enforce_rate_limit": true,
      "rate_limit_count": "string",
      "permission": "3",
      "permission_description": "publish"
    },
    "Organisation": {
      "id": "12345",
      "name": "ORGNAME"
    }
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Get user by ID:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/admin/users/view/{userId}</p>

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
{
  "id": "12345",
  "org_id": "12345",
  "server_id": "12345",
  "email": "user@example.com",
  "autoalert": true,
  "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
  "invited_by": "12345",
  "gpgkey": "string",
  "certif_public": "string",
  "nids_sid": "4000000",
  "termsaccepted": true,
  "newsread": "1617875568",
  "role_id": "3",
  "change_pw": "0",
  "contactalert": true,
  "disabled": true,
  "expiration": "2019-08-24T14:15:22Z",
  "current_login": "1617875568",
  "last_login": "1617875568",
  "force_logout": true,
  "date_created": "1617875568",
  "date_modified": "1617875568",
  "User": {
    "id": "12345",
    "org_id": "12345",
    "server_id": "12345",
    "email": "user@example.com",
    "autoalert": true,
    "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
    "invited_by": "12345",
    "gpgkey": "string",
    "certif_public": "string",
    "nids_sid": "4000000",
    "termsaccepted": true,
    "newsread": "1617875568",
    "role_id": "3",
    "change_pw": "0",
    "contactalert": true,
    "disabled": true,
    "expiration": "2019-08-24T14:15:22Z",
    "current_login": "1617875568",
    "last_login": "1617875568",
    "force_logout": true,
    "date_created": "1617875568",
    "date_modified": "1617875568"
  },
  "Role": {
    "id": "3",
    "name": "ORGNAME",
    "perm_add": true,
    "perm_modify": true,
    "perm_modify_org": true,
    "perm_publish": true,
    "perm_delegate": true,
    "perm_sync": true,
    "perm_admin": true,
    "perm_audit": true,
    "perm_auth": true,
    "perm_site_admin": true,
    "perm_regexp_access": true,
    "perm_tagger": true,
    "perm_template": true,
    "perm_sharing_group": true,
    "perm_tag_editor": true,
    "perm_sighting": true,
    "perm_object_template": true,
    "perm_publish_zmq": true,
    "perm_publish_kafka": true,
    "perm_decaying": true,
    "perm_galaxy_editor": true,
    "default_role": true,
    "memory_limit": "string",
    "max_execution_time": "string",
    "restricted_to_site_admin": true,
    "enforce_rate_limit": true,
    "rate_limit_count": "string",
    "permission": "3",
    "permission_description": "publish"
  },
  "UserSetting": {
    "publish_alert_filter": [
      {
        "AND": [
          {
            "NOT": [
              {
                "EventTag.name": [
                  "%osint%"
                ]
              }
            ]
          },
          {
            "OR": [
              {
                "Tag.name": [
                  "tlp:green",
                  "tlp:amber",
                  "tlp:red",
                  "%privint%"
                ]
              }
            ]
          }
        ]
      }
    ],
    "dashboard_access": true,
    "dashboard": [
      {
        "widget": "MispStatusWidget",
        "position": {
          "x": "0",
          "y": "0",
          "width": "2",
          "height": "2"
        }
      }
    ],
    "homepage": {
      "path": "/events/index"
    },
    "default_restsearch_parameters": [
      {
        "AND": [
          {
            "NOT": [
              {
                "EventTag.name": [
                  "%osint%"
                ]
              }
            ]
          },
          {
            "OR": [
              {
                "Tag.name": [
                  "tlp:green",
                  "tlp:amber",
                  "tlp:red",
                  "%privint%"
                ]
              }
            ]
          }
        ]
      }
    ],
    "tag_numerical_value_override": [
      {
        "false-positive:risk='medium'": 99
      }
    ],
    "event_index_hide_columns": [
      "clusters"
    ]
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Delete user TOTP:

<p class="callout danger">DELETE</p>

<p class="callout info">https://misp.local/users/totp\_delete/{userId}</p>

##### Response: 

**<span style="text-decoration: underline;">200:</span>**

```
{
  "saved": true,
  "success": true,
  "name": "User TOTP deleted.",
  "message": "User TOTP deleted.",
  "url": "/users/totp_delete/1",
  "id": "1"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid user",
  "message": "Invalid user",
  "url": "/users/totp_delete/1"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

# Organisations

#### Add organisation:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/admin/organisations/add</p>

##### Request:

```
{
  "name": "ORGNAME",
  "date_created": "2021-06-14 14:29:19",
  "date_modified": "2021-06-14 14:29:19",
  "description": "string",
  "type": "ADMIN",
  "nationality": "string",
  "sector": "string",
  "created_by": "12345",
  "uuid": "string",
  "contacts": "string",
  "local": true,
  "restricted_to_domain": [
    "example.com"
  ],
  "landingpage": "string",
  "user_count": "3",
  "created_by_email": "string"
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "id": "12345",
  "name": "ORGNAME",
  "date_created": "2021-06-14 14:29:19",
  "date_modified": "2021-06-14 14:29:19",
  "description": "string",
  "type": "ADMIN",
  "nationality": "string",
  "sector": "string",
  "created_by": "12345",
  "uuid": "string",
  "contacts": "string",
  "local": true,
  "restricted_to_domain": [
    "example.com"
  ],
  "landingpage": "string",
  "user_count": "3",
  "created_by_email": "string"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Edit organisation:

<p class="callout warning">PUT</p>

<p class="callout info">https://misp.local/admin/organisations/edit/{organisationId}</p>

##### Request:

```
{
  "name": "ORGNAME",
  "type": "ADMIN",
  "nationality": "string",
  "sector": "string",
  "contacts": "string",
  "description": "string",
  "local": true,
  "uuid": "095be615-a8ad-4c33-8e9c-c7612fbf6c9f",
  "restricted_to_domain": [
    "example.com"
  ]
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "id": "12345",
  "name": "ORGNAME",
  "date_created": "2021-06-14 14:29:19",
  "date_modified": "2021-06-14 14:29:19",
  "description": "string",
  "type": "ADMIN",
  "nationality": "string",
  "sector": "string",
  "created_by": "12345",
  "uuid": "string",
  "contacts": "string",
  "local": true,
  "restricted_to_domain": [
    "example.com"
  ],
  "landingpage": "string",
  "user_count": "3",
  "created_by_email": "string"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Delete organisation:

<p class="callout danger">DELETE</p>

<p class="callout info">https://misp.local/admin/organisations/delete/{organisationId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Organisation deleted",
  "message": "Organisation deleted",
  "url": "/admin/organisations/delete/1"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Get organisations:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/organisations</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
[
  {
    "Organisation": {
      "id": "12345",
      "name": "ORGNAME",
      "date_created": "2021-06-14 14:29:19",
      "date_modified": "2021-06-14 14:29:19",
      "description": "string",
      "type": "ADMIN",
      "nationality": "string",
      "sector": "string",
      "created_by": "12345",
      "uuid": "string",
      "contacts": "string",
      "local": true,
      "restricted_to_domain": [
        "example.com"
      ],
      "landingpage": "string",
      "user_count": "3",
      "created_by_email": "string"
    }
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Get organisation by ID:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/organisations/view/{organisationId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "id": "12345",
  "name": "ORGNAME",
  "date_created": "2021-06-14 14:29:19",
  "date_modified": "2021-06-14 14:29:19",
  "description": "string",
  "type": "ADMIN",
  "nationality": "string",
  "sector": "string",
  "created_by": "12345",
  "uuid": "string",
  "contacts": "string",
  "local": true,
  "restricted_to_domain": [
    "example.com"
  ],
  "landingpage": "string",
  "user_count": "3",
  "created_by_email": "string"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

# Server

#### Add server:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/servers/add</p>

##### Request:

```
{
  "name": "Phising Server",
  "url": "https://misppriv.circl.lu",
  "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
  "org_id": "12345",
  "push": true,
  "pull": true,
  "push_sightings": true,
  "push_galaxy_clusters": true,
  "pull_galaxy_clusters": true,
  "lastpulledid": "12345",
  "lastpushedid": "12345",
  "organization": "string",
  "remote_org_id": "12345",
  "publish_without_email": true,
  "unpublish_event": true,
  "self_signed": true,
  "pull_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
  "push_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]}}",
  "cert_file": "string",
  "client_cert_file": "string",
  "internal": true,
  "skip_proxy": true,
  "caching_enabled": true,
  "priority": "1",
  "cache_timestamp": true
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Server": {
    "id": "12345",
    "name": "Phising Server",
    "url": "https://misppriv.circl.lu",
    "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
    "org_id": "12345",
    "push": true,
    "pull": true,
    "push_sightings": true,
    "push_galaxy_clusters": true,
    "pull_galaxy_clusters": true,
    "lastpulledid": "12345",
    "lastpushedid": "12345",
    "organization": "string",
    "remote_org_id": "12345",
    "publish_without_email": true,
    "unpublish_event": true,
    "self_signed": true,
    "pull_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
    "push_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]}}",
    "cert_file": "string",
    "client_cert_file": "string",
    "internal": true,
    "skip_proxy": true,
    "caching_enabled": true,
    "priority": "1",
    "cache_timestamp": true
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Edit server:

<p class="callout warning">PUT</p>

<p class="callout info">https://misp.local/servers/edit/{serverId}</p>

##### Request:

```
{
  "id": "12345",
  "name": "Phising Server",
  "url": "https://misppriv.circl.lu",
  "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
  "org_id": "12345",
  "push": true,
  "pull": true,
  "push_sightings": true,
  "push_galaxy_clusters": true,
  "pull_galaxy_clusters": true,
  "lastpulledid": "12345",
  "lastpushedid": "12345",
  "organization": "string",
  "remote_org_id": "12345",
  "publish_without_email": true,
  "unpublish_event": true,
  "self_signed": true,
  "pull_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
  "push_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]}}",
  "cert_file": "string",
  "client_cert_file": "string",
  "internal": true,
  "skip_proxy": true,
  "caching_enabled": true,
  "priority": "1",
  "cache_timestamp": true
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Server": {
    "id": "12345",
    "name": "Phising Server",
    "url": "https://misppriv.circl.lu",
    "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
    "org_id": "12345",
    "push": true,
    "pull": true,
    "push_sightings": true,
    "push_galaxy_clusters": true,
    "pull_galaxy_clusters": true,
    "lastpulledid": "12345",
    "lastpushedid": "12345",
    "organization": "string",
    "remote_org_id": "12345",
    "publish_without_email": true,
    "unpublish_event": true,
    "self_signed": true,
    "pull_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
    "push_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]}}",
    "cert_file": "string",
    "client_cert_file": "string",
    "internal": true,
    "skip_proxy": true,
    "caching_enabled": true,
    "priority": "1",
    "cache_timestamp": true
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Delete server:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/servers/delete/{serverId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Server deleted",
  "message": "Server deleted",
  "url": "/servers/delete/1"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Get servers:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/servers</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
[
  {
    "Server": {
      "id": "12345",
      "name": "Phising Server",
      "url": "https://misppriv.circl.lu",
      "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
      "org_id": "12345",
      "push": true,
      "pull": true,
      "push_sightings": true,
      "push_galaxy_clusters": true,
      "pull_galaxy_clusters": true,
      "lastpulledid": "12345",
      "lastpushedid": "12345",
      "organization": "string",
      "remote_org_id": "12345",
      "publish_without_email": true,
      "unpublish_event": true,
      "self_signed": true,
      "pull_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
      "push_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]}}",
      "cert_file": "string",
      "client_cert_file": "string",
      "internal": true,
      "skip_proxy": true,
      "caching_enabled": true,
      "priority": "1",
      "cache_timestamp": true
    },
    "Organisation": {
      "id": "12345",
      "name": "ORGNAME",
      "date_created": "2021-06-14 14:29:19",
      "date_modified": "2021-06-14 14:29:19",
      "description": "string",
      "type": "ADMIN",
      "nationality": "string",
      "sector": "string",
      "created_by": "12345",
      "uuid": "string",
      "contacts": "string",
      "local": true,
      "restricted_to_domain": [
        "example.com"
      ],
      "landingpage": "string",
      "user_count": "3",
      "created_by_email": "string"
    },
    "RemoteOrg": {
      "id": "12345",
      "name": "ORGNAME",
      "date_created": "2021-06-14 14:29:19",
      "date_modified": "2021-06-14 14:29:19",
      "description": "string",
      "type": "ADMIN",
      "nationality": "string",
      "sector": "string",
      "created_by": "12345",
      "uuid": "string",
      "contacts": "string",
      "local": true,
      "restricted_to_domain": [
        "example.com"
      ],
      "landingpage": "string",
      "user_count": "3",
      "created_by_email": "string"
    },
    "User": [
      {
        "id": "12345",
        "org_id": "12345",
        "server_id": "12345",
        "email": "user@example.com",
        "autoalert": true,
        "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
        "invited_by": "12345",
        "gpgkey": "string",
        "certif_public": "string",
        "nids_sid": "4000000",
        "termsaccepted": true,
        "newsread": "1617875568",
        "role_id": "3",
        "change_pw": "0",
        "contactalert": true,
        "disabled": true,
        "expiration": "2019-08-24T14:15:22Z",
        "current_login": "1617875568",
        "last_login": "1617875568",
        "force_logout": true,
        "date_created": "1617875568",
        "date_modified": "1617875568"
      }
    ]
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Pull server:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/servers/pull/{serverId}/{pullTechnique}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Pull queued for background execution. Job ID: 1",
  "message": "Pull queued for background execution. Job ID: 1",
  "url": "/servers/pull/1"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Push server:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/servers/push/{serverId}/{pushTechnique}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Push queued for background execution. Job ID: 1",
  "message": "Push queued for background execution. Job ID: 1",
  "url": "/servers/push/1"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Get current instance version:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/servers/getVersion</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "version": "2.4.142",
  "perm_sync": true,
  "perm_sighting": true,
  "perm_galaxy_editor": true,
  "request_encoding": [
    "gzip"
  ]
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Get current instance PyMISP version:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/servers/getPyMISPVersion</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "version": "2.4.142"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Get current instance settings and diagnostics:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/servers/serverSettings</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "version": {
    "current": "v2.4.142",
    "newest": "v2.4.142",
    "upToDate": "same"
  },
  "phpSettings": {
    "max_execution_time": {
      "explanation": "The maximum duration that a script can run (does not affect the background workers). A too low number will break long running scripts like comprehensive API exports",
      "recommended": 300,
      "unit": "seconds",
      "value": 300
    },
    "memory_limit": {
      "explanation": "The maximum duration that a script can run (does not affect the background workers). A too low number will break long running scripts like comprehensive API exports",
      "recommended": 300,
      "unit": "seconds",
      "value": 300
    },
    "upload_max_filesize": {
      "explanation": "The maximum duration that a script can run (does not affect the background workers). A too low number will break long running scripts like comprehensive API exports",
      "recommended": 300,
      "unit": "seconds",
      "value": 300
    },
    "post_max_size": {
      "explanation": "The maximum duration that a script can run (does not affect the background workers). A too low number will break long running scripts like comprehensive API exports",
      "recommended": 300,
      "unit": "seconds",
      "value": 300
    }
  },
  "gpgStatus": "FAIL: Failed to load GnuPG",
  "proxyStatus": "not configured (so not tested)",
  "zmqStatus": 1,
  "stix": {
    "operational": 1,
    "stix": {
      "version": "1.2.0.11",
      "expected": ">1.2.0.9",
      "status": 1
    },
    "cybox": {
      "version": "1.2.0.11",
      "expected": ">1.2.0.9",
      "status": 1
    },
    "mixbox": {
      "version": "1.2.0.11",
      "expected": ">1.2.0.9",
      "status": 1
    },
    "maec": {
      "version": "1.2.0.11",
      "expected": ">1.2.0.9",
      "status": 1
    },
    "stix2": {
      "version": "1.2.0.11",
      "expected": ">1.2.0.9",
      "status": 1
    },
    "pymisp": {
      "version": "1.2.0.11",
      "expected": ">1.2.0.9",
      "status": 1
    }
  },
  "moduleStatus": {
    "Enrichment": 1,
    "Import": 1,
    "Export": 1,
    "Cortex": 1
  },
  "writeableDirs": {
    "/tmp": 0,
    "/var/www/MISP/app/tmp": 0,
    "/var/www/MISP/app/files": 0,
    "/var/www/MISP/app/files/scripts/tmp": 0
  },
  "writeableFiles": {
    "/var/www/MISP/app/Config/config.php": 0,
    "/var/www/MISP/.git/ORIG_HEAD": 2
  },
  "readableFiles": {
    "/var/www/MISP/app/files/scripts/stixtest.py": 0
  },
  "dbDiagnostics": {
    "admin_settings": {
      "table": "admin_settings",
      "used": "0.03 MB",
      "reclaimable": "0 MB",
      "data_in_bytes": 16384,
      "index_in_bytes": 16384,
      "reclaimable_in_bytes": 0
    },
    "allowedlist": {
      "table": "allowedlist",
      "used": "0.02 MB",
      "reclaimable": "0 MB",
      "data_in_bytes": 16384,
      "index_in_bytes": 0,
      "reclaimable_in_bytes": 0
    }
  },
  "dbSchemaDiagnostics": {
    "dataSource": "Database/Mysql",
    "actual_db_version": "68",
    "checked_table_column": [
      "column_name"
    ],
    "diagnostic": {},
    "diagnostic_index": {
      "event_reports": {
        "event_id": {
          "message": "Column `event_id` is indexed but should not",
          "sql": "DROP INDEX `event_id` ON event_reports;"
        }
      }
    },
    "expected_db_version": "70",
    "error": "string",
    "update_locked": true,
    "remaining_lock_time": 0,
    "update_fail_number_reached": true,
    "indexes": {
      "admin_settings": {
        "id": true,
        "setting": false
      }
    },
    "columnPerTable": {
      "admin_settings": [
        "id",
        "setting",
        "value"
      ]
    }
  },
  "redisInfo": {
    "extensionVersion": "5.1.1",
    "connection": true,
    "redis_version": "5.0.7",
    "redis_git_sha1": 0,
    "redis_git_dirty": 0,
    "redis_build_id": "636cde3b5c7a3923",
    "redis_mode": "standalone",
    "os": "Linux 5.8.0-50-generic x86_64",
    "arch_bits": 64,
    "multiplexing_api": "epoll",
    "atomicvar_api": "atomic-builtin",
    "gcc_version": "9.2.1",
    "process_id": 1051,
    "run_id": "f894944d92c978df93a18821fb5ebe30dfd0b257",
    "tcp_port": 6379,
    "uptime_in_seconds": 327116,
    "uptime_in_days": 3,
    "hz": 10,
    "configured_hz": 10,
    "lru_clock": 10365184,
    "executable": "/usr/bin/redis-server",
    "config_file": "/etc/redis/redis.conf",
    "connected_clients": 18,
    "client_recent_max_input_buffer": 2,
