{"name":"France Cyberwatch API","description":"Read-only public API over the France Cyberwatch 2025—2026 dataset. Open CORS, cached at the edge, no key required. Human-readable docs: /docs and /fr/docs. Streamable HTTP MCP: POST /mcp.","docs":"https://cyberwatch-france.vercel.app/docs","mcp":{"url":"https://cyberwatch-france.vercel.app/mcp","transport":"streamable-http","docs":"https://cyberwatch-france.vercel.app/docs#mcp","webmcp":"https://cyberwatch-france.vercel.app/docs#webmcp"},"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"counts":{"incidents":14,"sources":60,"patterns":6},"conventions":{"affected":"A null `affected` means the number is unknown or unpublished. It is never 0. Do not sum it, do not plot it as none, and do not treat a missing CSV cell as an empty incident.","disputed":"An incident with status \"disputed\" is a real breach whose headline scope is contested. Attacker-claimed figures live in `affectedLabel` text and never in the numeric field, and never in an aggregate.","attribution":"Attackers are only named where the cited source supports it. Do not infer a group from the method or the sector.","scope":"This is a curated set of major publicly reported incidents, not every French breach. Cite the original `sourceUrl` on each record."},"endpoints":[{"path":"/api","description":"Self-describing index: conventions, every endpoint, parameters and examples. Pass `?lang=fr` for French text. HTML docs stay at /docs.","query":{"lang":"en | fr"},"examples":["https://cyberwatch-france.vercel.app/api","https://cyberwatch-france.vercel.app/api?lang=fr"]},{"path":"/api/incidents","description":"List and search incidents. JSON includes full localized `detail` on each row (unlike MCP `list_incidents`, which returns compact rows). Unknown counts sort last when `sort=affected`, never as zero. CSV leaves the affected cell empty. Feed and llms routes also accept `?lang=fr`.","query":{"q":"Full-text across organisation, sector, method, data, risk, confidence, source and the longer incident-page fields.","kind":"government | company","severity":"critical | high | medium | low","status":"confirmed | disputed | unknown","sector":"Exact sector name, case-insensitive.","year":"e.g. 2026","from":"ISO date, inclusive lower bound.","to":"ISO date, inclusive upper bound.","sort":"date | affected | org (default date)","order":"desc | asc (default desc)","limit":"1–200, default 100","offset":"default 0","format":"json | csv","lang":"en | fr"},"examples":["https://cyberwatch-france.vercel.app/api/incidents?kind=government&severity=critical","https://cyberwatch-france.vercel.app/api/incidents?q=iban&lang=fr","https://cyberwatch-france.vercel.app/api/incidents?year=2026&sort=affected&format=csv"]},{"path":"/api/incidents/{id}","description":"One incident with its localized `detail` (lead, timeline, how, taken, notTaken, impact, response, methodDisclosure, optional revision and quotes) plus `lastResearched`, `source` and `sources`. Each source has `kind` (primary | official | secondary), `publisher` and optional `published`. Unknown ids return 404 and list the valid ones. CSV is not offered here; list CSV stays compact and still leaves unknown `affected` empty.","query":{"lang":"en | fr"},"examples":["https://cyberwatch-france.vercel.app/api/incidents/ants"]},{"path":"/api/summary","description":"ANSSI and CNIL national figures, plus counts derived from this list. Aggregates never include unknown or disputed attacker claims.","query":{"lang":"en | fr"},"examples":["https://cyberwatch-france.vercel.app/api/summary","https://cyberwatch-france.vercel.app/api/summary?lang=fr"]},{"path":"/api/sources","description":"Every source, with `kind` (primary | official | secondary), `publisher`, optional `published` date, and the incidents that cite it.","examples":["https://cyberwatch-france.vercel.app/api/sources"]},{"path":"/api/patterns","description":"Recurring weaknesses and the priority control for each.","query":{"lang":"en | fr"},"examples":["https://cyberwatch-france.vercel.app/api/patterns?lang=fr"]},{"path":"/api/recommendations","description":"Guidance for organisations and the public. Public items include explainerSlug when a matching /learn guide exists.","query":{"audience":"organizations | public","lang":"en | fr"},"examples":["https://cyberwatch-france.vercel.app/api/recommendations?audience=public&lang=fr"]}],"ids":["dgfip","sante","ceva","edustaff","ants","edustudents","educompas","ficoba","interior","eurofiber","weda","airfrance","bouygues","orange"]}