Collaborate API Reference (Live) ## Sections • [Collaborate API Reference](https://csapapi.cyware.com/api-overview/collaborate-api-reference.md): Organizations worldwide face increasingly sophisticated and coordinated cybersecurity threats, making it crucial for security teams to adopt a collaborative approach to define their security strategy. Collaborate is a situational awareness platform that enables real-time threat alert sharing and aggregation, helping you effectively respond to threats through information sharing, coordination, and collaboration among security analysts. With Collaborate, you can enrich, anonymize, and share precise threat intelligence, including indicators of compromise (IOCs) and incident responses. Collaborate's API is organized around REST and is available to all customers. The API endpoints contain predictable resource-oriented URLs, return JSON-encoded responses, and use standard HTTP response codes and authentication. For AI agents and LLM-based discovery, see the Collaborate LLM-friendly API Guide . The following are the two portals in Collaborate: Analyst Portal The Analyst Portal is an administrative module mainly used by administrators and analysts to create and share information with members. Administrators set the application and user preferences for all users through the Analyst Portal. Member Portal The Member Portal is used by security teams and member organizations for receiving strategic intelligence and alerts. It works along with the Analyst Portal to enhance communication and strategic intelligence sharing among employees and member organizations. Supported Collaborate Version : 3.8.6.0 and later versions • [Overview](https://csapapi.cyware.com/analyst-portal/analyst-portal-overview.md): The Analyst Portal is an admin module mainly used by administrators and analysts. Analysts create and share information with members. Administrators set the application and user preferences for all users through the Analyst Portal. As an analyst, you can perform the following actions: Alert Management : Create and publish alerts about vulnerabilities, exploits, and security issues to members. Organization Management : Create and manage organizations, control their status, and access related data for efficient alert sharing. Manage Intel Submissions : Manage threat intel submissions from members to enable bi-directional sharing of critical information as alerts across the organization. Manage Request for Information (RFI) : Manage RFIs submitted by members, review and publish them as alerts, and foster collaboration to enhance security. Intelligence Requirements : Retrieve Intelligence Requirements (IRs) and their followers. Allowed Indicators : Add trusted indicators to your allow list to enhance alert quality and support informed decision-making. Manage Members : Add and manage members, modify their details and status, and access member information as needed. Doc Library : Manage and share files, documents, and attachments to facilitate coordination between analysts and members. Tag Library : Organize and manage tags to efficiently categorize and locate items within the platform. For more information, see Collaborate Analyst Portal Documentation . • [Authentication](https://csapapi.cyware.com/analyst-portal/authentication.md): In Collaborate's Analyst Portal, you can manage user access and feature permissions by defining Open API roles and generating credentials to control access. Create Open API Roles You can create user roles for members to regulate access to Collaborate features using open API. You can assign these roles to members while generating API credentials for them. For more information, see Create Open API Roles . Generate Open API Credentials You can generate open API credentials for analysts or members to access the open API endpoints. You can assign a role to control and restrict members' access to Collaborate's features. For analysts, after the v3.7.6.0 update, access to certain categories is based on your user role in the Analyst Portal. This update does not impact credentials generated prior to this version. For more information, see Generate Open API Credentials . Mandatory Query Parameters To authenticate the API requests made to Collaborate, you must include the following parameters in the query of each API request: 1 Access ID Indicates the access ID of your Collaborate open API credentials. 2 Expires Indicates the validity of the signature parameter. The signature becomes invalid if not used within the specified expiry duration. You can use expires = current time + 300 seconds for authentication. You can give a margin of 10 to 15 seconds for expiry. 3 Signature A combination of the access ID, secret key, and expires parameters to authenticate API requests. The signature is hashed using the HMAC-SHA1 algorithm and then encoded using the Base64 scheme. Create a StringToSign value using the StringToSign = access_id + \n + expires formula. Create a Signature value using the Signature = Base64(HMAC-SHA1(secret_key, UTF-8-Encoding-Of(StringToSign))) formula. Test API Request Format For all PUT and POST calls, the content-type header is mandatory. You can now make a test API call in the following format using the Access ID, Expires, and Signature values: Plain text base_url/csap/v1/list_alerts/? Expires=expires_value&AccessID=accessid_value&Signature=signature_value base_url/csap/v1/list_alerts/? Expires=expires_value&AccessID=accessid_value&Signature=signature_value Remember to replace base_url, expires_value, accessid_value, and signature_value. {"content-type": "application/json"} is to be sent as part of the headers unless specified otherwise. A status code 415 response is given in the case of an invalid content type being provided. Use the script in the Pre-request Script section in the right panel to generate the Expires and Signature parameters in Postman. • [Test Connectivity](https://csapapi.cyware.com/analyst-portal/authentication/test-connectivity.md): Test connectivity with Collaborate's Analyst Portal. • [Alerts](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts.md): Collaborate helps you share real-time situational awareness alerts on the latest incidents, breaches, malware, and vulnerabilities to members over email, web, and mobile platforms. For more information about Alerts, see Collaborate Alerts Documentation . As an analyst, you can perform the following actions to keep members informed and prepared: Create Alerts : Create alerts with essential details, including a title, summary, Traffic Light Protocol (TLP), category, and recipients. Add Comprehensive Information : Add additional information to the alert such as images, campaigns, attachments, and more. Incorporate Threat Indicators: Specify threat indicators that identify alert elements, enhancing clarity and specificity for members. Enable Threat Response : Enable members to respond to organization-specific threats by attaching Threat Defender Library (TDL) content. Recommend Actions : Recommend actionable steps based on the threat insights shared in the alert, enabling members to act effectively. Attach Threat Assessments : Attach threat assessments for members impacted by a cyber threat. As an analyst, you can create and update alerts and access all related data. • [Create Alert](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/create-alert.md): Create an alert on the Collaborate Analyst Portal and publish it to the intended recipients. You can also add custom fields while creating an alert. The format to include custom fields is described in the custom field structures. Changelog Release v3.8.12.0 Supports scheduling alert expiry using scheduled_expiry_time parameter. Release v3.8.8.0 Added support for the share_with , reference_urls , and pirs body parameters. Release v3.7.6.0 Access to certain categories is based on your user role in the Analyst Portal. This update does not impact credentials generated prior to this version. Alert Field Types Custom Fields Format As an analyst, you can create alerts using custom fields tailored to your needs. Use fields like text boxes for detailed input, multi-select for tagging multiple values, single-select for predefined choices, and more to customize your alerts effectively. For details on retrieving additional field information, see the Retrieve Additional Fields section. Use the table below