JSON API

Static JSON, served with permissive CORS headers so you can build against the model from anywhere. No key, no rate limit, no tracking.

Endpoint	Contents
/api/model.json	The complete model: 8 domains, 58 sub-capabilities, all 348 level descriptors, evidence criteria, weights, crosswalks and the scoring rules.
/api/techniques.json	ATT&CK Enterprise v19.2 technique index (697 techniques) with tactics and platforms, as used by the assessment tool for scoping.
/api/levels.json	The 0–5 maturity scale with summaries and evidence bars.
/api/constraints.json	Scoring rules, maturity bands and the C1/C2/C3 integrity constraints.

Example

curl -s https://tid-cmm.com/api/model.json \
  | jq '.domains[] | {id, name, weight, subcaps: (.subcapabilities|length)}'

curl -s https://tid-cmm.com/api/model.json \
  | jq -r '.domains[].subcapabilities[] | [.id, .name, (.crosswalk.nist_csf_2|join(" "))] | @tsv'

Versioning

The payload always carries model.version. Breaking changes to the model shape bump the major version and are recorded in the changelog. ATT&CK content is pinned to the snapshot date in alignment.attack; it is not silently updated underneath you.

Licence

Model content CC-BY-4.0 — use it commercially, including in products, provided attribution is retained. ATT&CK content is © The MITRE Corporation under the ATT&CK Terms of Use.