JSON endpoints
Versioned static JSON, served with permissive CORS so you can build against the model from anywhere. No key, no rate limit, no tracking.
To be precise about what this is: versioned data files
on a CDN, not a service. Everything is GET. There is no endpoint that scores an
assessment for you and there never will be — the assessment runs entirely in your
browser, and the point is that the tool has no upload or submit path for what you enter.
Endpoints
| Endpoint | Contents |
|---|---|
/api/model.json | The complete model: 8 domains, 58 sub-capabilities, all 348 level descriptors, evidence criteria, weights, crosswalks and scoring rules. |
/api/techniques.json | ATT&CK Enterprise v19.2 technique index (697 techniques) with tactics and platforms. |
/api/levels.json | The 0–5 maturity scale with summaries and evidence bars. |
/api/constraints.json | Scoring rules, maturity bands and the C1–C4 integrity constraints, in the order they are applied. |
/api/tiers.json | The five maturity tiers with minimum scores and entry gates. |
/api/profiles.json | The three applicability profiles, detection classes and environment archetypes. |
/api/tid-cmm-export.schema.json | JSON Schema for the file the assessment tool writes for TIR-CMM — the TIR-CMM export, a superset of TIR-CMM’s import contract. |
Example
curl -s https://tid-cmm.com/api/model.json \
| jq '.domains[] | {id, name, weight, subcaps: (.subcapabilities|length)}'
curl -s https://tid-cmm.com/api/model.json \
| jq -r '.domains[].subcapabilities[] | [.id, .name] | @tsv'Handing an assessment to TIR-CMM
The assessment tool exports a document that satisfies TIR-CMM’s import contract and adds provenance: model version, assessment depth, the constraint log and every derivation. TIR-CMM reads the detection score as the ceiling on response. Since model 1.6.0 per-technique status can be 2 or 3 where the detection register evidences it, and registered scenarios travel as attack paths; the export schema was relaxed for both and the import contract was already wide enough. TIR-CMM 1.0 imports the core handoff context it recognises — the detection score, crown jewels with their asset classes, adversaries, and the stage and asset-class scope of the attack paths; the extended 1.6 detail travels in the file but is not yet consumed by that importer. The shape, the mappings and the rules the export imposes on itself are on the data model page. There is no endpoint involved: the file is written in your browser and you carry it across.
Versioning
The payload always carries model.version. Breaking changes to the model shape
bump the major version and are recorded in the changelog. ATT&CK
content is pinned to a snapshot date; it is not silently updated underneath you.