for custom field format: Field Type Description Format Boolean Boolean fields allow you to select either true or false for specific options. While creating an alert, you can use these fields to indicate details such as whether the alert is Publicly Shareable or Requires Immediate Action . field_id : value Example: "f65b26a174658": true Text Text boxes allow you to add information in text format. While creating an alert, you can use these fields to provide details such as Threat Description , Likely Motivation , and more. field_id : Text Example: "f533606babb44": "CVE-2014-12345" Single-select Single-select fields allow you to choose one option from a predefined list. These fields are used to capture key details of an alert, such as Threat Level or Severity . field_id : { field_id_id : selected value id} Example: "ffa80c88f1d20": { "ffa80c88f1d20_id": "oaa822c36c133" } Multi-select Multi-select fields allow you to associate multiple options with an alert from a predefined list. For example, you can use these fields to assign Affected Sectors or Indicators . field_id : [{ field_id_id : selected value id}, { field_id_id : selected value id}] Example: "f65b26a174658": [ { "f65b26a174658_id": "o15f317d51bec" }, { "f65b26a174658_id": "o43d57e02d92a" } ] Date & Time Date and time fields let you capture time-sensitive details for an alert, such as Reported At or Action Deadline . The values are stored in Epoch (Unix timestamp) format. field_id : Epoch value Example: "f9c217dfe8824": 1709725603 Retrieve Additional Fields Additional fields are system or custom fields that you can use while creating alerts. To ensure accurate field mapping, you need to retrieve the field IDs and details before passing them as body parameters. To retrieve field details, follow these steps: Use the Get Additional Fields List endpoint in the Alerts section to retrieve the list of all fields, including their field IDs. Use the field_id in the Get Additional Fields Details endpoint to retrieve associated field details. • [Update Published Alert](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/update-published-alert.md): Update a published Collaborate alert in the Analyst Portal by expiring the older alert and linking it to this new alert. Changelog Release v3.8.12.0 Supports scheduling and updating alert expiry using the scheduled_expiry_time parameter. Release v3.7.6.0 Access to certain categories is based on your user role in the Analyst Portal. This update does not impact credentials generated prior to this version. Alert Field Types Custom Fields Structure As an analyst, you can create alerts using custom fields tailored to your needs. Use fields like text boxes for detailed input, multi-select for tagging multiple values, single-select for predefined choices, and more to customize your alerts effectively. For details on retrieving additional field information, see the Retrieve Additional Fields section. Use the table below for custom field format: Field Type Description Structure Boolean Boolean fields allow you to select either true or false for specific options. While creating an alert, you can use these fields to indicate details such as whether the alert is Publicly Shareable or Requires Immediate Action. field_id : value Example: "f65b26a174658": true Text Text boxes allow you to add information in text format. While creating an alert, you can use these fields to provide details such as Threat Description , Likely Motivation , and more. field_id : Text Example: "f533606babb44": "CVE-2014-12345" Single-select Single-select fields allow you to choose one option from a predefined list. These fields are used to capture key details of an alert, such as Threat Level or Severity . field_id : { field_id_id : selected value id} Example: Example: "ffa80c88f1d20": { "ffa80c88f1d20_id": "oaa822c36c133" } Multi-select Multi-select fields allow you to associate multiple options with an alert from a predefined list. For example, you can use these fields to assign Affected Sectors or Indicators . field_id : [{ field_id+_id : selected value id}, { field_id+_id : selected value id}] Example: "f65b26a174658": [ { "f65b26a174658_id": "o15f317d51bec" }, { "f65b26a174658_id": "o43d57e02d92a" } ] Date & Time Date and time fields let you capture time-sensitive details for an alert, such as Reported At or Action Deadline . The values are stored in Epoch (Unix timestamp) format. field_id : EPOCH value Example: "f9c217dfe8824": 1709725603 Retrieve Additional Fields Additional fields are custom or system fields that you can use while creating alerts. To ensure accurate field mapping, you need to retrieve additional field IDs and details before passing them as body parameters. To retrieve field details, follow these steps: Use the Get Additional Fields List endpoint in the Alerts section to retrieve the list of all fields, including their field IDs. Use the field_id in the Get Additional Fields Details endpoint to retrieve associated field details. • [Get Alerts](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/alerts-list-analyst-member.md): Returns a list of alerts from Collaborate. Changelog Release v3.8.13.0 Added a new modified_time field. Release v3.8.11.0 Added support for the channel_ids query parameter. Release v3.7.6.0 For analysts, access to alerts is determined by the categories associated with your user role in the Analyst Portal. However, if your user role has View All Alerts permission, you can access all alerts based on your preference. This update does not impact credentials generated prior to this version. • [Get Alert Details](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/alert-details-analyst-member.md): Returns details of an alert using its unique ID. As an analyst, you can retrieve details of alerts in all statuses. Changelog Release v3.8.13.0 Returns modified_time and matched_irs response parameters. Release v3.8.12.0 Returns scheduled_expiry_time and shared_by response parameters. Release v3.8.9.0 Returns the source_urls response parameter. Release v3.8.8.0 Returns the analyst_groups response parameter. Release v3.7.6.0 For analysts, access to the alert is based on the categories associated with your user role in the Analyst Portal. However, if your user role has View All Alerts permission, you can access all alerts based on your preference. This update does not impact credentials generated prior to this version. • [Export Alert](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/alert-export-analyst.md): Returns an alert in downloadable format. Save the response to your device, ensuring to add the .pdf extension to the file name so it downloads as a PDF. • [Expire Alert](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/expire-alert.md): Expire alerts individually or in bulk by providing their unique alert IDs. A successful request requires at least one valid ID, with a maximum limit of 100 IDs per bulk operation. Changelog Release v3.8.12.0 Added a new endpoint to expire alerts. • [Get Alerts by Keyword](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/alerts-by-keyword-analyst-member.md): Returns latest published alerts based on a specific keyword. Changelog Release v3.7.6.0 For analysts, access to alerts are based on the categories associated with your user role in the Analyst Portal. This update does not impact credentials generated priori to this version. • [Get Alerts by Related Indicators](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/list-alerts-by-related-indicators-analyst-member.md): Returns published alerts by indicators mentioned in the alerts. Changelog Release v3.7.6.0 For analysts, access to alerts are based on the categories associated with your user role in the Analyst Portal. This update does not impact credentials generated prior to this version. • [Get Alerts by Tracking ID](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/list-alerts-by-tracking-id-analyst-member.md): Returns alerts using the tracking ID. A tracking ID is generated when third-party integrations publish alerts in Collaborate. Changelog Release v3.8.4.0 Added support for the status query parameter to filter alerts by status (draft, submitted, published, expired, and scheduled) The API response now includes the alert status field. Release v3.7.6.0 For analysts, alert access is based on the categories linked to their user role in the Analyst Portal. However, if your role includes the View All Alerts permission , you can access all alerts as preferred. This update does not affect credentials generated before this version. • [Get Alert History](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/alert-history-analyst.md): When you update an alert, the parent alert moves to an expired state and the new (child) alert is published to the recipients. You can use this endpoint retrieve the parent alerts linked to an updated alert. Changelog Release v3.7.6.0 For analysts, alert access is based on the categories linked to their user role in the Analyst Portal. However, if your role includes the View All Alerts permission, you can access all alerts as preferred. This update does not affect credentials generated before this version. • [Get Category List](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/category-list-analyst-member.md): Returns the list of active alert categories in Collaborate. Changelog Release v3.7.6.0 For analysts, access to alert categories is determined by the categories linked to your user role in the Analyst Portal. Credentials created before this update are not affected. • [Get Category Details](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/category-details-analyst-member.md): Returns details of an alert category using the unique category ID. You can retrieve the category ID using the Get Category List endpoint. Changelog Release v3.7.6.0 For analysts, access to alert categories is determined by the categories assigned to your user role in the Analyst Portal. This update does not affect credentials generated before this version. • [Get Additional Fields List](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/additional-fields-analyst-member.md): Returns the list of all fields in Collaborate. • [Get Additional Field Details](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/additional-field-details-analyst-member.md): Returns the details of a specific field in Collaborate using the field_id . You can retrieve field_id using the Get Additional Fields List endpoint. • [Create Tag](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/create-tag.md): Create a tag in Collaborate's Tag Library. Analysts can use tags while creating alerts. • [Get Tags](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/tags-analyst-member.md): Returns a list of all the tags in the Tag Library. • [Get Recipient Groups](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/recipient-groups-analyst-member.md): Returns a list of recipient groups in Collaborate. • [Get Information Source List](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/information-sources-analyst-member.md): Returns a list of information sources (info sources) in Collaborate. • [Get Member Locations](https://csapapi.cyware.com/analyst-portal/analyst-portal-alerts/member-locations-analyst-member.md): Returns locations configured in the CSAP Analyst Portal. • [Organization](https://csapapi.cyware.com/analyst-portal/organization.md): Analysts can classify members according to organizations while inviting them to the Collaborate Member Portal. Organizations can also be further grouped into organization types and be associated with certain organizational levels. This allows analysts to share alerts quickly with members from selected organizations and organization types. For more information, see Collaborate Organization Documentation . As an analyst, you can perform the following actions: Create and Manage Organizations : Create organizations, assign them to members, and update organization details for seamless alert sharing. Activate or Deactivate Organizations : Enable or disable organizations as needed to align with operational requirements. Retrieve Organization Data : Access detailed lists of organizations, organization types, and organization levels in Collaborate. Retrieve Associated Details : Obtain domains and IP addresses linked to a specific organization. • [Create Organization](https://csapapi.cyware.com/analyst-portal/organization/create-organization.md): As an analyst, you can create an organization in Collaborate. • [Update Organization](https://csapapi.cyware.com/analyst-portal/organization/update-organization.md): Update details of an organization. • [Activate/Deactivate Organizations](https://csapapi.cyware.com/analyst-portal/organization/activate-deactivate-organizations.md): Activate or deactivate a list of organizations. You can only deactivate organizations if all the members in the organizations have been deactivated. You can update a maximum of 5 organizations at a time. • [Get Organizations](https://csapapi.cyware.com/analyst-portal/organization/organizations-analyst-member.md): Returns the list of organizations in Collaborate. • [Get Organization Types](https://csapapi.cyware.com/analyst-portal/organization/organization-types-analyst-member.md): Returns the list of organization types available in Collaborate. • [Get Organization Domain and IPs](https://csapapi.cyware.com/analyst-portal/organization/organization-domain-and-ips-analyst-member.md): Returns the domains and IP addresses associated with an organization using its organization ID. • [Get Organization Levels](https://csapapi.cyware.com/analyst-portal/organization/organization-levels-analyst.md): Returns the list of organisation levels in Collaborate. • [Intel](https://csapapi.cyware.com/analyst-portal/intel.md): A member can submit threat intel reports from the Member Portal. The intel submissions include information to help you, as an analyst, understand the risks of an organization's most common or severe external threats. Analysts can further share this information as alerts to all the other members of the organization. This facilitates the sharing and dissemination of information between the Analyst and the Member Portals. For more information, see Collaborate Intel Submission Documentation . As an analyst, you can perform the following actions: Retrieve and View Intel : Access a list of intel submissions and view detailed information for specific intel. View Intel Category Details : Access intel categories and the list of fields and details associated with an intel category. • [Get Submitted Intels](https://csapapi.cyware.com/analyst-portal/intel/submitted-intel-list-analyst-member.md): Returns the intel submitted by members. • [Get Intel Details](https://csapapi.cyware.com/analyst-portal/intel/intel-details-analyst-member.md): Returns details of all submitted intel using the incident ID. • [Get Intel Categories](https://csapapi.cyware.com/analyst-portal/intel/intel-categories-list-analyst-member.md): Returns the list of intel categories. • [Get Intel Category Details](https://csapapi.cyware.com/analyst-portal/intel/intel-category-details-analyst-member.md): Returns the list of fields and details associated with a category. • [Allowed Indicators](https://csapapi.cyware.com/analyst-portal/allowed-indicators.md): Add trusted indicators like IPs, domains, URLs, email addresses, and hashes to your allow list. These indicators are parsed as allowed indicators when creating alerts, improving the quality of information shared, and assisting members in making more informed decisions. For more information, see Collaborate Allowed Indicators Documentation . • [Get Allowed Indicators](https://csapapi.cyware.com/analyst-portal/allowed-indicators/allowed-indicators-analyst-member.md): Returns the list of allowed indicators in Collaborate. • [Add Allowed Indicators](https://csapapi.cyware.com/analyst-portal/allowed-indicators/add-allowed-indicators.md): Add indicators to the list of allowed indicators in Collaborate. The RESPONSE PARAMETERS returns indicators organized by category. If an indicator is already in the allowed list, it appears under duplicate_indicators . If an indicator was previously added to the allowed list but later marked as inactive, it will be retrieved under blocked_indicators . • [Dashboard](https://csapapi.cyware.com/analyst-portal/dashboard.md): Dashboards in Collaborate help you visualize data, providing an overview of key metrics and insights. These visualizations allow you to monitor activities, track trends, and make informed decisions based on the data available. For more information, see Collaborate Dashboard Documentation . As an analyst, you can use the APIs in this section to perform the following actions: Retrieve a List of Widgets : Access a list of widgets available on the Collaborate dashboard. Get Data for a Widget : Fetch the data associated with a specific widget. This allows you to retrieve detailed information and analyze it further for deeper insights or reporting purposes. • [Get Widgets](https://csapapi.cyware.com/analyst-portal/dashboard/widgets-list-analyst.md): Returns the list of the dashboard widgets and their details. • [Get Widget Data](https://csapapi.cyware.com/analyst-portal/dashboard/widget-data-analyst.md): Returns data corresponding to a widget using its widget_id . • [Member](https://csapapi.cyware.com/analyst-portal/member.md): Members are users of the Collaborate Member Portal who receive alerts from security experts (Publishers, Creators) on the Member Portal (web or mobile application). With the features provided by the Member Portal, members can stay updated with crucial information and prepare for the potential impact of cyber events and other developments. As an analyst, you can add Collaborate members as well as modify and manage members, including setting their status to inactive. For more information, see Collaborate Member Documentation . • [Add Member](https://csapapi.cyware.com/analyst-portal/member/add-member.md): Add a member user to Collaborate's Member Portal. It is advised not to add a member if mandatory custom fields are enabled. To enable Intel Lake for a member through the features body parameter, ensure that you have a valid license. For more information, see Collaborate documentation . Changelog Release v3.8.9.0 Added support for the features body parameter Release v3.8.8.0 Added support for the member_roles body parameter • [Update Member](https://csapapi.cyware.com/analyst-portal/member/update-member.md): Update a member's profile details in Collaborate's Member Portal. Member details cannot be updated using this endpoint if mandatory custom fields are enabled. To enable Intel Lake for a member through the features body parameter, ensure that you have a valid license. For more information, see Collaborate documentation . Changelog Release v3.8.9 Added support for the features body parameter • [Get Members](https://csapapi.cyware.com/analyst-portal/member/member-list-analyst.md): Get a list of all member users in your tenant instance. Use either organization ID or email adresses, or both simultaneously, to narrow your results. This endpoint retrieves data for both active and inactive members in the Collaborate (CSAP) Member Portal. • [Get Member Details](https://csapapi.cyware.com/analyst-portal/member/member-details-analyst.md): As an analyst, you can get details of a member, such as the organization they belong to, email, recipient groups they belong to, and more. You can retrieve this data using the user ID of the member. Changelog Release v3.8.9 Returns the features response parameter. Release v3.8.4 Returns the registration_date , last_active , and user_location response parameters. • [Create Member Location](https://csapapi.cyware.com/analyst-portal/member/create-member-location.md): Creates a new member location with the specified country, state, city, and site details. Changelog Release v3.8.8.0 This endpoint is available starting from the 3.8.8.0 version. • [Create Recipient Group](https://csapapi.cyware.com/analyst-portal/member/create-recipient-group.md): Creates a recipient group to group members for targeted sharing of information. Changelog Release v3.8.8.0 This endpoint is available starting from the 3.8.8.0 version. • [Activate/Deactivate Member Account](https://csapapi.cyware.com/analyst-portal/member/activate-deactivate-member-account.md): Activates or deactivates the status of member accounts. Changelog Release v3.8.8.0 This endpoint is available starting from the 3.8.8.0 version. • [Messenger](https://csapapi.cyware.com/analyst-portal/messenger.md): Collaborate Messenger allows members to collaborate with each other, create groups for discussion, and start discussions based on topics. For more information, see Collaborate Messenger Documentation . As an analyst, you can perform the following actions: Retrieve Messages in a Topic : Access messages within a specific topic in Collaborate Messenger. Get Topics : Retrieve a list of topics related to a specific alert in a group, helping you to track the discussion. Retrieve Message Attachments : Get the attachments associated with messages on a particular topic. • [Get Messages](https://csapapi.cyware.com/analyst-portal/messenger/messages-analyst-member.md): Returns messages from the topic-based discussion in the Messenger. • [Get Topics](https://csapapi.cyware.com/analyst-portal/messenger/topics-analyst-member.md): Returns the list of topic-based discussions from the Messenger. • [Get Attachments](https://csapapi.cyware.com/analyst-portal/messenger/attachments-analyst-member.md): Returns attachments associated with a message using the topic_id and seq_id . • [Reports](https://csapapi.cyware.com/analyst-portal/reports.md): Reports provide statistics on different aspects of Collaborate such as member status, details of alerts published, and reader details. • [Alerts](https://csapapi.cyware.com/analyst-portal/reports/alerts.md): Get statistics related to alerts in the Collaborate Analyst Portal. As an analyst, you can perform the following actions: Retrieve Alert Statistics : Access a detailed list of alert statistics. View Published Alerts by Category : Retrieve statistics on the alerts that have been published, organized by their respective categories. Analyze Published Alerts by User Group : Access statistics on how alerts are distributed across different recipient groups. Examine Alerts Published by Intel Source : View statistics about alerts published from various intel sources, helping to understand where alerts are originating from. Track Published Alert Locations : Get a list of locations where alerts have been published, which helps track the dissemination of alerts. Review Alerts Published by Report Source : Retrieve statistics on alerts published based on their report sources. Monitor Alert Read Status : Track the read status of alerts over a specific date range, and use pagination to review which alerts have been read by users. • [Get Alert Details](https://csapapi.cyware.com/analyst-portal/reports/alerts/alert-details-analyst.md): Returns statistics on published alerts such as the number of recipients, readers, feedback details, and more. • [Get Alerts by Category](https://csapapi.cyware.com/analyst-portal/reports/alerts/alerts-by-category-analyst.md): Returns the number of alerts published for a category. • [Get Alerts by Recipient Group](https://csapapi.cyware.com/analyst-portal/reports/alerts/alerts-by-recipient-group-analyst.md): Returns the number of alerts published for a recipient group. • [Get Alerts by Intel Source](https://csapapi.cyware.com/analyst-portal/reports/alerts/alerts-by-intel-source-analyst.md): Returns the number of alerts published for intel sources. • [Get Alerts by Location](https://csapapi.cyware.com/analyst-portal/reports/alerts/alerts-by-location-analyst.md): Returns the number of alerts published for different locations. • [Get Alerts by Report Source](https://csapapi.cyware.com/analyst-portal/reports/alerts/alerts-by-report-source-analyst.md): Returns the number of alerts published by each report source. • [Get Alert Readers Details](https://csapapi.cyware.com/analyst-portal/reports/alerts/alert-readers-details-analyst.md): Returns the details of members who have read published alerts in the Member Portal. • [Doc Library](https://csapapi.cyware.com/analyst-portal/reports/doc-library.md): Get statistics related to the Doc Library in the Collaborate Analyst Portal. As an analyst, you can perform the following action: Get Document Download Stats : Retrieve the most downloaded documents and details of users who downloaded them. • [Get Most Downloaded Documents](https://csapapi.cyware.com/analyst-portal/reports/doc-library/most-downloaded-documents-analyst.md): Returns statistics for most downloaded documents by members from the Doc Library. • [Get Downloader Details](https://csapapi.cyware.com/analyst-portal/reports/doc-library/downloader-details-analyst.md): Returns the details of members who downloaded a document. • [Intel](https://csapapi.cyware.com/analyst-portal/reports/intel.md): Get statistics related to intels in the Collaborate