canonical: https://jentic.com/apis/ctftime.org/ctftime # CTFtime API The CTFtime API exposes the public CTF (Capture The Flag) competition data hosted at ctftime.org, including team rankings, event calendars, event results, and community votes. Endpoints return the top teams overall, the top teams within a country, lists of past and upcoming CTF events, details for a specific event or team, and per-year results and votes. The API is read-only and unauthenticated, designed for data analysis dashboards and mobile applications that surface upcoming CTFs and historical performance. ## For AI agents Read top CTF team rankings, upcoming and past competition events, and per-year results from CTFtime. Useful for agents that recommend CTFs to play or build security training dashboards. ## Scope Does not handle CTF challenge content, scoring infrastructure, or vulnerability disclosure - use for CTFtime team rankings, event listings, and results only. ## Capabilities - Pull the current year's top CTF teams via /top/ for ranking widgets - Retrieve top teams for a specific year via `/top/{year}`/ for historical analysis - List top teams filtered by country code via `/top-by-country/{countryCode}`/ - List past and upcoming CTF events with metadata via /events/ - Fetch full details for a single CTF event including format and weight via `/events/{eventId}`/ - Pull per-year event results and community votes for trend analysis ## Use cases ### Upcoming CTF Event Discovery Bot A Discord or Slack bot for a security team can poll the CTFtime events feed each morning and post a digest of upcoming competitions, weighted by event rating. Calls to GET /events/ return start and end times, format, weight, and registration links so the bot can rank events by quality and surface only those that match the team's level. The API is unauthenticated, which keeps the integration trivial. Example prompt: Call GET /events/ with limit=20 and start filtered to the next 30 days, then post a ranked summary of events with weight above 30 to the team channel. ### Team Ranking Dashboard A security training platform can show students how their team performs against the global CTFtime leaderboard. The /top/ and `/top-by-country/{countryCode}`/ endpoints return ranked teams with point totals so the dashboard can render world rank, country rank, and yearly progression. Pair with `/top/{year}`/ to plot historical movement and motivate continued participation. Example prompt: Call GET /top/ with limit=100 and GET `/top-by-country/DE`/ with limit=10 and merge the responses into a single dashboard payload. ### CTF Event Performance Analytics A security researcher analysing the competitive CTF scene can pull yearly results via `/results/{year}`/ and votes via `/votes/{year}`/ to study event quality trends, organiser reputation, and team performance. The structured JSON makes it straightforward to load the data into a notebook or warehouse for longitudinal analysis. Example prompt: Call GET `/results/2024`/ and GET `/votes/2024`/ and join them on event ID to compute average vote score per event organiser. ### AI Agent Integration via Jentic An AI assistant for a CTF team can use Jentic to discover the CTFtime operations rather than hand-coding HTTP calls. The agent searches for an intent like 'list upcoming CTF events', loads the /events/ schema, and runs the call without managing endpoints. Because the API is unauthenticated, integration through Jentic is essentially zero-config. Example prompt: Use Jentic search for 'list upcoming CTF events' and execute the matching ctftime.org operation, returning the next ten events to the user. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | `/top/` | Get current year's top teams | | GET | `/top/{year}/` | Get top teams for a specific year | | GET | `/top-by-country/{countryCode}/` | Get top teams by country | | GET | `/events/` | List past and upcoming CTF events | | GET | `/events/{eventId}/` | Get details for a specific CTF event | | GET | `/teams/{teamId}/` | Get details for a specific team | | GET | `/results/{year}/` | Get event results for a specific year | | GET | `/votes/{year}/` | Get event votes for a specific year | ## Key resources - **Top Teams** — Global and per-country team rankings for the current or a specified year. - **Events** — Past and upcoming CTF event listings and per-event details. - **Teams** — Per-team profile and rating information. - **Results and Votes** — Yearly results and community votes for ranked events. ## Why Jentic - **Setup:** Wiring the CTFtime API by hand still means learning its ctftime.org/api/v1 routes, handling retries, and respecting rate limits yourself even though it is unauthenticated. Through Jentic you install once, import the CTFtime API from the API Directory, and your agent calls it with consistent logging and retry handling. - **Permission scoping:** The CTFtime API is read-only and unauthenticated, with year, country, team, or event selected in the URL path, so limit the agent to the operations it needs, such as listing events or reading team rankings. You choose which of those read operations are in scope. - **Credential handling:** The CTFtime API is unauthenticated, so there is no credential to store. Jentic still routes the call through your own Jentic One instance so logging, retries, and rate-limit handling stay consistent with your other tools. - **Discovery method:** Agents search Jentic by intent such as 'list upcoming CTF events' or 'get team rankings', and Jentic returns the matching CTFtime operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **HackerOne API** — HackerOne complements CTFtime by tracking real bug bounty work alongside CTF training history. - **GitHub REST API** — GitHub stores the writeups and challenge repos that CTFtime events reference. - **Wayback Machine API** — Wayback Machine recovers archived snapshots of past CTF event pages when originals go offline. ## FAQ ### What authentication does the CTFtime API use? The CTFtime API is fully public and requires no authentication, so requests can be made without an API key or token. Through Jentic the call is still routed through your Jentic One instance so an agent gets a consistent execution surface across authenticated and public APIs. ### Can I list upcoming CTF events with the CTFtime API? Yes. Call GET /events/ with a limit and start parameter to retrieve upcoming and past CTF events, including format, weight, and registration URLs. Filter the response by start time to surface only events still ahead of today. ### What are the rate limits for the CTFtime API? CTFtime asks consumers to use the API for data analysis and mobile applications and to cache responses, but specific rate limits are not published in the OpenAPI spec. Cache event and ranking responses for at least an hour to stay polite. ### How do I read top CTF teams by country with the CTFtime API through Jentic? Install the SDK with pip install jentic, search Jentic for 'top CTF teams by country', load the schema for the `/top-by-country/{countryCode}`/ operation, and execute it with a country code such as US or DE. Jentic handles the path parameter and returns the ranked teams as JSON. ### How do I get details for a specific CTF event? Use GET `/events/{eventId}`/ with the numeric event ID returned from the /events/ listing. The response includes the event title, format, weight, organisers, and start and finish timestamps you need to render an event page. ### Is the CTFtime API free? Yes. CTFtime publishes the API for free with the expectation that it is used for data analysis and mobile applications, not for re-publishing the dataset. Always credit ctftime.org when surfacing the data in a product. ### Can I limit what my agent is allowed to do with the CTFtime API? Yes. Because you run Jentic One yourself, your own rules decide which CTFtime operations the agent may call, so you can allow it to list events with GET /events/ and read team rankings with GET /top/ while excluding per-year results or votes it does not need. The CTFtime API is read-only and unauthenticated, with the year, country, team, or event chosen in the URL path, so scoping is a matter of restricting the agent to just those read operations you approve. There is no credential to hand over, and every call still runs through your own instance for consistent logging.