---
title: "Get specific intel item"
method: GET
path: "/api/intel/items/{id}"
tags: ["Intel"]
---

# Get specific intel item

`GET /api/intel/items/{id}`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/intel/items/{id}`
- Auth: HTTP bearer

Retrieves detailed information for a specific threat intelligence item by its ID

## Path parameters

- `id` string, required

## Response `200`

Successful response

- object: Backwards-compatible intel item for read/API responses (tolerates legacy stored shapes).
  - `id` string, required
  - `externalId` string
  - `source` object, required
    - `url` string, uri, required
    - `name` string
    - `publisher` string, required
    - `publishTime` string, required
    - `tlp` 'CLEAR' | 'GREEN' | 'AMBER' | 'AMBER+STRICT' | 'RED'
    - `license` string
    - `language` string, required
  - `event` object, required
    - `title` string, required
    - `eventFirstSeen` string
    - `eventLastSeen` string
    - `severity` 'none' | 'low' | 'medium' | 'high' | 'critical', required
    - `confidence` number, required
    - `status` 'active' | 'corrected' | 'retracted', required
  - `summary` string, required
  - `abstract` string
  - `tldr` string, required
  - `attackPath` string[], required
  - `classification` object, required: Classification including ATT&CK mapping, kill chain phases, actors, malware, and platforms.
    - `attack` object[], required
      - `technique` string
      - `subTechnique` string: Sub-technique ID when applicable (e.g., T1059.001).
      - `techniqueName` string: Resolved human-readable technique name. Omit when unknown.
      - `confidence` number
      - `evidenceRef` string: Optional reference to supporting evidence (e.g., passage index or quote id).
    - `killChain` string[], required: Relevant kill chain phases demonstrated in the content. Return [] when not evidenced.
    - `malware` object[], required
      - `name` string, required: Malware family/tool name.
      - `confidence` number
      - `aliases` string[]: Known aliases for the malware family/tool.
    - `actor` object[], required
      - `name` string, required: Threat actor/group name.
      - `confidence` number
      - `aliases` string[]: Known aliases for the actor/group.
    - `platforms` string[], required: Affected platforms/environments. Return [] when not stated.
    - `mappings` object[], required: Mappings to other frameworks (e.g., NIST, CIS). Return [] when not applicable.
      - `framework` string, required: Framework name (e.g., NIST, CIS).
      - `id` string, required: Framework control/technique identifier.
      - `confidence` number: Optional confidence in mapping in [0,1].
  - `affectedProducts` object[], required
    - `vendor` string
    - `product` string
    - `versions` string[], required
    - `fixedVersions` string[], required: Minimum patched/secure versions of this product that remediate the issue, one per supported release line (e.g. ["16.3.6"] or ["15.5.10", "16.3.6"]). Only versions the source states as fixed; never guess. Use [] when the source names no fixed version.
    - `confidence` number: Optional confidence in product impact in [0,1].
  - `iocs` object, required: Grouped IOCs (read-tolerant).
    - `ipv4` object[]
      - `type` string
      - `value` string, required: Indicator value string as observed.
      - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot).
      - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown.
      - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown.
      - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown.
      - `status` 'active' | 'revoked' | 'superseded' | 'expired'
      - `confidence` number
      - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'.
    - `ipv6` object[]
      - `type` string
      - `value` string, required: Indicator value string as observed.
      - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot).
      - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown.
      - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown.
      - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown.
      - `status` 'active' | 'revoked' | 'superseded' | 'expired'
      - `confidence` number
      - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'.
    - `domains` object[]
      - `type` string
      - `value` string, required: Indicator value string as observed.
      - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot).
      - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown.
      - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown.
      - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown.
      - `status` 'active' | 'revoked' | 'superseded' | 'expired'
      - `confidence` number
      - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'.
    - `urls` object[]
      - `type` string
      - `value` string, required: Indicator value string as observed.
      - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot).
      - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown.
      - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown.
      - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown.
      - `status` 'active' | 'revoked' | 'superseded' | 'expired'
      - `confidence` number
      - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'.
    - `hashes` object[]
      - `type` string
      - `value` string, required: Indicator value string as observed.
      - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot).
      - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown.
      - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown.
      - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown.
      - `status` 'active' | 'revoked' | 'superseded' | 'expired'
      - `confidence` number
      - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'.
    - `files` object[]
      - `type` string
      - `value` string, required: Indicator value string as observed.
      - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot).
      - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown.
      - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown.
      - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown.
      - `status` 'active' | 'revoked' | 'superseded' | 'expired'
      - `confidence` number
      - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'.
    - `registryKeys` object[]
      - `type` string
      - `value` string, required: Indicator value string as observed.
      - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot).
      - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown.
      - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown.
      - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown.
      - `status` 'active' | 'revoked' | 'superseded' | 'expired'
      - `confidence` number
      - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'.
    - `processes` object[]
      - `type` string
      - `value` string, required: Indicator value string as observed.
      - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot).
      - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown.
      - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown.
      - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown.
      - `status` 'active' | 'revoked' | 'superseded' | 'expired'
      - `confidence` number
      - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'.
    - `certs` object[]
      - `type` string
      - `value` string, required: Indicator value string as observed.
      - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot).
      - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown.
      - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown.
      - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown.
      - `status` 'active' | 'revoked' | 'superseded' | 'expired'
      - `confidence` number
      - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'.
    - `cloudIds` object[]
      - `type` string
      - `value` string, required: Indicator value string as observed.
      - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot).
      - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown.
      - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown.
      - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown.
      - `status` 'active' | 'revoked' | 'superseded' | 'expired'
      - `confidence` number
      - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'.
    - `mobileIds` object[]
      - `type` string
      - `value` string, required: Indicator value string as observed.
      - `normalizedValue` string: Optional normalized form (e.g., lowercase domain without trailing dot).
      - `firstSeen` string: ISO-8601 timestamp when IOC was first observed. Omit when unknown.
      - `lastSeen` string: ISO-8601 timestamp when IOC was last observed. Omit when unknown.
      - `ttlDays` number: Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown.
      - `status` 'active' | 'revoked' | 'superseded' | 'expired'
      - `confidence` number
      - `indicatorRole` 'compromise' | 'relevance' | 'reference': 'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'.
  - `provenance` object, required: Provenance information tying claims to exact sources/passages.
    - `supportingPassages` object[], required: Evidence snippets grounding technical claims and mappings. Use [] when no precise evidence exists.
      - `text` string, required: Exact quoted text supporting a technical claim. Do not paraphrase.
      - `sourceUrl` string, uri: Optional URL if the passage is from a different source.
      - `charSpan` object: Character span for the quoted passage within the analyzed content.
        - `start` number, required: Start character offset (inclusive) of quoted span within content.
        - `end` number, required: End character offset (exclusive) of quoted span within the analyzed content.
  - `version` integer, required
  - `lastUpdated` string
  - `createdAt` string
  - `addedToFeedAt` string
  - `canonicalKey` string
  - `duplicateOf` string
  - `tenantOverrides` unknown

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)