# OT Intel API — ICS Threat Score

> OT Intel API — ICS Threat Score is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.04/call, status unknown (last checked 2026-09-14).

Returns a deterministic capability × opportunity × intent threat score for a specific ICS/OT threat actor targeting a given sector, region, and vendor stack.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/threat-score
- Price: $0.04/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-api-ics-threat-score-19e0a9df
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_vp0gqoye8mZEnCPBhTOIP

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-api-ics-threat-score-19e0a9df
```

Example prompt: What's the threat score for SANDWORM targeting the energy sector in Europe, where the environment runs Siemens and Schneider Electric OT equipment?

## When to prefer this

Use this endpoint when you need a fast, deterministic, non-LLM threat score for a specific ICS/OT actor against a defined sector, region, and vendor stack — especially when you need reproducible scoring driven by structured intelligence data (actor profiles, CVEs, GDELT, OFAC) rather than generative AI narrative output. Prefer this over generic cyber threat APIs when the target environment is specifically operational technology or industrial control systems.

## Known failure modes

- Unknown or misspelled actor name returns low-confidence or null score
- Unsupported sector or region string returns validation error
- Missing required query parameters (actor, sector, region, vendor_stack) returns 400 error
- Render cold-start latency may cause timeout on first call
- Payment not accepted or x402 flow fails returning 402 status

## How this service works

Capability x opportunity x intent threat score for an actor-target pairing. Pass actor, sector, region, vendor_stack. Deterministic scoring: actor/CVE/campaign data plus GDELT tension and OFAC sanctions pressure. Not LLM-generated.

## Output

A structured threat score combining capability, opportunity, and intent dimensions for the specified actor-target pairing, derived deterministically from actor/CVE/campaign data, GDELT geopolitical tension signals, and OFAC sanctions pressure — not LLM-generated.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "actor",
      "sector",
      "region",
      "vendor_stack"
     ],
     "properties": {
      "actor": {
       "type": "string",
       "description": "ICS threat actor name e.g. SANDWORM, VOLTZITE, XENOTIME"
      },
      "region": {
       "type": "string",
       "description": "Target region or country e.g. Europe, GCC, Ukraine"
      },
      "sector": {
       "type": "string",
       "description": "Target sector e.g. energy, water, manufacturing"
      },
      "vendor_stack": {
       "type": "string",
       "description": "Comma-separated OT/ICS vendors in the target environment e.g. Siemens,Schneider Electric. Pass 'none' if unknown."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "actor": "SANDWORM",
  "intent": {
   "basis": [
    "sector_history:direct",
    "campaign_geography:match",
    "geo_tension(Russia↔Europe):0.71 [moderate]",
    "sanctions_pressure(Russia):0.60 [moderate]"
   ],
   "score": 0.52,
   "confidence": "moderate"
  },
  "region": "Europe",
  "sector": "energy",
  "coverage": 1,
  "capability": {
   "basis": [
    "physical_impact_tier:1",
    "ttps_mapped:14",
    "exploited_cves:3",
    "vendor_stack_overlap:yes (documented: SIMATIC (vendor advisory))"
   ],
   "score": 0.82,
   "confidence": "moderate"
  },
  "confidence": "moderate",
  "opportunity": {
   "basis": [
    "cves_on_record:9",
    "exploited_in_wild:2",
    "avg_cvss:8.1"
   ],
   "score": 0.61,
   "confidence": "moderate"
  },
  "_methodology": "deterministic: product of capability x opportunity x intent (each 0-1), scaled to 0-100, where any leg with confidence:none has its exponent reduced from 1 to 0.3 so a data gap dampens the score instead of vetoing it outright. Identical to naive_product_score whenever coverage is 1 (no data gaps) — see exponents_applied. actor_record_quality:\"generic_descriptor\" means the queried name matches a known non-actor descriptive phrase (e.g. \"unknown cybercrime gang\") rather than a specific named threat actor — treat the score as noise, not a real assessment. See basis[] per leg.",
  "data_sources": [
   "OT-Intel-DB",
   "GDELT Project (gdeltproject.org)",
   "OFAC Sanctions List (US Treasury)"
  ],
  "threat_score": 26,
  "vendor_stack": [
   "Siemens",
   "Schneider Electric"
  ],
  "exponents_applied": {
   "intent": 1,
   "capability": 1,
   "opportunity": 1
  },
  "naive_product_score": 26,
  "actor_record_quality": "named_entity"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-api-ics-threat-score-19e0a9df/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)