{
  "openapi": "3.1.0",
  "info": {
    "title": "Runtime Rebel Threat Intelligence API",
    "version": "1.0.0",
    "summary": "Aggregated threat-intelligence metrics derived from the Runtime Rebel article corpus.",
    "description": "A single public, read-only endpoint publishing the threat metrics that drive the site's own dashboards: global threat level, a rolling severity distribution, the most-referenced CVEs, category activity, campaigns, threat actors and affected vendors.\n\nThe payload is regenerated by the ingestion pipeline every 8 hours and is the same document `/threats` renders, so it is derived data rather than a separate source of truth. No authentication, no rate limit beyond the CDN's, and CORS is open — everything here is already visible in the HTML of `/threats`.\n\nThis file is served as a static document. It is hand-maintained alongside the endpoint and pinned to it by `tests/test_api_catalog.py`, which fails if the two drift.",
    "license": {
      "name": "CC BY 4.0",
      "url": "https://creativecommons.org/licenses/by/4.0/"
    },
    "contact": {
      "name": "Runtime Rebel",
      "url": "https://runtimerebel.com/contact"
    }
  },
  "servers": [
    {
      "url": "https://runtimerebel.com",
      "description": "Production"
    }
  ],
  "externalDocs": {
    "description": "Human-readable API documentation",
    "url": "https://runtimerebel.com/api-docs"
  },
  "paths": {
    "/api/threat-intel.json": {
      "get": {
        "operationId": "getThreatIntel",
        "summary": "Current threat-intelligence metrics",
        "description": "Returns the full metrics document. Regenerated every 8 hours; `lastUpdated` carries the generation time. Attribution to runtimerebel.com is required under CC BY 4.0.",
        "tags": ["threat-intelligence"],
        "responses": {
          "200": {
            "description": "The current metrics document.",
            "content": {
              "application/json": {
                "schema": { "$ref": "#/components/schemas/ThreatIntel" }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "ThreatIntel": {
        "type": "object",
        "required": [
          "globalThreatLevel",
          "globalThreatLevelSubtext",
          "lastUpdated",
          "severityWindowDays",
          "severityCounts",
          "topCves",
          "threatCategories",
          "activeCampaigns",
          "topThreatActors",
          "hotVendors"
        ],
        "properties": {
          "globalThreatLevel": {
            "type": "string",
            "description": "Overall threat level derived from the severity distribution.",
            "examples": ["High"]
          },
          "globalThreatLevelSubtext": {
            "type": "string",
            "description": "One-line explanation of the current level.",
            "examples": ["Critical threats actively exploited"]
          },
          "lastUpdated": {
            "type": "string",
            "format": "date-time",
            "description": "ISO 8601 timestamp of the last pipeline regeneration.",
            "examples": ["2026-08-07T02:15:19.154098+00:00"]
          },
          "severityWindowDays": {
            "type": "integer",
            "description": "Rolling window, in days, that severityCounts is computed over.",
            "examples": [30]
          },
          "severityCounts": { "$ref": "#/components/schemas/SeverityCounts" },
          "topCves": {
            "type": "array",
            "description": "Most-referenced CVEs across the corpus.",
            "items": { "$ref": "#/components/schemas/Cve" }
          },
          "threatCategories": {
            "type": "array",
            "description": "Per-category activity levels.",
            "items": { "$ref": "#/components/schemas/ThreatCategory" }
          },
          "activeCampaigns": {
            "type": "array",
            "description": "Campaigns currently being tracked.",
            "items": { "$ref": "#/components/schemas/Campaign" }
          },
          "topThreatActors": {
            "type": "array",
            "description": "Most-mentioned threat actors.",
            "items": { "$ref": "#/components/schemas/ThreatActor" }
          },
          "hotVendors": {
            "type": "array",
            "description": "Vendors appearing most often in recent coverage.",
            "items": { "$ref": "#/components/schemas/Vendor" }
          },
          "_meta": { "$ref": "#/components/schemas/Meta" }
        }
      },
      "SeverityCounts": {
        "type": "object",
        "description": "Article counts by severity within severityWindowDays.",
        "required": ["critical", "high", "medium", "low", "info"],
        "properties": {
          "critical": { "type": "integer", "minimum": 0 },
          "high": { "type": "integer", "minimum": 0 },
          "medium": { "type": "integer", "minimum": 0 },
          "low": { "type": "integer", "minimum": 0 },
          "info": { "type": "integer", "minimum": 0 }
        }
      },
      "Cve": {
        "type": "object",
        "required": ["id"],
        "properties": {
          "id": {
            "type": "string",
            "pattern": "^CVE-[0-9]{4}-[0-9]+$",
            "examples": ["CVE-2026-59726"]
          },
          "description": { "type": "string" },
          "score": {
            "type": "number",
            "minimum": 0,
            "maximum": 10,
            "description": "CVSS base score where one is known.",
            "examples": [10.0]
          }
        }
      },
      "ThreatCategory": {
        "type": "object",
        "required": ["label", "level"],
        "properties": {
          "label": { "type": "string", "examples": ["Supply Chain"] },
          "level": {
            "type": "integer",
            "minimum": 0,
            "maximum": 100,
            "description": "Relative activity level, 0-100."
          },
          "color": {
            "type": "string",
            "description": "Tailwind class used by the site's own dashboard. Presentational; consumers should ignore it.",
            "examples": ["bg-yellow-500"]
          }
        }
      },
      "Campaign": {
        "type": "object",
        "required": ["name"],
        "properties": {
          "name": { "type": "string", "examples": ["Lazarus Group activity"] },
          "type": { "type": "string", "examples": ["Threat Intel"] },
          "status": { "type": "string", "examples": ["Reported"] },
          "severity": { "$ref": "#/components/schemas/Severity" }
        }
      },
      "ThreatActor": {
        "type": "object",
        "required": ["name"],
        "properties": {
          "name": { "type": "string", "examples": ["APT28"] },
          "attribution": {
            "type": "string",
            "description": "Reported country or bloc of origin, as attributed by the cited sources.",
            "examples": ["Russia"]
          },
          "mentions": { "type": "integer", "minimum": 0 }
        }
      },
      "Vendor": {
        "type": "object",
        "required": ["name"],
        "properties": {
          "name": { "type": "string", "examples": ["Microsoft"] },
          "count": { "type": "integer", "minimum": 0 }
        }
      },
      "Severity": {
        "type": "string",
        "description": "The site's single severity vocabulary.",
        "enum": ["critical", "high", "medium", "low", "info"]
      },
      "Meta": {
        "type": "object",
        "description": "Provenance block appended by the endpoint itself.",
        "properties": {
          "source": { "type": "string", "format": "uri" },
          "documentation": { "type": "string", "format": "uri" },
          "licence": { "type": "string" },
          "updated": { "type": "string" }
        }
      }
    }
  },
  "tags": [
    {
      "name": "threat-intelligence",
      "description": "Aggregated metrics derived from the published article corpus."
    }
  ]
}