CyberGordon API

Name: CyberGordon API
Brand: CyberGordon API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityThreat Detectionnone5 EndpointsREST

For Agents

Submit an IP, domain, URL, hash, or email to CyberGordon and receive an aggregated reputation report drawn from multiple threat intelligence engines.

Install Jentic One Beta

Connect the CyberGordon API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the CyberGordon API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with CyberGordon API.

Submit a single observable for analysis via GET /request/{observable}

Submit one or more observables via POST /request/form for bulk analysis

Look up request metadata to track which engines are still running via GET /get-request/{requestId}/info

GET STARTED

Start building with CyberGordon API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI specification for CyberGordon API, keeping it validated and agent-ready. CyberGordon is a cyber-reputation aggregator that submits an observable - an IP address, domain, URL, file hash, or email - to multiple security intelligence engines and returns a consolidated risk view. The five endpoints cover analysis submission, request status lookup, results retrieval, and the list of underlying engines. Result data, including suspicious and malicious indicators with links to the original sources, is retained for seven days.

Use Cases

Patterns agents use CyberGordon API for, with concrete tasks.

★ Triage suspicious indicators in security workflows

Send a suspect IP, domain, URL, hash, or email to CyberGordon and receive a consolidated reputation view drawn from engines like IPinfo, AbuseIPDB, VirusTotal, urlscan.io, GreyNoise, and Pulsedive. Analysts use the aggregated suspicious/malicious flags to triage indicators quickly without juggling several individual portals.

Submit IP 1.2.3.4 via /request/{observable}, poll /get-request/{requestId}/info until complete, then return the aggregated malicious-flag count from /results.

Phishing email investigation

When a user reports a phishing email, an automated workflow extracts the sender email, sending IP, and any URLs in the body, and submits each as an observable. The aggregated report makes it clear whether multiple engines already flag the indicators, which lets the analyst close low-quality reports quickly.

POST /request/form with the email's sender domain and the URL extracted from the body, then return malicious counts from the results endpoint.

Bulk indicator enrichment for a SIEM

Enrich a feed of indicators flowing into a SIEM with CyberGordon's consolidated reputation. A scheduled job batches new indicators, calls POST /request/form, and writes the aggregated risk score back to the SIEM event so detection rules can prioritise alerts that multiple engines flag.

Submit 50 observables in one POST /request/form call and return the aggregated suspicious/malicious totals per indicator.

AI agent threat lookup via Jentic

Give an autonomous agent a tool to check whether a URL or IP is known-bad before acting on user input. The agent searches Jentic for 'check the reputation of a URL', loads the schema, polls the request, and returns the aggregated score. CyberGordon requires no authentication, but Jentic still standardises the discovery and execution path.

Through Jentic, submit a URL extracted from chat input and surface a one-line summary of the aggregated CyberGordon results to the user.

Key Endpoints

5 endpoints — jentic publishes the only available openapi specification for cybergordon api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/request/{observable}

Submit a single observable for analysis

POST

/request/form

Submit one or more observables in a single call

GET

/get-request/{requestId}/info

Get request metadata and progress

GET

/get-request/{requestId}/results

Retrieve aggregated analysis results

GET

/assets/json/engine_list.fddb0.json

List the underlying threat intelligence engines

GET

/request/{observable}

Submit a single observable for analysis

POST

/request/form

Submit one or more observables in a single call

GET

/get-request/{requestId}/info

Get request metadata and progress

GET

/get-request/{requestId}/results

Retrieve aggregated analysis results

GET

/assets/json/engine_list.fddb0.json

List the underlying threat intelligence engines

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

The CyberGordon API requires no credentials, but Jentic still routes calls through its execution layer for consistent observability and rate-limit handling, so workflows behave the same as for authenticated APIs.

Intent-based discovery

Agents search by intent (e.g. 'check the reputation of a URL') and Jentic returns the CyberGordon submit and results operations with their parameter schemas, so the agent can run the full submit-poll-fetch flow without reading docs.

Time to first call

Direct CyberGordon integration: a few hours for the submit, poll, and parse loop. Through Jentic: under 30 minutes - search, load, execute.

FAQs

Specific to using CyberGordon API through Jentic.

Why is there no official OpenAPI spec for CyberGordon?

CyberGordon does not publish an OpenAPI specification on its docs site. Jentic generates and maintains this spec so that AI agents and developers can call CyberGordon via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the CyberGordon API use?

The spec defines no security scheme, so the API can be called anonymously, which is useful for read-only reputation lookups. Through Jentic, calls are still routed via the standard search/load/execute flow for consistent observability.

What kinds of observables can CyberGordon analyse?

IP addresses, domains, URLs, file hashes, and email addresses. Submit one observable via GET /request/{observable} or several at once via POST /request/form, then poll the request id for results.

Which threat intelligence engines does CyberGordon aggregate?

CyberGordon pulls from engines including IPinfo, AbuseIPDB, VirusTotal, urlscan.io, Google Safe Browsing, GreyNoise, and Pulsedive. The current live list is exposed via GET /assets/json/engine_list.fddb0.json.

How long are CyberGordon results retained?

Aggregated request results are retained for seven days. Persist any results you need long-term to your own storage, since /get-request/{requestId}/results will stop returning them after the retention window.

How do I check a URL's reputation through Jentic?

Run pip install jentic, search for 'check the reputation of a URL', load the request and results schemas, and execute. Jentic submits the observable, polls /get-request/{requestId}/info, and returns the aggregated results in one flow.