{
  "openapi": "3.1.1",
  "info": {
    "title": "OSINT Indicator Extractor API",
    "version": "1.0.0",
    "summary": "Find URLs, domains, IPs, e-mails, hashes and crypto identifiers in pasted text.",
    "description": "Every endpoint performs the same calculation as the human page and returns inputs, result, units, assumptions, sources, warnings and computedAt. MCP endpoint: /mcp."
  },
  "servers": [
    {
      "url": "https://obscuriqindicatorextractor.usefulweb.site"
    }
  ],
  "paths": {
    "/api/v1/calculate": {
      "post": {
        "operationId": "calculate",
        "summary": "Find URLs, domains, IPs, e-mails, hashes and crypto identifiers in pasted text.",
        "description": "Extract URLs, email addresses, domains, IPv4 addresses, common hexadecimal hashes, checksum-valid Bitcoin addresses and 0x-prefixed Ethereum addresses and hashes from pasted text, including bracket-dot defanged forms.\n\nMethodology:\n- Identify conservative ASCII patterns for HTTP URLs, email addresses, domains, IPv4 addresses and 32-, 40- or 64-character hexadecimal hashes.\n- Bitcoin mainnet addresses count only when their Base58Check or Bech32/Bech32m checksum is valid; 0x followed by 40 hex characters is reported as an Ethereum address and 0x followed by 64 as an EVM hash (format only).\n- Tokens that end in a common file extension such as .pdf, .txt or .exe are treated as file names, not domains.\n- Keep the original matched text and count repeated indicators; domains, IPv4 addresses, hashes and Ethereum identifiers are grouped without regard to letter case and bracket-dot notation.\n\nMatches are leads, not evidence that a host exists, a file is malicious, or an address belongs to a person. Unicode domains, IPv6 and unusual email formats are not covered; review results manually.",
        "tags": [
          "apps"
        ],
        "x-mcp-tool": "obscuriq_indicator_extractor",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ObscuriqIndicatorExtractorInput"
              },
              "examples": {
                "example1": {
                  "summary": "Extract indicators from a note",
                  "value": {
                    "text": "Suspicious link hxxps://example[.]org/login and analyst@example.org. Host 192.0.2.10 appears twice: 192.0.2.10."
                  }
                },
                "example2": {
                  "summary": "Find crypto identifiers",
                  "value": {
                    "text": "Donation page lists bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4 and 0x000000000000000000000000000000000000dEaD; the receipt mentions 0x5c504ed432cb51138bcf09aa5e8a410dd4a1e204ef84bfed1be16dfba1b22060."
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Calculation result envelope.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ObscuriqIndicatorExtractorResult"
                }
              }
            }
          },
          "400": {
            "description": "Malformed JSON body.",
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "422": {
            "description": "Invalid input (see errors[]).",
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          },
          "429": {
            "description": "Rate limit exceeded (see Retry-After).",
            "content": {
              "application/problem+json": {
                "schema": {
                  "$ref": "#/components/schemas/Problem"
                }
              }
            }
          }
        }
      }
    },
    "/api/v1/tool": {
      "get": {
        "operationId": "getToolDefinition",
        "summary": "Inputs, output schema and examples for this tool",
        "responses": {
          "200": {
            "description": "Tool definition.",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "Problem": {
        "type": "object",
        "description": "RFC 9457 problem details. 422 responses include per-field `errors`.",
        "required": [
          "type",
          "title",
          "status",
          "detail"
        ],
        "properties": {
          "type": {
            "type": "string"
          },
          "title": {
            "type": "string"
          },
          "status": {
            "type": "integer"
          },
          "detail": {
            "type": "string"
          },
          "code": {
            "type": "string"
          },
          "errors": {
            "type": "array",
            "items": {
              "type": "object",
              "required": [
                "field",
                "message"
              ],
              "properties": {
                "field": {
                  "type": "string"
                },
                "message": {
                  "type": "string"
                }
              }
            }
          }
        }
      },
      "ObscuriqIndicatorExtractorInput": {
        "type": "object",
        "additionalProperties": false,
        "properties": {
          "text": {
            "title": "Text to inspect",
            "description": "Paste text you are authorized to review. No lookups are performed.",
            "type": "string",
            "maxLength": 100000,
            "default": "Suspicious link hxxps://example[.]org/login and analyst@example.org. Host 192.0.2.10 appears twice: 192.0.2.10."
          }
        },
        "required": []
      },
      "ObscuriqIndicatorExtractorResult": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "schemaVersion",
          "tool",
          "computedAt",
          "inputs",
          "summary",
          "result",
          "units",
          "assumptions",
          "sources",
          "warnings",
          "presentation",
          "links"
        ],
        "properties": {
          "schemaVersion": {
            "type": "string",
            "const": "1.0"
          },
          "tool": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "id",
              "name",
              "version"
            ],
            "properties": {
              "id": {
                "type": "string"
              },
              "name": {
                "type": "string"
              },
              "version": {
                "type": "string"
              }
            }
          },
          "computedAt": {
            "type": "string",
            "format": "date-time"
          },
          "inputs": {
            "type": "object",
            "description": "Normalised inputs actually used, including applied defaults."
          },
          "summary": {
            "type": "string"
          },
          "result": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "indicators",
              "uniqueCount",
              "occurrenceCount"
            ],
            "properties": {
              "indicators": {
                "type": "array",
                "items": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "type",
                    "value",
                    "occurrences"
                  ],
                  "properties": {
                    "type": {
                      "type": "string",
                      "enum": [
                        "URL",
                        "Email",
                        "Domain",
                        "IPv4",
                        "Hash",
                        "Bitcoin address",
                        "Ethereum address",
                        "EVM hash"
                      ]
                    },
                    "value": {
                      "type": "string"
                    },
                    "occurrences": {
                      "type": "integer"
                    }
                  }
                }
              },
              "uniqueCount": {
                "type": "integer"
              },
              "occurrenceCount": {
                "type": "integer"
              }
            }
          },
          "units": {
            "type": "object",
            "additionalProperties": {
              "type": "string"
            }
          },
          "assumptions": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "sources": {
            "type": "array",
            "items": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "title"
              ],
              "properties": {
                "title": {
                  "type": "string"
                },
                "url": {
                  "type": "string"
                },
                "publisher": {
                  "type": "string"
                },
                "retrievedAt": {
                  "type": "string"
                },
                "note": {
                  "type": "string"
                }
              }
            }
          },
          "warnings": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "presentation": {
            "type": "array",
            "items": {
              "type": "object"
            },
            "description": "Display blocks used by the human page (same data)."
          },
          "links": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "human",
              "api",
              "openapi",
              "methodology"
            ],
            "properties": {
              "human": {
                "type": "string",
                "format": "uri"
              },
              "api": {
                "type": "string",
                "format": "uri"
              },
              "openapi": {
                "type": "string",
                "format": "uri"
              },
              "methodology": {
                "type": "string",
                "format": "uri"
              }
            }
          }
        }
      }
    }
  }
}