# Abnormal AI

> Abnormal AI (formerly Abnormal Security) is a cloud email and human-behavior security company. Its behavioral AI platform protects Microsoft 365 and Google Workspace against phishing, business email compromise, vendor fraud, account takeover and misdirected email. The platform is API-first: every capability in the Abnormal Portal is also reachable through the Abnormal Security Client API, a bearer-token REST API published as OpenAPI 3.0.3 with separate US and EU production hosts.

Generated by the API Evangelist enrichment pipeline on 2026-08-02. Abnormal serves no /llms.txt of its own on any of its hosts (abnormal.ai/llms.txt returns 500; the API hosts return 401 to every anonymous request). This document is generated from apis.yml and the artifacts in this repo, not published by Abnormal.

## APIs

- [Abnormal Security Client API](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3): REST API for threats, cases, messages, AI Security Mailbox, employee and vendor insights, Detection 360, search and remediation, audit logs, RBAC roles and users, security posture management (SPM v2) and dashboard aggregations. 64 paths, 67 operations, 187 schemas. Base URL `https://api.abnormalplatform.com/v1` (US) or `https://eu.rest.abnormalsecurity.com/v1` (EU).

## Specs

- [OpenAPI 3.0.3 (verbatim)](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/openapi/abnormal-client-api-openapi-original.yml): harvested from SwaggerHub `abnormal-security/abx` 1.4.3.
- [SwaggerHub source](https://api.swaggerhub.com/apis/abnormal-security/abx/1.4.3): the live registry copy Abnormal publishes.
- [OpenAPI Overlay](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/overlays/abnormal-client-api-overlay.yaml): API Evangelist enhancements (provenance, region labels, token issuance, runtime conventions, webhook surface) applied without mutating the harvested spec.

## Getting started

- [Abnormal REST API Integration guide](https://abnormalsecurity.my.site.com/knowledgebase/s/article/Abnormal-REST-API-Integration): the three-step setup.
- [Abnormal Portal — Settings > Integrations](https://portal.abnormalsecurity.com/home/settings/integrations): where the API token is generated and where the source-IP allowlist is configured.
- Authentication: `Authorization: Bearer <ACCESS_TOKEN>`. There are no OAuth scopes; the token is a long-lived organization credential.
- Second control: requests from an IP outside the organization's allowlist are rejected with 403 even when the token is valid.
- Test mode: send `Mock-Data: True` alongside a real token and the production host returns the spec's documented example payloads instead of live tenant data. Declared on 36 of the 67 operations.

## Runtime conventions

- Pagination: `pageSize` + `pageNumber` in, `pageNumber` + `nextPageNumber` out. Follow `nextPageNumber` until it is absent or null. On `/threats` and `/auditlogs` these fields appear only when a `filter` parameter is supplied.
- Filtering: a `filter` expression string, most often a `receivedTime` or `lastModifiedTime` range with OData-style `gte`/`lte`. A range wider than the endpoint's window returns 400; a malformed filter returns 404.
- Idempotency: **not supported**. No `Idempotency-Key` header or parameter exists. Do not blindly retry writes — reconcile with `v1_threats_actions_retrieve`, `v1_cases_actions_retrieve` or `v1_search_activities_status_retrieve` first.
- Async: search and remediation return 202 Accepted; poll `v1_search_activities_status_retrieve` with the returned activity id.
- Rate limiting: HTTP 429 on 61 of 67 operations, expressed as concurrency per resource type per token. No `Retry-After` or `X-RateLimit-*` header is declared. Serialize paging loops and back off exponentially.
- Errors: `application/json` with a flat `{"error": "<message>"}` body. Not RFC 9457 problem+json.
- Regions: the token is bound to the tenant's region; EU tenants must call the EU host.

## Events

- [Webhooks](https://abnormal.ai/products/whats-new/stream-abnormal-event-data-in-near-real-time-with-webhooks): since 2026-04-23, Webhook is a SIEM integration type in the Portal. Seven event families — Threats, Vendor Cases, AI Security Mailbox, Audit Logs, Account Takeover, Security Posture Management, URL Rewriting Clicked. Subscriber-side auth by API Key, Basic, Bearer or Custom Header, with guaranteed retries and IP allowlisting. No AsyncAPI document is published.

## Artifacts

- [Authentication profile](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/authentication/abnormal-authentication.yml)
- [API conventions](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/conventions/abnormal-conventions.yml)
- [Error catalog](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/errors/abnormal-problem-types.yml)
- [Data model](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/data-model/abnormal-data-model.yml)
- [Lifecycle](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/lifecycle/abnormal-lifecycle.yml)
- [Sandbox / test mode](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/sandbox/abnormal-sandbox.yml)
- [Changelog](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/changelog/abnormal-changelog.yml)
- [Conformance](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/conformance/abnormal-conformance.yml)
- [Webhooks](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/asyncapi/abnormal-webhooks.yml)
- [Packages](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/packages/abnormal-packages.yml)
- [Agent skills](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/skills/_index.yml)
- [Candidate MCP tool surface](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/mcp/abnormal-mcp.yml)
- [Well-known probe index](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/well-known/abnormal-well-known.yml)
- [Domain security](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/security/abnormal-domain-security.yml)
- [Vulnerability disclosure](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/security/abnormal-vulnerability-disclosure.yml)
- [Trust center](https://raw.githubusercontent.com/api-evangelist/abnormal/refs/heads/main/security/abnormal-trust-center.yml)

## Company

- [Website](https://abnormal.ai/)
- [Platform overview](https://abnormal.ai/platform/overview)
- [What's New](https://abnormal.ai/platform/whats-new)
- [Blog](https://abnormal.ai/blog)
- [Technology integrations](https://abnormal.ai/resources/abnormal-technology-integrations)
- [Trust center](https://security.abnormal.ai/) — SOC 2, ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001:2023, CSA STAR, FedRAMP Moderate, GovRAMP, TX-RAMP, CMMC, Cyber Essentials Plus, CJIS, ITAR
- [Responsible disclosure](https://abnormal.ai/legal/disclosure) — security@abnormal.ai, five business day acknowledgement, no bug bounty
- [Status page](https://status.abnormalsecurity.com/)
- [Terms of use](https://abnormal.ai/legal/terms-of-use)
- [Privacy](https://abnormal.ai/legal/privacy)
- [Subprocessors](https://abnormal.ai/legal/subprocessors)
- [GitHub](https://github.com/abnormal-ai)

## Not published

- No official SDK in any language, and no CLI.
- No public Postman collection or workspace.
- No MCP server (Abnormal's own MCP server is internal to their engineering team).
- No A2A agent card at either `/.well-known/agent-card.json` or `/.well-known/agent.json` on any host.
- No `/.well-known/security.txt`, no `/.well-known/api-catalog`, no `/llms.txt`.
- No AsyncAPI document, no GraphQL surface, no gRPC/protobuf.
- No published API deprecation policy, Sunset header support, or SLA.