# OT Intel API — ICS/SCADA Threat Intelligence
> Pay-per-call OT/ICS threat intelligence. USDC micropayments on Base mainnet via x402. No API key required.

## Paid Endpoints (x402 payment required)
- https://ot-intel.daligence.com/ot/cve?id=CVE-XXXX-XXXX         — OT-contextualised CVE triage ($0.02)
- https://ot-intel.daligence.com/ot/device?vendor=siemens&model=s7-1200 — OT device security profile: CVEs, CISA advisories, hardening ($0.05)
- https://ot-intel.daligence.com/ot/actor?name=SANDWORM          — ICS threat actor profiles ($0.03)
- https://ot-intel.daligence.com/ot/actor/sector?sector=energy   — Actors by industrial sector ($0.03)
- https://ot-intel.daligence.com/ot/ioc?value=1.2.3.4&type=ip   — IOC enrichment with OT campaign context ($0.01)
- https://ot-intel.daligence.com/ot/advisory?vendor=siemens      — CISA ICS-CERT advisory feed ($0.02)
- https://ot-intel.daligence.com/ot/patch?id=CVE-XXXX-XXXX      — OT patch feasibility assessment ($0.05)
- https://ot-intel.daligence.com/ot/exposure?vendor=siemens&model=s7-1500&sector=energy&network=internet-facing — Asset risk verdict: escalate true/false ($0.05)
- https://ot-intel.daligence.com/ot/campaign?sector=electric&status=active — Active campaign tracker ($0.05)
- https://ot-intel.daligence.com/ot/delta?sector=water&days=7   — Change feed: only what's new ($0.03)
- https://ot-intel.daligence.com/ot/malware?name=PIPEDREAM      — ICS malware encyclopedia ($0.02)
- https://ot-intel.daligence.com/ot/brief?sector=energy&period=30 — Complete sector threat brief with risk trend ($0.10)
- https://ot-intel.daligence.com/ot/asn?asn=AS215540           — ICS threat actor ASN infrastructure profiling ($0.03)
- https://ot-intel.daligence.com/ot/detection?target=PIPEDREAM — YARA/Sigma detection artifacts for ICS malware/actors ($0.05)
- https://ot-intel.daligence.com/ot/compliance?cve_id=CVE-2023-38802 — Compliance gap mapping across 11 frameworks ($0.04). Pass ?cve_id=... or ?actor=..., optionally with &framework=<value> to filter to one standard. Valid framework values: nerc_cip, iec_62443_2_1, iec_62443_2_4, iec_62443_3_2, iec_62443_3_3, iec_62443_4_2, nist_800_82, nist_csf, cisa_cpg, nca_otcc, uae_nesa_ia. Omit framework to return matches across all of them.
- https://ot-intel.daligence.com/ot/compliance/batch?items=CVE-2023-38802,SANDWORM — Aggregate compliance-gap assessment across multiple CVEs/actors in one call ($0.20). Pass ?items=<comma-separated list, max 25>, optionally &framework=<value> and &entity_sector=<ENERGY|WATER|TRANSPORTATION|GOVERNMENT>. Cheaper than N individual /ot/compliance calls when triaging a batch of new advisories at once.
- https://ot-intel.daligence.com/ot/xai/root-cause-localization?window=<JSON array> — Statistical per-sensor anomaly attribution ($0.15). Ranks sensors by z-score deviation from baseline. Fully deterministic, no LLM. Statistical approximation, not a trained SHAP/TCAE model.
- https://ot-intel.daligence.com/ot/agentic/threat-hunt/control-loop?observed_processes=AnyDesk&zone=OT — Advisory-only threat hunt for control-loop recon and RMM/LOTL abuse ($0.15). Fully deterministic keyword matching, no LLM. Never executes containment; text findings and canned recommendations only.
- https://ot-intel.daligence.com/ot/physics/invariant-reachability?asset_id=TANK_302&flow_in=50&flow_out=40&level_start=100&level_end=120&dt_seconds=60&tank_area=10 — Deterministic mass-balance physical-invariant check ($0.20). Flags whether reported level change is consistent with metered flows; no LLM, no trained model.
- https://ot-intel.daligence.com/ot/sighting/submit?ioc_or_ttp_id=CVE-2024-12345&sector=energy&region=KSA — Submit an anonymized IOC/TTP sighting from your own OT environment ($0.05)

