Changelog

v2.0.0

2025-07-30: Initial Release of the API

v2.1.0

2025-07-31: Clarify the false positive risk and add disclaimer to each response.

v2.2.0

2025-09-02: New endpoint reports/{id}/correlations that returns the correlations to other reports based on shared IOCs.

v2.2.1

2025-09-03: Add type field to Correlation type indicating the type of the IOC value.

v2.3.0

2025-09-11: Add timestamp parameter to IOCs listing.

v2.3.1

2025-09-11: Add timestamp parameter to report listing.

v2.3.2

2025-09-12: Changed how IOCs and reports are sorted for pagination

• IOCs are now sorted by timestamp instead of date. The date of an IOC is when it appeared in the source report, while timestamp refers to when the IOC was added to Rösti or last updated. Updates might happend if an IOC is modified, e.g., the comment is changed or the IDS flag removed.
• Reports are now sorted by last_updated instead of date. The date of a report is when it was published, while last_updated is when the report was created or last updated by Rösti.

v2.4

2025-10-30: Access to CVE entries

• New endpoint cve/ to list all CVE entries known to Rösti.
• New endpoint reports/{id}/cve/ to list all CVEs associated with a report {id}.
• New query parameter cve for the /reports/{id} endpoint to include CVEs in the response (also included when setting full=true).

v2.4.1

2025-11-05: Clarified the parameters to get report and bulk exports (You need to use the id of the wanted File Type to get exports, so for example csv or jsonl).