{
  "aid": "misp-project.org:main-2.5",
  "name": "MISP Automation API",
  "type": "Index",
  "description": "\n### Getting Started\n\nMISP API allows you to query, create, modify data models, such as [Events](https://www.circl.lu/doc/misp/GLOSSARY.html#misp-event),\n[Objects](https://www.circl.lu/doc/misp/misp-objects/), [Attributes](https://www.circl.lu/doc/misp/GLOSSARY.html#misp-attribute).\nThis is extremely useful for interconnecting MISP with external tools and feeding other systems with threat intel data.\n\nIt also lets you perform administrative tasks such as creating users, organisations, altering MISP settings, and much more.\n\nTo get an API key there are several options:\n* **[UI]** Go to [My Profile -> Auth Keys](/auth_keys/index) section and click on `+ Add authentication key`\n\n* **[UI]** As an admin go to the [Administration -> List Users -> View](/admin/users/view/[id]) page of the user you want to create an auth key for and on the `Auth keys` section click on `+ Add authentication key`\n\n* **[CLI]** Use the following command: `./app/Console/cake user change_authkey [e-mail/user_id]`\n\n* **API** Provided you already have an admin level API key, you can create an API key for another user using the `[POST]/auth_keys/add/{{user_id}}` endpoint.\n\n> **NOTE:** The authentication key will only be displayed once, so take note of it or store it properly in your application secrets.\n\n#### Accept and Content-Type headers \nWhen performing your request, depending on the type of request, you might need to explicitly specify in what content \ntype you want to get your results. This is done by setting one of the below `Accept` headers:\n\n    Accept: application/json\n    Accept: application/xml\n\nWhen submitting data in a `POST`, `PUT` or `DELETE` operation you also need to specify in what content-type you encoded the payload. \nThis is done by setting one of the below `Content-Type` headers:\n\n    Content-Type: application/json\n    Content-Type: application/xml\n\nExample:\n```\ncurl  --header \"Authorization: YOUR_API_KEY\" \\\n      --header \"Accept: application/json\" \\\n      --header \"Content-Type: application/json\" https://<misp url>/ \n```\n\n> **NOTE**: By appending .json or .xml the content type can also be set without the need for a header.\n\n#### Automation using PyMISP\n\n[PyMISP](https://github.com/MISP/PyMISP) is a Python library to access MISP platforms via their REST [API](https://www.circl.lu/doc/misp/GLOSSARY.html#api).\nIt allows you to fetch events, add or update events/attributes, add or update samples or search for attributes.\n\n### FAQ\n* [Dev FAQ](https://www.circl.lu/doc/misp/dev-faq/)\n* [GitHub project FAQ](https://github.com/MISP/MISP/wiki/Frequently-Asked-Questions)\n",
  "url": "https://raw.githubusercontent.com/jentic/jentic-public-apis/refs/heads/main/apis/openapi/misp-project.org/main/2.5/apis.json",
  "tags": [
    "misp-project.org",
    "main"
  ],
  "created": "2026-04-11",
  "modified": "2026-04-11",
  "specificationVersion": "0.19",
  "access": "3rd-Party",
  "maintainers": [
    {
      "FN": "Jentic",
      "X-github": "jentic",
      "url": "https://github.com/jentic"
    }
  ],
  "apis": [
    {
      "aid": "misp-project.org:main-2.5",
      "name": "MISP Automation API",
      "description": "\n### Getting Started\n\nMISP API allows you to query, create, modify data models, such as [Events](https://www.circl.lu/doc/misp/GLOSSARY.html#misp-event),\n[Objects](https://www.circl.lu/doc/misp/misp-objects/), [Attributes](https://www.circl.lu/doc/misp/GLOSSARY.html#misp-attribute).\nThis is extremely useful for interconnecting MISP with external tools and feeding other systems with threat intel data.\n\nIt also lets you perform administrative tasks such as creating users, organisations, altering MISP settings, and much more.\n\nTo get an API key there are several options:\n* **[UI]** Go to [My Profile -> Auth Keys](/auth_keys/index) section and click on `+ Add authentication key`\n\n* **[UI]** As an admin go to the [Administration -> List Users -> View](/admin/users/view/[id]) page of the user you want to create an auth key for and on the `Auth keys` section click on `+ Add authentication key`\n\n* **[CLI]** Use the following command: `./app/Console/cake user change_authkey [e-mail/user_id]`\n\n* **API** Provided you already have an admin level API key, you can create an API key for another user using the `[POST]/auth_keys/add/{{user_id}}` endpoint.\n\n> **NOTE:** The authentication key will only be displayed once, so take note of it or store it properly in your application secrets.\n\n#### Accept and Content-Type headers \nWhen performing your request, depending on the type of request, you might need to explicitly specify in what content \ntype you want to get your results. This is done by setting one of the below `Accept` headers:\n\n    Accept: application/json\n    Accept: application/xml\n\nWhen submitting data in a `POST`, `PUT` or `DELETE` operation you also need to specify in what content-type you encoded the payload. \nThis is done by setting one of the below `Content-Type` headers:\n\n    Content-Type: application/json\n    Content-Type: application/xml\n\nExample:\n```\ncurl  --header \"Authorization: YOUR_API_KEY\" \\\n      --header \"Accept: application/json\" \\\n      --header \"Content-Type: application/json\" https://<misp url>/ \n```\n\n> **NOTE**: By appending .json or .xml the content type can also be set without the need for a header.\n\n#### Automation using PyMISP\n\n[PyMISP](https://github.com/MISP/PyMISP) is a Python library to access MISP platforms via their REST [API](https://www.circl.lu/doc/misp/GLOSSARY.html#api).\nIt allows you to fetch events, add or update events/attributes, add or update samples or search for attributes.\n\n### FAQ\n* [Dev FAQ](https://www.circl.lu/doc/misp/dev-faq/)\n* [GitHub project FAQ](https://github.com/MISP/MISP/wiki/Frequently-Asked-Questions)\n",
      "image": "",
      "baseURL": "https://misp.local",
      "humanURL": "https://github.com/jentic/jentic-public-apis/tree/main/apis/openapi/misp-project.org/main/2.5",
      "version": "2.5",
      "tags": [
        "misp-project.org",
        "main"
      ],
      "properties": [
        {
          "type": "OpenAPI",
          "name": "OpenAPI definition",
          "url": "https://raw.githubusercontent.com/jentic/jentic-public-apis/refs/heads/main/apis/openapi/misp-project.org/main/2.5/openapi.json",
          "mediaType": "application/openapi+json"
        },
        {
          "type": "GitHubRepo",
          "url": "https://github.com/jentic/jentic-public-apis/tree/main/apis/openapi/misp-project.org/main/2.5"
        }
      ]
    }
  ]
}