openapi: 3.0.3
info:
  title: Abnormal Security Client API
  version: 1.4.3
  description: |
    This is the specification for Abnormal Security Client API which can be used for managing security threats detected by Abnormal Security.
    <h2>Who is this API for?</h2>
    This API is for managing threats to an organization identified by Abnormal Security. The organization should be integrated with Abnormal Security and enabled for real-time detection of malicious emails.
    <h2> Integration Steps </h2>
    Go to `https://portal.abnormalsecurity.com/home/settings/integrations` & click on `Abnormal REST API`
    <h3> Step 1: Generating the authentication token </h3>

    Retrieve your authentication token via the <a href="https://portal.abnormalsecurity.com/home/settings/integrations">Abnormal portal</a>. You will use this token to view and modify your Abnormal-detected threats and cases.

    Keep the token safe, as it grants access to sensitive threat data related to your organization. Store it in a secure place, such as an encrypted password vault, and do not share it unless absolutely necessary. If you feel that the token has been compromised, please contact your Account Manager immediately.

    Once obtained, the token can be used in a request from any HTTP client, such as cURL:
    <pre> curl -H "Authorization: Bearer  << ACCESS_TOKEN >>" https://api.abnormalplatform.com/v1/threats </pre>

    <h3> Step 2: IP allowlisting </h3>

    IP allowlisting ensures that API access is only possible from IP addresses explicitly belonging to your organization. It prevents users from unauthorized networks to access your Abnormal SOAR data. This second layer of security helps keep your data safe from unauthorized users, and protects you in the event of a token compromise.

    To allowlist your organization's IPs, please provide enter into the <a href="https://portal.abnormalsecurity.com/home/settings/integrations">Abnormal portal</a> specific IPv4 / IPv6 addresses, or a range of addresses using a <a href="https://www.ipaddressguide.com/cidr"> CIDR block</a>.

    <h3> Step 3: Try it out with Test Data </h3>

    To confirm that <b>Steps 1 & 2</b> have been configured properly, send a request to the server with the following header set:

    <pre> curl -H "Authorization: Bearer  << ACCESS_TOKEN >>" <b>-H "Mock-Data: True"</b> https://api.abnormalplatform.com/v1/threats </pre>

    The server should respond with a body payload similar to the examples specified in this documentation.

    <h3> Note for EU Customers </h3>

    If you're a customer in the EU, you'll need to make API requests to our EU host `https://eu.rest.abnormalsecurity.com`. If you'd like to test the API through SwaggerHub, you'll find both the default host and the EU host in the Servers dropdown menu below.
  termsOfService: https://legal.abnormalsecurity.com/legal-hub/abnormal-security-api-terms-of-service-6feee5e3
  contact:
    name: Abnormal Security Support
    email: support@abnormalsecurity.com
paths:
  /abuse_mailbox/not_analyzed:
    get:
      operationId: v1_abuse_mailbox_not_analyzed_retrieve
      summary: Get a list of messages submitted to AI Security Mailbox (formerly known
        as Abuse Mailbox) that were not analyzed.
      parameters:
      - in: query
        name: start
        schema:
          type: string
          format: date-time
        description: The start of the datetime range, as an RFC 3339 timestamp, to
          fetch unanalyzed messages from. Defaults to 90 days before end.
        examples:
          Start:
            value: '2022-01-01T00:00:00Z'
            summary: start
      - in: query
        name: end
        schema:
          type: string
          format: date-time
        description: The end of the datetime range, as an RFC 3339 timestamp, to fetch
          unanalyzed messages from. Defaults to the current time.
        examples:
          End:
            value: '2022-01-07T23:59:59Z'
            summary: end
      tags:
      - AI Security Mailbox (formerly known as Abuse Mailbox)
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AbuseMailboxUnanalyzedResponse'
          description: Unanalyzed message information
        '400':
          $ref: '#/components/responses/InvalidDateError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /abusecampaigns:
    get:
      operationId: v1_abusecampaigns_retrieve
      summary: Get a list of campaigns submitted to AI Security Mailbox (formerly
        known as Abuse Mailbox)
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the keys `lastReportedTime` and `receivedTime` are supported for `/abusecampaigns`.
          At least one of `gte`/`lte` must be specified, with a datetime string following
          the `YYYY-MM-DDTHH:MM:SSZ` format. `lastReportedTime` defaults to the last
          24h if unspecified. Do note that provided filter time is in UTC.
        explode: false
        style: spaceDelimited
        examples:
          LastReportedTime:
            value: lastReportedTime gte 2020-01-01T00:00:00Z lte 2021-12-01T00:00:00Z
            summary: lastReportedTime
      - in: query
        name: sender
        schema:
          type: string
        description: Filters threats based on the name or email address of the sender
      - in: query
        name: recipient
        schema:
          type: string
        description: Filters threats based on the name or email address of the recipient
      - in: query
        name: subject
        schema:
          type: string
        description: Filters threats based on the email subject
      - in: query
        name: reporter
        schema:
          type: string
        description: Filters threats based on the reporter name or email address
      - in: query
        name: attackType
        schema:
          type: string
          enum:
          - Internal-to-Internal Attacks (Email Account Takeover)
          - Spam
          - Reconnaissance
          - Scam
          - Social Engineering (BEC)
          - 'Phishing: Credential'
          - Invoice/Payment Fraud (BEC)
          - Malware
          - Extortion
          - 'Phishing: Sensitive Data'
          - Other
        description: Filters threats based on the type of attack
      - in: query
        name: threatType
        schema:
          type: string
          enum:
          - All
          - Malicious
          - Safe
          - Spam
        description: Filters threats based on the type of threat
      - in: query
        name: pageSize
        schema:
          type: integer
          minimum: 1
          default: 100
        description: Number of abuse campaigns shown on each page. Each page of data
          will have at most pageSize abuse campaign IDs.
      - in: query
        name: pageNumber
        schema:
          type: integer
          minimum: 1
          default: 1
        description: 1-indexed page number to get a particular page of abuse campaigns.
          Has no effect if filter is not specified.
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - AI Security Mailbox (formerly known as Abuse Mailbox)
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedAbuseCampaings'
          description: Returns a paginated list of abuse campaign IDs for each  campaign
            in AI Security Mailbox (formerly known as Abuse Mailbox). The nextPageNumber
            field will be absent if there are no more pages of data.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /abusecampaigns/{campaign_id}:
    get:
      operationId: v1_abusecampaigns_retrieve_2
      summary: Get details of an abuse campaign
      parameters:
      - in: path
        name: campaign_id
        schema:
          type: string
        description: A UUID representing the abuse campaign id
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - AI Security Mailbox (formerly known as Abuse Mailbox)
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AbuseCampaignDetails'
          description: An abuse campaign identified by Abnormal Security.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/attack_frequency:
    get:
      operationId: v1_aggregations_attack_frequency_retrieve
      summary: Retrieve the frequency of specific attack types for a given period.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/attack_frequency` are `receivedTime`.
          At least 1 of `gte`/`lte` must be specified, with a datetime string following
          the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last
          7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters attacks by frequency based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttackFrequencyResponse'
          description: A summary of attack frequencies. Represents the count of specific
            attack types for each reported timestamp.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/attack_stopped:
    get:
      operationId: v1_aggregations_attack_stopped_retrieve
      summary: Retrieve aggregated counts of distinct attack types that were successfully
        stopped, including current and previous periods.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/attack_stopped` are `receivedTime`.
          At least 1 of `gte`/`lte` must be specified, with a datetime string following
          the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last
          7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters attacks stopped based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttackStoppedResponse'
          description: A summary of stopped attacks. Represents the count of attacks
            stopped for each attack type.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/attack_strategy_breakdown:
    get:
      operationId: v1_aggregations_attack_strategy_breakdown_retrieve
      summary: Retrieve the breakdown of attacks based on their strategy.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/attack_strategy_breakdown` are `receivedTime`.
          At least 1 of `gte`/`lte` must be specified, with a datetime string following
          the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last
          7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters attack strategy breakdown based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttackStrategyBreakdownResponse'
          description: A breakdown of attacks based on their strategy.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/attack_vector_breakdown:
    get:
      operationId: v1_aggregations_attack_vector_breakdown_retrieve
      summary: Retrieve the breakdown of attacks based on their vectors.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/attack_vector_breakdown` are `receivedTime`.
          At least 1 of `gte`/`lte` must be specified, with a datetime string following
          the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last
          7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters attack vector breakdown based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttackVectorBreakdownResponse'
          description: A breakdown of attacks based on their vectors.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/attacker_origin:
    get:
      operationId: v1_aggregations_attacker_origin_retrieve
      summary: Retrieve the origin countries of attackers for a given period.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/attacker_origin` are `receivedTime`.
          At least 1 of `gte`/`lte` must be specified, with a datetime string following
          the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last
          7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters attacker origins based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttackerOriginResponse'
          description: A summary of attacker origins based on geographical regions
            and countries.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/dashboard_summary:
    get:
      operationId: v1_aggregations_dashboard_summary_retrieve
      summary: Retrieve an aggregated summary of multiple security data points for
        the dashboard.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/dashboard_summary` are `receivedTime`.
          At least 1 of `gte`/`lte` must be specified, with a datetime string following
          the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last
          7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters the dashboard summary based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/DashboardSummary'
          description: An aggregated list of security data points.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/most_impersonated_employee:
    get:
      operationId: v1_aggregations_most_impersonated_employee_retrieve
      summary: Retrieve the most impersonated employees for a specified period.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/most_impersonated_employee` are `receivedTime`.
          At least 1 of `gte`/`lte` must be specified, with a datetime string following
          the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last
          7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters impersonated employees based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MostImpersonatedEmployeeResponse'
          description: A list of the most impersonated employees and related statistics.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/most_impersonated_employee_non_vip:
    get:
      operationId: v1_aggregations_most_impersonated_employee_non_vip_retrieve
      summary: Retrieve the most impersonated non-VIP employees for a specified period.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/most_impersonated_employee_non_vip`
          are `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a
          datetime string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter
          is omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters impersonated non-VIP employees based on the source of
          detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MostImpersonatedEmployeeNonVIPResponse'
          description: A list of the most impersonated non-VIP employees and related
            statistics.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/most_impersonated_employee_vip:
    get:
      operationId: v1_aggregations_most_impersonated_employee_vip_retrieve
      summary: Retrieve the most impersonated VIP employees for a specified period.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/most_impersonated_employee_vip` are
          `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime
          string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is
          omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters impersonated VIP employees based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MostImpersonatedEmployeeVIPResponse'
          description: A list of the most impersonated VIP employees and related statistics.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/most_impersonated_vendor:
    get:
      operationId: v1_aggregations_most_impersonated_vendor_retrieve
      summary: Retrieve a list of the most impersonated vendors in attacks.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/most_impersonated_vendor` are `receivedTime`.
          At least 1 of `gte`/`lte` must be specified, with a datetime string following
          the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last
          7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters the most impersonated vendor data based on the source
          of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MostImpersonatedVendorResponse'
          description: A list of the most impersonated vendors in attacks.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/recipient_employees:
    get:
      operationId: v1_aggregations_recipient_employees_retrieve
      summary: Retrieve a list of the employees who were recipients of attacks, based
        on their job titles.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/recipient_employees` are `receivedTime`.
          At least 1 of `gte`/`lte` must be specified, with a datetime string following
          the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last
