{"openapi":"3.1.0","info":{"title":"YARAify (BYOK) API","version":"0.1.0","description":"YARAify (BYOK) lets an AI assistant read your own YARAify data through the YARAify API with a key you supply (abuse.ch Auth-Key). Read-only: 10 tools (lookup_file_hash, get_task_results, get_files_by_yara_rule, get_files_by_clamav_signature, get_files_by_imphash, get_files_by_tlsh, get_files_by_telfhash, get_files_by_gimphash, get_files_by_icon_dhash, list_recent_yara_rules). The BYOK key travels...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-yaraify.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-yaraify/docs"},"termsOfService":"https://connectorbay.com/byok-yaraify/terms"},"servers":[{"url":"https://byok-yaraify.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-yaraify/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/lookup_file_hash":{"post":{"operationId":"lookup_file_hash","summary":"Look up one file in YARAify by SHA256, MD5, SHA1 or SHA3-384 hash: file metadata, similarity hashes and the scan tasks t","description":"Look up one file in YARAify by SHA256, MD5, SHA1 or SHA3-384 hash: file metadata, similarity hashes and the scan tasks that touched it with YARA and ClamAV matches. Use for \"What does YARAify know about file hash b0bb095dd0ad8b8de1c83b13c38e68dd\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"search_term":{"description":"File hash (SHA256, MD5, SHA1 or SHA3-384).","maxLength":96,"title":"Search Term","type":"string"}},"required":["search_term"],"title":"lookup_file_hashArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_task_results":{"post":{"operationId":"get_task_results","summary":"Get the status and scan results (YARA and ClamAV matches, unpacked files) of one YARAify scan task by its task id. Use f","description":"Get the status and scan results (YARA and ClamAV matches, unpacked files) of one YARAify scan task by its task id. Use for \"What were the YARAify scan results for task fb2763e9-7b84-11ec-9f01-42010aa4000b\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"task_id":{"description":"YARAify task id (UUID).","maxLength":36,"title":"Task Id","type":"string"}},"required":["task_id"],"title":"get_task_resultsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_files_by_yara_rule":{"post":{"operationId":"get_files_by_yara_rule","summary":"List recent files known to YARAify that share a match for one YARA rule, with hashes, size, type, sightings and first an","description":"List recent files known to YARAify that share a match for one YARA rule, with hashes, size, type, sightings and first and last seen dates. Use for \"Which files in YARAify carry YARA rule MALWARE_Win_Neshta\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"search_term":{"description":"The YARA rule name to look up, for example MALWARE_Win_Neshta.","maxLength":300,"title":"Search Term","type":"string"},"result_max":{"anyOf":[{"maximum":1000,"minimum":1,"type":"integer"},{"type":"null"}],"default":25,"description":"How many files to return (1 to 1000).","title":"Result Max"}},"required":["search_term"],"title":"get_files_by_yara_ruleArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_files_by_clamav_signature":{"post":{"operationId":"get_files_by_clamav_signature","summary":"List recent files known to YARAify that share a match for one ClamAV signature, with hashes, size, type, sightings and f","description":"List recent files known to YARAify that share a match for one ClamAV signature, with hashes, size, type, sightings and first and last seen dates. Use for \"Which files in YARAify carry ClamAV signature Win.Dropper.Gh0stRAT-978\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"search_term":{"description":"The ClamAV signature name to look up, for example Win.Dropper.Gh0stRAT-9789290-0.","maxLength":300,"title":"Search Term","type":"string"},"result_max":{"anyOf":[{"maximum":1000,"minimum":1,"type":"integer"},{"type":"null"}],"default":25,"description":"How many files to return (1 to 1000).","title":"Result Max"}},"required":["search_term"],"title":"get_files_by_clamav_signatureArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_files_by_imphash":{"post":{"operationId":"get_files_by_imphash","summary":"List recent files known to YARAify that share the same import hash (imphash), with hashes, size, type, sightings and fir","description":"List recent files known to YARAify that share the same import hash (imphash), with hashes, size, type, sightings and first and last seen dates. Use for \"Which files in YARAify carry imphash 680b9682922177224183342c\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"search_term":{"description":"The imphash to look