{"openapi":"3.1.0","info":{"title":"SigmaShake Rules Hub API","version":"0.1.0","description":"Public API for browsing, searching, and downloading SigmaShake governance rulesets.","contact":{"url":"https://docs.sigmashake.com/hub"}},"servers":[{"url":"https://hub.sigmashake.com"}],"paths":{"/api/rulesets":{"get":{"summary":"List rulesets (paginated)","parameters":[{"name":"q","in":"query","schema":{"type":"string"},"description":"Search keyword"},{"name":"tech","in":"query","schema":{"type":"string"},"description":"Technology filter (e.g., ts, bash, python)"},{"name":"page","in":"query","schema":{"type":"integer","default":0},"description":"Page number (0-indexed)"},{"name":"limit","in":"query","schema":{"type":"integer","default":20,"maximum":100},"description":"Results per page"}],"responses":{"200":{"description":"Paginated list of rulesets","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/RulesetSummary"}},"page":{"type":"integer"},"limit":{"type":"integer"},"has_more":{"type":"boolean"}}}}}}}}},"/api/rulesets/{id}":{"get":{"summary":"Get ruleset with all rules","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Ruleset detail with rules","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RulesetDetail"}}}},"404":{"description":"Ruleset not found"}}}},"/api/search":{"get":{"summary":"Search rulesets","description":"Returns HTML (HTMX partial) by default. Add format=json for JSON response.","parameters":[{"name":"q","in":"query","schema":{"type":"string"}},{"name":"tech","in":"query","schema":{"type":"string"}},{"name":"page","in":"query","schema":{"type":"integer","default":0}},{"name":"format","in":"query","schema":{"type":"string","enum":["json"]},"description":"Set to \"json\" for JSON response"}],"responses":{"200":{"description":"Search results"}}}},"/api/technologies":{"get":{"summary":"List all technologies","responses":{"200":{"description":"Technology list","content":{"application/json":{"schema":{"type":"object","properties":{"technologies":{"type":"array","items":{"type":"string"}}}}}}}}}},"/api/attack":{"get":{"summary":"MITRE ATT&CK matrix (tactic→technique tree)","description":"Returns the 14 Enterprise ATT&CK tactics (kill-chain order) with rule/ruleset counts, the techniques grouped under each tactic, and the list of technologies present in the ATT&CK index. Optional ?tech= narrows all counts to one technology.","parameters":[{"name":"tech","in":"query","schema":{"type":"string"},"description":"Technology filter (e.g., ts, bash, macos)"}],"responses":{"200":{"description":"ATT&CK tactic→technique tree with counts","content":{"application/json":{"schema":{"type":"object","properties":{"tactics":{"type":"array","items":{"type":"object"}},"techniquesByTactic":{"type":"object","additionalProperties":{"type":"array","items":{"type":"object"}}},"technologies":{"type":"array","items":{"type":"string"}},"technology":{"type":["string","null"]}}}}}}}}},"/api/attack/{id}":{"get":{"summary":"ATT&CK technique or tactic drilldown","description":"id may be a technique id (T#### or sub-technique T####.###) or a tactic id (TA####). Returns the public rulesets that contain at least one rule mapped to it. Optional ?tech= technology filter and ?page= pagination.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"},"description":"Technique (T####) or tactic (TA####) id"},{"name":"tech","in":"query","schema":{"type":"string"},"description":"Technology filter"},{"name":"page","in":"query","schema":{"type":"integer","default":0},"description":"Page number (0-indexed)"}],"responses":{"200":{"description":"Drilldown result with matching rulesets","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"kind":{"type":"string","enum":["technique","tactic"]},"name":{"type":"string"},"tactic":{"type":"string"},"rulesets":{"type":"array","items":{"$ref":"#/components/schemas/RulesetSummary"}},"total":{"type":"integer"},"page":{"type":"integer"},"technology":{"type":["string","null"]}}}}}},"400":{"description":"Invalid technique id"},"404":{"description":"Unknown tactic"}}}},"/api/downloads/{id}":{"post":{"summary":"Register a download","description":"Increments download counter. Rate limited to 1/min per IP per ruleset.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Download registered"}}}},"/api/health":{"get":{"summary":"Health check","responses":{"200":{"description":"Service health status"}}}},"/api/eval":{"post":{"summary":"Evaluate a tool call against a ruleset","description":"Evaluates a tool call against the rules in a hub-hosted ruleset. No installation required. Returns allow/block/log/shadow/ask/force decision with matching rule details; force refuses the original risky action and returns a safe substitute or required safer path. Rate limited to 10 evaluations per minute per IP per ruleset. Install @sigmashake/ssg for offline evaluation, audit trails, loop detection, and session analytics.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["ruleset_id","tool","input"],"properties":{"ruleset_id":{"type":"string","description":"Ruleset ID from GET /api/rulesets"},"tool":{"type":"string","description":"Tool name being invoked (e.g., Bash, Write, Agent)"},"input":{"type":"object","description":"Tool input parameters. Common fields: command (Bash), file_path (Read/Write/Edit), content/new_string (Write/Edit).","additionalProperties":true}}},"example":{"ruleset_id":"abc-123","tool":"Bash","input":{"command":"rm -rf /tmp/build"}}}}},"responses":{"200":{"description":"Evaluation result","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EvalResponse"}}}},"400":{"description":"Invalid request body"},"404":{"description":"Ruleset not found or has no rules"},"413":{"description":"Request body too large (max 64KB)"},"429":{"description":"Rate limit exceeded"}}}}},"components":{"schemas":{"RulesetSummary":{"type":"object","properties":{"id":{"type":"string"},"title":{"type":"string"},"author":{"type":"string"},"author_avatar":{"type":["string","null"]},"github_repo":{"type":"string"},"path":{"type":"string"},"rule_count":{"type":"integer"},"technologies":{"type":"array","items":{"type":"string"}},"download_count":{"type":"integer"},"last_synced_at":{"type":["integer","null"]},"created_at":{"type":"integer"}}},"EvalResponse":{"type":"object","properties":{"decision":{"type":"string","enum":["allow","block","log","shadow","ask","force"],"description":"Governance decision for this tool call"},"rule_id":{"type":["string","null"],"description":"ID of the matched rule, null if no rule fired"},"reason":{"type":["string","null"],"description":"Rule message explaining the decision"},"matched_pattern":{"type":["string","null"],"description":"Condition that triggered the match"},"ruleset_id":{"type":"string"},"rules_version":{"type":"integer","description":"Ruleset version at time of evaluation"},"evaluated_at":{"type":"integer","description":"Unix timestamp (ms)"},"upgrade_hints":{"type":"object","description":"Information about capabilities available with ssg installed locally","properties":{"message":{"type":"string"},"missing_features":{"type":"array","items":{"type":"string"}},"install":{"type":"string"},"docs":{"type":"string"}}}}},"RulesetDetail":{"allOf":[{"$ref":"#/components/schemas/RulesetSummary"},{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"technology":{"type":"string"},"capability":{"type":["string","null"]},"severity":{"type":"string"},"decision":{"type":"string"},"message":{"type":"string"},"raw_text":{"type":"string","description":"Original .rules DSL syntax"}}}}}}]}}}}