          7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters the recipient employees data based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RecipientEmployeeResponse'
          description: A list of the employees who were recipients of attacks, based
            on their job titles.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/recipient_employees_non_vip:
    get:
      operationId: v1_aggregations_recipient_employees_non_vip_retrieve
      summary: Retrieve a list of the non-VIP employees who were recipients of attacks,
        based on their job titles.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/recipient_employees_non_vip` are
          `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime
          string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is
          omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters the recipient non-VIP employees data based on the source
          of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RecipientEmployeeNonVIPResponse'
          description: A list of the non-VIP employees who were recipients of attacks,
            based on their job titles.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/recipient_employees_vip:
    get:
      operationId: v1_aggregations_recipient_employees_vip_retrieve
      summary: Retrieve a list of the VIP employees who were recipients of attacks,
        based on their job titles.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/recipient_employees_vip` are `receivedTime`.
          At least 1 of `gte`/`lte` must be specified, with a datetime string following
          the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last
          7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters the recipient VIP employees data based on the source
          of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RecipientEmployeeVIPResponse'
          description: A list of the VIP employees who were recipients of attacks,
            based on their job titles.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/sender_impersonation_breakdown:
    get:
      operationId: v1_aggregations_sender_impersonation_breakdown_retrieve
      summary: Retrieve a breakdown of attacks based on sender impersonation.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/sender_impersonation_breakdown` are
          `receivedTime`. At least 1 of `gte`/`lte` must be specified, with a datetime
          string following the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is
          omitted, the last 7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters sender impersonation breakdown based on the source of
          detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SenderImpersonationResponse'
          description: A breakdown of attacks based on sender impersonation.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /aggregations/trending_attacks:
    get:
      operationId: v1_aggregations_trending_attacks_retrieve
      summary: Retrieve the list of trending attacks for a specified period.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/trending_attacks` are `receivedTime`.
          At least 1 of `gte`/`lte` must be specified, with a datetime string following
          the `YYYY-MM-DDTHH:MM:SSZ` format. If this parameter is omitted, the last
          7 days of data will be returned.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - advanced
        description: Filters trending attacks based on the source of detection.
      tags:
      - Dashboard Aggregations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TrendingAttacksResponse'
          description: A list of trending attacks and related statistics.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /auditlogs:
    get:
      operationId: v1_auditlogs_retrieve
      summary: Gets a list of Audit Logs for Portal
      parameters:
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only key that are supported for `/auditlogs` is `timestamp`. At least
          1 of `gte`/`lte` must be specified, with a datetime string following the
          `YYYY-MM-DDTHH:MM:SSZ format`. We limit the results returned to the last
          90 days and will default to that if no filter is supplied.
        style: spaceDelimited
        examples:
          Timestamp:
            value: timestamp gte 2020-01-01T01:01:01Z lte 2020-03-01T01:01:01Z
            summary: timestamp
      - in: query
        name: action
        schema:
          type: string
        description: 'Filters audit logs based on the action(s) taken. Accepts >=
          1 options in a space-delimited string. Example: `view_message_content`'
        style: spaceDelimited
      - in: query
        name: category
        schema:
          type: string
        description: 'Filters audit logs based on their category(ies).Accepts >= 1
          options in a space-delimited string. Example: `abuse_mailbox threat_log`'
        style: spaceDelimited
      - in: query
        name: status
        schema:
          type: string
        description: Filters audit logs based on their status
      - in: query
        name: sourceIp
        schema:
          type: string
        description: Filters audit logs based on their source IP address
      - in: query
        name: pageSize
        schema:
          type: integer
          minimum: 1
          default: 100
        description: Number of audit logs that are on each page. Each page of data
          will have at most pageSize audit logs.
      - in: query
        name: pageNumber
        schema:
          type: integer
          minimum: 1
          default: 1
        description: 1-indexed page number to get a particular page of audit logs.
      tags:
      - Audit Logs
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditLogResponse'
          description: The audit logs based on filters specified. The nextPageNumber
            field will be absent if there are no more pages of data.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /cases:
    get:
      operationId: v1_cases_retrieve
      description: Account Takeover license is required to call this endpoint.
      summary: Get a list of Abnormal cases identified by Abnormal Security
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`.  A `{FILTER KEY}` must be specified, and currently
          the only key that is supported for `/cases` is `lastModifiedTime`. At least
          1 of `gte`/`lte` must be specified, with a datetime string following the
          `YYYY-MM-DDTHH:MM:SSZ` format.
        explode: false
        style: spaceDelimited
        examples:
          LastModifiedTime:
            value: lastModifiedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: lastModifiedTime
          CreatedTime:
            value: createdTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: createdTime
          CustomerVisibleTime:
