JSON endpoints
Versioned static JSON, served with permissive CORS so you can build against the model from anywhere. No key, no rate limit, no tracking.
To be precise about what this is: versioned data files
on a CDN, not a service. Everything is GET. There is no endpoint that scores an
assessment for you and there never will be — the assessment runs entirely in your
browser and the point is that nothing you enter leaves it.
Endpoints
| Endpoint | Contents |
|---|---|
/api/model.json | The complete model: 8 domains, 58 sub-capabilities, all 348 level descriptors, evidence criteria, weights, crosswalks and scoring rules. |
/api/techniques.json | ATT&CK Enterprise v19.2 technique index (697 techniques) with tactics and platforms. |
/api/levels.json | The 0–5 maturity scale with summaries and evidence bars. |
/api/constraints.json | Scoring rules, maturity bands and the C1–C4 integrity constraints, in the order they are applied. |
/api/tiers.json | The five maturity tiers with minimum scores and entry gates. |
/api/profiles.json | The three applicability profiles, detection classes and environment archetypes. |
Example
curl -s https://tid-cmm.com/api/model.json \
| jq '.domains[] | {id, name, weight, subcaps: (.subcapabilities|length)}'
curl -s https://tid-cmm.com/api/model.json \
| jq -r '.domains[].subcapabilities[] | [.id, .name] | @tsv'Versioning
The payload always carries model.version. Breaking changes to the model shape
bump the major version and are recorded in the changelog. ATT&CK
content is pinned to a snapshot date; it is not silently updated underneath you.