Feeds & JSON API
The panel's structured judgment — findings, actions, entities, and evidence — is available as machine-readable JSON so you can pipe it into a threat-intel platform, a SOAR runbook, or your #soc-triage channel. Everything here is public and free; nothing exceeds what the public session page already renders.
Per-session JSON
Each public archived session has a JSON document at a stable address that mirrors its page:
GET /api/session/{date}/{edition}
GET /api/session/{date}/custom/{runId}The document is versioned (schema_version: "today_session.v1") and carries run, findings, actions (the full action object below), open_questions, entities, sources, confidence (both the raw numeric and the verbal tier), and correction_notes. Non-public runs return 404. Responses carry a strong ETag and a 6-hour public cache.
Export field policy
The export never exceeds the public session page:
- findings, actions, sources, confidence (numeric + verbal) — full export.
- entities — the public entity set only (label + kind, deduped, capped).
- open_questions — question / raised_by / context as rendered; no internal ids or scores.
- raw memory rows, reasoning, token counts, costs, model ids, internal run fields — never exported.
Action feed
One item per action across the most recent public sessions, newest first:
GET /podcast.xml (RSS 2.0, daily edition audio)
GET /action-feed.xml (RSS 2.0)
GET /api/action-feed (JSON)Podcast feed. /podcast.xml is the public daily-edition podcast RSS feed. Each item links back to the archived edition page and carries anaudio/mpeg enclosure with the public MP3 URL plus the stored byte length. Episode descriptions come from the published show notes, including the AI disclosure.
Each item is the shared action object:
{
"action_schema_version": "today_action.v1",
"guid": "<run-id>:action:0",
"source_ordinal": 0,
"anchor": "action-01",
"item": "Isolate exposed SharePoint until patched…",
"priority": "critical",
"owner_role": "cloud_security",
"attributed_roles": ["cloud_security"],
"time_horizon": "first_2_hours",
"cves": ["CVE-2026-45659"],
"cve_links": [{ "cve": "CVE-2026-45659", "url": "https://msrc.microsoft.com/…" }],
"evidence_urls": [],
"products": ["SharePoint"],
"versions": { "affected": [], "fixed": [] },
"specificity": "named",
"watch_logs": [],
"acm": {
"acm_envelope_version": "acm_public_envelope.v1",
"continuity_id": "<uuid>",
"continuity_status": "still_open",
"fingerprint": "product|sharepoint|remediate_patch_mitigate",
"subject_type": "product",
"resolved_subject_id": "sharepoint",
"action_class": "remediate_patch_mitigate",
"scoped_id": null,
"first_seen_at": "2026-07-20T07:00:00.000Z",
"last_material_update_at": "2026-07-20T07:00:00.000Z",
"first_seen_edition_seq": 1,
"last_material_edition_seq": 1,
"active_horizon_days": 10,
"active_horizon_editions": 20,
"comparison_edition_run_id": null,
"delta_reason": null,
"status_rationale": "Standing guidance carried forward.",
"severity": "CRITICAL",
"source_ordinal": 0
}
}attributed_rolescontains only public expert role keys corroborated by that session's response interactions. It is an empty array when attribution cannot be derived; consumers should never infer a role from action text.
Action Continuity Model (acm). When the authoritative publish boundary labeled the action, each JSON action object (session JSON, /api/action-feed, and profile-filtered action feeds) carries an additive acm envelope with continuity_status (new | updated | still_open) plus public-safe lineage fields. Absent acm never means New — do not invent novelty from published_at, corrections, or feed order. The RSS feed (/action-feed.xml) exposes the same status as a <category> and a Continuity: … description prefix only when the envelope is present.
GUID policy. An item's GUID is <run-id>:action:<source-ordinal>— stable across corrections. A correction updates the item's content in place at the same GUID; it never mints a new one, so your dedupe keeps working. The session document's updated_atmoves when a correction lands. Corrections and GUID stability do not change ACM status by themselves.