    "client_recent_max_output_buffer": 0,
    "blocked_clients": 0,
    "used_memory": 1309488,
    "used_memory_human": "1.25M",
    "used_memory_rss": 5541888,
    "used_memory_rss_human": "5.29M",
    "used_memory_peak": 1410464,
    "used_memory_peak_human": "1.35M",
    "used_memory_peak_perc": "92.84%",
    "used_memory_overhead": 1200800,
    "used_memory_startup": 796232,
    "used_memory_dataset": 108688,
    "used_memory_dataset_perc": "21.18%",
    "allocator_allocated": 1480176,
    "allocator_active": 1896448,
    "allocator_resident": 5890048,
    "total_system_memory": 33406590976,
    "total_system_memory_human": "31.11G",
    "used_memory_lua": 41984,
    "used_memory_lua_human": "41.00K",
    "used_memory_scripts": 0,
    "used_memory_scripts_human": "0B",
    "number_of_cached_scripts": 0,
    "maxmemory": 0,
    "maxmemory_human": "0B",
    "maxmemory_policy": "noeviction",
    "allocator_frag_ratio": 1.28,
    "allocator_frag_bytes": 416272,
    "allocator_rss_ratio": 3.11,
    "allocator_rss_bytes": 3993600,
    "rss_overhead_ratio": 0.94,
    "rss_overhead_bytes": -348160,
    "mem_fragmentation_ratio": 4.24,
    "mem_fragmentation_bytes": 4233432,
    "mem_not_counted_for_evict": 0,
    "mem_replication_backlog": 0,
    "mem_clients_slaves": 0,
    "mem_clients_normal": 402912,
    "mem_aof_buffer": 0,
    "mem_allocator": "jemalloc-5.2.1",
    "active_defrag_running": 0,
    "lazyfree_pending_objects": 0,
    "loading": 0,
    "rdb_changes_since_last_save": 0,
    "rdb_bgsave_in_progress": 0,
    "rdb_last_save_time": 1620977919,
    "rdb_last_bgsave_status": "ok",
    "rdb_last_bgsave_time_sec": 0,
    "rdb_current_bgsave_time_sec": -1,
    "rdb_last_cow_size": 446464,
    "aof_enabled": 0,
    "aof_rewrite_in_progress": 0,
    "aof_rewrite_scheduled": 0,
    "aof_last_rewrite_time_sec": -1,
    "aof_current_rewrite_time_sec": -1,
    "aof_last_bgrewrite_status": "ok",
    "aof_last_write_status": "ok",
    "aof_last_cow_size": 0,
    "total_connections_received": 289,
    "total_commands_processed": 252747,
    "instantaneous_ops_per_sec": 7,
    "total_net_input_bytes": 12111506,
    "total_net_output_bytes": 1232466,
    "instantaneous_input_kbps": 0.36,
    "instantaneous_output_kbps": 0.03,
    "rejected_connections": 0,
    "sync_full": 0,
    "sync_partial_ok": 0,
    "sync_partial_err": 0,
    "expired_keys": 17,
    "expired_stale_perc": 0,
    "expired_time_cap_reached_count": 0,
    "evicted_keys": 0,
    "keyspace_hits": 70,
    "keyspace_misses": 62805,
    "pubsub_channels": 0,
    "pubsub_patterns": 0,
    "latest_fork_usec": 168,
    "migrate_cached_sockets": 0,
    "slave_expires_tracked_keys": 0,
    "active_defrag_hits": 0,
    "active_defrag_misses": 0,
    "active_defrag_key_hits": 0,
    "active_defrag_key_misses": 0,
    "role": "master",
    "connected_slaves": 0,
    "master_replid": "d5e7afcf4fd1a31e539a4eadd5caf2a7da6d121c",
    "master_replid2": 0,
    "master_repl_offset": 0,
    "second_repl_offset": -1,
    "repl_backlog_active": 0,
    "repl_backlog_size": 1048576,
    "repl_backlog_first_byte_offset": 0,
    "repl_backlog_histlen": 0,
    "used_cpu_sys": 195.014281,
    "used_cpu_user": 217.352183,
    "used_cpu_sys_children": 0.050885,
    "used_cpu_user_children": 0.076436,
    "cluster_enabled": 0,
    "db0": "keys=15,expires=0,avg_ttl=0",
    "db13": "keys=12,expires=4,avg_ttl=21265731140"
  },
  "finalSettings": [
    {
      "level": 0,
      "value": "string",
      "errorMessage": "The currently set baseurl does not match the URL through which you have accessed the page. Disregard this if you are accessing the page via an alternate URL (for example via IP address).",
      "test": "testBaseURL",
      "type": "string",
      "null": true,
      "subGroup": "Enrichment",
      "cli_only": 1,
      "redacted": true,
      "optionsSource": {},
      "afterHook": "cleanCacheFiles",
      "error": 1,
      "tab": "MISP",
      "setting": "MISP.baseurl",
      "options": {}
    }
  ],
  "extensions": {
    "cli": {
      "phpversion": "7.4.3"
    },
    "extensions": {
      "json": {
        "web_version": "7.4.3",
        "web_version_outdated": false,
        "cli_version": "7.4.3",
        "cli_version_outdated": false,
        "required": true,
        "info": null
      }
    }
  },
  "workers": {
    "cache": {
      "ok": true,
      "workers": [
        {
          "pid": 1233,
          "user": "www-data",
          "alive": true,
          "correct_user": true,
          "ok": true
        }
      ],
      "jobCount": 0
    },
    "default": {
      "ok": true,
      "workers": [
        {
          "pid": 1233,
          "user": "www-data",
          "alive": true,
          "correct_user": true,
          "ok": true
        }
      ],
      "jobCount": 0
    },
    "email": {
      "ok": true,
      "workers": [
        {
          "pid": 1233,
          "user": "www-data",
          "alive": true,
          "correct_user": true,
          "ok": true
        }
      ],
      "jobCount": 0
    },
    "prio": {
      "ok": true,
      "workers": [
        {
          "pid": 1233,
          "user": "www-data",
          "alive": true,
          "correct_user": true,
          "ok": true
        }
      ],
      "jobCount": 0
    },
    "update": {
      "ok": true,
      "workers": [
        {
          "pid": 1233,
          "user": "www-data",
          "alive": true,
          "correct_user": true,
          "ok": true
        }
      ],
      "jobCount": 0
    },
    "scheduler": {
      "ok": true,
      "workers": [
        {
          "pid": 1233,
          "user": "www-data",
          "alive": true,
          "correct_user": true,
          "ok": true
        }
      ],
      "jobCount": 0
    },
    "proc_accessible": true,
    "controls": true
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Get workers:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/servers/getWorkers</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "cache": {
    "ok": true,
    "workers": [
      {
        "pid": 1233,
        "user": "www-data",
        "alive": true,
        "correct_user": true,
        "ok": true
      }
    ],
    "jobCount": 0
  },
  "default": {
    "ok": true,
    "workers": [
      {
        "pid": 1233,
        "user": "www-data",
        "alive": true,
        "correct_user": true,
        "ok": true
      }
    ],
    "jobCount": 0
  },
  "email": {
    "ok": true,
    "workers": [
      {
        "pid": 1233,
        "user": "www-data",
        "alive": true,
        "correct_user": true,
        "ok": true
      }
    ],
    "jobCount": 0
  },
  "prio": {
    "ok": true,
    "workers": [
      {
        "pid": 1233,
        "user": "www-data",
        "alive": true,
        "correct_user": true,
        "ok": true
      }
    ],
    "jobCount": 0
  },
  "update": {
    "ok": true,
    "workers": [
      {
        "pid": 1233,
        "user": "www-data",
        "alive": true,
        "correct_user": true,
        "ok": true
      }
    ],
    "jobCount": 0
  },
  "scheduler": {
    "ok": true,
    "workers": [
      {
        "pid": 1233,
        "user": "www-data",
        "alive": true,
        "correct_user": true,
        "ok": true
      }
    ],
    "jobCount": 0
  },
  "proc_accessible": true,
  "controls": true
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Start worker:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/servers/startWorker/{workerType}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Worker start signal sent",
  "message": "Worker start signal sent",
  "url": "/servers/startWorker/email"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Stop worker:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/servers/stopWorker/{workerPid}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Worker stop signal sent",
  "message": "Worker stop signal sent",
  "url": "/servers/startWorker/1234"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Kill all workers:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/servers/killAllWorkers</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Killing workers.",
  "message": "Killing workers.",
  "url": "/servers/killAllWorkers"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Restart workers:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/servers/restartWorkers</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Restarting workers.",
  "message": "Restarting workers.",
  "url": "/servers/restartWorkers"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Restart dead workers:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/servers/restartDeadWorkers</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Restarting workers.",
  "message": "Restarting workers.",
  "url": "/servers/restartDeadWorkers"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Update server:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/servers/update</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "results": [
    {
      "input": "cd $(git rev-parse --show-toplevel) && git checkout app/composer.json 2>&1",
      "output": [
        "Updated 1 path from the index"
      ],
      "status": 0
    }
  ]
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Cache server:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/servers/cache</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Server caching job initiated.",
  "message": "Server caching job initiated.",
  "url": "/servers/cache"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Create sync:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/servers/createSync</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Server": {
    "url": "https://misppriv.circl.lu",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
    "Organisation": {
      "name": "ORGNAME",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
    }
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Get instance UUID:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/servers/getInstanceUUID</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Get server setting by name:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/servers/getSetting/{settingName}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "level": 0,
  "value": "string",
  "errorMessage": "The currently set baseurl does not match the URL through which you have accessed the page. Disregard this if you are accessing the page via an alternate URL (for example via IP address).",
  "test": "testBaseURL",
  "type": "string",
  "null": true,
  "subGroup": "Enrichment",
  "cli_only": 1,
  "redacted": true,
  "optionsSource": {},
  "afterHook": "cleanCacheFiles",
  "error": 1,
  "tab": "MISP",
  "setting": "MISP.baseurl",
  "options": {}
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Edit server setting:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/servers/serverSettingsEdit/{settingName}</p>

##### Request: 

