Search & Graph

Search

GET/search

Parameter	Type		Description
q	string	req	Search term (minimum 2 characters). Searches across actors, clusters, campaigns, tools, TTPs, CVEs, indicators, and reports.

Returns { query, results, total }. results holds one array per entity type (actors, clusters, campaigns, tools, ttps, cves, indicators, reports), each with up to 10 matches.

Graph

GET/graph/:type/:id

Returns the entity graph for a given node — its neighbours and their edges, up to the requested depth.

Parameter	Type		Description
type	string	req	Entity type: actor / cluster / campaign / tool / ttp / cve / indicator / report
id	string	req	Entity UUID. Actors, clusters, campaigns and tools also accept a slug.
depth	number	opt	Traversal depth (default: 1, max: 3)

The response is { nodes, edges, meta }. A graph is capped at about 300 nodes. When the cap applies, meta.was_capped is true and meta.original_count gives the size before trimming. The node itself and its direct neighbours among actors, clusters, campaigns, tools and TTPs are always kept; reports, indicators and CVEs are trimmed first.

Compare entities

GET/graph/compare

Compares two or more entities side-by-side. Returns shared indicators, TTPs, and tools, plus pairwise similarity scores.

Parameter	Type		Description
ids	string	req	Comma-separated list of type:id pairs (minimum 2). Example: actor:uuid1,cluster:uuid2. Entity type must be one of actor / cluster / campaign / tool / ttp / cve / indicator / report.

The response contains three keys:

• graph — merged subgraph of nodes and edges connecting the compared entities through their shared neighbours
• shared — an object with indicator, ttp and tool arrays: the items that appear in two or more of the compared entities; each entry has id, name, and shared_by (array of entity IDs that share it)
• similarity_scores — pairwise similarity scores between each pair of compared entities

Pivot

GET/graph/pivot

Pivots from an indicator value or entity to all entities connected to it — useful for tracing an IOC to the actors, clusters, and reports it belongs to.

Parameter	Type		Description
value	string	opt*	Raw IOC value (IP, domain, hash, URL, or email). Babel resolves the value to its indicator record and traverses from it.
type	string	opt*	Entity type (actor / cluster / campaign / tool / ttp / cve / indicator / report). Use with id.
id	string	opt*	Entity UUID. Use with type.

*Provide either value or type + id — not both. Returns 404 if the value is not found; 400 if neither form is supplied or if type is not a recognised entity type.

Returns the same graph format as GET /graph/:type/:id at depth 1.

Similar entities

GET/graph/similar/:type/:id

Returns groups similar to a given actor or cluster. Supported for actor and cluster only.

Parameter	Type		Description
limit	number	opt	Maximum results (default 10, max 20)

A match is returned only on one of three kinds of evidence, each labelled with its reason and source:

• Reviewer — a Babel reviewer marked the pair as similar, with a written reason.
• Vendor — a source report states that the two designations overlap or correspond. Weaker statements ("may be related", code reuse) are returned separately and labelled as possible.
• Behaviour — computed from shared tooling under strict rules: the pair must share distinctive malware stated for both sides. Being reported together, or sharing a parent actor, never counts as evidence.

Similarity is never a statement that two groups are the same.

Platform stats

GET/stats

Returns platform-wide counts: total actors, clusters, campaigns, tools, indicators, TTPs, CVEs, and reports. No key required.

STIX export

GET/export/stix/:entityType/:id

Exports an entity and its relationships as a STIX 2.1 bundle. entityType is one of actor / cluster / campaign / tool / ttp / indicator.