Ledger movement feed
One item per public Cyber Decision Ledger lifecycle event — record published, update approved, prediction opened/resolved, correction, retraction, evidence change, and archive — newest first. Same public gate the ledger pages use; never paywalled:
GET /ledger/feed.xml (RSS 2.0)
GET /api/ledger-feed (JSON)Each item is the shared ledger-movement object (verbal confidence/severity labels only):
{
"ledger_movement_schema_version": "ledger_movement.v2",
"guid": "crt-move-<opaque-stable-hash>",
"event_kind": "record_published",
"title": "New public decision record: Example Decision Record",
"record_title": "Example Decision Record",
"record_permalink": "https://cyberroundtable.ai/ledger/example-record",
"record_slug": "example-record",
"record_number": "CRT-2026-0007",
"citation": "CRT-2026-0007 · Published 2026-07-08 · https://cyberroundtable.ai/ledger/example-record",
"confidence_label": "High confidence",
"severity_label": "Critical",
"occurred_at": "2026-07-08T12:00:00.000Z",
"summary": "Patch the affected ShareFile deployments before the weekend.",
"first_action_sentence": "Inventory internet-facing ShareFile instances.",
"anchors": [
{ "canonical_key": "cve:cve-2026-2222", "value": "CVE-2026-2222" },
{ "canonical_key": "vendor:progress", "value": "Progress" }
],
"primary_source_urls": ["https://www.progress.com/security/advisory"],
"guidance_as_of": "2026-07-09T08:00:00.000Z"
}GUID policy.An item's GUID is the Public Value Timeline event identity (e.g. initial_publication:<record-id>:<version-id>) — stable across re-projection. Private, held, or rejected records never emit items.
STIX 2.1 action feed (Team / keyed)
Team machine-access keys (and Pro personal keys with feed/STIX scope) can fetch a STIX 2.1 bundle that projects the same public action objects as the JSON action feed — one content model, two formats. There is no anonymous STIXin v1; bulk formats are the key's value.
GET /api/stix/action-feed
Authorization: Bearer crt_…
# or: X-Api-Key: crt_…The response is a STIX 2.1 bundle (Content-Type: application/stix+json;version=2.1) with vulnerability objects per CVE (plus an x_crt_kev flag when the CVE is in a fresh CISA KEV snapshot), course-of-action objects from each action, report objects per session action, and mitigates relationships. Bundle metadata carries x_crt_mapping_version for the versioned mapping contract. Fields that do not map cleanly (priority, owner role, attributed roles, watch logs, numeric confidence, …) are explicitly dropped — never improvised.
ACM on STIX. Continuity metadata is projected only as the custom extension property x_crt_acm on course-of-action objects (same public envelope fields as JSON acm). It is never mapped into unrelated standard STIX properties. When the action has no envelope, x_crt_acm is omitted — absence does not mean New.
TAXII posture (v1). Cyber Roundtable does not run a TAXII 2.x server in v1. Clients fetch the HTTPS bundle endpoint above; discovery, collections, and TAXII inbox/outbox are out of scope until a later slice.
Keyless requests receive 401. Invalid, revoked, or entitlement-lapsed keys are rejected by the same key-auth seam as keyed JSON feeds, under the same rate/volume envelope.
Schema versioning
The session document is today_session.v1, the shared action object is today_action.v1, and the ledger-movement object is ledger_movement.v2. Additive changes stay within v1; a breaking change mints v2 while v1 keeps serving — append ?schema=v1 to either ledger-movement endpoint to keep receiving the previous shape. Pin the version you parse.
Slack webhook template
This template is the self-hosted pull route: wire the JSON feed into your own automation (your scheduler plus an incoming webhook) to land actions in a channel. On this route we do not store your webhook URL — that stays with you. Map each feed item into this payload:
{
"text": ":rotating_light: New cyber action — <${SESSION_URL}|open session>",
"blocks": [
{
"type": "section",
"text": {
"type": "mrkdwn",
"text": "*${PRIORITY}* · <${SESSION_URL}|${OWNER}>\n${ITEM}"
}
},
{
"type": "context",
"elements": [
{ "type": "mrkdwn", "text": "CVEs: ${CVES} · Horizon: ${TIME_HORIZON}" }
]
}
]
}On this route the "07:00 push into #soc-triage" outcome is your automation calling this feed on your schedule.
Connected delivery (Team organizations)
Team organizations can instead register a delivery target and have Cyber Roundtable push ledger-movement events to it — no scheduler of your own. This route is opt-in and separate from the template above: because we deliver, we store the destination URL and any shared secret encrypted at rest, and you can revoke a target at any time. Deliveries are signed for the generic HTTPS channel, retried with backoff, and de-duplicated per target and event, so a retry or a re-scan never sends the same event twice.
Delivered payloads carry the same public fields as the feed item — event kind, record identity and permalink, the decision summary, the first action sentence, the event-moment anchors and the guidance timestamp. Event keys are opaque: internal record identifiers are never sent.