Search & Graph

Search

GET/search

Parameter	Type		Description
q	string	req	Search term (minimum 2 characters). Searches across actors, clusters, campaigns, tools, TTPs, CVEs, and indicators.

Graph

GET/graph/:type/:id

Returns the entity graph for a given node — its direct neighbours and their edges, up to the requested depth.

Parameter	Type		Description
type	string	req	Entity type: actor / cluster / campaign / tool
id	string	req	Entity UUID or slug
depth	number	opt	Traversal depth (default: 2, max: 3)

Compare entities

GET/graph/compare

Compares two or more entities side-by-side. Returns shared indicators, TTPs, and tools, plus pairwise similarity scores.

Parameter	Type		Description
ids	string	req	Comma-separated list of type:id pairs (minimum 2). Example: actor:uuid1,cluster:uuid2. Entity type must be one of actor / cluster / campaign / tool / ttp / cve / indicator / report.

The response contains three keys:

• graph — merged subgraph of nodes and edges connecting the compared entities through their shared neighbours
• shared — indicators, TTPs, and tools that appear in two or more of the compared entities; each entry has id, name, and shared_by (array of entity IDs that share it)
• similarity_scores — pairwise similarity scores between each pair of compared entities

Pivot

GET/graph/pivot

Pivots from an indicator value or entity to all entities connected to it — useful for tracing an IOC to the actors, clusters, and reports it belongs to.

Parameter	Type		Description
value	string	opt*	Raw IOC value (IP, domain, hash, URL, or email). Babel resolves the value to its indicator record and traverses from it.
type	string	opt*	Entity type (actor / cluster / campaign / tool / ttp / cve / indicator / report). Use with id.
id	string	opt*	Entity UUID. Use with type.

*Provide either value or type + id — not both. Returns 404 if the value is not found; 400 if neither form is supplied or if type is not a recognised entity type.

Returns the same graph format as GET /graph/:type/:id at depth 1.

Similar entities

GET/graph/similar/:type/:id

Returns entities that share the most overlapping connections with the given entity — useful for finding related threat groups or infrastructure clusters.

Platform stats

GET/stats

Returns platform-wide counts: total actors, clusters, campaigns, tools, indicators, TTPs, CVEs, and reports.