# OT Intel API - SCADA/ICS Internet-Exposed Device Lookup

> OT Intel API - SCADA/ICS Internet-Exposed Device Lookup is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-13).

Looks up internet-exposed industrial control system devices by vendor and model, returning default credential risks, at-risk OT protocols, exploitation notes, and hardening recommendations.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/device
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-api-onrender-com-10fa9eeb
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_tQreDFkmnDBHBhdKm7-9s

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-api-onrender-com-10fa9eeb
```

Example prompt: Can you check the internet-exposure risk for a Siemens S7-1200 PLC — I want to know about default credential issues, which OT protocols like Modbus or S7comm are at risk, any known exploitation details, and what hardening steps I should take?

## When to prefer this

Use this endpoint when you need to assess the security posture of a specific internet-exposed ICS/SCADA device by vendor and model, particularly to understand default credential risks, exposed industrial protocols, and actionable hardening steps. Prefer this over general CVE lookup endpoints when the concern is protocol-level exposure and device-specific hardening for OT environments rather than software vulnerability triage.

## Known failure modes

- Unknown vendor or model returns no results or 404
- Missing required query parameters (vendor or model) returns 400 error
- Render.com cold-start latency may cause first request to be slow
- Rate limiting or payment failure for x402 micropayment may block access
- Device not in database returns empty or partial results

## How this service works

ICS/OT device exposure lookup. Pass ?vendor=siemens&model=s7-1200. Returns default credential risk, exposed OT protocols (Modbus/502, S7comm/102, DNP3/20000), exploitation notes, and hardening steps. Covers Siemens, Schneider, Rockwell, Honeywell, GE, Unitronics, Beckhoff.

## Output

Returns a structured report including default credential risk level, list of at-risk OT protocols (Modbus/502, DNP3/20000, S7comm/102), exploitation notes specific to the device, and recommended hardening actions for the queried vendor and model combination.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "model": "S7-1200",
   "vendor": "Siemens"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "vendor",
      "model"
     ],
     "properties": {
      "model": {
       "type": "string",
       "description": "Model or product line e.g. s7-1200, quantum, logix, vision"
      },
      "vendor": {
       "type": "string",
       "description": "Vendor name e.g. siemens, schneider, rockwell, honeywell, unitronics, ge, beckhoff"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "query": {
   "model": "vision",
   "vendor": "unitronics"
  },
  "freshness": "2025-05-22T10:00:00.000Z",
  "data_sources": [
   "NVD",
   "CISA-ICS-CERT",
   "DeepSeek-CTI-Analysis"
  ],
  "recommended_action": "Change default credentials immediately. No downtime required.",
  "ot_protocols_at_risk": [
   "PCOM (20256)",
   "Modbus TCP (502)"
  ],
  "default_credential_risk": {
   "note": "Default password 1111 on port 20256. Actively exploited by IRGC 2023–2024.",
   "risk": "critical"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-api-onrender-com-10fa9eeb/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)