# ORKL — Community Cyber Threat Intelligence Library

> A searchable corpus of publicly released CTI reports, with extracted
> plain text, threat-actor tagging and source attribution. Everything the
> web UI shows is available as structured JSON from a public REST API.

**Please do not crawl this frontend — use the API instead.** The site is
a client-rendered single-page app; fetching its HTML without executing
JavaScript returns an empty shell containing no report data. Crawling it
costs you requests and returns nothing useful. The API serves the same
content as JSON, in one request, without markup.

Documents themselves (PDF, extracted text, preview images) live on the
[archive host](https://archive.orkl.eu/). Every API report record carries
direct `files.pdf`, `files.text` and `files.img` URLs pointing there, so
there is no need to fetch the archive's directory index — please do not
enumerate it.

The API is rate limited to ensure fair use. Please send a descriptive
User-Agent so we can contact you if your client misbehaves.

## API

- [Machine-readable API spec](https://orkl.eu/api/v1/doc/doc.json): Swagger 2.0 JSON describing every endpoint, parameter and response type. **Start here** — the spec is served at `doc.json`; `swagger.json` and `openapi.json` are not available.
- [Human-readable API docs](https://orkl.eu/api/v1/doc/index.html): Swagger UI. Renders the spec above via JavaScript, so fetch the JSON instead.
- API root: `https://orkl.eu/api/v1`

Every response is wrapped as `{"status", "message", "data"}`. List
endpoints serialise an empty result as `"data": null` rather than `[]`.

## Reports

- `GET /api/v1/library/entries`: paginated reports (`limit`, `offset`)
- `GET /api/v1/library/entry/{uuid}`: single report including extracted `plain_text`
- `GET /api/v1/library/entry/sha1/{hash}`: same, looked up by file hash
- `GET /api/v1/library/search?query=`: full-text search; add `full=true` to include `plain_text`
- `GET /api/v1/library/info`: corpus counts and last update time

Each report carries `files.pdf`, `files.text` and `files.img` URLs
pointing at the archive host, so there is no need to render the UI to
reach the underlying documents.

## Threat actors and sources

- `GET /api/v1/ta/entries`: all threat actors with aliases and tools
- `GET /api/v1/ta/entry/{uuid}`: one threat actor plus its linked reports
- `GET /api/v1/source/entries`: monitored sources

## News

- `GET /api/v1/news/entries`: curated CTI news, hot-score ranked (`limit`, `offset`, `order_by=rank|published_at`)
- [OPML feed list](https://orkl.eu/feeds.opml): subscribe to the underlying RSS feeds directly

## Optional

- [Contact](https://orkl.eu/about): for integration questions or bulk access needs