```
{
  "value": "string"
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Field updated",
  "message": "Field updated",
  "url": "/servers/serverSettingsEdit"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```



#### Import server:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/servers/import</p>

##### Request: 

```
{
  "name": "Phising Server",
  "url": "https://misppriv.circl.lu",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
  "Organisation": {
    "name": "ORGNAME"
  }
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Server": {
    "id": "12345",
    "name": "Phising Server",
    "url": "https://misppriv.circl.lu",
    "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
    "org_id": "12345",
    "push": true,
    "pull": true,
    "push_sightings": true,
    "push_galaxy_clusters": true,
    "pull_galaxy_clusters": true,
    "lastpulledid": "12345",
    "lastpushedid": "12345",
    "organization": "string",
    "remote_org_id": "12345",
    "publish_without_email": true,
    "unpublish_event": true,
    "self_signed": true,
    "pull_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
    "push_rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]}}",
    "cert_file": "string",
    "client_cert_file": "string",
    "internal": true,
    "skip_proxy": true,
    "caching_enabled": true,
    "priority": "1",
    "cache_timestamp": true
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

# Sharing Group

#### Add a sharing group:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/sharing\_groups/add</p>

##### Request:

```
{
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "name": "Banking Sharing Group",
  "description": "Banking Institutions of X Sharing Group",
  "releasability": "string",
  "local": true,
  "active": true,
  "org_count": "6",
  "organisation_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "org_id": "12345",
  "sync_user_id": "12345",
  "created": "string",
  "modified": "string",
  "roaming": true
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "SharingGroup": {
    "id": "1",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "name": "Banking Sharing Group",
    "description": "Banking Institutions of X Sharing Group",
    "releasability": "string",
    "local": true,
    "active": true,
    "org_count": "6",
    "organisation_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "org_id": "12345",
    "sync_user_id": "12345",
    "created": "string",
    "modified": "string",
    "roaming": true
  },
  "Organisation": {
    "id": "12345",
    "name": "ORGNAME",
    "date_created": "2021-06-14 14:29:19",
    "date_modified": "2021-06-14 14:29:19",
    "description": "string",
    "type": "ADMIN",
    "nationality": "string",
    "sector": "string",
    "created_by": "12345",
    "uuid": "string",
    "contacts": "string",
    "local": true,
    "restricted_to_domain": [
      "example.com"
    ],
    "landingpage": "string",
    "user_count": "3",
    "created_by_email": "string"
  },
  "SharingGroupOrg": [
    {
      "id": "1",
      "sharing_group_id": "1",
      "org_id": "12345",
      "extend": true,
      "Organisation": {
        "id": "12345",
        "name": "ORGNAME",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
      }
    }
  ],
  "SharingGroupServer": [
    {
      "all_orgs": true,
      "server_id": "12345",
      "sharing_group_id": "1",
      "Server": {
        "id": "12345",
        "name": "Phising Server"
      }
    }
  ],
  "editable": true,
  "deletable": true
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```




#### Edit a sharing group:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/sharing\_groups/edit/{sharingGroupId}</p>

