ot-intel-api.onrender.com publishes 30 machine-payable endpoints over the x402 protocol, priced from $0.01 to $0.2 per call. Each was probed directly; the response code below is what it returned.
| Endpoint | Method | Price | Probe |
|---|---|---|---|
| /ot/action-conformance | GET | $0.12 | 402 |
| /ot/actor | GET | $0.03 | 402 |
| /ot/actor/sector | GET | $0.03 | 402 |
| /ot/advisory | GET | $0.02 | 402 |
| /ot/agentic/threat-hunt/control-loop | GET | $0.15 | 402 |
| /ot/ai-exposure | GET | $0.2 | 402 |
| /ot/analyst-brief | GET | $0.12 | 200 |
| /ot/asn | GET | $0.03 | 402 |
| /ot/brief | GET | $0.1 | 402 |
| /ot/campaign | GET | $0.05 | 402 |
| /ot/compliance | GET | $0.04 | 402 |
| /ot/compliance/batch | GET | $0.2 | 402 |
| /ot/cve | GET | $0.02 | 402 |
| /ot/delta | GET | $0.03 | 402 |
| /ot/detection | GET | $0.05 | 402 |
| /ot/device | GET | $0.05 | 402 |
| /ot/exposure | GET | $0.05 | 402 |
| /ot/gcc-bulletin | GET | $0.01 | 402 |
| /ot/ioc | GET | $0.01 | 402 |
| /ot/malware | GET | $0.02 | 402 |
| /ot/mitigation-map | GET | $0.2 | 402 |
| /ot/patch | GET | $0.05 | 402 |
| /ot/physics/invariant-reachability | GET | $0.2 | 402 |
| /ot/precursor-ttp | GET | $0.04 | 402 |
| /ot/sighting/submit | GET | $0.05 | 402 |
| /ot/stix-coverage | GET | $0.2 | 200 |
| /ot/threat-score | GET | $0.04 | 402 |
| /ot/vendor-risk | GET | $0.15 | 402 |
| /ot/vendor-risk-delta | GET | $0.2 | 200 |
| /ot/xai/root-cause-localization | GET | $0.15 | 402 |
Deterministic remediation risk gate. Pass actor, sector, region, planned_action (e.g. block_ip, halt_pipeline, disable_account). Returns auto_approve/human_review/reject via capability x opportunity x…
ICS threat actor profile. Pass ?name=SANDWORM. Returns MITRE ATT&CK ICS techniques, known malware, attribution, physical impact, targeted sectors, and OT detection recommendations. Alias lookup suppor…
ICS threat actors by sector. Pass ?sector=energy. Returns all groups targeting that sector from live MITRE ATT&CK ICS STIX data. Covers energy, water, manufacturing, oil-and-gas, chemical, transportat…
Live CISA ICS-CERT advisories filtered by vendor or sector. Pass ?vendor=siemens or ?sector=energy. Returns advisory IDs, CVSS scores, CVE lists, OT severity, and sector tags. Up to 25 results.
Flags control-loop recon patterns and living-off-the-land/RMM-tool abuse from caller-submitted process/command observations. Pass observed_processes? and/or observed_commands? (comma-separated, max 40…
AI/agentic copilot exposure lookup for OT/ICS vendors. Pass vendor (Siemens, Schneider Electric, Rockwell Automation, ABB, Emerson, Honeywell, Yokogawa, GE Vernova, Omron, Mitsubishi Electric). Return…
Human-readable analyst brief: BLUF, key judgments, and ICD-203 confidence assessment for a threat actor (optionally scoped to a sector). Same fan-out data as /ot/report (actor, campaign, malware, advi…
ICS threat actor ASN infrastructure profiling. Pass ?asn=AS215540. Returns ICS actor associations (SANDWORM, VOLTZITE, XENOTIME), phishing kit links (Tycoon2FA, EvilProxy, NakedPages), bulletproof hos…
Sector threat brief for ICS/OT. Pass ?sector=energy&period=30. Returns active actors, new CVE counts, active campaigns, top advisories, and risk_trend (increasing/stable/decreasing). One call replaces…
Active ICS campaign tracker. Pass ?sector=electric&status=active. Returns campaigns currently targeting a sector with actor attribution, start date, targeted geography, TTPs in use, and CVEs being exp…
Compliance gap mapping for a CVE or threat actor across 11 frameworks: NERC CIP, IEC 62443, NIST 800-82, NIST CSF 2.0, CISA CPG, Saudi NCA OTCC, UAE NESA IA. Pass ?cve_id=CVE-2023-38802 or ?actor=SAND…
Aggregate compliance-gap assessment across multiple CVEs/actors in one call. Pass items=<comma-separated, max 25> (auto-detects CVE vs actor), optional framework=<value>, entity_sector=<ENERGY|WATER|T…
OT-contextualised CVE triage for ICS/SCADA. Pass ?id=CVE-XXXX-XXXX. Returns OT-adjusted severity, cyber-physical impact, patch feasibility, CISA KEV status, and prioritised action. DeepSeek-enriched w…
ICS sector change feed — only what is NEW in the last N days. Pass ?sector=water&days=7. Returns new CVEs, new CISA advisories, and new actor activity since the last call. Designed for cron-based moni…
ICS detection artifact retrieval. Pass ?target=PIPEDREAM or ?target=SANDWORM&format=sigma. Returns YARA/Sigma rules for the target malware or actor, sourced from public corpus (Florian Roth signature-…
ICS/OT device exposure lookup. Pass ?vendor=siemens&model=s7-1200. Returns default credential risk, exposed OT protocols (Modbus/502, S7comm/102, DNP3/20000), exploitation notes, and hardening steps. …
OT asset risk verdict. Pass ?vendor=siemens&model=s7-1500§or=energy&network=internet-facing. Returns risk_score (0-100), risk_level, escalate (boolean), recommended_action, active CVEs, and threat…
Recurring public "State of OT Threat Intel — GCC" sitrep, human-reviewed before publish, sourced from the same intel.db pipeline as /ot/sitrep. Pass optional issue_date (YYYY-MM-DD) for a past edition…
IOC enrichment with ICS campaign context. Pass ?value=1.2.3.4&type=ip or type=domain. Queries AlienVault OTX, AbuseIPDB, and DeepSeek CTI for OT campaign association. Returns verdict on whether the IO…
ICS malware encyclopedia. Pass ?name=PIPEDREAM. Returns capabilities, targeted OT protocols, attributed actor, affected vendors, detection signatures, and MITRE ATT&CK ICS techniques. Covers PIPEDREAM…
Prescriptive D3FEND-mapped mitigation guidance for OT/ICS threats. Pass one of ?actor=<threat actor name>, ?cve_id=<CVE ID>, or ?technique_id=<MITRE ATT&CK ICS technique ID e.g. T0836>, optionally wit…
OT/ICS patch feasibility for a CVE. Pass ?id=CVE-XXXX-XXXX. Returns patch availability, OT-safe workarounds, patch complexity per ICS layer, estimated downtime, safe-to-patch-live flag, deployment str…
Checks whether a tank/vessel reported level change is physically consistent with its metered flow-in/flow-out via conservation of mass. Pass asset_id, flow_in, flow_out, level_start, level_end, dt_sec…
Buckets an actor's known ATT&CK-for-ICS TTPs into pre-impact (reconnaissance through command-and-control — the early-warning window before physical/process disruption) vs impact-stage (inhibit-respons…
Submit an anonymized IOC/TTP sighting observed in your own OT environment. Pass ioc_or_ttp_id, sector, region (actor_name, observed_at optional). Feeds the correlation corpus without storing an org id…