{ "openapi": "3.0.1", "info": { "title": "Ransomware Breach Claim Monitor for SOC Teams", "description": "Monitor public ransomware leak-site claims from RansomLook against an organization and domain watchlist. Returns matched victim claims, group, discovery time, clear-web source links, verification status, and machine-readable run summaries for SOC, CTI, and incident-response workflows.", "version": "0.2", "x-build-id": "BxFOKGgds2gMBl6kb" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/khadinakbar~ransomware-breach-monitor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-khadinakbar-ransomware-breach-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/khadinakbar~ransomware-breach-monitor/runs": { "post": { "operationId": "runs-sync-khadinakbar-ransomware-breach-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/khadinakbar~ransomware-breach-monitor/run-sync": { "post": { "operationId": "run-sync-khadinakbar-ransomware-breach-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "watchlist" ], "properties": { "watchlist": { "title": "Organizations or domains to monitor", "minItems": 1, "maxItems": 100, "type": "array", "description": "Names, brands, or domains to compare with public ransomware claim titles, such as `example.com` or `Example Holdings`. Provide 1–100 unique values; URLs are normalized to their hostname. This is a defensive watchlist, not a list of stolen records, credentials, or private forum targets.", "items": { "type": "string", "minLength": 2, "maxLength": 120 } }, "lookbackDays": { "title": "Lookback window in days", "minimum": 1, "maximum": 30, "type": "integer", "description": "Number of recent days requested from the public RansomLook posts feed, from 1 through 30. Defaults to 7, which is suitable for recurring daily monitoring and keeps the source request bounded. This is not a guarantee that a claim was first published inside the window.", "default": 7 }, "maxResults": { "title": "Maximum matched claims", "minimum": 1, "maximum": 500, "type": "integer", "description": "Hard maximum number of matched claim records persisted in this run. Defaults to 25 and caps at 500; each persisted match is one `matched-claim` event. A lower cap limits output and event charges, but it may leave additional matches in the source window.", "default": 25 }, "matchMode": { "title": "Watchlist matching mode", "enum": [ "strict", "contains" ], "type": "string", "description": "Use `strict` for token-boundary name matching and exact domain matching, or `contains` for broader name matching when the source uses shortened company names. Defaults to `strict` to reduce false positives. This changes matching only; it does not prove or score the underlying breach claim.", "default": "strict" }, "groupAllowlist": { "title": "Ransomware groups to include", "maxItems": 50, "type": "array", "description": "Optional ransomware group labels that a watchlist match must use, such as `qilin` or `lockbit`. Provide 1–50 distinct labels, or leave this empty to include every group. Matching is case- and punctuation-insensitive against the public RansomLook group label. This filter narrows triage; it does not verify a claim or discover groups absent from the source.", "items": { "type": "string", "minLength": 2, "maxLength": 80 }, "default": [] }, "excludeClaimIds": { "title": "Previously handled claim IDs", "maxItems": 500, "type": "array", "description": "Optional stable claim IDs from an earlier Dataset that this run should suppress, such as `ransomlook:0123456789abcdef0123`. Provide up to 500 IDs, or leave this empty to return every current match. This enables stateless delta-only monitoring because the caller controls the baseline. It does not delete source records or persist a cross-run watchlist state.", "items": { "type": "string", "pattern": "^ransomlook:[a-f0-9]{20}$" }, "default": [] } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } }