---
title: OpenCTI Graphql
slug: connectors/opencti-graphql
docTags: 
createdAt: 2026-08-05T04:45:03.068Z
---

OpenCTI is an open-source platform that facilitates the management and analysis of cyber threat intelligence.

OpenCTI is a comprehensive threat intelligence platform that centralizes and analyzes cyber threat data. The OpenCTI GraphQL connector enables Swimlane Turbine users to execute GraphQL queries and mutations directly against the OpenCTI API, facilitating seamless retrieval and analysis of threat intelligence data. By integrating with OpenCTI GraphQL, users can automate the extraction of valuable threat insights, enhancing their security operations and decision-making processes.

### Limitations

None to date.

### Supported Versions

This connector targets the OpenCTI GraphQL API as documented at [https://docs.opencti.io/latest/reference/api/](https://docs.opencti.io/latest/reference/api/).

### Additional Docs

- [OpenCTI API Documentation](https://docs.opencti.io/latest/reference/api/)
- [OpenCTI GraphQL Playground](https://docs.opencti.io/latest/reference/api/#graphql-playground)

## Configuration

## Prerequisites

Before you can use the OpenCTI GraphQL connector for Turbine, you'll need access to the OpenCTI API. This requires the following:

- HTTP Bearer authentication using the following parameters:
  - URL: The endpoint URL for accessing the OpenCTI API.
  - API Key: A valid API key to authenticate requests to the OpenCTI API.

## Authentication Methods

To use the OpenCTI GraphQL connector within the Swimlane Turbine platform, ensure you have:

- Bearer token (API key) authentication:
  - URL: The base URL of your OpenCTI instance.
  - API Key: Your OpenCTI API key, used as a Bearer token.

## Capabilities

This OpenCTI GraphQL Connector provides the following capabilities:

- Execute GraphQL Query

### Execute GraphQL Query

- Execute an arbitrary GraphQL query or mutation against the OpenCTI `/graphql` endpoint and return the JSON response. [Click Here](https://docs.opencti.io/latest/reference/api/).

## Notes

- More information on OpenCTI can be found [here](https://docs.opencti.io/latest/).

# Configurations

## OpenCTI GraphQL Bearer Authentication

Authenticates to the OpenCTI API using a Bearer token (API key).

### Configuration Parameters

| **Parameter** | **Description**                                                                                             | **Type** | **Required** |
| ------------- | ----------------------------------------------------------------------------------------------------------- | -------- | ------------ |
| url           | Base URL of the OpenCTI instance (for example, [https://opencti.example.com](https://opencti.example.com)). | string   | Required     |
| token         | OpenCTI API key used as a Bearer token in the Authorization header.                                         | string   | Required     |
| verify\_ssl   | Verify SSL certificate                                                                                      | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through.                                                                          | string   | Optional     |

# Actions

## Execute GraphQL Query

Execute a GraphQL query or mutation against the OpenCTI /graphql endpoint and return the JSON response. Requires a JSON body with a query.

### Endpoint

- **URL:** `graphql`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                                                       |
| ----------------- | -------- | ------------ | ------------------------------------------------------------------------------------- |
| `query`           | string   | Optional     | GraphQL query or mutation string to execute against the OpenCTI API.                  |
| `variables`       | object   | Optional     | Optional variables object to pass to the GraphQL query.                               |
| `operationName`   | string   | Optional     | Optional operation name. Required when the query string contains multiple operations. |

### Input Example

`{"json_body":{"query":"query StixCyberObservables($search: String) {\n  stixCyberObservables(search: $search) {\n    edges {\n      node {\n        id\n        entity_type\n        observable_value\n      }\n    }\n  }\n}","variables":{"search":"8.8.8.8"}}}`

### Output

| **Parameter**       | **Type** | **Description**                                                |
| ------------------- | -------- | -------------------------------------------------------------- |
| `status_code`       | number   | HTTP response status code returned by the OpenCTI API.         |
| `reason`            | string   | HTTP reason phrase. OK indicates success.                      |
| `data`              | object   | GraphQL response data. Shape depends on the executed query.    |
| `errors`            | array    | List of GraphQL errors returned for the request, when present. |
| `errors.message`    | string   | Response message                                               |
| `errors.path`       | array    | Error message if any                                           |
| `errors.extensions` | object   | Error message if any                                           |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"stixCyberObservables":{}}}}`

# Response Headers

| **Header**   | **Description**                                       | **Example**                   |
| ------------ | ----------------------------------------------------- | ----------------------------- |
| Content-Type | The media type of the resource                        | application/json              |
| Date         | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |