{
  "openapi": "3.0.3",
  "info": {
    "title": "Threat Intel Gateway API",
    "description": "Real-time IP threat intelligence scoring and threat feed export API. Aggregates data from 18 independent threat intelligence sources.",
    "version": "1.0.0",
    "contact": {
      "name": "Furkan Danis",
      "url": "https://furkandanis.com"
    }
  },
  "servers": [
    {
      "url": "https://threatintel.furkandanis.com/api/v1"
    }
  ],
  "paths": {
    "/check": {
      "get": {
        "summary": "IP Reputation Check",
        "description": "Look up threat reputation of an IP address. Returns weighted score from up to 18 threat intelligence sources.",
        "parameters": [
          {
            "name": "ip",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "IPv4 or IPv6 address"
          },
          {
            "name": "key",
            "in": "query",
            "schema": {
              "type": "string"
            },
            "description": "API key (alternative to X-API-Key header)"
          }
        ],
        "responses": {
          "200": {
            "description": "Reputation result",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "ok": {
                      "type": "boolean"
                    },
                    "ip": {
                      "type": "string"
                    },
                    "score": {
                      "type": "integer",
                      "minimum": 0,
                      "maximum": 100
                    },
                    "threatLevel": {
                      "type": "integer",
                      "enum": [
                        0,
                        1,
                        2,
                        3
                      ]
                    },
                    "threatLevelLabel": {
                      "type": "string",
                      "enum": [
                        "CLEAN",
                        "SUSPICIOUS",
                        "MALICIOUS",
                        "CRITICAL"
                      ]
                    },
                    "sources": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "cached": {
                      "type": "boolean"
                    },
                    "lastChecked": {
                      "type": "string",
                      "format": "date-time"
                    },
                    "hitCount": {
                      "type": "integer"
                    },
                    "checkedAt": {
                      "type": "string",
                      "format": "date-time"
                    }
                  }
                }
              }
            }
          },
          "401": {
            "description": "Missing API key"
          },
          "403": {
            "description": "Invalid API key"
          },
          "429": {
            "description": "Rate limit exceeded"
          }
        },
        "security": [
          {
            "apiKey": []
          }
        ]
      }
    },
    "/feed/blocklist": {
      "get": {
        "summary": "Blocklist Feed (plain text)",
        "description": "Plain text list of blocked IPs, one per line. For firewalls and network appliances.",
        "parameters": [
          {
            "name": "threshold",
            "in": "query",
            "schema": {
              "type": "integer",
              "default": 60
            },
            "description": "Minimum score to include"
          }
        ],
        "responses": {
          "200": {
            "description": "IP list",
            "content": {
              "text/plain": {}
            }
          }
        },
        "security": [
          {
            "apiKey": []
          }
        ]
      }
    },
    "/feed/csv": {
      "get": {
        "summary": "Threat Feed (CSV)",
        "parameters": [
          {
            "name": "threshold",
            "in": "query",
            "schema": {
              "type": "integer",
              "default": 60
            }
          }
        ],
        "responses": {
          "200": {
            "description": "CSV data",
            "content": {
              "text/csv": {}
            }
          }
        },
        "security": [
          {
            "apiKey": []
          }
        ]
      }
    },
    "/feed/json": {
      "get": {
        "summary": "Threat Feed (JSON)",
        "parameters": [
          {
            "name": "threshold",
            "in": "query",
            "schema": {
              "type": "integer",
              "default": 60
            }
          }
        ],
        "responses": {
          "200": {
            "description": "JSON feed",
            "content": {
              "application/json": {}
            }
          }
        },
        "security": [
          {
            "apiKey": []
          }
        ]
      }
    },
    "/feed/cef": {
      "get": {
        "summary": "SIEM Feed (CEF)",
        "description": "Common Event Format export for SIEM integration.",
        "parameters": [
          {
            "name": "hours",
            "in": "query",
            "schema": {
              "type": "integer",
              "default": 24,
              "maximum": 168
            }
          },
          {
            "name": "limit",
            "in": "query",
            "schema": {
              "type": "integer",
              "default": 1000,
              "maximum": 10000
            }
          }
        ],
        "responses": {
          "200": {
            "description": "CEF lines",
            "content": {
              "text/plain": {}
            }
          }
        },
        "security": [
          {
            "apiKey": []
          }
        ]
      }
    },
    "/feed/syslog": {
      "get": {
        "summary": "SIEM Feed (Syslog)",
        "description": "Syslog format export for SIEM integration.",
        "parameters": [
          {
            "name": "hours",
            "in": "query",
            "schema": {
              "type": "integer",
              "default": 24,
              "maximum": 168
            }
          },
          {
            "name": "limit",
            "in": "query",
            "schema": {
              "type": "integer",
              "default": 1000,
              "maximum": 10000
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Syslog lines",
            "content": {
              "text/plain": {}
            }
          }
        },
        "security": [
          {
            "apiKey": []
          }
        ]
      }
    },
    "/badge": {
      "get": {
        "summary": "Reputation Badge (SVG)",
        "description": "Returns an SVG shield showing IP threat level. No auth required.",
        "parameters": [
          {
            "name": "ip",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "SVG badge",
            "content": {
              "image/svg+xml": {}
            }
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "apiKey": {
        "type": "apiKey",
        "in": "header",
        "name": "X-API-Key",
        "description": "API key (format: ti_<64hex>)"
      }
    }
  }
}