canonical: https://jentic.com/apis/cycat.org/cycat

# CyCAT.org API

CyCAT.org is the open Cybersecurity Resource Catalogue, a public index that links projects, tools, publishers, and the relationships between them. The API exposes 14 read-only endpoints for resolving CyCAT UUIDs, walking parent and child relationships, searching the catalogue, and proposing new entries. It is built for SOC analysts, threat intelligence engineers, and AI agents that need to map third-party tooling and publisher provenance.

## For AI agents

Look up cybersecurity tools, publishers, and projects in the CyCAT catalogue and walk relationships between entities for threat intel and tooling research.

## Scope

Does not handle vulnerability scanning, malware analysis, or live threat feeds - use for cybersecurity tool, publisher, and project catalogue lookups only.

## Capabilities

- Resolve a CyCAT UUID to its canonical record with GET `/lookup/{uuid}`
- Walk parent and child relationships between cybersecurity entities for provenance mapping
- Search the CyCAT catalogue by free-text query for projects, publishers, and tools
- List projects or publishers in paginated ranges for bulk indexing
- Resolve a namespace identifier to its CyCAT UUID for cross-reference with external sources
- Propose a new entry to CyCAT for community catalogue contributions

## Use cases

### Threat Intel Tool Provenance

When a threat intel analyst encounters a new defensive tool referenced in a report, they resolve the tool's CyCAT UUID and walk its relationships to identify the publisher, parent project, and any child forks. CyCAT's GET `/lookup/{uuid}` and `/parent/{uuid}` endpoints return that lineage in two calls, so the analyst can attribute the tool without manually crawling vendor websites.

Example prompt: Call GET `/lookup/{uuid}` for the supplied CyCAT UUID, then call GET `/parent/{uuid}` and summarise publisher and parent project.

### Catalogue Mirror for Internal Wiki

Security engineering teams that maintain an internal tooling wiki paginate through CyCAT's project and publisher lists to populate a local mirror. `/list/project/{start}/{end}` and `/list/publisher/{start}/{end}` return ordered slices, so a scheduled agent can incrementally sync new entries without re-fetching the full catalogue.

Example prompt: Loop GET `/list/project/0/100`, `/list/project/100/200` ... and write each project's UUID and metadata to a local index until the response is empty.

### Cross-Reference With External Frameworks

A SOC tooling team that already references MITRE ATT&CK or vendor namespace IDs uses `/namespace/getid/{namespace}` and `/namespace/finduuid` to translate those external identifiers into CyCAT UUIDs. This lets them join CyCAT's relationship graph onto their existing detection engineering inventory without manual mapping.

Example prompt: Given namespace 'mitre-attack' and namespace ID 'T1566', call GET `/namespace/finduuid/mitre-attack/T1566` and return the CyCAT UUID.

### Agent-Assisted Catalogue Contribution

An AI agent reviewing a newly released open-source security tool drafts a CyCAT proposal by calling GET `/generate/uuid` for a candidate identifier and POST /propose with the tool metadata. A human curator reviews the proposal before it is merged, with the agent removing the friction of writing the JSON payload by hand.

Example prompt: Call GET `/generate/uuid`, then POST /propose with the new UUID, tool name, publisher, and source URL extracted from a GitHub README.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/lookup/{uuid}` | Resolve a CyCAT UUID to its record |
| GET | `/search/{searchquery}` | Free-text catalogue search |
| GET | `/parent/{uuid}` | Get the parent of a CyCAT entity |
| GET | `/child/{uuid}` | Get the children of a CyCAT entity |
| GET | `/relationships/expanded/{uuid}` | Expanded relationship graph |
| GET | `/namespace/finduuid/{namespace}/{namespaceid}` | Resolve namespace to UUID |
| POST | `/propose` | Propose a new catalogue entry |

## Key resources

- **Lookup** — UUID-based record resolution and parent/child traversal
- **Search** — Free-text catalogue search
- **Namespaces** — Cross-reference between external IDs and CyCAT UUIDs
- **Lists** — Paginated listings of projects and publishers
- **Propose** — Submit new candidate entries

## Why Jentic

- **Setup:** Wiring the CyCAT.org API by hand means targeting its host, mapping its lookup, search, and relationship routes, and parsing the catalogue responses yourself. Through Jentic you install once, import the CyCAT.org API from the API Directory, and your agent calls it even though the API itself needs no credential.
- **Permission scoping:** CyCAT.org puts the item uuid in the URL path (`/lookup/{uuid}`, `/parent/{uuid}`), so a rule can pin your agent to reading a specific catalogue item and its relationships. You choose the operations it may call, so proposing new entries is not included unless you add it.
- **Credential handling:** CyCAT.org needs no credential, so none is stored, and Jentic still routes the call through your own Jentic One instance at execution time. Nothing sensitive enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'look up a cybersecurity tool' or 'walk catalogue relationships', and Jentic returns the matching CyCAT.org operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Shodan API** — Internet-exposure scan data that pairs with CyCAT tool metadata for full attack-surface context.
- **MISP API** — Threat-intelligence sharing platform with a richer indicator-of-compromise graph but lacking CyCAT's tool/publisher focus.
- **AbuseIPDB API** — IP reputation data that pairs with CyCAT's tool and publisher catalogue for incident triage.

## FAQ

### What authentication does the CyCAT.org API use?

The CyCAT.org API is unauthenticated for read operations. The OpenAPI spec declares no security schemes, so GET endpoints can be called directly against api.cycat.org. Through Jentic the agent simply executes the operation; no credentials are stored or injected.

### Can I look up a cybersecurity tool by its CyCAT UUID?

Yes. GET `/lookup/{uuid}` returns the canonical record for a CyCAT UUID, and GET `/parent/{uuid}` and `/child/{uuid}` let you walk the entity graph to identify the parent project and any forks or sub-projects.

### What are the rate limits for the CyCAT.org API?

The OpenAPI spec does not document explicit rate limits. CyCAT is operated as a community service, so treat sustained traffic above a few requests per second as inappropriate and stagger bulk catalogue mirrors across longer time windows.

### How do I search the CyCAT catalogue through Jentic?

Install pip install jentic and run an agent with the search query 'search the CyCAT cybersecurity catalogue'. Jentic returns the GET `/search/{searchquery}` operation with its input schema so the agent can call it with a free-text query like 'crowdstrike' and parse the matching catalogue entries.

### Can I add a new tool to CyCAT through the API?

Yes. POST /propose accepts a candidate entry that is reviewed by a human curator before being merged into the catalogue. Use GET `/generate/uuid` first to get a fresh UUID for the proposal, then submit the metadata.

### Is the CyCAT.org API free?

Yes. CyCAT.org is an open community catalogue and the public API is free to use. There is no paid tier or API key required for read access.

### Can I limit what my agent is allowed to do with the CyCAT.org API?

Yes. Because you run Jentic One yourself, your own rules decide which CyCAT.org operations and which entities your agent may touch. CyCAT.org carries the item UUID in the URL path, as in GET `/lookup/{uuid}` and GET `/parent/{uuid}`, so you can pin the agent to reading a specific catalogue item and walking its relationships. Since you pick the allowed operations, write actions like POST /propose stay excluded unless you add them.