Cyware

Overview

Collaborate API Reference

Analyst Portal

Authentication

As an analyst, you can create and update alerts, as well as retrieve all alert-related data.

As a member, you can retrieve all alert-related data shared with you.

Alerts

Member are classified into various organizations. Organizations comprise of organization types and are associated with certain organization levels.

Organization

Members can create intel and submit it to analysts for review.

Intel

View and add indicators such as IPs, domains, URLs, emails, and hashes that are added to the allow list by analysts and members.

Allowed Indicators

Dashboards in CSAP help you visualize data. Use APIs in this folder to get a list of widgets and data in a widget on the CSAP dashbaord.

Dashboard

Members are users of CSAP Member Portal. Analysts can create members.

Member

CSAP Messenger allows members to collaborate with each other, create groups for discussion, and start discussions based on topics. This section contains API endpoints that supports messenger actions.

Messenger

Reports provide statistics on different aspects of CSAP such as member status, details of alerts published, and reader details.

Reports

The Doc Library is a secure place to store text, image, and video files where analysts and members can store and maintain important cybersecurity files.

Doc Library

RFI is used for gathering information about subjects or to inform the assessment and steps taken by security teams to optimize the overall security posture of the organization.

Request for Information (RFI)

Intelligence Requirements (IRs) are information requests that help you gain insights into a particular subject over a specified period. IRs guide the collection, analysis, and dissemination of intelligence to support decision-making and threat detection within your organization.

Intelligence Requirements (IRs)

Recommended Actions

Member Portal

## Create Open API Roles

As an analyst user of Collaborate's Analyst Portal, you can create user roles for members to regulate access to Collaborate features using open API. You can assign these role to members while generating API credentials for them. For more information, see [Create Open API Roles](https://techdocs.cyware.com/en/299669-311103-configure-csap-open-api.html#UUID-619438df-5270-99c9-e9e3-627354e346a2_section-idm4602926397864033127945617155).

## Generate Open API Credentials

As an analyst user of Collaborate's Analyst Portal, you can generate open API credentials for analysts or members to access the open API endpoints.  
You can assign a role to control and restrict member's access to Collaborate's features.  
For analysts, post the v3.7.6.0 update: access to certain categories are based on your user role in the Analyst Portal. This update does not impact credentials generated prior to this version.  
For more information, see [Generate Open API Credentials](https://techdocs.cyware.com/en/299669-311103-configure-csap-open-api.html#UUID-619438df-5270-99c9-e9e3-627354e346a2_section-idm456429263300003297458551117).

## **Mandatory Query Parameters**

To authenticate the API requests made to Collaborate, you must include the following parameters in the query of each API request:

1. **Access ID**: Indicates the access ID of your Collaborate open API credentials.
2. **Expires:** Indicates the validity of the signature parameter. The signature becomes invalid if not used within the specified expiry duration. You can use the `expires = current time + 300 seconds` for authentication. You can give a margin of 10 to 15 seconds for expiry.
3. **Signature:** A combination of the access ID, secret key, and expires parameters to authenticate API requests. The signature is hashed using the HMAC-SHA1 algorithm, and then encoded using the Base64 scheme.
    1. Create a StringToSign value using the `StringToSign = access_id + \n + expires` formula.
    2. Create a Signature value using the `Signature = Base64(HMAC-SHA1(secret_key, UTF-8-Encoding-Of(StringToSign)))` formula.

You can now make a test API call in the following format using the Access ID, Expires, and Signature values:  
`base_url/csap/v1/list_alerts/? Expires=expires_value&AccessID=accessid_value&Signature=signature_value`  
Remember to replace `base_url`, `expires_value`, `accessid_value`, and `signature_value`.

For all PUT and POST Calls being made the content-type header is mandatory.

{"content-type": "application/json"} is to be sent as part of the headers unless specified otherwise.

A status code 415 response is given in the case of invalid content-type provided.

Use the following script in the **Pre-request Script** section to generate the **Expires** and **Signature** parameters in Postman:

``` javascript
var accessid = pm.environment.get("accessid");
var secret_key = pm.environment.get("secretkey");
/*
  -Generating epoch time
  -Epoch time is being sent in Expires parameter of the request
  -Signature is generated using the accessid and expires parameter
*/
pm.environment.set("unixtimestamp",Math.round(Date.now()/1000));
var expires = pm.environment.get("unixtimestamp")+300;
pm.environment.set('UTC Timezone', new Date().toISOString());
pm.environment.set("expires", expires);
var to_sign = accessid+"\n"+expires;
/*
Generate Signature for Authentication
  -Key-based hashing is done using HMAC-SHA1 algorithm
  -This is then converted into Base64 format
  -Finally, the generated signature is URL-encoded
*/
var hash = CryptoJS.HmacSHA1(to_sign, secret_key);
var hashInBase64 = CryptoJS.enc.Base64.stringify(hash);
pm.environment.set("signature",encodeURIComponent(hashInBase64));
/*
Set authentication credentials in request parameters
*/
pm.request.addQueryParams(`AccessID=${accessid}`)
pm.request.addQueryParams(`Signature=${pm.environment.get('signature')}`)
pm.request.addQueryParams(`Expires=${pm.environment.get('expires')}`)

 ```

Use the following Python script to generate the **Expires** and **Signature** parameters to use in Python integrations:

``` python
import base64
import hashlib
import hmac
import time
import requests
import urllib.parse
# Credentials to access CSAP open API
base_url = "<enter base URL>" # The base URL should contain / in the end. Example: https://csap-01.cyware.com/api/
access_id = "<enter access ID>"
secret_key = "<enter secret key>"
expiration_margin_time = 20 # seconds
# Just for formatting
padding_length = 100
padding_design_char = "-"
tab_width = 25
def signature(access_id: str, secret_key: str, expires: int) -> str:
    """
    Computes and returns signature.
    """
    #string to sign in
    to_sign = "{}\n{}".format(access_id, expires)
    hashed = hmac.new(
        secret_key.encode("utf-8"), to_sign.encode("utf-8"), hashlib.sha1
    )
    # b64_signature
    return base64.b64encode(hashed.digest()).decode("utf-8")
def expiry_time(margin: int = expiration_margin_time) -> int:
    """
    Expiration time with the margin specified
    """
    return int(time.time() + margin)
def query(access_id: str, secret_key: str, expiration_margin_time: int, 
        method: str, endpoint: str, data = None, headers={}, **params):
    """
    Uses 'requests' module to get response.
    Note: Payload for PUT and POST call can be specified in data (dict).
    """
    expires = expiry_time(expiration_margin_time) # Getting expiry time
    params["Expires"] = expires
    params["AccessID"] = access_id
    params["Signature"] = signature(access_id, secret_key, expires)
    url = "{}{}".format(base_url, endpoint) + "?" + urllib.parse.urlencode(params, doseq=True)
    print("Using python-requests module".center(padding_length, padding_design_char))
    print("REQUEST DATA".center(padding_length, padding_design_char))
    request_data_dict = {"Method": method, "Params": params, "Header": headers, "Payload": data, "URL": url}
    for key, val in request_data_dict.items():
        print("{:<{width}}{}".format(key+":", val, width=tab_width))
    response = requests.request(method, url, headers=headers, json=data)
    print("RESPONSE DATA".center(padding_length, padding_design_char))
    request_data_dict = {"Status-code": response.status_code, "Data": response.text}
    for key, val in request_data_dict.items():
        print("{:<{width}}{}".format(key+":", val, width=tab_width))
    return response
def test_connectivity():
    """
    CSAP Open API test connectivity call.
    """
    print("Test Connectivity".center(padding_length, padding_design_char))
    # Note the endpoint shouldn't begin with a '/'. base_url already contains it.
    endpoint = "csap/v1/test_connectivity/"
    method_type = "GET"
    response = query(access_id, secret_key, expiration_margin_time, method_type, endpoint)
if __name__ == "__main__":
    test_connectivity()

 ```

Request for Information (RFI) 

Default

Collaborate API Reference (Live)

Production

Sandbox

<p class="slate-p " ><p class="slate-p " >Organizations worldwide face increasingly sophisticated and coordinated cybersecurity threats, making it crucial for security teams to adopt a collaborative approach to define their security strategy. Collaborate is a situational awareness platform that enables real-time threat alert sharing and aggregation, helping you effectively respond to threats through information sharing, coordination, and collaboration among security analysts. With Collaborate, you can enrich, anonymize, and share precise threat intelligence, including indicators of compromise (IOCs) and incident responses.
Collaborate&apos;s API is organized around REST and is available to all customers. The API endpoints contain predictable resource-oriented URLs, return JSON-encoded responses, and use standard HTTP response codes, and authentication.</p><p class="slate-p " >The following are the two portals in Collaborate:</p></p><a href="https://csapapi.cyware.com/analyst-portal/analyst-portal" target="_top" class=card-anchor><div class="card-box" style="width:60%;"><img src=https://theneo-prod-public.s3.us-east-1.amazonaws.com/bdcb593e-d398-43c4-88c3-f1eed965258d.png class=card-icon></img><div ><h3 class="slate-h3 " >Analyst Portal</h3><p class="slate-p slate-indent-0" style="0px">The Analyst Portal is an administrative module mainly used by administrators and analysts to create and share information with members. Administrators set the application and user preferences for all users through the Analyst Portal. </p></div></div></a><a href="https://csapapi.cyware.com/member-portal-1/member-portal" target="_top" class=card-anchor><div class="card-box" style="width:60%;"><img src=https://theneo-prod-public.s3.us-east-1.amazonaws.com/e15dd45b-5dde-4933-be8a-23f040e6c7fc.png class=card-icon></img><div ><h3 class="slate-h3 " >Member Portal</h3><p class="slate-p slate-indent-0" style="0px">The Member Portal is used by security teams and member organizations for receiving strategic intelligence and alerts. It works along with the Analyst Portal to enhance communication and strategic intelligence sharing among employees and member organizations. </p></div></div></a><div class="card-box" style="width:60%;"><svg width="24" height="24" viewBox="0 0 24 24" fill="none" class="icon-style" xmlns="http://www.w3.org/2000/svg"> <g clipPath="url(#clip0_2631_5104)"> <path d="M17 0C16.7348 0 16.4804 0.105357 16.2929 0.292893C16.1054 0.48043 16 0.734784 16 1C16 3.949 13.417 5 11 5H4C2.93913 5 1.92172 5.42143 1.17157 6.17157C0.421427 6.92172 0 7.93913 0 9L0 11C0.00218416 11.5987 0.139462 12.1893 0.401603 12.7276C0.663743 13.2659 1.04399 13.7381 1.514 14.109L5.086 22.081C5.34004 22.6521 5.75417 23.1373 6.27827 23.4779C6.80237 23.8185 7.41396 23.9998 8.039 24C8.53631 23.9997 9.02565 23.875 9.46247 23.6373C9.89929 23.3996 10.2697 23.0564 10.54 22.639C10.8104 22.2215 10.972 21.7431 11.0103 21.2473C11.0485 20.7515 10.9621 20.2539 10.759 19.8L8.559 15H11C13.417 15 16 16.051 16 19C16 19.2652 16.1054 19.5196 16.2929 19.7071C16.4804 19.8946 16.7348 20 17 20C17.2652 20 17.5196 19.8946 17.7071 19.7071C17.8946 19.5196 18 19.2652 18 19V1C18 0.734784 17.8946 0.48043 17.7071 0.292893C17.5196 0.105357 17.2652 0 17 0V0ZM8.937 20.619C9.00324 20.7686 9.03109 20.9323 9.01804 21.0954C9.005 21.2585 8.95145 21.4157 8.86227 21.5529C8.77309 21.69 8.65109 21.8027 8.50733 21.8808C8.36357 21.9589 8.20259 21.9999 8.039 22C7.8004 21.9998 7.56697 21.9304 7.36709 21.8001C7.1672 21.6698 7.00945 21.4842 6.913 21.266L4.105 15H6.359L8.937 20.619ZM16 14.6C14.5713 13.4992 12.8024 12.9331 11 13H4C3.46957 13 2.96086 12.7893 2.58579 12.4142C2.21071 12.0391 2 11.5304 2 11V9C2 8.46957 2.21071 7.96086 2.58579 7.58579C2.96086 7.21071 3.46957 7 4 7H11C12.8018 7.0683 14.5706 6.50403 16 5.405V14.6ZM23.9 15.452C23.8413 15.5696 23.7601 15.6744 23.6609 15.7606C23.5617 15.8467 23.4465 15.9125 23.3218 15.9541C23.1972 15.9957 23.0656 16.0123 22.9345 16.0031C22.8035 15.9938 22.6755 15.9588 22.558 15.9L20.558 14.9C20.3206 14.7814 20.1401 14.5735 20.0561 14.3218C19.972 14.0701 19.9915 13.7954 20.11 13.558C20.2286 13.3206 20.4365 13.1401 20.6882 13.0561C20.9399 12.972 21.2146 12.9914 21.452 13.11L23.452 14.11C23.6882 14.2285 23.8678 14.4356 23.9518 14.6861C24.0357 14.9366 24.0171 15.2102 23.9 15.447V15.452ZM20.11 6.452C20.0512 6.33448 20.0162 6.20653 20.0069 6.07546C19.9977 5.9444 20.0143 5.81279 20.0559 5.68816C20.0975 5.56353 20.1633 5.44832 20.2494 5.34912C20.3356 5.24991 20.4404 5.16866 20.558 5.11L22.558 4.11C22.7954 3.99145 23.0701 3.97205 23.3218 4.05606C23.5735 4.14008 23.7815 4.32063 23.9 4.558C24.0186 4.79537 24.038 5.07011 23.9539 5.32178C23.8699 5.57346 23.6894 5.78145 23.452 5.9L21.452 6.9C21.3345 6.95876 21.2065 6.99378 21.0755 7.00306C20.9444 7.01234 20.8128 6.99571 20.6882 6.9541C20.5635 6.9125 20.4483 6.84674 20.3491 6.76058C20.2499 6.67443 20.1687 6.56957 20.11 6.452ZM20 10C20 9.73478 20.1054 9.48043 20.2929 9.29289C20.4804 9.10536 20.7348 9 21 9H23C23.2652 9 23.5196 9.10536 23.7071 9.29289C23.8946 9.48043 24 9.73478 24 10C24 10.2652 23.8946 10.5196 23.7071 10.7071C23.5196 10.8946 23.2652 11 23 11H21C20.7348 11 20.4804 10.8946 20.2929 10.7071C20.1054 10.5196 20 10.2652 20 10Z" fill="#374957"/> </g> <defs> <clipPath id="clip0_2631_5104"> <rect width="24" height="24" fill="white"/> </clipPath> </defs> </svg><div ><p class="slate-p slate-indent-0" style="0px"><span style="color:rgb(0, 0, 0)"><strong class="slate-bold">Supported Collaborate Version</strong></span><span style="color:rgb(0, 0, 0)">:
</span>3.8.6.0 and later versions</p></div></div><p class="slate-p " ></p>