            value: customerVisibleTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: customerVisibleTime
      - in: query
        name: pageSize
        schema:
          type: integer
          minimum: 1
          default: 100
        description: Number of cases that are on each page. Each page of data will
          have at most pageSize threats. Has no effect if filter is not specified.
      - in: query
        name: pageNumber
        schema:
          type: integer
          minimum: 1
          default: 1
        description: 1-indexed page number to get a particular page of cases. Has
          no effect if filter is not specified.
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Cases
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedCases'
          description: A list of the top 100 cases identified in Abnormal Cases if
            no filter query parameter is specified, or a paginated list of cases if
            a filter query parameter is specified. The pageNumber and nextPageNumber
            fields will be absent if no filter query parameter is used. The nextPageNumber
            field will be absent if there are no more pages of data.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /cases/{case_id}:
    get:
      operationId: v1_cases_retrieve_2
      description: Account Takeover license is required to call this endpoint.
      summary: Get details of an Abnormal case
      parameters:
      - in: path
        name: case_id
        schema:
          type: string
        description: A string representing the case
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Cases
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AbnormalCaseDetails'
          description: An Abnormal Case.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/CaseDoesNotExistError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
    post:
      operationId: v1_cases_create
      description: Account Takeover license is required to call this endpoint. Use
        this to update the status of an abnormal case. The action field is contains
        the new case status.
      summary: Manage an Abnormal Case.
      parameters:
      - in: path
        name: case_id
        schema:
          type: string
        description: A string representing the case
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Cases
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostCaseRequest'
        required: true
      responses:
        '202':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostCaseResponse'
          description: Accepted for processing.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/CaseDoesNotExistError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /cases/{case_id}/actions/{action_id}:
    get:
      operationId: v1_cases_actions_retrieve
      description: Account Takeover license is required to call this endpoint.
      summary: Check the status of an action requested on a case.
      parameters:
      - in: path
        name: case_id
        schema:
          type: string
        description: A string representing the case
        required: true
      - in: path
        name: action_id
        schema:
          type: string
        description: A UUID representing the action id for a case
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Cases
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActionStatus'
          description: Status of the action requested on a case. This API can be used
            to check the status of a request made to the threats. The response will
            return a descriptive string if the action on the threat could not be completed.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/ActionDoesNotExistError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /cases/{case_id}/analysis:
    get:
      operationId: v1_cases_analysis_retrieve
      description: Account Takeover license is required to call this endpoint.
      summary: Provides the analysis and timeline details of a case
      parameters:
      - in: path
        name: case_id
        schema:
          type: string
        description: A string representing the case
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Cases
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CaseAnalysis'
          description: The analysis results and timeline of events for the case.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /detection360/reports:
    get:
      operationId: v1_detection360_reports_retrieve
      description: Get a list of Detection 360 reports that you have submitted and
        view corresponding details for each case, including report summaries, statuses,
        message analyses, and more.
      summary: List Detection 360 reports for a specific type of detection misclassification.
      parameters:
      - in: query
        name: inquiry_type
        schema:
          enum:
          - MISSED_ATTACK
          - FALSE_POSITIVE
          type: string
          minLength: 1
        description: Whether to fetch missed attacks or false positives.
        required: true
      - in: query
        name: start
        schema:
          type: string
          format: date-time
        description: The start of the datetime range, as an RFC 3339 timestamp, to
          fetch Detection 360 cases from. Defaults to 30 days before end.
        examples:
          Start:
            value: '2022-01-01T00:00:00Z'
            summary: start
      - in: query
        name: end
        schema:
          type: string
          format: date-time
        description: The end of the datetime range, as an RFC 3339 timestamp, to fetch
          Detection 360 cases from. Defaults to the current time.
        examples:
          End:
            value: '2022-01-07T23:59:59Z'
            summary: end
      - in: query
        name: status
        schema:
          type: array
          items:
            enum:
            - UNREVIEWED
            - CONTAINING_ATTACK
            - IMPROVING_PLATFORM
            - RESOLVED
            - CORRECTING_JUDGEMENT
            type: string
        description: Only Detection 360 cases with these statuses will be retrieved.
          Defaults to all statuses.
      tags:
      - Detection360
      responses:
        '200':
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Detection360Case'
          description: Successful operation
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
    post:
      operationId: v1_detection360_reports_create
      description: Use this to report a detection misclassification judgement by Abnormal
        Security.  We use this data to improve our models, and also give customers
        transparency into the frequency of misclassifications.
      summary: Submit a detection misclassification report
      parameters:
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Detection360