Analyst Portal. As an analyst, you can use the following API endpoints to access detailed statistics related to threat indicators and intel sharing: Get Intel with Indicators : Retrieve the number of intel submissions that include or exclude associated threat indicators. Get Intel Sharing Info : Access detailed information regarding the sharing of intel, including how and with whom it is shared. • [Get Number of Intel with Indicators](https://csapapi.cyware.com/analyst-portal/reports/intel/number-of-intel-with-indicators-analyst.md): Returns the number of intel submissions with and without indicators. • [Get Intel Sharing Details](https://csapapi.cyware.com/analyst-portal/reports/intel/intel-sharing-details-analyst.md): Returns details of intel that have been published as alerts and the external parties associated with it. • [Channel](https://csapapi.cyware.com/analyst-portal/reports/channel.md): Get statistics related to channels in the Collaborate Analyst Portal. As an analyst, you can use the following API endpoints to access statistics related to channels: Get Channel Stats : Retrieve statistics related to channel usage and engagement. Get Top Tags : Access the top 10 tags most commonly used by members when creating alert channels. • [Get Channel Statistics](https://csapapi.cyware.com/analyst-portal/reports/channel/channel-statistics-analyst.md): Returns channel-related statistics • [Get Top 10 Channel Tags](https://csapapi.cyware.com/analyst-portal/reports/channel/top-10-channel-tags-analyst.md): Returns the top 10 commonly-used tags by members while creating alert channels. • [Member](https://csapapi.cyware.com/analyst-portal/reports/member.md): Get statistics related to members in the Collaborate Analyst Portal. As an analyst, you can perform the following actions: Get Member Status : Retrieve member status statistics, including the number of members who have completed the registration process and other relevant data. Get Member Stats : Access user statistics based on the type of data requested. • [Get Member Statuses](https://csapapi.cyware.com/analyst-portal/reports/member/member-statuses-analyst.md): Returns the statuses of members such as the number of members who have completed the registration process, number of registered, and more. • [Get Member Stats](https://csapapi.cyware.com/analyst-portal/reports/member/member-stats-analyst.md): Returns user stats based on stats type received. • [Analyst](https://csapapi.cyware.com/analyst-portal/reports/analyst.md): Get statistics related to analysts in the Collaborate Analyst Portal. • [Get Published Categories per User](https://csapapi.cyware.com/analyst-portal/reports/analyst/published-categories-per-user-analyst.md): Returns the categories that have been used by analysts while publishing alerts. • [Doc Library](https://csapapi.cyware.com/analyst-portal/analyst-portal-doc-library.md): The Doc Library is a secure place to store text, image, and video files where analysts and members can store and maintain important cybersecurity files. For more information, see Collaborate Doc Library Documentation . As an analyst, you can perform the following actions in this section: Upload a File : Upload a file to the Doc Library and share it with recipient groups or individual recipients. Access Document : Retrieve details of a document or folder from the Doc Library. Create a Folder : Create a folder in the Doc Library within a parent folder or in the root directory. Access Folder Details : Retrieve details of a folder or the root directory. • [Upload File](https://csapapi.cyware.com/analyst-portal/analyst-portal-doc-library/upload-file.md): Upload a file to the Doc Library and share it with recipient groups and individual recipients. Changelog Release v3.8.5 Added support for the parent_folder_id body parameter The API response now includes the parent_folder_id field • [Get Document Details](https://csapapi.cyware.com/analyst-portal/analyst-portal-doc-library/document-details-analyst.md): Returns the details of a Doc Library file or folder using its document ID. • [Create Folder](https://csapapi.cyware.com/analyst-portal/analyst-portal-doc-library/create-folder.md): Creates a new folder in the Doc Library within the specified parent folder. If you do not specify any parent folder, the new folder is created in the root directory. Changelog Release v3.8.5.0 This endpoint is available starting from the 3.8.5.0 version. • [Get Folder Details](https://csapapi.cyware.com/analyst-portal/analyst-portal-doc-library/get-folder-details.md): Returns details of the folder such as folder ID, folder recipients, and more based on the provided folder ID. If you do not pass a folder ID, it retrieves the details of the root directory. You can retrieve the folder_id using the Get Folder Details endpoint. Changelog Release v3.8.5.0 This endpoint is available starting from the 3.8.5.0 version. • [Get Specific Folder Details](https://csapapi.cyware.com/analyst-portal/analyst-portal-doc-library/get-folder-details/get-root-folder-details-copy-1.md): Returns details of a specific folder using the folder ID. It retrieves information such as the folder ID, recipients, and other attributes. You can retrieve the folder_id using the Get Folder Details endpoint. • [Get Root Folder Details](https://csapapi.cyware.com/analyst-portal/analyst-portal-doc-library/get-folder-details/get-root-folder-details.md): Returns the details of the root directory when no folder ID is specified. • [Request for Information (RFI)](https://csapapi.cyware.com/analyst-portal/request-for-information-rfi.md): In Collaborate, members can submit Requests for Information (RFIs), facilitating the exchange of insights for optimizing their organization's security posture. As an analyst, you can review these RFIs and publish them as alerts to a larger network. For more information, see Collaborate Request for Information Documentation . As an analyst, you can perform the following actions: Retrieve a list of all RFIs, providing an overview of current and past requests. Access detailed information about a specific RFI, including its context and related information. View all responses received for a particular RFI, helping analysts assess the quality and relevance of the collected data. • [Get RFI List](https://csapapi.cyware.com/analyst-portal/request-for-information-rfi/rfi-list-analyst-member.md): Returns all the RFIs submitted by members. Changelog Release 3.8.13.0 Added IN_PROGRESS as a possible value for the status field alongside OPEN and CLOSED. • [Get RFI Details](https://csapapi.cyware.com/analyst-portal/request-for-information-rfi/rfi-details-analyst-member.md): Returns the details of an RFI using its incident ID. Changelog Release v3.8.13.0 Added IN_PROGRESS as a possible value for the status value field alongside OPEN and CLOSED . Release v3.8.8.0 Added support for the analyst_groups response parameters. • [Get RFI Responses](https://csapapi.cyware.com/analyst-portal/request-for-information-rfi/rfi-responses-analyst-member.md): Returns all responses to an RFI alert. • [Intelligence Requirements (IRs)](https://csapapi.cyware.com/analyst-portal/intelligence-requirements-irs.md): Intelligence Requirements (IRs) are information requests that help you gain insights into a particular subject over a specified period. IRs guide the collection, analysis, and dissemination of intelligence to support decision-making and threat detection within your organization. For more information, see Collaborate Intelligence Requirements Documentation . • [Get IRs](https://csapapi.cyware.com/analyst-portal/intelligence-requirements-irs/ir-list-analyst.md): Returns the list of Intelligence Requirements (IRs) and their statuses. This endpoint excludes IRs in draft status. • [Get IR Followers](https://csapapi.cyware.com/analyst-portal/intelligence-requirements-irs/ir-followers-analyst.md): Returns the list followers of a published Intelligence Requirement (IR). • [Get Matched Alerts by IR ID](https://csapapi.cyware.com/analyst-portal/intelligence-requirements-irs/get-matched-alerts-by-ir-id.md): Returns the list of alerts matched with the specified Intelligence Requirement (IR) ID. Alerts are matched to IR based on tags. • [Recommended Actions](https://csapapi.cyware.com/analyst-portal/recommended-actions.md): In an alert, actions are tasks assigned or recommended to members. This is based on the insights shared in the alert or as a course of normal security measures. As an analyst, you can recommend actions to members and retrieve the list of recommended actions. For more information, see Collaborate Recommended Actions Documentation . • [Create Recommended Action](https://csapapi.cyware.com/analyst-portal/recommended-actions/create-recommended-action.md): As an analyst, you can recommend actions to members for published alerts. Recommended actions help guide members on necessary steps based on insights from the alert or as part of standard security measures. • [Get Recommended Actions](https://csapapi.cyware.com/analyst-portal/recommended-actions/get-recommended-actions.md): Returns the recommended actions and their details for a specific alert using its alert ID. • [Overview](https://csapapi.cyware.com/member-portal/overview.md): Members use the Member Portal widely to collaborate, receive, and share security information. Member Portal is a web-based application that members can use from desktop or laptop computers. As a member, you can perform the following actions: Receive Alerts : Stay informed with real-time alerts on security incidents, breaches, vulnerabilities, and emerging threats. Collaborate through Messenger : Engage in secure, real-time communication with other members, create group discussions, and share insights on specific topics. Share Threat Intelligence : Submit valuable threat intelligence to help organizations understand external threats. All submissions are reviewed and verified by analysts before being shared. Access Organization : Manage organizations, control their status, and access related data. Request for Information (RFI) : Gather information from analysts and other members to share relevant and contextual information on threats, vulnerabilities, malware, and prioritized intelligence requirements. For more information, see Collaborate Member Portal Documentation . • [Authentication](https://csapapi.cyware.com/member-portal/authentication.md): Create Open API Roles As an analyst user of Collaborate's Analyst Portal, you can create user roles for members to regulate access to Collaborate features using open API. You can assign these role to members while generating API credentials for them. For more information, see Create Open API Roles . Generate Open API Credentials Analysts of Collaborate's Analyst Portal can generate open API credentials for analysts or members to access the open API endpoints. They can also assign a role to control and restrict members' access to Collaborate's features. For more information, see Generate Open API Credentials . Mandatory Query Parameters To authenticate the API requests made to Collaborate, you must include the following parameters in the query of each API request: Access ID : Indicates the access ID of your Collaborate open API credentials. Expires : Indicates the validity of the signature parameter. The signature becomes invalid if not used within the specified expiry duration. You can use the expires = current time + 300 seconds for authentication. You can give a margin of 10 to 15 seconds for expiry. Signature : A combination of the access ID, secret key, and expires parameters to authenticate API requests. The signature is hashed using the HMAC-SHA1 algorithm and then encoded using the Base64 scheme. Create a StringToSign value using the StringToSign = access_id + \n + expires formula. Create a Signature value using the Signature = Base64(HMAC-SHA1(secret_key, UTF-8-Encoding-Of(StringToSign))) formula. Test API Request Format For all PUT and POST Calls being made, the content-type header is mandatory. You can now make a test API call in the following format using the Access ID, Expires, and Signature values: base_url/csap/v1/list_alerts/? Expires=expires_value&AccessID=accessid_value&Signature=signature_value Remember to replace base_url , expires_value , accessid_value , and signature_value . {"content-type": "application/json"} is to be sent as part of the headers unless specified otherwise. A status code 415 response is given in the case of an invalid content type provided. Use the script in the Pre-request Script section in the right panel to generate the Expires and Signature parameters in Postman. • [Test Connectivity](https://csapapi.cyware.com/member-portal/authentication/test-connectivity.md): Test connectivity with Collaborate's Member Portal. • [Alerts](https://csapapi.cyware.com/member-portal/member-portal-alerts.md): Collaborate helps you share real-time situational awareness alerts on the latest incidents, breaches, malware, and vulnerabilities to members over email, web, and mobile platforms. For more information, see Collaborate Alerts Documentation . As a member, you can view and engage with alerts relevant to your organization’s security needs. You can perform the following actions: Access Alerts : Receive timely alerts on vulnerabilities, exploits, and security concerns specific to certain products, industries, or organizations, keeping you informed of emerging threats and critical security issues. Share Feedback : Provide feedback on alerts directly through the Member Portal, ensuring analysts receive valuable insights to refine and enhance their security updates. As a member, you can access all alert-related data that has been shared with you. • [Get Alerts](https://csapapi.cyware.com/member-portal/member-portal-alerts/get-alerts.md): Returns a list of alerts from Collaborate. Changelog Release v3.8.13 Added modified_time and published_time response parameters. Release v3.8.11 (EA) Added support for the channel_ids query parameter. • [Get Alert Details](https://csapapi.cyware.com/member-portal/member-portal-alerts/get-alert-details.md): Returns details of an alert using its unique ID. As a member, you can only retrieve published alerts that are shared with you. Changelog Release v3.8.13.0 Returns modified_time and matched_irs response parameters. Release v3.8.12.0 Returns scheduled_expiry_time and shared_by response parameters. Release v3.8.9.0 Returns the source_urls response parameter. Release v3.8.8.0 Returns the analyst_groups response parameter. Release v3.7.6.0 For analysts, access to the alert is based on the categories associated with your user role in the Analyst Portal. However, if your user role has View All Alerts permission, you can access all alerts based on your preference. This update does not impact credentials generated prior to this version. • [Export Alert](https://csapapi.cyware.com/member-portal/member-portal-alerts/export-alert.md): Returns an alert in downloadable format. Save the response to your device, ensuring to add the .pdf extension to the file name so it downloads as a PDF. • [Get Alerts by Keyword](https://csapapi.cyware.com/member-portal/member-portal-alerts/get-alerts-by-keyword.md): Returns latest published alerts based on a specific keyword. • [Get Alerts by Related Indicators](https://csapapi.cyware.com/member-portal/member-portal-alerts/get-alerts-by-related-indicators.md): Returns published alerts by indicators mentioned in the alerts. • [Get Alerts by Tracking ID](https://csapapi.cyware.com/member-portal/member-portal-alerts/get-alerts-by-tracking-id.md): Returns alerts using the tracking ID. A tracking ID is generated when third-party integrations publish alerts in Collaborate. • [Get Category List](https://csapapi.cyware.com/member-portal/member-portal-alerts/get-category-list.md): Returns the list of active alert categories in Collaborate. • [Get Category Details](https://csapapi.cyware.com/member-portal/member-portal-alerts/get-category-details.md): Returns details of an alert category using the unique category ID. You can retrieve the category ID using the List Category endpoint. • [Get Additional Fields List](https://csapapi.cyware.com/member-portal/member-portal-alerts/get-additional-fields-list.md): Returns the list of all fields in Collaborate. • [Get Additional Field Details](https://csapapi.cyware.com/member-portal/member-portal-alerts/get-additional-field-details.md): Returns the details of a specific field in Collaborate using the field_id . You can retrieve field_id using the Get Additional Fields List endpoint. • [Create Tag](https://csapapi.cyware.com/member-portal/member-portal-alerts/create-tag.md): Create a tag in Collaborate's Tag Library. Members can use tags while submitting threat intel RFIs and more. • [Get Tags](https://csapapi.cyware.com/member-portal/member-portal-alerts/get-tags.md): Returns a list of all the tags in the Tag Library. • [Get Recipient Groups](https://csapapi.cyware.com/member-portal/member-portal-alerts/get-recipient-groups.md): Returns a list of recipient groups that the member is part of. • [Get Information Source List](https://csapapi.cyware.com/member-portal/member-portal-alerts/get-information-source-list.md): Returns a list of information sources (info sources) in Collaborate. • [Get Channel List](https://csapapi.cyware.com/member-portal/member-portal-alerts/get-channel-list.md): Retrieves a list of channels based on the specified channel type. Changelog Release v3.8.11.0 (EA) This endpoint is available starting from the 3.8.11.0 (Early Access) version. • [Get Member Locations](https://csapapi.cyware.com/member-portal/member-portal-alerts/get-member-locations.md): Returns locations configured in the CSAP Analyst Portal. • [Submit Alert Feedback](https://csapapi.cyware.com/member-portal/member-portal-alerts/submit-alert-feedback.md): Submit feedback for an alert by indicating like or dislike, rating the content and relevancy, as well as adding a comment. For a successful submission: alert_ID and like parameters are mandatory. If you include relevancy_rating , you must also include content_rating , and vice versa. • [Organization](https://csapapi.cyware.com/member-portal/member-portal-organization.md): Analysts can classify members according to organizations while inviting them to the Collaborate Member Portal. Organizations can also be further grouped into organization types and be associated with certain organizational levels. This allows analysts to share alerts quickly with members from selected organizations and organization types. For more information, see Collaborate Organization Documentation. As a member, you can perform the following actions: Retrieve Organization Data : View detailed lists of organizations, organization types, and organization levels you belong to. Retrieve Associated Details : Access domains and IP addresses linked to your organization. Update Organization Details (Member Admins Only) : If you are a member admin, you can update the details of your organization. • [Update Organization](https://csapapi.cyware.com/member-portal/member-portal-organization/update-organization.md): Update the details of the organization you belong to. Your API role must have the permissions to update organizations. • [Get Organizations](https://csapapi.cyware.com/member-portal/member-portal-organization/get-organizations.md): Returns the organization that you belong to. • [Get Organization Types](https://csapapi.cyware.com/member-portal/member-portal-organization/get-organization-types.md): Returns the organization type details for the organization you belong to. • [Get Organization Domain and IPs](https://csapapi.cyware.com/member-portal/member-portal-organization/get-organization-domain-and-ips.md): Returns the domains and IP addresses associated with an organization using its organization ID. • [Intel](https://csapapi.cyware.com/member-portal/member-portal-intel.md): Threat intelligence sharing helps organizations understand the risks of the most common and severe external threats. As a member, you can create and share threat intel information with analysts. Analysts review the shared threat intelligence and can choose to publish this information as alerts to other members. For more information, see Collaborate Threat Intel Documentation. As a member, you can perform the following actions related to threat intelligence: Submit Threat Intel : Submit threat intel to share information about external threats with analysts. View Intel Submissions : Access a list of submitted intel and view detailed information for specific intel submissions. Access Intel Categories : Retrieve information about available intel categories and their associated fields. • [Create Intel](https://csapapi.cyware.com/member-portal/member-portal-intel/create-intel.md): As a member, you can submit threat intel to analysts. Retrieve the Required Fields for Intel Category The required fields while submitting intel is based on the configuration for the intel category in the Analyst Portal. To get the required fields for the category, follow these steps: Use the Get Intel Categories API in the Intel section to retrieve the list of all categories. You can use the category_id of the category to retrieve all associated fields. Use this category_id in the Get Intel Category Details API to fetch all the fields associated with the category. All fields marked as required true are mandatory while submitting the RFI. Retrieve the Field Details for RFI Submission While passing body parameters, the field ID is mandatory. To retrieve field details, follow these steps: Use the Get Additional Fields API in the Alerts section to retrieve the list of all fields. You can use the field_id to retrieve all associated details. Use this field_id in Get Additional Field Details to fetch all the field details. The ID of the field is a required key while submitting RFIs. For example, for the Priority field, the priority_id is a required key. Custom Fields Format As a member, you can submit intel using custom fields tailored to your needs. Use fields like text boxes for detailed input, multi-select for tagging multiple values, single-select for predefined choices, and more to customize your intel effectively. Field Type Description Format Boolean Boolean fields allow you to select either true or false for specific options. field_id : value Example: "f65b26a174658": true Text Text boxes allow you to add information in text format. field_id : Text Example: "f533606babb44": "CVE-2014-12345" Single-select Single-select fields allow you to choose one option from a predefined list. field_id : { field_id_id : selected value id} Example: "ffa80c88f1d20": { "ffa80c88f1d20_id": "oaa822c36c133" } Multi-select Multi-select fields allow you to associate multiple options from a predefined list. field_id : [{ field_id_id : selected value id}, { field_id_id : selected value id}] Example: "f65b26a174658": [ { "f65b26a174658_id": "o15f317d51bec" }, { "f65b26a174658_id": "o43d57e02d92a" } ] • [Get Submitted Intels](https://csapapi.cyware.com/member-portal/member-portal-intel/get-submitted-intels.md): Returns all intel submitted by you. • [Get Intel Details](https://csapapi.cyware.com/member-portal/member-portal-intel/get-intel-details.md): Returns details of intel submitted by you, using its incident ID. • [Get Intel Categories](https://csapapi.cyware.com/member-portal/member-portal-intel/get-intel-categories.md): Returns the list of intel categories. • [Get Intel Category Details](https://csapapi.cyware.com/member-portal/member-portal-intel/get-intel-category-details.md): Returns the list of fields and details associated with a category. • [Allowed Indicators](https://csapapi.cyware.com/member-portal/member-portal-allowed-indicators.md): Add trusted indicators like IPs, domains, URLs, email addresses, and hashes to your allow list. These indicators are parsed as allowed indicators when creating alerts, improving the quality of information shared, and assisting members in making more informed decisions. For more information, see Collaborate Allowed Indicator documentation . • [Get Allowed Indicators](https://csapapi.cyware.com/member-portal/member-portal-allowed-indicators/get-allowed-indicators.md): Returns the list of allowed indicators which are part of your organization. • [Add Allowed Indicators](https://csapapi.cyware.com/member-portal/member-portal-allowed-indicators/add-allowed-indicators.md): Add indicators to the list of allowed indicators for your organization. The RESPONSE PARAMETERS returns indicators organized by category. If an indicator is already in the allowed list, it appears under duplicate_indicators . If an indicator was previously added to the allowed list but later marked as inactive, it will be retrieved under blocked_indicators . • [Messenger](https://csapapi.cyware.com/member-portal/member-portal-messenger.md): Collaborate Messenger allows members to collaborate with each other, create groups for discussion, and start discussions based on topics. This section contains API endpoints that support messenger actions. For more information, see Collaborate Messenger Documentation . As a