<p class="slate-p " >The Analyst Portal is an admin module mainly used by administrators and analysts. Analysts create and share information with members. Administrators set the application and user preferences for all users through the Analyst Portal.</p><p class="slate-p " >As an analyst, you can perform the following actions:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Alert Management</strong>: Create and publish alerts about vulnerabilities, exploits, and security issues to members.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Organization Management</strong>: Create and manage organizations, control their status, and access related data for efficient alert sharing.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Manage Intel Submissions</strong>: Manage threat intel submissions from members to enable bi-directional sharing of critical information as alerts across the organization.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Manage Request for Information (RFI)</strong>: Manage RFIs submitted by members, review and publish them as alerts, and foster collaboration to enhance security.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Intelligence Requirements</strong>: Retrieve Intelligence Requirements (IRs) and their followers.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Allowed Indicators</strong>: Add trusted indicators to your allow list to enhance alert quality and support informed decision-making.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Manage Members</strong>: Add and manage members, modify their details and status, and access member information as needed.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Doc Library</strong>: Manage and share files, documents, and attachments to facilitate coordination between analysts and members.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Tag Library</strong>: Organize and manage tags to efficiently categorize and locate items within the platform.</div></li></ul><p class="slate-p " >For more information, see <a href="https://techdocs.cyware.com/en/299669-326161-analyst-portal.html" target="_blank">Collaborate Analyst Portal Documentation</a>.</p>

The Analyst Portal is an admin module mainly used by administrators and analysts. Analysts create and share information with members. Administrators set the application and user preferences for all users through the Analyst Portal.

As an analyst, you can perform the following actions:

Javascript

Python

<p class="slate-p " >In Collaborate&apos;s Analyst Portal, you can manage user access and feature permissions by defining Open API roles and generating credentials to control access.</p><h3 class="slate-h3 " >Create Open API Roles</h3><p class="slate-p " >
You can create user roles for members to regulate access to Collaborate features using open API. You can assign these roles to members while generating API credentials for them. For more information, see <a href="https://techdocs.cyware.com/en/299669-311103-configure-csap-open-api.html#UUID-619438df-5270-99c9-e9e3-627354e346a2_section-idm4602926397864033127945617155" target="_blank">Create Open API Roles</a>.</p><h3 class="slate-h3 " >Generate Open API Credentials</h3><p class="slate-p " >
You can generate open API credentials for analysts or members to access the open API endpoints.  
You can assign a role to control and restrict members&apos; access to Collaborate&apos;s features.  
For analysts, after the v3.7.6.0 update, access to certain categories is based on your user role in the Analyst Portal. This update does not impact credentials generated prior to this version.  
For more information, see <a href="https://techdocs.cyware.com/en/299669-311103-configure-csap-open-api.html#UUID-619438df-5270-99c9-e9e3-627354e346a2_section-idm4602926397864033127945617155" target="_blank">Generate Open API Credentials</a>.</p><h3 class="slate-h3 " >
Mandatory Query Parameters
</h3><p class="slate-p " >To authenticate the API requests made to Collaborate, you must include the following parameters in the query of each API request:</p><div class="steps-widget" style="width:100%;
  	min-width:100%;"><div class="steps-wrapper"><div class="steps-content"><h6 class="slate-h6 " >1</h6><h3 class="slate-h3 " >Access ID</h3><p class="slate-p " >Indicates the access ID of your Collaborate open API credentials.</p></div></div><div class="steps-wrapper"><div class="steps-content"><h6 class="slate-h6 " >2</h6><h3 class="slate-h3 " >Expires</h3><p class="slate-p " >Indicates the validity of the signature parameter. The signature becomes invalid if not used within the specified expiry duration. You can use </p><p class="slate-p " ><code class="slate-code">expires = current time + 300 seconds</code> for authentication. You can give a margin of 10 to 15 seconds for expiry.</p></div></div><div class="steps-wrapper"><div class="steps-content"><h6 class="slate-h6 " >3</h6><h3 class="slate-h3 " >Signature</h3><p class="slate-p " >A combination of the access ID, secret key, and expires parameters to authenticate API requests. The signature is hashed using the HMAC-SHA1 algorithm and then encoded using the Base64 scheme.</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative">Create a StringToSign value using the <code class="slate-code">StringToSign = access_id + \n + expires</code><em class="slate-italic"> </em>formula.</div></li><li class="slate-li " ><div style="position:relative">Create a Signature value using the <code class="slate-code">Signature = Base64(HMAC-SHA1(secret_key, UTF-8-Encoding-Of(StringToSign)))</code> formula.</div></li></ul></div></div></div><h3 class="slate-h3 " >Test API Request Format</h3><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=info ><div class="callout-icon"><svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M10.0628 14.1676C10.2434 14.1676 10.3927 14.1086 10.5107 13.9905C10.6288 13.8725 10.6878 13.7232 10.6878 13.5426V9.77177C10.6878 9.6051 10.6253 9.46274 10.5003 9.34469C10.3753 9.22663 10.2295 9.1676 10.0628 9.1676C9.88227 9.1676 9.73296 9.22663 9.61491 9.34469C9.49685 9.46274 9.43783 9.61205 9.43783 9.7926V13.5634C9.43783 13.7301 9.50033 13.8725 9.62533 13.9905C9.75033 14.1086 9.89616 14.1676 10.0628 14.1676ZM10.0003 7.62594C10.1948 7.62594 10.358 7.56344 10.4899 7.43844C10.6219 7.31344 10.6878 7.15371 10.6878 6.95927C10.6878 6.76482 10.6219 6.59816 10.4899 6.45927C10.358 6.32038 10.1948 6.25094 10.0003 6.25094C9.80588 6.25094 9.64269 6.32038 9.51074 6.45927C9.3788 6.59816 9.31283 6.76482 9.31283 6.95927C9.31283 7.15371 9.3788 7.31344 9.51074 7.43844C9.64269 7.56344 9.80588 7.62594 10.0003 7.62594ZM10.0003 18.3343C8.81977 18.3343 7.72255 18.1225 6.70866 17.6989C5.69477 17.2752 4.81283 16.6884 4.06283 15.9384C3.31283 15.1884 2.72602 14.3065 2.30241 13.2926C1.8788 12.2787 1.66699 11.1815 1.66699 10.0009C1.66699 8.83427 1.8788 7.74399 2.30241 6.7301C2.72602 5.71621 3.31283 4.83427 4.06283 4.08427C4.81283 3.33427 5.69477 2.74399 6.70866 2.31344C7.72255 1.88288 8.81977 1.6676 10.0003 1.6676C11.167 1.6676 12.2573 1.88288 13.2712 2.31344C14.285 2.74399 15.167 3.33427 15.917 4.08427C16.667 4.83427 17.2573 5.71621 17.6878 6.7301C18.1184 7.74399 18.3337 8.83427 18.3337 10.0009C18.3337 11.1815 18.1184 12.2787 17.6878 13.2926C17.2573 14.3065 16.667 15.1884 15.917 15.9384C15.167 16.6884 14.285 17.2752 13.2712 17.6989C12.2573 18.1225 11.167 18.3343 10.0003 18.3343ZM10.0003 17.0843C11.9448 17.0843 13.6114 16.3898 15.0003 15.0009C16.3892 13.612 17.0837 11.9454 17.0837 10.0009C17.0837 8.05649 16.3892 6.38982 15.0003 5.00094C13.6114 3.61205 11.9448 2.9176 10.0003 2.9176C8.05588 2.9176 6.38921 3.61205 5.00033 5.00094C3.61144 6.38982 2.91699 8.05649 2.91699 10.0009C2.91699 11.9454 3.61144 13.612 5.00033 15.0009C6.38921 16.3898 8.05588 17.0843 10.0003 17.0843Z" fill="#3960B4"></path></svg></div><div ><p class="slate-p " >For all PUT and POST calls, the content-type header is mandatory.</p></div></div><p class="slate-p " >You can now make a test API call in the following format using the Access ID, Expires, and Signature values:  </p><div class="code-block-wrapper"  style="width:100%;min-width:100%" ><div class="code-block-header">Plain text</div><pre class="slate-CodeBlockElement slate-code_block"><textarea id="publishedPageCodeblock" style="display:none !important; visibility: hidden; opacity: 0; width: 1px; height: 1px;" type="hidden">base_url/csap/v1/list_alerts/? Expires=expires_value&AccessID=accessid_value&Signature=signature_value </textarea><code class="language-plainText keep-markup drop-tokens"></code></pre></div><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=info ><div class="callout-icon"><svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M10.0628 14.1676C10.2434 14.1676 10.3927 14.1086 10.5107 13.9905C10.6288 13.8725 10.6878 13.7232 10.6878 13.5426V9.77177C10.6878 9.6051 10.6253 9.46274 10.5003 9.34469C10.3753 9.22663 10.2295 9.1676 10.0628 9.1676C9.88227 9.1676 9.73296 9.22663 9.61491 9.34469C9.49685 9.46274 9.43783 9.61205 9.43783 9.7926V13.5634C9.43783 13.7301 9.50033 13.8725 9.62533 13.9905C9.75033 14.1086 9.89616 14.1676 10.0628 14.1676ZM10.0003 7.62594C10.1948 7.62594 10.358 7.56344 10.4899 7.43844C10.6219 7.31344 10.6878 7.15371 10.6878 6.95927C10.6878 6.76482 10.6219 6.59816 10.4899 6.45927C10.358 6.32038 10.1948 6.25094 10.0003 6.25094C9.80588 6.25094 9.64269 6.32038 9.51074 6.45927C9.3788 6.59816 9.31283 6.76482 9.31283 6.95927C9.31283 7.15371 9.3788 7.31344 9.51074 7.43844C9.64269 7.56344 9.80588 7.62594 10.0003 7.62594ZM10.0003 18.3343C8.81977 18.3343 7.72255 18.1225 6.70866 17.6989C5.69477 17.2752 4.81283 16.6884 4.06283 15.9384C3.31283 15.1884 2.72602 14.3065 2.30241 13.2926C1.8788 12.2787 1.66699 11.1815 1.66699 10.0009C1.66699 8.83427 1.8788 7.74399 2.30241 6.7301C2.72602 5.71621 3.31283 4.83427 4.06283 4.08427C4.81283 3.33427 5.69477 2.74399 6.70866 2.31344C7.72255 1.88288 8.81977 1.6676 10.0003 1.6676C11.167 1.6676 12.2573 1.88288 13.2712 2.31344C14.285 2.74399 15.167 3.33427 15.917 4.08427C16.667 4.83427 17.2573 5.71621 17.6878 6.7301C18.1184 7.74399 18.3337 8.83427 18.3337 10.0009C18.3337 11.1815 18.1184 12.2787 17.6878 13.2926C17.2573 14.3065 16.667 15.1884 15.917 15.9384C15.167 16.6884 14.285 17.2752 13.2712 17.6989C12.2573 18.1225 11.167 18.3343 10.0003 18.3343ZM10.0003 17.0843C11.9448 17.0843 13.6114 16.3898 15.0003 15.0009C16.3892 13.612 17.0837 11.9454 17.0837 10.0009C17.0837 8.05649 16.3892 6.38982 15.0003 5.00094C13.6114 3.61205 11.9448 2.9176 10.0003 2.9176C8.05588 2.9176 6.38921 3.61205 5.00033 5.00094C3.61144 6.38982 2.91699 8.05649 2.91699 10.0009C2.91699 11.9454 3.61144 13.612 5.00033 15.0009C6.38921 16.3898 8.05588 17.0843 10.0003 17.0843Z" fill="#3960B4"></path></svg></div><div ><p class="slate-p " >Remember to replace base_url, expires_value, accessid_value, and signature_value.</p></div></div><p class="slate-p " >
<code class="slate-code">{&quot;content-type&quot;: &quot;application/json&quot;}</code> is to be sent as part of the headers unless specified otherwise.</p><p class="slate-p " >A status code 415 response is given in the case of an invalid content type being provided.</p><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=info ><div class="callout-icon"><svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M10.0628 14.1676C10.2434 14.1676 10.3927 14.1086 10.5107 13.9905C10.6288 13.8725 10.6878 13.7232 10.6878 13.5426V9.77177C10.6878 9.6051 10.6253 9.46274 10.5003 9.34469C10.3753 9.22663 10.2295 9.1676 10.0628 9.1676C9.88227 9.1676 9.73296 9.22663 9.61491 9.34469C9.49685 9.46274 9.43783 9.61205 9.43783 9.7926V13.5634C9.43783 13.7301 9.50033 13.8725 9.62533 13.9905C9.75033 14.1086 9.89616 14.1676 10.0628 14.1676ZM10.0003 7.62594C10.1948 7.62594 10.358 7.56344 10.4899 7.43844C10.6219 7.31344 10.6878 7.15371 10.6878 6.95927C10.6878 6.76482 10.6219 6.59816 10.4899 6.45927C10.358 6.32038 10.1948 6.25094 10.0003 6.25094C9.80588 6.25094 9.64269 6.32038 9.51074 6.45927C9.3788 6.59816 9.31283 6.76482 9.31283 6.95927C9.31283 7.15371 9.3788 7.31344 9.51074 7.43844C9.64269 7.56344 9.80588 7.62594 10.0003 7.62594ZM10.0003 18.3343C8.81977 18.3343 7.72255 18.1225 6.70866 17.6989C5.69477 17.2752 4.81283 16.6884 4.06283 15.9384C3.31283 15.1884 2.72602 14.3065 2.30241 13.2926C1.8788 12.2787 1.66699 11.1815 1.66699 10.0009C1.66699 8.83427 1.8788 7.74399 2.30241 6.7301C2.72602 5.71621 3.31283 4.83427 4.06283 4.08427C4.81283 3.33427 5.69477 2.74399 6.70866 2.31344C7.72255 1.88288 8.81977 1.6676 10.0003 1.6676C11.167 1.6676 12.2573 1.88288 13.2712 2.31344C14.285 2.74399 15.167 3.33427 15.917 4.08427C16.667 4.83427 17.2573 5.71621 17.6878 6.7301C18.1184 7.74399 18.3337 8.83427 18.3337 10.0009C18.3337 11.1815 18.1184 12.2787 17.6878 13.2926C17.2573 14.3065 16.667 15.1884 15.917 15.9384C15.167 16.6884 14.285 17.2752 13.2712 17.6989C12.2573 18.1225 11.167 18.3343 10.0003 18.3343ZM10.0003 17.0843C11.9448 17.0843 13.6114 16.3898 15.0003 15.0009C16.3892 13.612 17.0837 11.9454 17.0837 10.0009C17.0837 8.05649 16.3892 6.38982 15.0003 5.00094C13.6114 3.61205 11.9448 2.9176 10.0003 2.9176C8.05588 2.9176 6.38921 3.61205 5.00033 5.00094C3.61144 6.38982 2.91699 8.05649 2.91699 10.0009C2.91699 11.9454 3.61144 13.612 5.00033 15.0009C6.38921 16.3898 8.05588 17.0843 10.0003 17.0843Z" fill="#3960B4"></path></svg></div><div ><p class="slate-p " >Use the script in the Pre-request Script section in the right panel to generate the Expires and Signature parameters in Postman.</p></div></div><div class="slate-div"></div><p class="slate-p " ></p>

In Collaborate's Analyst Portal, you can manage user access and feature permissions by defining Open API roles and generating credentials to control access.


You can create user roles for members to regulate access to Collaborate features using open API. You can assign these roles to members while generating API credentials for them. For more information, see 


You can generate open API credentials for analysts or members to access the open API endpoints.  
You can assign a role to control and restrict members' access to Collaborate's features.  
For analysts, after the v3.7.6.0 update, access to certain categories is based on your user role in the Analyst Portal. This update does not impact credentials generated prior to this version.  
For more information, see 

To authenticate the API requests made to Collaborate, you must include the following parameters in the query of each API request:

You can now make a test API call in the following format using the Access ID, Expires, and Signature values:  

 is to be sent as part of the headers unless specified otherwise.

A status code 415 response is given in the case of an invalid content type being provided.

<p class="slate-p slate-indent-0" style="0px">Collaborate helps you share real-time situational awareness alerts on the latest incidents, breaches, malware, and vulnerabilities to members over email, web, and mobile platforms. For more information about Alerts, see <a href="https://techdocs.cyware.com/en/299669-311910-alerts.html" target="_blank">Collaborate Alerts Documentation</a>.</p><p class="slate-p " >As an analyst, you can perform the following actions to keep members informed and prepared:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Create Alerts</strong>: Create alerts with essential details, including a title, summary, Traffic Light Protocol (TLP), category, and recipients.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Add Comprehensive Information</strong>: Add additional information to the alert such as images, campaigns, attachments, and more. </div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Incorporate Threat Indicators: </strong>Specify threat indicators that identify alert elements, enhancing clarity and specificity for members.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Enable Threat Response</strong>: Enable members to respond to organization-specific threats by attaching Threat Defender Library (TDL) content.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Recommend Actions</strong>: Recommend actionable steps based on the threat insights shared in the alert, enabling members to act effectively.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Attach Threat Assessments</strong>: Attach threat assessments for members impacted by a cyber threat.</div></li></ul><p class="slate-p " ></p><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=info ><div class="callout-icon"><svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M10.0628 14.1676C10.2434 14.1676 10.3927 14.1086 10.5107 13.9905C10.6288 13.8725 10.6878 13.7232 10.6878 13.5426V9.77177C10.6878 9.6051 10.6253 9.46274 10.5003 9.34469C10.3753 9.22663 10.2295 9.1676 10.0628 9.1676C9.88227 9.1676 9.73296 9.22663 9.61491 9.34469C9.49685 9.46274 9.43783 9.61205 9.43783 9.7926V13.5634C9.43783 13.7301 9.50033 13.8725 9.62533 13.9905C9.75033 14.1086 9.89616 14.1676 10.0628 14.1676ZM10.0003 7.62594C10.1948 7.62594 10.358 7.56344 10.4899 7.43844C10.6219 7.31344 10.6878 7.15371 10.6878 6.95927C10.6878 6.76482 10.6219 6.59816 10.4899 6.45927C10.358 6.32038 10.1948 6.25094 10.0003 6.25094C9.80588 6.25094 9.64269 6.32038 9.51074 6.45927C9.3788 6.59816 9.31283 6.76482 9.31283 6.95927C9.31283 7.15371 9.3788 7.31344 9.51074 7.43844C9.64269 7.56344 9.80588 7.62594 10.0003 7.62594ZM10.0003 18.3343C8.81977 18.3343 7.72255 18.1225 6.70866 17.6989C5.69477 17.2752 4.81283 16.6884 4.06283 15.9384C3.31283 15.1884 2.72602 14.3065 2.30241 13.2926C1.8788 12.2787 1.66699 11.1815 1.66699 10.0009C1.66699 8.83427 1.8788 7.74399 2.30241 6.7301C2.72602 5.71621 3.31283 4.83427 4.06283 4.08427C4.81283 3.33427 5.69477 2.74399 6.70866 2.31344C7.72255 1.88288 8.81977 1.6676 10.0003 1.6676C11.167 1.6676 12.2573 1.88288 13.2712 2.31344C14.285 2.74399 15.167 3.33427 15.917 4.08427C16.667 4.83427 17.2573 5.71621 17.6878 6.7301C18.1184 7.74399 18.3337 8.83427 18.3337 10.0009C18.3337 11.1815 18.1184 12.2787 17.6878 13.2926C17.2573 14.3065 16.667 15.1884 15.917 15.9384C15.167 16.6884 14.285 17.2752 13.2712 17.6989C12.2573 18.1225 11.167 18.3343 10.0003 18.3343ZM10.0003 17.0843C11.9448 17.0843 13.6114 16.3898 15.0003 15.0009C16.3892 13.612 17.0837 11.9454 17.0837 10.0009C17.0837 8.05649 16.3892 6.38982 15.0003 5.00094C13.6114 3.61205 11.9448 2.9176 10.0003 2.9176C8.05588 2.9176 6.38921 3.61205 5.00033 5.00094C3.61144 6.38982 2.91699 8.05649 2.91699 10.0009C2.91699 11.9454 3.61144 13.612 5.00033 15.0009C6.38921 16.3898 8.05588 17.0843 10.0003 17.0843Z" fill="#3960B4"></path></svg></div><div ><p class="slate-p " >As an analyst, you can create and update alerts and access all related data.</p></div></div><p class="slate-p " ></p>

Collaborate helps you share real-time situational awareness alerts on the latest incidents, breaches, malware, and vulnerabilities to members over email, web, and mobile platforms. For more information about Alerts, see 

As an analyst, you can perform the following actions to keep members informed and prepared:

<p class="slate-p " >Analysts can classify members according to organizations while inviting them to the Collaborate Member Portal. Organizations can also be further grouped into organization types and be associated with certain organizational levels. This allows analysts to share alerts quickly with members from selected organizations and organization types. For more information, see <a href="https://techdocs.cyware.com/en/299669-310190-member-organization.html" target="_blank">Collaborate Organization Documentation</a>.</p><p class="slate-p " >As an analyst, you can perform the following actions:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Create and Manage Organizations</strong>: Create organizations, assign them to members, and update organization details for seamless alert sharing.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Activate or Deactivate Organizations</strong>: Enable or disable organizations as needed to align with operational requirements.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Organization Data</strong>: Access detailed lists of organizations, organization types, and organization levels in Collaborate.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Associated Details</strong>: Obtain domains and IP addresses linked to a specific organization.</div></li></ul><p class="slate-p " ></p>

Analysts can classify members according to organizations while inviting them to the Collaborate Member Portal. Organizations can also be further grouped into organization types and be associated with certain organizational levels. This allows analysts to share alerts quickly with members from selected organizations and organization types. For more information, see 

<p class="slate-p " >A member can submit threat intel reports from the Member Portal. The intel submissions include information to help you, as an analyst, understand the risks of an organization&apos;s most common or severe external threats. Analysts can further share this information as alerts to all the other members of the organization. This facilitates the sharing and dissemination of information between the Analyst and the Member Portals. For more information, see <a href="https://techdocs.cyware.com/en/299669-312383-manage-intel-submissions.html" target="">Collaborate Intel Submission Documentation</a>.</p><p class="slate-p " >As an analyst, you can perform the following actions:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve and View Intel</strong>: Access a list of intel submissions and view detailed information for specific intel.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">View Intel Category Details</strong>: Access intel categories and the list of fields and details associated with an intel category.</div></li></ul><p class="slate-p " ></p>

A member can submit threat intel reports from the Member Portal. The intel submissions include information to help you, as an analyst, understand the risks of an organization's most common or severe external threats. Analysts can further share this information as alerts to all the other members of the organization. This facilitates the sharing and dissemination of information between the Analyst and the Member Portals. For more information, see 

<p class="slate-p " >Add trusted indicators like IPs, domains, URLs, email addresses, and hashes to your allow list. These indicators are parsed as allowed indicators when creating alerts, improving the quality of information shared, and assisting members in making more informed decisions. For more information, see <a href="https://techdocs.cyware.com/en/299669-319088-allowed-indicators.html" target="_blank">Collaborate Allowed Indicators Documentation</a>.</p>