##### Request:

```
{
  "id": "1",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "name": "Banking Sharing Group",
  "description": "Banking Institutions of X Sharing Group",
  "releasability": "string",
  "local": true,
  "active": true,
  "org_count": "6",
  "organisation_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "org_id": "12345",
  "sync_user_id": "12345",
  "created": "string",
  "modified": "string",
  "roaming": true
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "SharingGroup": {
    "id": "1",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "name": "Banking Sharing Group",
    "description": "Banking Institutions of X Sharing Group",
    "releasability": "string",
    "local": true,
    "active": true,
    "org_count": "6",
    "organisation_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "org_id": "12345",
    "sync_user_id": "12345",
    "created": "string",
    "modified": "string",
    "roaming": true
  },
  "Organisation": {
    "id": "12345",
    "name": "ORGNAME",
    "date_created": "2021-06-14 14:29:19",
    "date_modified": "2021-06-14 14:29:19",
    "description": "string",
    "type": "ADMIN",
    "nationality": "string",
    "sector": "string",
    "created_by": "12345",
    "uuid": "string",
    "contacts": "string",
    "local": true,
    "restricted_to_domain": [
      "example.com"
    ],
    "landingpage": "string",
    "user_count": "3",
    "created_by_email": "string"
  },
  "SharingGroupOrg": [
    {
      "id": "1",
      "sharing_group_id": "1",
      "org_id": "12345",
      "extend": true,
      "Organisation": {
        "id": "12345",
        "name": "ORGNAME",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
      }
    }
  ],
  "SharingGroupServer": [
    {
      "all_orgs": true,
      "server_id": "12345",
      "sharing_group_id": "1",
      "Server": {
        "id": "12345",
        "name": "Phising Server"
      }
    }
  ],
  "editable": true,
  "deletable": true
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```




#### Delete a sharing group:

<p class="callout danger">DELETE</p>

<p class="callout info">https://misp.local/sharing\_groups/delete/{sharingGroupId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "SharingGroup deleted",
  "message": "SharingGroup deleted",
  "url": "/sharing_groups/delete/1"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```




#### Get a list of sharing groups:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/sharing\_groups</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "response": [
    {
      "SharingGroup": {
        "id": "1",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "name": "Banking Sharing Group",
        "description": "Banking Institutions of X Sharing Group",
        "releasability": "string",
        "local": true,
        "active": true,
        "org_count": "6"
      },
      "Organisation": {
        "id": "12345",
        "name": "ORGNAME",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
      },
      "SharingGroupOrg": [
        {
          "id": "1",
          "sharing_group_id": "1",
          "org_id": "12345",
          "extend": true,
          "Organisation": {
            "id": "12345",
            "name": "ORGNAME",
            "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
          }
        }
      ],
      "SharingGroupServer": [
        {
          "all_orgs": true,
          "server_id": "12345",
          "sharing_group_id": "1",
          "Server": {
            "id": "12345",
            "name": "Phising Server"
          }
        }
      ],
      "editable": true,
      "deletable": true
    }
  ]
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```




#### Get a sharing group by ID:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/sharing\_groups/view/{sharingGroupId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "SharingGroup": {
    "id": "1",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "name": "Banking Sharing Group",
    "description": "Banking Institutions of X Sharing Group",
    "releasability": "string",
    "local": true,
    "active": true,
    "org_count": "6",
    "organisation_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "org_id": "12345",
    "sync_user_id": "12345",
    "created": "string",
    "modified": "string",
    "roaming": true
  },
  "Organisation": {
    "id": "12345",
    "name": "ORGNAME",
    "date_created": "2021-06-14 14:29:19",
    "date_modified": "2021-06-14 14:29:19",
    "description": "string",
    "type": "ADMIN",
    "nationality": "string",
    "sector": "string",
    "created_by": "12345",
    "uuid": "string",
    "contacts": "string",
    "local": true,
    "restricted_to_domain": [
      "example.com"
    ],
    "landingpage": "string",
    "user_count": "3",
    "created_by_email": "string"
  },
  "SharingGroupOrg": [
    {
      "id": "1",
      "sharing_group_id": "1",
      "org_id": "12345",
      "extend": true,
      "Organisation": {
        "id": "12345",
        "name": "ORGNAME",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b"
      }
    }
  ],
  "SharingGroupServer": [
    {
      "all_orgs": true,
      "server_id": "12345",
      "sharing_group_id": "1",
      "Server": {
        "id": "12345",
        "name": "Phising Server"
      }
    }
  ],
  "editable": true,
  "deletable": true
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```




#### Add an organisation to a sharing group:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/sharing\_groups/addOrg/{sharingGroupId}/{organisationId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Organisation added to the sharing group.",
  "message": "Organisation added to the sharing group.",
  "url": "/sharing_groups/addOrg"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```




#### Remove an organisation from a sharing group:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/sharing\_groups/removeOrg/{sharingGroupId}/{organisationId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Organisation removed from the sharing group.",
  "message": "Organisation removed from the sharing group.",
  "url": "/sharing_groups/removeOrg"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```




#### Add a server to a sharing group:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/sharing\_groups/addServer/{sharingGroupId}/{serverId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Server added to the sharing group.",
  "message": "Server added to the sharing group.",
  "url": "/sharing_groups/addServer"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```




#### Remove a server from a sharing group:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/sharing\_groups/removeServer/{sharingGroupServerId}/{serverId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Server removed from the sharing group.",
  "message": "Server removed from the sharing group.",
  "url": "/sharing_groups/removeServer"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

# Feed

#### Get a list of feeds:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/feeds</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
[
  {
    "Feed": {
      "id": "3",
      "name": "CIRCL OSINT Feed",
      "provider": "CIRCL",
      "url": "https://www.circl.lu/doc/misp/feed-osint",
      "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
      "enabled": true,
      "distribution": "0",
      "sharing_group_id": "1",
      "tag_id": "12345",
      "default": true,
      "source_format": "1",
      "fixed_event": true,
      "delta_merge": true,
      "event_id": "12345",
      "publish": false,
      "override_ids": true,
      "settings": "{\"csv\":{\"value\":\"\",\"delimiter\":\"\"},\"common\":{\"excluderegex\":\"\"},\"disable_correlation\":\"1\"}",
      "input_source": "local",
      "delete_local_file": true,
      "lookup_visible": true,
      "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n",
      "caching_enabled": true,
      "force_to_ids": true,
      "orgc_id": "12345",
      "cache_timestamp": "1617875568"
    }
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```





#### Get a feed by ID:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/feeds/view/{feedId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Feed": {
    "id": "3",
    "name": "CIRCL OSINT Feed",
    "provider": "CIRCL",
    "url": "https://www.circl.lu/doc/misp/feed-osint",
    "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
    "enabled": true,
    "distribution": "0",
    "sharing_group_id": "1",
    "tag_id": "12345",
    "default": true,
    "source_format": "1",
    "fixed_event": true,
    "delta_merge": true,
    "event_id": "12345",
    "publish": false,
    "override_ids": true,
    "settings": "{\"csv\":{\"value\":\"\",\"delimiter\":\"\"},\"common\":{\"excluderegex\":\"\"},\"disable_correlation\":\"1\"}",
    "input_source": "local",
    "delete_local_file": true,
    "lookup_visible": true,
    "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n",
    "caching_enabled": true,
    "force_to_ids": true,
    "orgc_id": "12345",
    "cache_timestamp": "1617875568"
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```





#### Add a feed:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/feeds/view/{feedId}</p>

##### Request:

```
{
  "name": "CIRCL OSINT Feed",
  "provider": "CIRCL",
  "url": "https://www.circl.lu/doc/misp/feed-osint",
  "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
  "enabled": true,
  "distribution": "0",
  "sharing_group_id": "1",
  "tag_id": "12345",
  "source_format": "1",
  "fixed_event": true,
  "delta_merge": true,
  "event_id": "12345",
  "publish": false,
  "override_ids": true,
  "input_source": "local",
  "delete_local_file": true,
  "lookup_visible": true,
  "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n",
  "caching_enabled": true,
  "force_to_ids": true,
  "orgc_id": "12345"
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Feed": {
    "id": "3",
    "name": "CIRCL OSINT Feed",
    "provider": "CIRCL",
    "url": "https://www.circl.lu/doc/misp/feed-osint",
    "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
    "enabled": true,
    "distribution": "0",
    "sharing_group_id": "1",
    "tag_id": "12345",
    "default": true,
    "source_format": "1",
    "fixed_event": true,
    "delta_merge": true,
    "event_id": "12345",
    "publish": false,
    "override_ids": true,
    "settings": "{\"csv\":{\"value\":\"\",\"delimiter\":\"\"},\"common\":{\"excluderegex\":\"\"},\"disable_correlation\":\"1\"}",
    "input_source": "local",
    "delete_local_file": true,
    "lookup_visible": true,
    "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n",
    "caching_enabled": true,
    "force_to_ids": true,
    "orgc_id": "12345",
    "cache_timestamp": "1617875568"
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```





#### Edit a feed:

<p class="callout warning">PUT</p>

<p class="callout info">https://misp.local/feeds/edit/{feedId}</p>

##### Request:

```
{
  "id": "3",
  "name": "CIRCL OSINT Feed",
  "provider": "CIRCL",
  "url": "https://www.circl.lu/doc/misp/feed-osint",
  "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
  "enabled": true,
  "distribution": "0",
  "sharing_group_id": "1",
  "tag_id": "12345",
  "source_format": "1",
  "fixed_event": true,
  "delta_merge": true,
  "event_id": "12345",
  "publish": false,
  "override_ids": true,
  "input_source": "local",
  "delete_local_file": true,
  "lookup_visible": true,
  "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n",
  "caching_enabled": true,
  "force_to_ids": true,
  "orgc_id": "12345"
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Feed": {
    "id": "3",
    "name": "CIRCL OSINT Feed",
    "provider": "CIRCL",
    "url": "https://www.circl.lu/doc/misp/feed-osint",
    "rules": "{\"tags\":{\"OR\":[],\"NOT\":[]},\"orgs\":{\"OR\":[],\"NOT\":[]},\"url_params\":\"\"}",
    "enabled": true,
    "distribution": "0",
    "sharing_group_id": "1",
    "tag_id": "12345",
    "default": true,
    "source_format": "1",
    "fixed_event": true,
    "delta_merge": true,
    "event_id": "12345",
    "publish": false,
    "override_ids": true,
    "settings": "{\"csv\":{\"value\":\"\",\"delimiter\":\"\"},\"common\":{\"excluderegex\":\"\"},\"disable_correlation\":\"1\"}",
    "input_source": "local",
    "delete_local_file": true,
    "lookup_visible": true,
    "headers": "X-Custom-Header-A: Foo\nX-Custom-Header-B: Bar\n",
    "caching_enabled": true,
    "force_to_ids": true,
    "orgc_id": "12345",
    "cache_timestamp": "1617875568"
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```





#### Enable feed:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/feeds/enable/{feedId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "name": "Feed enabled.",
  "message": "Feed enabled.",
  "url": "/feeds/enable/1"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```





#### Disable feed:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/feeds/disable/{feedId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "name": "Feed disabled.",
  "message": "Feed disabled.",
  "url": "/feeds/disable/1"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```





#### Cache feeds:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/feeds/cacheFeeds/{cacheFeedsScope}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "name": "Feed caching job initiated.",
  "message": "Feed caching job initiated.",
  "url": "/feeds/cacheFeed"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```





#### Fetch from feed by ID:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/feeds/fetchFromFeed/{feedId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "result": "Pull queued for background execution."
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```





#### Fetch from all feeds:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/feeds/fetchFromAllFeeds</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "result": "Pull queued for background execution."
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

# Object

#### \[restSearch\] Get a filtered and paginated list of objects:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/objects/restsearch</p>

##### Request:

