# MITRE CAPEC Attack Pattern Lookup

> MITRE CAPEC Attack Pattern Lookup is a paid API for AI agents from 2s.io, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-13).

Looks up or searches MITRE CAPEC (Common Attack Pattern Enumeration and Classification) entries by ID or keyword, returning attack pattern details, severity, and CWE mappings.

## Facts

- Endpoint: GET https://2s.io/api/security/capec
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/mitre-capec-attack-pattern-lookup-3eb076a9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_2Ypsqe0V8E1JOm0cufmPg

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability mitre-capec-attack-pattern-lookup-3eb076a9
```

Example prompt: Look up CAPEC-66 in the MITRE CAPEC database and tell me its name, severity, abstraction level, and any CWE mappings.

## When to prefer this

Use this endpoint when you need structured, ground-truth MITRE CAPEC data — specifically attack pattern details, severity ratings, or CWE cross-references — without needing an API key or signup. Prefer over scraping capec.mitre.org directly or using general web search when you need machine-readable structured output for threat modeling or security analysis.

## Known failure modes

- Unknown CAPEC ID returns empty items array with total=0
- Invalid ID format may return no results or an error
- Keyword query with no matches returns empty results
- Network or payment failure returns non-OK response

## How this service works

Authoritative MITRE CAPEC (Common Attack Pattern Enumeration) lookup. Pass id (e.g. CAPEC-66, or just 66) for the canonical attack pattern — name, abstraction, description, typical likelihood + severity, mapped CWE weaknesses (with names), and related patterns (with names) — or query for a keyword search. Bundled catalog (~615 patterns), zero external calls. The attacker's-eye complement to security.cwe (the defender's weakness view) — the CAPEC↔CWE cross-links let an agent pivot between how an attack works and the weakness it exploits, with exact citeable IDs.

## Output

Returns a list of CAPEC attack pattern objects, each containing the CAPEC ID, name, severity (e.g. High), abstraction level (e.g. Standard), and an array of mapped CWE entries with their IDs and names. Also includes total count and MITRE source attribution.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "id": "CAPEC-66"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "required": [],
     "properties": {
      "id": {
       "type": "string",
       "description": "CAPEC id (CAPEC-66 or 66)."
      },
      "limit": {
       "type": "integer"
      },
      "query": {
       "type": "string",
       "description": "Keyword search."
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/mitre-capec-attack-pattern-lookup-3eb076a9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)