Add trusted indicators like IPs, domains, URLs, email addresses, and hashes to your allow list. These indicators are parsed as allowed indicators when creating alerts, improving the quality of information shared, and assisting members in making more informed decisions. For more information, see 

<p class="slate-p " >Dashboards in Collaborate help you visualize data, providing an overview of key metrics and insights. These visualizations allow you to monitor activities, track trends, and make informed decisions based on the data available. For more information, see <a href="https://techdocs.cyware.com/en/299669-319258-dashboards.html" target="_blank">Collaborate Dashboard Documentation</a>.</p><p class="slate-p " >As an analyst, you can use the APIs in this section to perform the following actions:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve a List of Widgets</strong>: Access a list of widgets available on the Collaborate dashboard. </div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Get Data for a Widget</strong>: Fetch the data associated with a specific widget. This allows you to retrieve detailed information and analyze it further for deeper insights or reporting purposes.</div></li></ul><p class="slate-p " ></p>

Dashboards in Collaborate help you visualize data, providing an overview of key metrics and insights. These visualizations allow you to monitor activities, track trends, and make informed decisions based on the data available. For more information, see 

As an analyst, you can use the APIs in this section to perform the following actions:

<p class="slate-p " >Members are users of the Collaborate Member Portal who receive alerts from security experts (Publishers, Creators), on the Member Portal (web or mobile application). With the features provided by the Member Portal, members can stay updated with crucial information and prepare for the potential impact of cyber events and other developments.</p><p class="slate-p " >As an analyst, you can add Collaborate members as well as modify and manage members, including setting their status to inactive. For more information, see <a href="https://techdocs.cyware.com/en/299669-308286-onboard-members.html" target="_blank">Collaborate Member Documentation</a>.</p>

Members are users of the Collaborate Member Portal who receive alerts from security experts (Publishers, Creators), on the Member Portal (web or mobile application). With the features provided by the Member Portal, members can stay updated with crucial information and prepare for the potential impact of cyber events and other developments.

As an analyst, you can add Collaborate members as well as modify and manage members, including setting their status to inactive. For more information, see 

<p class="slate-p " >Collaborate Messenger allows members to collaborate with each other, create groups for discussion, and start discussions based on topics. For more information, see <a href="https://techdocs.cyware.com/en/299669-559689-configure-messenger.html#299669-559689-configure-messenger" target="_blank">Collaborate Messenger Documentation</a>.</p><p class="slate-p " >As an analyst, you can perform the following actions:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Messages in a Topic</strong>: Access messages within a specific topic in Collaborate Messenger.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Get Topics</strong>: Retrieve a list of topics related to a specific alert in a group, helping you to track the discussion.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Message Attachments</strong>: Get the attachments associated with messages on a particular topic. </div></li></ul><p class="slate-p " ></p>

Collaborate Messenger allows members to collaborate with each other, create groups for discussion, and start discussions based on topics. For more information, see 

<p class="slate-p " >Reports provide statistics on different aspects of Collaborate such as member status, details of alerts published, and reader details.</p><p class="slate-p " ></p>

Reports provide statistics on different aspects of Collaborate such as member status, details of alerts published, and reader details.

<p class="slate-p " >The Doc Library is a secure place to store text, image, and video files where analysts and members can store and maintain important cybersecurity files. For more information, see <a href="https://techdocs.cyware.com/en/299669-318886-doc-library.html" target="_blank">Collaborate Doc Library Documentation</a>.</p><p class="slate-p " >As an analyst, you can perform the following actions in this section:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Upload a File</strong>: Upload a file to the Doc Library and share it with recipient groups or individual recipients.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Access Document</strong>: Retrieve details of a document or folder from the Doc Library.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Create a Folder</strong>: Create a folder in the Doc Library within a parent folder or in the root directory.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Access Folder Details</strong>: Retrieve details of a folder or the root directory.</div></li></ul><p class="slate-p " ></p>

The Doc Library is a secure place to store text, image, and video files where analysts and members can store and maintain important cybersecurity files. For more information, see 

As an analyst, you can perform the following actions in this section:

<p class="slate-p " >In Collaborate, members can submit Requests for Information (RFIs), facilitating the exchange of insights for optimizing their organization&apos;s security posture. As an analyst, you can review these RFIs and publish them as alerts to a larger network. For more information, see <a href="https://techdocs.cyware.com/en/299669-312448-manage-request-for-information.html" target="_blank">Collaborate Request for Information Documentation</a>.</p><p class="slate-p " >As an analyst, you can perform the following actions:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative">Retrieve a list of all RFIs, providing an overview of current and past requests.</div></li><li class="slate-li " ><div style="position:relative">Access detailed information about a specific RFI, including its context and related information.</div></li><li class="slate-li " ><div style="position:relative">View all responses received for a particular RFI, helping analysts assess the quality and relevance of the collected data.</div></li></ul><p class="slate-p " ></p>

In Collaborate, members can submit Requests for Information (RFIs), facilitating the exchange of insights for optimizing their organization's security posture. As an analyst, you can review these RFIs and publish them as alerts to a larger network. For more information, see 

<p class="slate-p " >Intelligence Requirements (IRs) are information requests that help you gain insights into a particular subject over a specified period. IRs guide the collection, analysis, and dissemination of intelligence to support decision-making and threat detection within your organization. For more information, see <a href="https://techdocs.cyware.com/en/299669-552405-intelligence-requirements.html" target="">Collaborate Intelligence Requirements Documentation</a>.</p>

Intelligence Requirements (IRs) are information requests that help you gain insights into a particular subject over a specified period. IRs guide the collection, analysis, and dissemination of intelligence to support decision-making and threat detection within your organization. For more information, see 

<p class="slate-p " >In an alert, actions are tasks assigned or recommended to members. This is based on the insights shared in the alert or as a course of normal security measures. As an analyst, you can recommend actions to members and retrieve the list of recommended actions.</p><p class="slate-p " >For more information, see <a href="https://techdocs.cyware.com/en/299669-312300-recommend-actions-to-members.html" target="">Collaborate Recommended Actions Documentation</a>.</p>

In an alert, actions are tasks assigned or recommended to members. This is based on the insights shared in the alert or as a course of normal security measures. As an analyst, you can recommend actions to members and retrieve the list of recommended actions.

<p class="slate-p " >Members use the Member Portal widely to collaborate, receive, and share security information. Member Portal is a web-based application that members can use from desktop or laptop computers.</p><p class="slate-p " >As a member, you can perform the following actions:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Receive Alerts</strong>: Stay informed with real-time alerts on security incidents, breaches, vulnerabilities, and emerging threats.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Collaborate through Messenger</strong>: Engage in secure, real-time communication with other members, create group discussions, and share insights on specific topics.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Share Threat Intelligence</strong>: Submit valuable threat intelligence to help organizations understand external threats. All submissions are reviewed and verified by analysts before being shared.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Access Organization</strong>: Manage organizations, control their status, and access related data.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Request for Information (RFI)</strong>: Gather information from analysts and other members to share relevant and contextual information on threats, vulnerabilities, malware, and prioritized intelligence requirements.</div></li></ul><p class="slate-p " >For more information, see <a href="https://techdocs.cyware.com/en/299669-326158-member-portal.html" target="_blank">Collaborate Member Portal Documentation</a>.</p><p class="slate-p " ></p>

Members use the Member Portal widely to collaborate, receive, and share security information. Member Portal is a web-based application that members can use from desktop or laptop computers.

As a member, you can perform the following actions:

<h2 class="slate-h2 " >Create Open API Roles</h2><p class="slate-p " >
As an analyst user of Collaborate&apos;s Analyst Portal, you can create user roles for members to regulate access to Collaborate features using open API. You can assign these role to members while generating API credentials for them. For more information, see <a href="https://techdocs.cyware.com/en/299669-311103-configure-csap-open-api.html#UUID-619438df-5270-99c9-e9e3-627354e346a2_section-idm4602926397864033127945617155" target="_blank">Create Open API Roles</a>.
</p><h2 class="slate-h2 " >Generate Open API Credentials</h2><p class="slate-p " >
Analysts of Collaborate&apos;s Analyst Portal can generate open API credentials for analysts or members to access the open API endpoints.  
They can also assign a role to control and restrict members&apos; access to Collaborate&apos;s features.  
For more information, see <a href="https://techdocs.cyware.com/en/299669-311103-configure-csap-open-api.html#UUID-619438df-5270-99c9-e9e3-627354e346a2_section-idm4602926397864033127945617155" target="_blank">Generate Open API Credentials</a>.</p><h2 class="slate-h2 " >
Mandatory Query Parameters
</h2><p class="slate-p " >To authenticate the API requests made to Collaborate, you must include the following parameters in the query of each API request:</p><ol class="slate-ol " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Access ID</strong>: Indicates the access ID of your Collaborate open API credentials.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Expires</strong>: Indicates the validity of the signature parameter. The signature becomes invalid if not used within the specified expiry duration. You can use the <code class="slate-code">expires = current time + 300 seconds</code> for authentication. You can give a margin of 10 to 15 seconds for expiry.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Signature</strong>: A combination of the access ID, secret key, and expires parameters to authenticate API requests. The signature is hashed using the HMAC-SHA1 algorithm and then encoded using the Base64 scheme.    </div></li></ol><p class="slate-p " >Create a StringToSign value using the <code class="slate-code">StringToSign = access_id + \n + expires</code><em class="slate-italic"> </em>formula.</p><p class="slate-p " >Create a Signature value using the <code class="slate-code">Signature = Base64(HMAC-SHA1(secret_key, UTF-8-Encoding-Of(StringToSign)))</code> formula.</p><p class="slate-p " ></p><h2 class="slate-h2 " >Test API Request Format</h2><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=info ><div class="callout-icon"><svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M10.0628 14.1676C10.2434 14.1676 10.3927 14.1086 10.5107 13.9905C10.6288 13.8725 10.6878 13.7232 10.6878 13.5426V9.77177C10.6878 9.6051 10.6253 9.46274 10.5003 9.34469C10.3753 9.22663 10.2295 9.1676 10.0628 9.1676C9.88227 9.1676 9.73296 9.22663 9.61491 9.34469C9.49685 9.46274 9.43783 9.61205 9.43783 9.7926V13.5634C9.43783 13.7301 9.50033 13.8725 9.62533 13.9905C9.75033 14.1086 9.89616 14.1676 10.0628 14.1676ZM10.0003 7.62594C10.1948 7.62594 10.358 7.56344 10.4899 7.43844C10.6219 7.31344 10.6878 7.15371 10.6878 6.95927C10.6878 6.76482 10.6219 6.59816 10.4899 6.45927C10.358 6.32038 10.1948 6.25094 10.0003 6.25094C9.80588 6.25094 9.64269 6.32038 9.51074 6.45927C9.3788 6.59816 9.31283 6.76482 9.31283 6.95927C9.31283 7.15371 9.3788 7.31344 9.51074 7.43844C9.64269 7.56344 9.80588 7.62594 10.0003 7.62594ZM10.0003 18.3343C8.81977 18.3343 7.72255 18.1225 6.70866 17.6989C5.69477 17.2752 4.81283 16.6884 4.06283 15.9384C3.31283 15.1884 2.72602 14.3065 2.30241 13.2926C1.8788 12.2787 1.66699 11.1815 1.66699 10.0009C1.66699 8.83427 1.8788 7.74399 2.30241 6.7301C2.72602 5.71621 3.31283 4.83427 4.06283 4.08427C4.81283 3.33427 5.69477 2.74399 6.70866 2.31344C7.72255 1.88288 8.81977 1.6676 10.0003 1.6676C11.167 1.6676 12.2573 1.88288 13.2712 2.31344C14.285 2.74399 15.167 3.33427 15.917 4.08427C16.667 4.83427 17.2573 5.71621 17.6878 6.7301C18.1184 7.74399 18.3337 8.83427 18.3337 10.0009C18.3337 11.1815 18.1184 12.2787 17.6878 13.2926C17.2573 14.3065 16.667 15.1884 15.917 15.9384C15.167 16.6884 14.285 17.2752 13.2712 17.6989C12.2573 18.1225 11.167 18.3343 10.0003 18.3343ZM10.0003 17.0843C11.9448 17.0843 13.6114 16.3898 15.0003 15.0009C16.3892 13.612 17.0837 11.9454 17.0837 10.0009C17.0837 8.05649 16.3892 6.38982 15.0003 5.00094C13.6114 3.61205 11.9448 2.9176 10.0003 2.9176C8.05588 2.9176 6.38921 3.61205 5.00033 5.00094C3.61144 6.38982 2.91699 8.05649 2.91699 10.0009C2.91699 11.9454 3.61144 13.612 5.00033 15.0009C6.38921 16.3898 8.05588 17.0843 10.0003 17.0843Z" fill="#3960B4"></path></svg></div><div ><p class="slate-p " >For all PUT and POST Calls being made, the content-type header is mandatory.</p></div></div><p class="slate-p " >You can now make a test API call in the following format using the Access ID, Expires, and Signature values:  
<code class="slate-code">base_url/csap/v1/list_alerts/? Expires=expires_value&amp;AccessID=accessid_value&amp;Signature=signature_value</code>  
Remember to replace <code class="slate-code">base_url</code>, <code class="slate-code">expires_value</code>, <code class="slate-code">accessid_value</code>, and <code class="slate-code">signature_value</code>.

{&quot;content-type&quot;: &quot;application/json&quot;} is to be sent as part of the headers unless specified otherwise.</p><p class="slate-p " >A status code 415 response is given in the case of an invalid content type provided.</p><p class="slate-p " >Use the script in the Pre-request Script section in the right panel to generate the Expires and Signature parameters in Postman.</p><div class="slate-div"></div><p class="slate-p " ></p>


As an analyst user of Collaborate's Analyst Portal, you can create user roles for members to regulate access to Collaborate features using open API. You can assign these role to members while generating API credentials for them. For more information, see 


Analysts of Collaborate's Analyst Portal can generate open API credentials for analysts or members to access the open API endpoints.  
They can also assign a role to control and restrict members' access to Collaborate's features.  
For more information, see 

Signature = Base64(HMAC-SHA1(secret_key, UTF-8-Encoding-Of(StringToSign)))

You can now make a test API call in the following format using the Access ID, Expires, and Signature values:  


base_url/csap/v1/list_alerts/? Expires=expires_value&AccessID=accessid_value&Signature=signature_value

.

{"content-type": "application/json"} is to be sent as part of the headers unless specified otherwise.

A status code 415 response is given in the case of an invalid content type provided.

Use the script in the Pre-request Script section in the right panel to generate the Expires and Signature parameters in Postman.

<p class="slate-p slate-indent-0" style="0px">Collaborate helps you share real-time situational awareness alerts on the latest incidents, breaches, malware, and vulnerabilities to members over email, web, and mobile platforms. For more information, see <a href="https://techdocs.cyware.com/en/299669-322026-alerts.html" target="_blank">Collaborate Alerts Documentation</a>.</p><p class="slate-p " >As a member, you can view and engage with alerts relevant to your organization’s security needs. You can perform the following actions:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Access Alerts</strong>: Receive timely alerts on vulnerabilities, exploits, and security concerns specific to certain products, industries, or organizations, keeping you informed of emerging threats and critical security issues.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Share Feedback</strong>: Provide feedback on alerts directly through the Member Portal, ensuring analysts receive valuable insights to refine and enhance their security updates.</div></li></ul><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=info ><div class="callout-icon"><svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M10.0628 14.1676C10.2434 14.1676 10.3927 14.1086 10.5107 13.9905C10.6288 13.8725 10.6878 13.7232 10.6878 13.5426V9.77177C10.6878 9.6051 10.6253 9.46274 10.5003 9.34469C10.3753 9.22663 10.2295 9.1676 10.0628 9.1676C9.88227 9.1676 9.73296 9.22663 9.61491 9.34469C9.49685 9.46274 9.43783 9.61205 9.43783 9.7926V13.5634C9.43783 13.7301 9.50033 13.8725 9.62533 13.9905C9.75033 14.1086 9.89616 14.1676 10.0628 14.1676ZM10.0003 7.62594C10.1948 7.62594 10.358 7.56344 10.4899 7.43844C10.6219 7.31344 10.6878 7.15371 10.6878 6.95927C10.6878 6.76482 10.6219 6.59816 10.4899 6.45927C10.358 6.32038 10.1948 6.25094 10.0003 6.25094C9.80588 6.25094 9.64269 6.32038 9.51074 6.45927C9.3788 6.59816 9.31283 6.76482 9.31283 6.95927C9.31283 7.15371 9.3788 7.31344 9.51074 7.43844C9.64269 7.56344 9.80588 7.62594 10.0003 7.62594ZM10.0003 18.3343C8.81977 18.3343 7.72255 18.1225 6.70866 17.6989C5.69477 17.2752 4.81283 16.6884 4.06283 15.9384C3.31283 15.1884 2.72602 14.3065 2.30241 13.2926C1.8788 12.2787 1.66699 11.1815 1.66699 10.0009C1.66699 8.83427 1.8788 7.74399 2.30241 6.7301C2.72602 5.71621 3.31283 4.83427 4.06283 4.08427C4.81283 3.33427 5.69477 2.74399 6.70866 2.31344C7.72255 1.88288 8.81977 1.6676 10.0003 1.6676C11.167 1.6676 12.2573 1.88288 13.2712 2.31344C14.285 2.74399 15.167 3.33427 15.917 4.08427C16.667 4.83427 17.2573 5.71621 17.6878 6.7301C18.1184 7.74399 18.3337 8.83427 18.3337 10.0009C18.3337 11.1815 18.1184 12.2787 17.6878 13.2926C17.2573 14.3065 16.667 15.1884 15.917 15.9384C15.167 16.6884 14.285 17.2752 13.2712 17.6989C12.2573 18.1225 11.167 18.3343 10.0003 18.3343ZM10.0003 17.0843C11.9448 17.0843 13.6114 16.3898 15.0003 15.0009C16.3892 13.612 17.0837 11.9454 17.0837 10.0009C17.0837 8.05649 16.3892 6.38982 15.0003 5.00094C13.6114 3.61205 11.9448 2.9176 10.0003 2.9176C8.05588 2.9176 6.38921 3.61205 5.00033 5.00094C3.61144 6.38982 2.91699 8.05649 2.91699 10.0009C2.91699 11.9454 3.61144 13.612 5.00033 15.0009C6.38921 16.3898 8.05588 17.0843 10.0003 17.0843Z" fill="#3960B4"></path></svg></div><div ><p class="slate-p " >As a member, you can access all alert-related data that has been shared with you.</p></div></div><p class="slate-p " ></p>

Collaborate helps you share real-time situational awareness alerts on the latest incidents, breaches, malware, and vulnerabilities to members over email, web, and mobile platforms. For more information, see 

As a member, you can view and engage with alerts relevant to your organization’s security needs. You can perform the following actions:

<p class="slate-p " >Returns a list of alerts from Collaborate.</p>

Returns a list of alerts from Collaborate.

Get Alerts

Pass the status of the alerts to be retrieved. Published alerts are retrieved based on the published time in epoch format. 

status

Pass the start date of the query in epoch format. This represents the earliest timestamp for any alert in the query.

start_time

Pass the end date of the query in epoch format. This represents the latest timestamp for any alert in the query. 

end_time

page_size

page

Pass the category ID to filter alerts. Enter multiple category IDs separated by a comma. You can retrieve `category_id` using the **Get Category List** endpoint. Example, *4bfd32c0,c7012fcc*

category_id

Pass the TLP to filter alerts. Enter multiple TLPs separated by a comma. Example, *GREEN*, *WHITE*.

title

Returns the total number of alerts in the Analyst Portal.

count

Returns the ID, title, status, and published time of the alert.

data

<p class="slate-p " >Returns details of an alert using it&apos;s unique ID. As a member, you can only retrieve published alerts that are shared with you.</p>

Returns details of an alert using it's unique ID. As a member, you can only retrieve published alerts that are shared with you.

Get Alert Details

Pass the 8-digit unique ID of the alert for which you want to retrieve the details. You can retrieve the alert ID using the **Get Alerts** endpoint.

short_id

Returns the 8-digit unique ID of the alert.

content

Returns the list of recipients (both recipient groups and individual recipients) to whom the alert is published.

card_group

Returns the list of individual recipient details to whom the alert is published.


individual_recipients

Returns the list of recipient groups to whom the alert is published.


recipient_groups

Returns the category assigned to the alert.


card_category

Returns the additional details associated with the alert.

card_info

Returns the list of information sources for the alert.


info_source

Returns the image URL with the extension.

card_image

Returns the push notification status of the alert.

push_required

Returns the email notification status of the alert.

push_email_notification

Returns the epoch timestamp of when the alert was published. For draft alerts, the value is null.

published_time

Returns all the optional fields associated with the alert


optional_fields

Returns the indicator details attached to the alert.


indicators

Returns the credibility details associated with the alert.


credibility

Returns the confidence level details of the alert.


confidence

Returns the announcement type details of the alert.


announcement_type

Returns the risk details associated with the alert.


risk

Returns the urgency details of the alert.


urgency

Returns the severity details of the alert.


severity

Returns the priority details of the alert.


priority

Returns the kill chain phase details of the alert.


kill_chain_phase

Returns the likelihood of an exploit for the alert.


exploit_likelihood

Returns the vulnerability details if already being exploited by attackers in the cyber landscape.


exploited_wild

Returns the number of systems affected by the alert.


systemsaffected

Returns the list of threat actors associated with the alert.


threat_actor

Returns the threat methods associated with the alert.


threat_method

Returns the detection methods associated with the alert.


detectionmethod

Returns the list of root causes for the alert.


root_cause

Returns the list of cyber threat methods associated with alert.


cyber_threat_method

Returns the list of physical threat methods associated with the alert.


physical_threat_method

Returns the list of document types associated with the alert.


document_type

Returns the list of vendors associated with the alert.


vendorsnproduct

Returns the list of report sources for the alert.


reportsource

Returns the list of types of vulnerabilities.


vulnerability_type

Returns the list of sources of vulnerabilities.


vulnerability_source

Returns the list of sectors that would be targeted.


targeted_sector

card_tag

Returns a list of parent alerts if the specified `short_id` corresponds to an updated alert.

parent_alerts

Returns a list of child alerts if the specified `short_id` corresponds to an updated alert.

child_alerts

Returns the list of tactic techniques related to the alert.

tactic_technique_pairs_data

Returns the custom fields associated with the category of the alert.

custom_fields

Returns the tracking ID associated with the alert. The tracking ID is used as reference for third-party integrations with Collaborate.

tracking_id

Returns any attachments (ID, file path, and file name) associated with the alert.

Sections