fix(ransomware-live): keyless — drop optional API key, no auth required

Ransomware.live's v2 API is free and needs no authentication. Remove the
optional api_key config field and the X-API-KEY header logic from all commands
so instance creation requires no credentials. Only an optional base_url override
remains.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

integrations/ransomware-live/manifest.yaml

@@ -1,19 +1,14 @@
 id: ransomware_live
 name: Ransomware.live
 version: 1.0.0
-description: "Ransomware.live (API v2) — OSINT tracking of ransomware & extortion groups and their claimed victims. Query recent victims, list and profile threat groups, pull a group's victims, and search victims by keyword, country, or date. Ideal for third-party/supply-chain exposure checks (is a partner or domain listed as a victim?). An API key is optional — set it if your ransomware.live plan requires one; it is sent as the X-API-KEY header. Stdlib-only, no extra Python dependencies."
+description: "Ransomware.live (API v2) — OSINT tracking of ransomware & extortion groups and their claimed victims. Query recent victims, list and profile threat groups, pull a group's victims, and search victims by keyword, country, or date. Ideal for third-party/supply-chain exposure checks (is a partner or domain listed as a victim?). Free and keyless — no authentication required. Stdlib-only, no extra Python dependencies."
 changelog: "1.0.0 — Initial release: recent victims, groups, group profile, group victims, search victims (keyword/country/date), recent cyberattacks."
 category: threat_intel
 
-# Per-instance configuration. Ransomware.live's v2 API may require a free API key
-# depending on your plan; leave it blank to call keyless endpoints. When set, it
-# is sent as the X-API-KEY header.
+# Ransomware.live's v2 API is free and requires no authentication. The only
+# configuration is an optional base URL override.
 config_schema:
   properties:
-    api_key:
-      type: string
-      description: "Ransomware.live API key (optional — sent as X-API-KEY when set)"
-      x-soar-sensitive: true
     base_url:
       type: string
       description: "API base URL"

integrations/ransomware-live/scripts/country_victims.py

@@ -14,9 +14,6 @@ def _inputs():
 def _get(cfg, path):
     base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/")
     headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"}
-    key = str(cfg.get("api_key") or "").strip()
-    if key:
-        headers["X-API-KEY"] = key
     req = urllib.request.Request(base + path, headers=headers)
     with urllib.request.urlopen(req, timeout=60) as r:
         raw = r.read()

integrations/ransomware-live/scripts/get_group.py

@@ -14,9 +14,6 @@ def _inputs():
 def _get(cfg, path):
     base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/")
     headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"}
-    key = str(cfg.get("api_key") or "").strip()
-    if key:
-        headers["X-API-KEY"] = key
     req = urllib.request.Request(base + path, headers=headers)
     with urllib.request.urlopen(req, timeout=60) as r:
         raw = r.read()

integrations/ransomware-live/scripts/group_victims.py

@@ -14,9 +14,6 @@ def _inputs():
 def _get(cfg, path):
     base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/")
     headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"}
-    key = str(cfg.get("api_key") or "").strip()
-    if key:
-        headers["X-API-KEY"] = key
     req = urllib.request.Request(base + path, headers=headers)
     with urllib.request.urlopen(req, timeout=60) as r:
         raw = r.read()

integrations/ransomware-live/scripts/list_groups.py

@@ -14,9 +14,6 @@ def _inputs():
 def _get(cfg, path):
     base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/")
     headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"}
-    key = str(cfg.get("api_key") or "").strip()
-    if key:
-        headers["X-API-KEY"] = key
     req = urllib.request.Request(base + path, headers=headers)
     with urllib.request.urlopen(req, timeout=60) as r:
         raw = r.read()

integrations/ransomware-live/scripts/recent_cyberattacks.py

@@ -14,9 +14,6 @@ def _inputs():
 def _get(cfg, path):
     base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/")
     headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"}
-    key = str(cfg.get("api_key") or "").strip()
-    if key:
-        headers["X-API-KEY"] = key
     req = urllib.request.Request(base + path, headers=headers)
     with urllib.request.urlopen(req, timeout=60) as r:
         raw = r.read()

integrations/ransomware-live/scripts/recent_victims.py

@@ -14,9 +14,6 @@ def _inputs():
 def _get(cfg, path):
     base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/")
     headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"}
-    key = str(cfg.get("api_key") or "").strip()
-    if key:
-        headers["X-API-KEY"] = key
     req = urllib.request.Request(base + path, headers=headers)
     with urllib.request.urlopen(req, timeout=60) as r:
         raw = r.read()

integrations/ransomware-live/scripts/search_victims.py

@@ -14,9 +14,6 @@ def _inputs():
 def _get(cfg, path):
     base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/")
     headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"}
-    key = str(cfg.get("api_key") or "").strip()
-    if key:
-        headers["X-API-KEY"] = key
     req = urllib.request.Request(base + path, headers=headers)
     with urllib.request.urlopen(req, timeout=60) as r:
         raw = r.read()

integrations/ransomware-live/scripts/test_connection.py

@@ -14,9 +14,6 @@ def _inputs():
 def _get(cfg, path):
     base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/")
     headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"}
-    key = str(cfg.get("api_key") or "").strip()
-    if key:
-        headers["X-API-KEY"] = key
     req = urllib.request.Request(base + path, headers=headers)
     with urllib.request.urlopen(req, timeout=60) as r:
         raw = r.read()

integrations/ransomware-live/scripts/victims_by_date.py

@@ -14,9 +14,6 @@ def _inputs():
 def _get(cfg, path):
     base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/")
     headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"}
-    key = str(cfg.get("api_key") or "").strip()
-    if key:
-        headers["X-API-KEY"] = key
     req = urllib.request.Request(base + path, headers=headers)
     with urllib.request.urlopen(req, timeout=60) as r:
         raw = r.read()