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Detection360ReportRequest'
      responses:
        '202':
          description: Report was submitted successfully.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /employee/{email_address}:
    get:
      operationId: v1_employee_retrieve
      summary: Get employee information
      parameters:
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      - in: path
        name: email_address
        schema:
          type: string
        description: Email address of the employee you want to retrieve data for
        required: true
      tags:
      - Employee Insights
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmployeeDetails'
          description: Employee information for provided email address
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /employee/{email_address}/identity:
    get:
      operationId: v1_employee_identity_retrieve
      summary: Get employee identity analysis (Genome) data
      parameters:
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      - in: path
        name: email_address
        schema:
          type: string
        description: Email address of the employee you want to retrieve data for
        required: true
      tags:
      - Employee Insights
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EmployeeIdentityDetails'
          description: Employee identity analysis data derived from employee login
            data.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /employee/{email_address}/logins:
    get:
      operationId: v1_employee_logins_retrieve
      summary: Get employee login information for last 30 days in csv format
      parameters:
      - in: path
        name: email_address
        schema:
          type: string
        description: Email address of the employee you want to retrieve data for
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Employee Insights
      responses:
        '200':
          content:
            text/csv:
              schema:
                type: string
                example: Timestamp,User Principal Name,User Display Name,Status,IP
                  Address,City,State,Country or Region,Latitude,Longitude,App Display
                  Name,App ID,Client App Used,Browser,Operating System,Device ID,Resource
                  Display Name
          description: A csv list of employee login information. Headers of the csv
            include the following in order:<br />- Timestamp<br />- User Principal
            Name<br />- User Display Name<br />- Status<br />- IP Address<br />- City<br
            />- State<br />- Country or Region<br />- Latitude<br />- Longitude<br
            />- App Display Name<br />- App ID<br />- Client App Used<br />- Browser<br
            />- Operating System<br />- Device ID<br />- Resource Display Name
        '401':
          content:
            text/csv:
              schema:
                $ref: '#/components/responses/UnauthorizedError'
          description: ''
        '403':
          content:
            text/csv:
              schema:
                $ref: '#/components/responses/ForbiddenError'
          description: ''
        '404':
          content:
            text/csv:
              schema:
                $ref: '#/components/responses/NotFoundError'
          description: ''
        '429':
          content:
            text/csv:
              schema:
                $ref: '#/components/responses/TooManyRequestsError'
          description: ''
  /messages/{message_id}/attachment/{attachment_name}:
    get:
      operationId: v1_messages_attachment_retrieve
      summary: Get details of an attachment in an email message
      parameters:
      - in: path
        name: message_id
        schema:
          type: number
        description: The ABX Message Id of a message.
        required: true
      - in: path
        name: attachment_name
        schema:
          type: string
        description: The attachment name of an attachment belonging to an email message.
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Messages
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SoarAttachmentSignalsStruct'
          description: Attachment details of an attachment in an email message.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/ThreatDoesNotExistError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /messages/{message_id}/attachment/{attachment_name}/download:
    get:
      operationId: v1_messages_attachment_download_retrieve
      summary: Download the attachment in an email as a file
      parameters:
      - in: path
        name: message_id
        schema:
          type: number
        description: The ABX Message Id of a message.
        required: true
      - in: path
        name: attachment_name
        schema:
          type: string
        description: The attachment name of an attachment belonging to an email message.
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Messages
      responses:
        '200':
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
          description: The attachment file as an octet-stream. Will resolve into a
            file in the file system of the machine calling the request.
        '401':
          content:
            application/octet-stream:
              schema:
                $ref: '#/components/responses/UnauthorizedError'
          description: ''
        '403':
          content:
            application/octet-stream:
              schema:
                $ref: '#/components/responses/ForbiddenError'
          description: ''
        '404':
          content:
            application/octet-stream:
              schema:
                $ref: '#/components/responses/NotFoundError'
          description: ''
        '429':
          content:
            application/octet-stream:
              schema:
                $ref: '#/components/responses/TooManyRequestsError'
          description: ''
  /messages/{message_id}/download:
    get:
      operationId: v1_messages_download_retrieve
      description: Download the message contents in plaintext in the EML format. For
        security reasons, this API endpoint is disabled by default. Please talk to
        your customer specialist to get it enabled.
      summary: Download a message in EML format
      parameters:
      - in: path
        name: message_id
        schema:
          type: number
        description: The ABX Message Id of a message.
        required: true
      tags:
      - Messages
      responses:
        '200':
          content:
            message/rfc822:
              schema:
                type: string
                example: |
                  From: sender@example.com
                  To: recipient@example.com
                  Subject: Test Email
                  Date: Thu, 23 Aug 2024 12:00:00 +0000
                  Content-Type: text/plain; charset="UTF-8"

