# OT Intel API – OT Asset Exposure & Risk Verdict

> OT Intel API – OT Asset Exposure & Risk Verdict is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-13).

Returns a risk score, risk level, escalation flag, recommended action, active CVEs, and associated threat actors for an OT/ICS device identified by vendor, model, sector, and network exposure.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/exposure
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-api-ot-asset-exposure-risk-verdict-68ea69ad
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_OOgv_u5SdZTK3jjMuKFY4

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-api-ot-asset-exposure-risk-verdict-68ea69ad
```

Example prompt: What's the risk verdict for a Siemens S7-1500 running firmware 2.9.2, deployed internet-facing in the energy sector — do I need to escalate, and what CVEs are active against it?

## When to prefer this

Use this endpoint when you need a single aggregated risk verdict for a specific OT/ICS device — combining CVE exposure, threat actor intelligence, and network posture into one actionable score. Prefer this over raw CVE lookup endpoints when you want an escalation decision and recommended action rather than raw vulnerability data. Best suited for asset risk triage in ICS/SCADA environments across energy, water, manufacturing, and oil-and-gas sectors.

## Known failure modes

- Missing required query parameters (vendor, model, sector, network) returns a 400 error
- Unknown or unsupported vendor/model combination may return empty CVE list or low-confidence score
- Firmware parameter mismatch may fall back to generic CVE matching without firmware-specific results
- Service hosted on Render free tier may have cold-start latency or be unavailable
- Payment not processed results in 402 response blocking access

## How this service works

OT asset risk verdict. Pass ?vendor=siemens&model=s7-1500&sector=energy&network=internet-facing. Returns risk_score (0-100), risk_level, escalate (boolean), recommended_action, active CVEs, and threat actors. Optional firmware param enables firmware-specific CVE matching. Cached 1 hour.

## Output

A JSON object containing: risk_score (0–100 integer), risk_level (e.g. critical/high/medium/low), escalate (boolean indicating whether immediate escalation is warranted), recommended_action (plain-text remediation or response guidance), a list of active CVEs relevant to the device, and known threat actor groups targeting it. Results are cached for 1 hour.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "model": "s7-1500",
   "sector": "energy",
   "vendor": "siemens",
   "network": "internet-facing",
   "firmware": "2.9.2"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "vendor",
      "model",
      "sector",
      "network"
     ],
     "properties": {
      "model": {
       "type": "string",
       "description": "Device model e.g. s7-1500, modicon-m340, controllogix"
      },
      "sector": {
       "type": "string",
       "description": "Industrial sector e.g. energy, water, manufacturing, oil-and-gas"
      },
      "vendor": {
       "type": "string",
       "description": "Vendor name e.g. siemens, schneider, rockwell, ge, honeywell"
      },
      "network": {
       "type": "string",
       "description": "Network exposure: internet-facing | dmz | lan-only | air-gapped"
      },
      "firmware": {
       "type": "string",
       "description": "Firmware version e.g. 2.9.2 (optional — enables firmware-specific CVE matching)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "model": "s7-1500",
  "sector": "energy",
  "vendor": "siemens",
  "network": "internet-facing",
  "escalate": true,
  "freshness": "2026-06-13T10:00:00Z",
  "confidence": "high",
  "risk_level": "critical",
  "risk_score": 87,
  "top_threat": "VOLTZITE pre-positioning via CVE-2023-38380",
  "active_cves": 3,
  "ttl_seconds": 3600,
  "data_sources": [
   "NVD",
   "CISA-KEV",
   "MITRE-ATT&CK-ICS",
   "DeepSeek-CTI-Analysis"
  ],
  "threat_actors": [
   "VOLTZITE",
   "SANDWORM"
  ],
  "active_campaigns": 2,
  "recommended_action": "isolate"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-api-ot-asset-exposure-risk-verdict-68ea69ad/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)