Docs
Export: STIX 2.1 and TagPack
What the Curated band asserts can leave as a STIX 2.1 bundle or as a GraphSense TagPack, with the claim id, the citation and the fetch behind every object, so a consumer can verify what it imported. Ids are deterministic: the same claim always becomes the same object, and two bundles merge. Sources that forbid redistribution never enter a bundle (decision P38); the bundle says which ones it left out.
Bundles
GET /v1/export/stix?subject=address:bc1q… # one subject: its observable, every claim, the events; community=true adds notes and labels (P29)
GET /v1/export/stix?entity=<id> # one entity: its object, its claims (paged), relations and events
GET /v1/export/stix?source=<id>&since=2026-09-01&limit=200&cursor=… # a source, paged by claim id; relations and events on the first page
GET /v1/claims/ann_9990.stix # one claim
Content-Type: application/stix+json;version=2.1
X-Next-Cursor: 1234 # only when a further page exists (also x_btcintel_next_cursor in the bundle)A bundle carries the btcintel creator identity, the TLP:WHITE marking, the observables (cryptocurrency-wallet, cryptocurrency-transaction with their extension definitions), the source identities, the entities and the derived objects. x_btcintel_bundle_sha256 is the SHA-256 of the RFC 8785 serialisation of objects; the bundle id derives from it, so identical content is the same bundle. Attributions and chain observations are not exported: they are outside the CTI scope.
The mapping
| btcintel | STIX 2.1 |
|---|---|
| abuse or sanction annotation | indicator (a pattern on the observable, valid_from/valid_until, confidence = level, revoked when retracted) + sighting where the source saw it + relationship indicates the entity |
| ownership or service annotation with an entity | relationship attributed-to from the observable to the entity |
| entity | identity, threat-actor, malware or tool from the vocabulary's map; an entity with an ATT&CK group id is an intrusion-set (P48) |
| entity relation | relationship of the mapped type (operated-by, derived-from, …) |
| event | report citing the source, the entities and the observables it names |
| source | identity with the attribution text and the licence in external_references |
| Community note and label (opt-in) | note and opinion by an individual identity carrying the pubkey |
Every derived object carries x_btcintel_claim — the claim id, its version, the content hash, the citation, the confidence class, the validity and the fetch — and an external_references entry with the fetch URL and its SHA-256. Ids are type--uuid5(NS, type + ":" + key) with NS = uuid5(DNS, "btcintel.io"); observables follow the STIX deterministic-id rule. The full table with the namespaces and the property lists is docs/stix-mapping.md in the API repository.
TagPacks
GET /v1/export/tagpack?source=ofac-sdn # Content-Type: application/yaml
title: btcintel — OFAC SDN
creator: btcintel (https://btcintel.io)
lastmod: 2026-09-28
currency: BTC
confidence: authority_data # the source's default class; a tag names its own when it differs
source: https://btcintel.io/sources/ofac-sdn
tags:
- address: 1A1z…
label: 'SDN: CYBER2'
abuse: sanction # DW-VA short ids
lastmod: 2026-09-02
source: https://… # the fetch
context: '{"claim_id":"ann_9990","citation":"btcintel:annotations:9990@v1 sha256:…","entity_id":"ofac-58287"}'
actor: …One file per source, the current address annotations only. The same format comes back in: a source registered with parser: tagpack-yaml imports a third-party TagPack, keeping the pack's confidence word in source_confidence and mapping category, abuse and confidence to the vocabulary (a word we do not know skips that tag; a tag without an address or a label refuses the file). The pack's creator becomes the source's attribution.
What this is not
Not a risk feed: an indicator's confidence is the class level of the claim behind it, never a score on the address (decision P1), and nothing here is fused across sources. Read the semantics before you wire a bundle into anything that decides.