```
{
  "page": 1,
  "limit": 0,
  "quickFilter": "malware",
  "searchall": "malware",
  "timestamp": "1617875568",
  "object_name": "ail-leak",
  "object_template_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "object_template_version": "1",
  "eventid": "12345",
  "eventinfo": "logged source ip",
  "ignore": false,
  "from": "string",
  "to": "string",
  "date": "string",
  "tags": [
    "tlp:amber"
  ],
  "last": 0,
  "event_timestamp": "1617875568",
  "publish_timestamp": "1617875568",
  "org": "12345",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "value": "127.0.0.1",
  "type": "md5",
  "category": "Internal reference",
  "object_relation": "filepath",
  "attribute_timestamp": "1617875568",
  "first_seen": "1581984000000000",
  "last_seen": "1581984000000000",
  "comment": "logged source ip",
  "to_ids": true,
  "published": false,
  "deleted": false,
  "withAttachments": false,
  "enforceWarninglist": true,
  "includeAllTags": false,
  "includeEventUuid": false,
  "include_event_uuid": false,
  "includeEventTags": false,
  "includeProposals": false,
  "includeWarninglistHits": true,
  "includeContext": true,
  "includeSightings": true,
  "includeSightingdb": true,
  "includeCorrelations": true,
  "includeDecayScore": false,
  "includeFullModel": false,
  "allow_proposal_blocking": false,
  "metadata": true,
  "attackGalaxy": "mitre-attack",
  "excludeDecayed": false,
  "decayingModel": "string",
  "modelOverrides": {
    "lifetime": 3,
    "decay_speed": 2.3,
    "threshold": 30,
    "default_base_score": 80,
    "base_score_config": {
      "estimative-language:confidence-in-analytic-judgment": 0.25,
      "estimative-language:likelihood-probability": 0.25,
      "phishing:psychological-acceptability": 0.25,
      "phishing:state": 0.2
    }
  },
  "score": "string",
  "returnFormat": "json"
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "response": [
    {
      "Object": {
        "id": "12345",
        "name": "ail-leak",
        "meta-category": "string",
        "description": "string",
        "template_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "template_version": "1",
        "event_id": "12345",
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "string",
        "deleted": true,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000",
        "Attribute": [
          {
            "id": "12345",
            "event_id": "12345",
            "object_id": "12345",
            "object_relation": "sensor",
            "category": "Internal reference",
            "type": "md5",
            "value": "127.0.0.1",
            "to_ids": true,
            "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
            "timestamp": "1617875568",
            "distribution": "0",
            "sharing_group_id": "1",
            "comment": "logged source ip",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "1581984000000000",
            "last_seen": "1581984000000000"
          }
        ]
      }
    }
  ]
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Add an object to an event:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/objects/add/{eventId}/{objectTemplateId}</p>

##### Request:

```
{
  "Attribute": [
    {
      "category": "Internal reference",
      "value": "127.0.0.1",
      "to_ids": true,
      "disable_correlation": false,
      "distribution": "0",
      "comment": "logged source ip",
      "object_relation": "sensor"
    }
  ]
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Object": {
    "id": "12345",
    "name": "ail-leak",
    "meta-category": "string",
    "description": "string",
    "template_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "template_version": "1",
    "event_id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "timestamp": "1617875568",
    "distribution": "0",
    "sharing_group_id": "1",
    "comment": "string",
    "deleted": true,
    "first_seen": "1581984000000000",
    "last_seen": "1581984000000000",
    "Attribute": [
      {
        "id": "12345",
        "event_id": "12345",
        "object_id": "12345",
        "object_relation": "sensor",
        "category": "Internal reference",
        "type": "md5",
        "value": "127.0.0.1",
        "to_ids": true,
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "logged source ip",
        "deleted": false,
        "disable_correlation": false,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000"
      }
    ]
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">404:</span>**

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Get object by ID:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/objects/view/{objectId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Object": {
    "id": "12345",
    "name": "ail-leak",
    "meta-category": "string",
    "description": "string",
    "template_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "template_version": "1",
    "event_id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "timestamp": "1617875568",
    "distribution": "0",
    "sharing_group_id": "1",
    "comment": "string",
    "deleted": true,
    "first_seen": "1581984000000000",
    "last_seen": "1581984000000000",
    "Attribute": [
      {
        "id": "12345",
        "event_id": "12345",
        "object_id": "12345",
        "object_relation": "sensor",
        "category": "Internal reference",
        "type": "md5",
        "value": "127.0.0.1",
        "to_ids": true,
        "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
        "timestamp": "1617875568",
        "distribution": "0",
        "sharing_group_id": "1",
        "comment": "logged source ip",
        "deleted": false,
        "disable_correlation": false,
        "first_seen": "1581984000000000",
        "last_seen": "1581984000000000"
      }
    ],
    "Event": {
      "id": "12345",
      "info": "logged source ip",
      "org_id": "12345",
      "orgc_id": "12345"
    }
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">404:</span>**

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Delete object:

<p class="callout success">DELETE</p>

<p class="callout info">https://misp.local/objects/delete/{objectId}/{hardDelete}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Object deleted",
  "message": "Object deleted",
  "url": "/objects/delete/1"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

**<span style="text-decoration: underline;">404:</span>**

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

# TAG

#### Get tags:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/tags</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Tag": [
    {
      "id": "12345",
      "name": "tlp:white",
      "colour": "#ffffff",
      "exportable": true,
      "org_id": "12345",
      "user_id": "12345",
      "hide_tag": false,
      "numerical_value": "12345",
      "is_galaxy": true,
      "is_custom_galaxy": true,
      "inherited": 1
    }
  ]
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Get tag by ID:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/tags/view/{tagId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "id": "12345",
  "name": "tlp:white",
  "colour": "#ffffff",
  "exportable": true,
  "org_id": "12345",
  "user_id": "12345",
  "hide_tag": false,
  "numerical_value": "12345",
  "is_galaxy": true,
  "is_custom_galaxy": true,
  "inherited": 1
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Add tag:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/tags/add</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "id": "12345",
  "name": "tlp:white",
  "colour": "#ffffff",
  "exportable": true,
  "org_id": "12345",
  "user_id": "12345",
  "hide_tag": false,
  "numerical_value": "12345",
  "is_galaxy": true,
  "is_custom_galaxy": true,
  "inherited": 1
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Delete tag:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/tags/delete/{tagId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "name": "Tag deleted.",
  "message": "Tag deleted.",
  "url": "https://misppriv.circl.lu/tags/delete/1"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Edit tag:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/tags/edit/{tagId}</p>

##### Request:

```
{
  "name": "tlp:white",
  "colour": "#ffffff",
  "exportable": true,
  "org_id": "12345",
  "user_id": "12345",
  "hide_tag": false,
  "numerical_value": "12345",
  "is_galaxy": true,
  "is_custom_galaxy": true,
  "inherited": 1
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Tag": {
    "id": "12345",
    "name": "tlp:white",
    "colour": "#ffffff",
    "exportable": true,
    "org_id": "12345",
    "user_id": "12345",
    "hide_tag": false,
    "numerical_value": "12345",
    "is_galaxy": true,
    "is_custom_galaxy": true,
    "inherited": 1
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Search tag:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/tags/search/{tagSearchTerm}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
[
  {
    "Tag": {
      "id": "12345",
      "name": "tlp:white",
      "colour": "#ffffff",
      "exportable": true,
      "org_id": "12345",
      "user_id": "12345",
      "hide_tag": false,
      "numerical_value": "12345",
      "is_galaxy": true,
      "is_custom_galaxy": true,
      "inherited": 1
    },
    "Taxonomy": {
      "id": "12345",
      "namespace": "tlp",
      "description": "Disclosure is not limited.  Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.",
      "version": "5",
      "enabled": true,
      "exclusive": true,
      "required": true
    },
    "TaxonomyPredicate": {
      "id": "12345",
      "taxonomy_id": "12345",
      "value": "white",
      "expanded": "(TLP:WHITE) Information can be shared publicly in accordance with the law.",
      "colour": "#ffffff",
      "description": "Disclosure is not limited.  Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.",
      "exclusive": true,
      "numerical_value": 0
    }
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

# Sighting

#### Get sightings by event ID:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/sightings/index/{eventId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Tag": [
    {
      "id": "12345",
      "name": "tlp:white",
      "colour": "#ffffff",
      "exportable": true,
      "org_id": "12345",
      "user_id": "12345",
      "hide_tag": false,
      "numerical_value": "12345",
      "is_galaxy": true,
      "is_custom_galaxy": true,
      "inherited": 1
    }
  ]
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Add sightings of a list of values:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/sightings/add</p>

##### Request:

```
{
  "values": [
    "127.0.0.1"
  ],
  "timestamp": "1617875568",
  "filters": {
    "page": 1,
    "limit": 0,
    "value": "127.0.0.1",
    "value1": "127.0.0.1",
    "value2": "127.0.0.1",
    "type": "md5",
    "category": "Internal reference",
    "org": "12345",
    "tags": [
      "tlp:amber"
    ],
    "from": "string",
    "to": "string",
    "last": 0,
    "eventid": "12345",
    "withAttachments": false,
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "publish_timestamp": "1617875568",
    "published": false,
    "timestamp": "1617875568",
    "attribute_timestamp": "1617875568",
    "enforceWarninglist": true,
    "to_ids": true,
    "deleted": false,
    "event_timestamp": "1617875568",
    "threat_level_id": "1",
    "eventinfo": "string",
    "sharinggroup": [
      "1"
    ],
    "decayingModel": "string",
    "score": "string",
    "first_seen": "string",
    "last_seen": "string",
    "includeEventUuid": false,
    "includeEventTags": false,
    "includeProposals": false,
    "requested_attributes": [
      "id"
    ],
    "includeContext": true,
    "headerless": true,
    "includeWarninglistHits": true,
    "attackGalaxy": "mitre-attack",
    "object_relation": "filepath",
    "includeSightings": true,
    "includeCorrelations": true,
    "modelOverrides": {
      "lifetime": 3,
      "decay_speed": 2.3,
      "threshold": 30,
      "default_base_score": 80,
      "base_score_config": {
        "estimative-language:confidence-in-analytic-judgment": 0.25,
        "estimative-language:likelihood-probability": 0.25,
        "phishing:psychological-acceptability": 0.25,
        "phishing:state": 0.2
      }
    },
    "includeDecayScore": false,
    "includeFullModel": false,
    "excludeDecayed": false,
    "returnFormat": "json"
  }
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "id": "12345",
  "attribute_id": "12345",
  "event_id": "12345",
  "org_id": "12345",
  "date_sighting": "1617875568",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "source": "string",
  "type": "string",
  "attribute_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "Organisation": {
    "id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "name": "ORGNAME"
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Add sighting of an attribute:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/sightings/add/{attributeId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "id": "12345",
  "attribute_id": "12345",
  "event_id": "12345",
  "org_id": "12345",
  "date_sighting": "1617875568",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "source": "string",
  "type": "string",
  "attribute_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "Organisation": {
    "id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "name": "ORGNAME"
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Delete sighting:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/sightings/delete/{sightingId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Sighting successfully deleted.",
  "message": "Sighting successfully deleted.",
  "url": "/sightings/delete/1"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

# Warninglist

#### Get a list of warninglists:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/warninglists</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Warninglists": [
    {
      "Warninglist": {
        "id": "3",
        "name": "List of known domains to know external IP",
        "type": "cidr",
        "description": "string",
        "version": "10",
        "enabled": true,
        "warninglist_entry_count": "1234",
        "valid_attributes": "domain, hostname, domain|ip, uri, url",
        "WarninglistEntry": [
          {
            "id": "1234",
            "value": "10.128.0.0/24",
            "warninglist_id": "3"
          }
        ]
      }
    }
  ]
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Search warninglists:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/warninglists</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Warninglists": [
    {
      "Warninglist": {
        "id": "3",
        "name": "List of known domains to know external IP",
        "type": "cidr",
        "description": "string",
        "version": "10",
        "enabled": true,
        "warninglist_entry_count": "1234",
        "valid_attributes": "domain, hostname, domain|ip, uri, url",
        "WarninglistEntry": [
          {
            "id": "1234",
            "value": "10.128.0.0/24",
            "warninglist_id": "3"
          }
        ]
      }
    }
  ]
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Enable/disable warninglists:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/warninglists/toggleEnable</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": "1 warninglist(s) disabled"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Get warninglist by ID:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/warninglists/view/{warninglistId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Warninglist": {
    "id": "3",
    "name": "List of known domains to know external IP",
    "type": "cidr",
    "description": "string",
    "version": "10",
    "enabled": true,
    "warninglist_entry_count": "1234",
    "valid_attributes": "domain, hostname, domain|ip, uri, url",
    "WarninglistEntry": [
      {
        "id": "1234",
        "value": "10.128.0.0/24",
        "warninglist_id": "3"
      }
    ]
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Check if a list of values matches any warninglists:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/warninglists/checkValue</p>

##### Request:

```
[
  "10.128.0.2"
]
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "10.128.0.2": [
    {
      "id": "10",
      "name": "List of known Wikimedia address ranges"
    }
  ]
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Update warninglists:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/warninglists/update</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Successfully updated 1 warninglists.",
  "message": "Successfully updated 1 warninglists.",
  "url": "/warninglists/update"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

# Noticelist

#### Get a list of noticelists

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/warninglists</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
[
  {
    "Noticelist": {
      "id": "3",
      "name": "List of known domains to know external IP",
      "type": "cidr",
      "description": "string",
      "version": "10",
      "enabled": true,
      "warninglist_entry_count": "1234",
      "valid_attributes": "domain, hostname, domain|ip, uri, url",
      "NoticelistEntry": [
        {
          "id": "1234",
          "noticelist_id": "3",
          "data": {
            "scope": [
              "attribute"
            ],
            "field": [
              "category"
            ],
            "value": [
              "Person"
            ],
            "tags": [
              "tlp:white"
            ],
            "message": {
              "en": "This attribute is likely to contain personal data and the data subject is likely to be directly identifiable."
            }
          }
        }
      ]
    }
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Get a noticelist by ID:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/warninglists</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Noticelist": {
    "id": "3",
    "name": "List of known domains to know external IP",
    "type": "cidr",
    "description": "string",
    "version": "10",
    "enabled": true,
    "warninglist_entry_count": "1234",
    "valid_attributes": "domain, hostname, domain|ip, uri, url",
    "NoticelistEntry": [
      {
        "id": "1234",
        "noticelist_id": "3",
        "data": {
          "scope": [
            "attribute"
          ],
          "field": [
            "category"
          ],
          "value": [
            "Person"
          ],
          "tags": [
            "tlp:white"
          ],
          "message": {
            "en": "This attribute is likely to contain personal data and the data subject is likely to be directly identifiable."
          }
        }
      }
    ]
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Enable/disable noticelist:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/warninglists</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Noticelist enabled.",
  "message": "Noticelist enabled.",
  "url": "/noticelists/toggleEnable/1"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Update noticelists:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/noticelists/update</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Successfully updated 1 noticelists.",
  "message": "Successfully updated 1 noticelists.",
  "url": "/noticelists/update"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

####  

# Log

#### Get instance logs

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/admin/logs</p>

##### Request:

```
{
  "page": 1,
  "limit": 0,
  "id": "12345",
  "title": "Attribute (448272) from Event (1): Other/text foo",
  "created": "string",
  "model": "AdminSetting",
  "model_id": "12345",
  "action": "accept",
  "user_id": "12345",
  "change": "%name () => (ORGNAME)%",
  "email": "user@example.com",
  "org": "ORG_%",
  "description": "%updated by User%",
  "ip": "string"
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
[
  {
    "Log": {
      "id": "12345",
      "title": "Attribute (448272) from Event (1): Other/text foo",
      "created": "string",
      "model": "AdminSetting",
      "model_id": "12345",
      "action": "accept",
      "user_id": "12345",
      "change": "name () => (ORGNAME)",
      "email": "user@example.com",
      "org": "ORGNAME",
      "description": "Organisation \"ORGNAME\" (1) added by User \"SYSTEM\" (0).",
      "ip": "10.0.0.10"
    }
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

# Auth key

#### Get auth keys:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/auth\_keys</p>

##### Request:

```
[
  {
    "AuthKey": {
      "id": "12345",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "authkey_start": "stri",
      "authkey_end": "stri",
      "created": "1617875568",
      "expiration": "1970-01-01 00:00:00",
      "read_only": true,
      "user_id": "12345",
      "comment": "string",
      "allowed_ips": [
        "127.0.0.1"
      ],
      "last_used": "1617875568"
    },
    "User": {
      "id": "12345",
      "email": "user@example.com"
    }
  }
]
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
[
  {
    "Log": {
      "id": "12345",
      "title": "Attribute (448272) from Event (1): Other/text foo",
      "created": "string",
      "model": "AdminSetting",
      "model_id": "12345",
      "action": "accept",
      "user_id": "12345",
      "change": "name () => (ORGNAME)",
      "email": "user@example.com",
      "org": "ORGNAME",
      "description": "Organisation \"ORGNAME\" (1) added by User \"SYSTEM\" (0).",
      "ip": "10.0.0.10"
    }
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