member, you can perform the following actions: Retrieve Messages in a Topic : Access messages within a specific topic in Collaborate Messenger. Get Topics : Retrieve a list of topics related to a specific alert in a group, helping you to track the discussion. Retrieve Message Attachments : Get the attachments associated with messages on a particular topic. • [Get Messages](https://csapapi.cyware.com/member-portal/member-portal-messenger/get-messages.md): Returns messages from the topic-based discussion in the Messenger. • [Get Topics](https://csapapi.cyware.com/member-portal/member-portal-messenger/get-topics.md): Returns the list of topic-based discussions from the Messenger. • [Get Attachments](https://csapapi.cyware.com/member-portal/member-portal-messenger/get-attachments.md): Returns attachments associated with a message using the topic_id and seq_id . • [Request for Information (RFI)](https://csapapi.cyware.com/member-portal/member-portal-request-for-information.md): In Collaborate, members can submit Requests for Information (RFIs), facilitating the exchange of insights for optimizing their organization's security posture. For more information, see Collaborate Request for Information Documentation . As a member, you can perform the following actions: Submit a new RFI to request specific information from members or external sources. Provide a response to an open RFI, contributing valuable insights or data. Attach relevant files or documents to an RFI response for further clarity and support. • [Submit RFI](https://csapapi.cyware.com/member-portal/member-portal-request-for-information/create-rfi-member-copy.md): You can submit a request for information (RFI) to analysts. Retrieve the Required Fields for RFI Submission The required fields while submitting an RFI are based on the configuration for the Request for Information category in the Analyst Portal. To get the required fields for submitting the RFI, follow these steps: Use the Get Category List API in the Alerts section to retrieve the list of all categories. You can use the category_id for Request for Information category to retrieve all associated fields. Use this category_id in the Category Details API to fetch all the fields associated with the RFI category. All fields marked as required true are mandatory while submitting the RFI. Retrieve the Field Details for RFI Submission While passing body parameters, the field ID is mandatory. To retrieve field details, follow these steps: Use the Additional Fields API in the Alerts section to retrieve the list of all fields. You can use the field_id to retrieve all associated details. Use this field_id in Additional Field Details to fetch all the field details. The ID of the field is a required key while submitting RFIs. For example, for the Priority field, the priority_id is a required key. Custom Field Format As a member, you can submit an RFI using custom fields tailored to your needs. Use fields like text boxes for detailed input, multi-select for tagging multiple values, single-select for predefined choices, and more to customize your RFI effectively. Field Type Description Format Boolean Boolean fields allow you to select either true or false for specific options. field_id : value Example: "f65b26a174658": true Text Text boxes allow you to add information in text format. field_id : Text Example: "f533606babb44": "CVE-2014-12345" Single-select Single-select fields allow you to choose one option from a predefined list. field_id : { field_id_id : selected value ID} Example: "ffa80c88f1d20": { "ffa80c88f1d20_id": "oaa822c36c133" } Multi-select Multi-select fields allow you to associate multiple options from a predefined list. field_id : [{ field_id_id : selected value ID}, { field_id_id : selected value ID}] Example: "f65b26a174658": [ { "f65b26a174658_id": "o15f317d51bec" }, { "f65b26a174658_id": "o43d57e02d92a" } ] System Field Format As a member, you can submit an RFI using system fields tailored to your needs. Use fields like text boxes for detailed input, multi-select for tagging multiple values, single-select for predefined choices, and more to customize your RFI effectively. Field Type Description Format Boolean Boolean fields allow you to select either true or false for specific options. field_name : { field_id : value} Example: "Notable": {"f68663be84ae5": true} Text Text boxes allow you to add information in text format. field_name : value Example: "available_patch": "Restart device" Single-select Single-select fields allow you to choose one option from a predefined list. field_name : { id : selected value ID, name : selected value name} Example: "priority": { "priority_id": "cdff50bf-ddcf-4523-a1da-560f3674e983", "priority_name": "3" } Multi-select Multi-select fields allow you to associate multiple options from a predefined list. field_name : [{ id : selected value ID, name : selected value name}] Example: "info_source": [ { "source_id": "6653f073", "info_source_name": "Internal" }, { "source_id": "115020b5", "info_source_name": "Intel Team" }] • [Get RFI List](https://csapapi.cyware.com/member-portal/member-portal-request-for-information/get-rfi-list.md): Returns all the RFIs submitted by you. Changelog Release 3.8.13.0 Added IN_PROGRESS as a possible value for the status field alongside OPEN and CLOSED. • [Get RFI Details](https://csapapi.cyware.com/member-portal/member-portal-request-for-information/get-rfi-details.md): Returns the details of an RFI using its incident ID. • [Get RFI Responses](https://csapapi.cyware.com/member-portal/member-portal-request-for-information/get-rfi-responses.md): Returns all responses to an RFI alert. • [Share RFI Response](https://csapapi.cyware.com/member-portal/member-portal-request-for-information/share-rfi-response.md): Add a response to the specified RFI alert. You can also attach files to your RFI response. To attach a file, retrieve its media ID using the Upload Attachment endpoint. To attach the same file to different RFI alerts or the same alert again, generate a unique media ID for each submission. • [Upload Attachment](https://csapapi.cyware.com/member-portal/member-portal-request-for-information/upload-attachment.md): Upload a file to obtain the media_id and use it when submitting RFI responses. To attach the same file to different RFI alerts, you must generate a unique media_id for each submission. • [Intelligence Requirements (IRs)](https://csapapi.cyware.com/member-portal/member-portal-intelligence-requirements.md): Intelligence Requirements (IRs) are information requests that help you gain insights into a particular subject over a specified period. IRs guide the collection, analysis, and dissemination of intelligence to support decision-making and threat detection within your organization. For more information, see Collaborate Intelligence Requirements Documentation . As a member, you can perform the following actions: Retrieve a list of IRs you submitted. Retrieve a list of matched alerts for a specified IR ID. • [Get IRs](https://csapapi.cyware.com/member-portal/member-portal-intelligence-requirements/get-irs.md): Retrieves the list of Intelligence Requirements (IRs) and their statuses. This endpoint excludes IRs in draft status. • [Get Matched Alerts by IR ID](https://csapapi.cyware.com/member-portal/member-portal-intelligence-requirements/get-matched-alerts-by-ir-id.md): Retrieves the list of alerts matched with the specified Intelligence Requirement (IR) ID. Alerts are matched to IR based on tags. • [Recommended Actions](https://csapapi.cyware.com/member-portal/member-portal-recommended-actions.md): In an alert, actions are tasks assigned or recommended to members. This is based on the insights shared in the alert or as a course of normal security measures. As a member, you can suggest recommended actions to other members. For more information, see Collaborate Recommended Actions Documentation . • [Create Recommended Action](https://csapapi.cyware.com/member-portal/member-portal-recommended-actions/create-recommended-actions.md): As a member, you can suggest recommended actions to other members, providing guidance on specific actions they should take in response to the alert. • [Get Recommended Actions](https://csapapi.cyware.com/member-portal/member-portal-recommended-actions/get-recommended-actions.md): Returns the recommended actions and their details for a specific alert using its alert ID.