# OT Intel API - ICS/SCADA Threat Intelligence Article

> OT Intel API - ICS/SCADA Threat Intelligence Article is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.45/call, status unknown (last checked 2026-09-14).

Returns an AI-enriched OT/ICS threat intelligence article for a given CVE or ICS threat actor, including MITRE ATT&CK for ICS mapping, cyber-physical impact, and CISA KEV status

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/article
- Price: $0.45/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-api-ics-scada-threat-intelligence-article-7120659c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_A44ruzRjbNUBWw2HexMgr

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-api-ics-scada-threat-intelligence-article-7120659c
```

Example prompt: Pull the OT Intel threat intelligence article for CVE-2022-38465 in the energy sector — I need the MITRE ATT&CK for ICS mapping, cyber-physical impact, and CISA KEV status.

## When to prefer this

Choose this endpoint when you need OT/ICS-specific threat intelligence that goes beyond generic CVE databases — particularly when you need cyber-physical impact context, MITRE ATT&CK for ICS technique mapping, industrial sector relevance, or ICS-specific threat actor profiling (e.g. SANDWORM, CHERNOVITE, XENOTIME). Prefer this over general CVE lookup APIs when the asset is an industrial controller, SCADA system, or OT network component and you need actionable SOC-ready intelligence with CISA KEV status.

## Known failure modes

- Missing both cve and actor parameters returns an error requiring at least one
- Invalid CVE format returns a validation error
- Unknown actor name returns not-found or empty response
- Payment failure on Base mainnet blocks the call
- Render.com cold start may cause timeout on first request
- Data may lag behind real-time CISA ICS-CERT advisories

## How this service works

Publication-ready CTI article ~700 words. Pass ?actor=CHERNOVITE or ?cve=CVE-XXXX-XXXX. Fans out to actor/cve + campaign + malware + advisory. DeepSeek writes journalist-style: headline, lede, body with ATT&CK context, defanged IOCs, analyst assessment, TLP. Ready for threat intel blog or advisory publication.

## Output

A structured JSON object containing a TLP-classified markdown threat intelligence article (typically ~720 words) composed from multiple OT intel sources, including the threat actor or CVE title, word count, full body in markdown, and a _composed_from field listing the underlying intelligence modules (e.g. actor, campaign, malware, advisory) used to build the article.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "cve": "CVE-2022-38465",
   "sector": "energy"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "cve": {
       "type": "string",
       "description": "CVE ID e.g. CVE-2024-12345 (required if no actor)"
      },
      "actor": {
       "type": "string",
       "description": "Actor name e.g. CHERNOVITE (required if no cve)"
      },
      "sector": {
       "type": "string",
       "description": "Optional sector context"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "tlp": "WHITE",
  "title": "CHERNOVITE Threat Group Expands OT Targeting to Energy Sector",
  "word_count": 720,
  "body_markdown": "**TLP: WHITE** | ICS Threat Intelligence\n\n...",
  "_composed_from": [
   "ot/actor",
   "ot/campaign",
   "ot/malware",
   "ot/advisory"
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-api-ics-scada-threat-intelligence-article-7120659c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)