#### Search auth keys:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/auth\_keys</p>

##### Request:

```
{
  "page": 1,
  "limit": 0,
  "id": "12345",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "authkey_start": "string",
  "authkey_end": "string",
  "created": "string",
  "expiration": "string",
  "read_only": true,
  "user_id": "12345",
  "comment": "string",
  "allowed_ips": "[\"127.0.0.1\",\"127.0.0.2\"]",
  "last_used": "string"
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
[
  {
    "AuthKey": {
      "id": "12345",
      "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
      "authkey_start": "stri",
      "authkey_end": "stri",
      "created": "1617875568",
      "expiration": "1970-01-01 00:00:00",
      "read_only": true,
      "user_id": "12345",
      "comment": "string",
      "allowed_ips": [
        "127.0.0.1"
      ],
      "last_used": "1617875568"
    },
    "User": {
      "id": "12345",
      "email": "user@example.com"
    }
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Add auth keys:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/auth\_keys/add/{userId}</p>

##### Request:

```
{
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "read_only": true,
  "user_id": "12345",
  "comment": "string",
  "allowed_ips": [
    "127.0.0.1"
  ]
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "AuthKey": {
    "id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "authkey_start": "stri",
    "authkey_end": "stri",
    "created": "1617875568",
    "expiration": "1970-01-01 00:00:00",
    "read_only": true,
    "user_id": "12345",
    "comment": "string",
    "allowed_ips": [
      "127.0.0.1"
    ],
    "last_used": "1617875568"
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### View auth key:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/auth\_keys/add/{userId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "AuthKey": {
    "id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "authkey_start": "stri",
    "authkey_end": "stri",
    "created": "1617875568",
    "expiration": "1970-01-01 00:00:00",
    "read_only": true,
    "user_id": "12345",
    "comment": "string",
    "allowed_ips": [
      "127.0.0.1"
    ],
    "last_used": "1617875568"
  },
  "User": {
    "id": "12345",
    "org_id": "12345",
    "email": "user@example.com"
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Edit auth key:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/auth\_keys/add/{userId}</p>

##### Request:

```
{
  "read_only": true,
  "comment": "string",
  "allowed_ips": [
    "127.0.0.1"
  ]
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "AuthKey": {
    "id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "authkey_start": "stri",
    "authkey_end": "stri",
    "created": "1617875568",
    "expiration": "1970-01-01 00:00:00",
    "read_only": true,
    "user_id": "12345",
    "comment": "string",
    "allowed_ips": [
      "127.0.0.1"
    ],
    "last_used": "1617875568"
  },
  "User": {
    "id": "12345",
    "org_id": "12345",
    "email": "user@example.com"
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Delete auth key:

<p class="callout danger">DELETE</p>

<p class="callout info">https://misp.local/auth\_keys/delete/{authKeyId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "AuthKey deleted.",
  "message": "AuthKey deleted.",
  "url": "/auth_keys/delete/1234"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

# UserSettings

#### Get user settings:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/user\_settings</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
[
  {
    "UserSetting": {
      "id": "12345",
      "setting": "publish_alert_filter",
      "value": {
        "widget": "MispStatusWidget",
        "position": {
          "x": "0",
          "y": "0",
          "width": "2",
          "height": "2"
        }
      },
      "user_id": "12345",
      "timestamp": "1617875568"
    }
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Search user settings:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/user\_settings</p>

##### Request:

```
{
  "id": "12345",
  "setting": "publish_alert_filter",
  "user_id": "12345"
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
[
  {
    "UserSetting": {
      "id": "12345",
      "setting": "publish_alert_filter",
      "value": {
        "widget": "MispStatusWidget",
        "position": {
          "x": "0",
          "y": "0",
          "width": "2",
          "height": "2"
        }
      },
      "user_id": "12345",
      "timestamp": "1617875568"
    }
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Get user setting by id:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/user\_settings/view/{userSettingId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "UserSetting": {
    "id": "12345",
    "setting": "publish_alert_filter",
    "value": {
      "widget": "MispStatusWidget",
      "position": {
        "x": "0",
        "y": "0",
        "width": "2",
        "height": "2"
      }
    },
    "user_id": "12345",
    "timestamp": "1617875568"
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Set user setting:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/user\_settings/setSetting/{userId}/{userSettingName}</p>

##### Request:

```
{
  "widget": "MispStatusWidget",
  "position": {
    "x": "0",
    "y": "0",
    "width": "2",
    "height": "2"
  }
}
```

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "UserSetting": {
    "id": "12345",
    "setting": "publish_alert_filter",
    "value": {
      "widget": "MispStatusWidget",
      "position": {
        "x": "0",
        "y": "0",
        "width": "2",
        "height": "2"
      }
    },
    "user_id": "12345",
    "timestamp": "1617875568"
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Get user setting by id:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/user\_settings/getSetting/{userId}/{userSettingName}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "UserSetting": {
    "id": "12345",
    "setting": "publish_alert_filter",
    "value": {
      "widget": "MispStatusWidget",
      "position": {
        "x": "0",
        "y": "0",
        "width": "2",
        "height": "2"
      }
    },
    "user_id": "12345",
    "timestamp": "1617875568"
  }
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Delete user setting by id:

<p class="callout danger">DELETE</p>

<p class="callout info">https://misp.local/user\_settings/delete/{userSettingId}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Setting deleted.",
  "message": "Setting deleted.",
  "url": "/user_settings/delete/1234"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```

# Taxonomy

#### Get taxonomies:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/taxonomies</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
[
  {
    "Taxonomy": {
      "id": "12345",
      "namespace": "tlp",
      "description": "Disclosure is not limited.  Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.",
      "version": "5",
      "enabled": true,
      "exclusive": true,
      "required": true
    },
    "total_count": 0,
    "current_count": 0
  }
]
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Get a taxonomy by ID:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/taxonomies/view/{taxonomyIdParameter}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Taxonomy": {
    "id": "12345",
    "namespace": "tlp",
    "description": "Disclosure is not limited.  Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.",
    "version": "5",
    "enabled": true,
    "exclusive": true,
    "required": true
  },
  "entries": [
    {
      "tag": "tlp:white",
      "expanded": "string",
      "description": "string",
      "exclusive_predicate": true,
      "existing_tag": true
    }
  ]
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Enable taxonomy:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/taxonomies/enable/{taxonomyIdParameter}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Taxonomy enabled",
  "message": "Taxonomy enabled",
  "url": "/taxonomies/enable/1234"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Disable taxonomy:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/taxonomies/disable/{taxonomyIdParameter}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Taxonomy disabled",
  "message": "Taxonomy disabled",
  "url": "/taxonomies/disabled/1234"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Update taxonomies:

<p class="callout info">POST</p>

<p class="callout info">https://misp.local/taxonomies/update</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "saved": true,
  "success": true,
  "name": "Successfully updated 120 taxonomy libraries.",
  "message": "Successfully updated 120 taxonomy libraries.",
  "url": "/taxonomies/update"
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Get a taxonomy extended with tags used in events and attributes:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/taxonomies/taxonomy\_tags/{taxonomyIdParameter}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "Taxonomy": {
    "id": "12345",
    "namespace": "tlp",
    "description": "Disclosure is not limited.  Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.",
    "version": "5",
    "enabled": true,
    "exclusive": true,
    "required": true
  },
  "entries": [
    {
      "org_id": "12345",
      "server_id": "12345",
      "email": "user@example.com",
      "autoalert": true,
      "authkey": "894c8d095180c7ea28789092e96ca6424199aa4f",
      "invited_by": "12345",
      "gpgkey": "string",
      "certif_public": "string",
      "nids_sid": "4000000",
      "termsaccepted": true,
      "newsread": "1617875568",
      "role_id": "3",
      "change_pw": "0",
      "contactalert": true,
      "disabled": true,
      "expiration": "2019-08-24T14:15:22Z",
      "current_login": "1617875568",
      "last_login": "1617875568",
      "force_logout": true,
      "date_created": "1617875568",
      "date_modified": "1617875568",
      "events": 0,
      "attributes": 0
    }
  ]
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


#### Export taxonomy:

<p class="callout success">GET</p>

<p class="callout info">https://misp.local/taxonomies/export/{taxonomyIdParameter}</p>

##### Response: 

<span style="text-decoration: underline;">**200:**</span>

```
{
  "namespace": "tlp",
  "description": "Disclosure is not limited.  Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.",
  "version": 0,
  "exclusive": true,
  "predicates": [
    {
      "value": "white",
      "expanded": "(TLP:WHITE) Information can be shared publicly in accordance with the law."
    }
  ],
  "values": [
    {
      "predicate": "white",
      "entry": [
        {
          "value": "spam",
          "expanded": "spam",
          "description": "Spam or ‘unsolicited bulk e-mail’, meaning that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having identical content."
        }
      ]
    }
  ]
}
```

**<span style="text-decoration: underline;">403:</span>**

```
{
  "name": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "message": "Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.",
  "url": "/attributes"
}
```

<span style="text-decoration: underline;">**404:**</span>

```
{
  "name": "Invalid attribute",
  "message": "Invalid attribute",
  "url": "/attributes/1234"
}
```

**<span style="text-decoration: underline;">Default:</span>**

```
{
  "name": "string",
  "message": "string",
  "url": "/attributes"
}
```


####