up, for example 680b9682922177224183342c299d809f.","maxLength":300,"title":"Search Term","type":"string"},"result_max":{"anyOf":[{"maximum":1000,"minimum":1,"type":"integer"},{"type":"null"}],"default":25,"description":"How many files to return (1 to 1000).","title":"Result Max"}},"required":["search_term"],"title":"get_files_by_imphashArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_files_by_tlsh":{"post":{"operationId":"get_files_by_tlsh","summary":"List recent files known to YARAify that share a similar TLSH fuzzy hash, with hashes, size, type, sightings and first an","description":"List recent files known to YARAify that share a similar TLSH fuzzy hash, with hashes, size, type, sightings and first and last seen dates. Use for \"Which files in YARAify carry TLSH hash T140551236C8E05951CAEFD7\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"search_term":{"description":"The TLSH hash to look up, for example T140551236C8E05951CAEFD73315186AF9831824.","maxLength":300,"title":"Search Term","type":"string"},"result_max":{"anyOf":[{"maximum":1000,"minimum":1,"type":"integer"},{"type":"null"}],"default":25,"description":"How many files to return (1 to 1000).","title":"Result Max"}},"required":["search_term"],"title":"get_files_by_tlshArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_files_by_telfhash":{"post":{"operationId":"get_files_by_telfhash","summary":"List recent files known to YARAify that share the same telfhash (ELF import hash), with hashes, size, type, sightings an","description":"List recent files known to YARAify that share the same telfhash (ELF import hash), with hashes, size, type, sightings and first and last seen dates. Use for \"Which files in YARAify carry telfhash t1dd211d716b2195266ea0cd\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"search_term":{"description":"The telfhash to look up, for example t1dd211d716b2195266ea0cd9088eca7b2512c97.","maxLength":300,"title":"Search Term","type":"string"},"result_max":{"anyOf":[{"maximum":1000,"minimum":1,"type":"integer"},{"type":"null"}],"default":25,"description":"How many files to return (1 to 1000).","title":"Result Max"}},"required":["search_term"],"title":"get_files_by_telfhashArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_files_by_gimphash":{"post":{"operationId":"get_files_by_gimphash","summary":"List recent files known to YARAify that share the same gimphash (Go import hash), with hashes, size, type, sightings and","description":"List recent files known to YARAify that share the same gimphash (Go import hash), with hashes, size, type, sightings and first and last seen dates. Use for \"Which files in YARAify carry gimphash a081e2fab5999d99ed6be718\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"search_term":{"description":"The gimphash to look up, for example a081e2fab5999d99ed6be718af55e93df171d14b.","maxLength":300,"title":"Search Term","type":"string"},"result_max":{"anyOf":[{"maximum":1000,"minimum":1,"type":"integer"},{"type":"null"}],"default":25,"description":"How many files to return (1 to 1000).","title":"Result Max"}},"required":["search_term"],"title":"get_files_by_gimphashArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_files_by_icon_dhash":{"post":{"operationId":"get_files_by_icon_dhash","summary":"List recent files known to YARAify that share the same icon difference hash, with hashes, size, type, sightings and firs","description":"List recent files known to YARAify that share the same icon difference hash, with hashes, size, type, sightings and first and last seen dates. Use for \"Which files in YARAify carry icon dhash 92264e9e361ccdee\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"search_term":{"description":"The icon dhash to look up, for example 92264e9e361ccdee.","maxLength":300,"title":"Search Term","type":"string"},"result_max":{"anyOf":[{"maximum":1000,"minimum":1,"type":"integer"},{"type":"null"}],"default":25,"description":"How many files to return (1 to 1000).","title":"Result Max"}},"required":["search_term"],"title":"get_files_by_icon_dhashArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_recent_yara_rules":{"post":{"operationId":"list_recent_yara_rules","summary":"List the most recently deployed public (TLP:WHITE) YARA rules on YARAify with rule name, author, description, licence an","description":"List the most recently deployed public (TLP:WHITE) YARA rules on YARAify with rule name, author, description, licence and Malpedia family. Use for \"Which new public YARA rules were deployed on YARAify recently\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"list_recent_yara_rulesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}