## Analytical Endpoints (deterministic + DeepSeek-synthesised risk/compliance)
- https://ot-intel.daligence.com/ot/threat-score?actor=SANDWORM&sector=energy&region=Europe&vendor_stack=Siemens,Schneider — Deterministic capability x opportunity x intent threat score ($0.04). No LLM in the scoring path.
- https://ot-intel.daligence.com/ot/precursor-ttp?actor=SANDWORM — Pre-impact vs impact-stage TTP breakdown, early-warning window ($0.04). Deterministic, no LLM.
- https://ot-intel.daligence.com/ot/vendor-risk?vendor=Schneider+Electric — OT/ICS supply-chain vendor risk assessment ($0.15)
- https://ot-intel.daligence.com/ot/vendor-risk-delta?vendor_current=Siemens&vendor_proposed=Schneider+Electric — Counterfactual vendor-swap risk comparison ($0.20)
- https://ot-intel.daligence.com/ot/mitigation-map?actor=SANDWORM — D3FEND-mapped mitigation guidance for actor/CVE/technique ($0.20)
- https://ot-intel.daligence.com/ot/risk-exposure?sector=energy&region=GCC — Board/GRC portfolio risk aggregator ($0.40)
- https://ot-intel.daligence.com/ot/action-conformance?actor=SANDWORM&sector=energy&region=Europe&planned_action=block_ip — Deterministic remediation action risk gate: auto_approve/human_review/reject ($0.12)
- https://ot-intel.daligence.com/ot/ai-exposure?vendor=Siemens — AI/agentic copilot attack-surface lookup, MITRE ATLAS mapping ($0.20)
- https://ot-intel.daligence.com/ot/ai-uplift?vendor=Schneider+Electric&internet_facing=true — Attacker-AI-uplift exposure, Dragos-precedent-grounded ($0.20)
- https://ot-intel.daligence.com/ot/ai-attack-feasibility?technique=Brute+Force+I/O — LLM-generated ICS attack feasibility, Cook et al. 2026 ($0.20). No LLM in the lookup path.
- https://ot-intel.daligence.com/ot/claim-reliability?claim=<text> — CTI claim reliability scoring, Meng et al. 2026 ($0.20)
- https://ot-intel.daligence.com/ot/stix-coverage?technique_id=T0836&campaign=Stuxnet — STIX representability + actionability lookup, Hahn/Krief et al. 2026 ($0.20). No LLM in the lookup path.

## Composed Endpoints — synthesis tier, one call → finished artifact
- https://ot-intel.daligence.com/ot/report?actor=CHERNOVITE&sector=energy — Full threat actor report in Markdown ($0.25)
- https://ot-intel.daligence.com/ot/dossier?actor=SANDWORM — Deep actor dossier with IOCs, infra, detections ($0.35)
- https://ot-intel.daligence.com/ot/sitrep?sector=energy&period=30 — Sector situation report, 30-day picture ($0.35)
- https://ot-intel.daligence.com/ot/article?actor=CHERNOVITE — Publication-ready CTI article ~700 words ($0.45)
- https://ot-intel.daligence.com/ot/linkedin?actor=VOLTZITE — LinkedIn post for CTI/ICS security audience ($0.15)
- https://ot-intel.daligence.com/ot/xpost?actor=XENOTIME — X/Twitter thread 5-7 posts ($0.10)
- https://ot-intel.daligence.com/ot/analyst-brief?actor=SANDWORM&sector=energy — BLUF-style decision-ready analyst brief with confidence assessment ($0.12)
- https://ot-intel.daligence.com/ot/gcc-bulletin — Recurring public "State of OT Threat Intel — GCC" sitrep, human-reviewed ($0.01)

## Free Endpoints
- https://ot-intel.daligence.com/SKILL.md
- https://ot-intel.daligence.com/.well-known/x402.json
- https://ot-intel.daligence.com/.well-known/agent-card.json
- https://ot-intel.daligence.com/.well-known/ot-intel-signer.json — response-signing key: paid JSON carries _provenance (ot-intel-sig/1, RFC8785+SHA-256+EIP-191)
- https://ot-intel.daligence.com/openapi.json
- https://ot-intel.daligence.com/health
- https://ot-intel.daligence.com/a2a
- https://ot-intel.daligence.com/mcp — MCP endpoint (POST, protocol 2026-07-28); tools/call paid via x402 _meta["x402/payment"]
- https://ot-intel.daligence.com/mcp/server-card — MCP server card

## Payment Protocol
x402 on Base mainnet (eip155:8453), USDC. Facilitator: CDP (api.cdp.coinbase.com).