                  This is the email body
          description: The EML file in plain text
        '401':
          content:
            message/rfc822:
              schema:
                $ref: '#/components/responses/UnauthorizedError'
          description: ''
        '403':
          content:
            message/rfc822:
              schema:
                $ref: '#/components/responses/ForbiddenError'
          description: ''
        '404':
          content:
            message/rfc822:
              schema:
                $ref: '#/components/responses/NotFoundError'
          description: ''
        '429':
          content:
            message/rfc822:
              schema:
                $ref: '#/components/responses/TooManyRequestsError'
          description: ''
  /messages/{message_id}/remediation_history:
    get:
      operationId: v1_messages_remediation_history_retrieve
      summary: Get details of the remediation history for a threat log message
      parameters:
      - in: path
        name: message_id
        schema:
          type: number
        description: The ABX Message Id of a message.
        required: true
      tags:
      - Messages
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemediationHistory'
          description: Remediation history for a threat log message.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /resources:
    get:
      operationId: v1_resources_retrieve
      description: Retrieve a paginated list of resources with optional filtering
        using pageSize and pageNumber query parameters.
      summary: List resources with pagination and filtering
      parameters:
      - in: query
        name: pageSize
        schema:
          type: integer
        description: 'Number of results to return per page (default: 20, max: 100)'
      - in: query
        name: pageNumber
        schema:
          type: integer
        description: 'Page number to retrieve (1-indexed, default: 1)'
      tags:
      - Resources
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResourcesResponse'
          description: A paginated list of resources matching the filter criteria
        '400':
          $ref: '#/components/schemas/BadRequestError'
        '401':
          description: Authentication credentials were missing or invalid
        '403':
          description: The request was valid but the server is refusing to respond
            to it
        '429':
          description: Rate limit exceeded, please try again later
        '502':
          description: Failed to communicate with upstream service
  /resources/{resource_id}:
    get:
      operationId: v1_resources_retrieve_2
      description: Retrieve detailed information about a specific resource by its
        UUID.
      summary: Get a single resource by ID
      parameters:
      - in: path
        name: resource_id
        schema:
          type: string
        description: Unique identifier for the resource
        required: true
      tags:
      - Resources
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetResourceResponse'
          description: The requested resource
        '401':
          description: Authentication credentials were missing or invalid
        '403':
          description: The request was valid but the server is refusing to respond
            to it
        '404':
          $ref: '#/components/schemas/NotFoundError'
        '429':
          description: Rate limit exceeded, please try again later
        '502':
          description: Failed to communicate with upstream service
  /resources/{resource_id}/actions:
    post:
      operationId: v1_resources_actions_create
      description: Execute a specific action on a resource (refresh or validate).
        Returns 202 Accepted with action ID for tracking.
      summary: Perform an action on a resource
      parameters:
      - in: path
        name: resource_id
        schema:
          type: string
        description: Unique identifier for the resource
        required: true
      tags:
      - Resources
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PerformAction'
        required: true
      responses:
        '202':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PerformActionResponse'
          description: Action accepted and completed
        '400':
          $ref: '#/components/schemas/BadRequestError'
        '401':
          description: Authentication credentials were missing or invalid
        '403':
          description: The request was valid but the server is refusing to respond
            to it
        '404':
          $ref: '#/components/schemas/NotFoundError'
        '429':
          description: Rate limit exceeded, please try again later
        '500':
          description: An unexpected error occurred on the server
  /resources/{resource_id}/update:
    patch:
      operationId: v1_resources_update_partial_update
      description: Partially update an existing resource's fields (PATCH). Provide
        only the fields that need updating.
      summary: Update an existing resource
      parameters:
      - in: path
        name: resource_id
        schema:
          type: string
        description: Unique identifier for the resource
        required: true
      tags:
      - Resources
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchedUpdateResource'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateResourceResponse'
          description: Resource updated successfully
        '400':
          $ref: '#/components/schemas/BadRequestError'
        '401':
          description: Authentication credentials were missing or invalid
        '403':
          description: The request was valid but the server is refusing to respond
            to it
        '404':
          $ref: '#/components/schemas/NotFoundError'
        '429':
          description: Rate limit exceeded, please try again later
        '500':
          description: An unexpected error occurred on the server
  /resources/create:
    post:
      operationId: v1_resources_create_create
      description: Create a new resource with the specified name and optional description.
        Returns 201 Created with resource ID.
      summary: Create a new resource
      tags:
      - Resources
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateResource'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateResourceResponse'
          description: Resource created successfully
        '400':
          $ref: '#/components/schemas/BadRequestError'
        '401':
          description: Authentication credentials were missing or invalid
        '403':
          description: The request was valid but the server is refusing to respond
            to it
        '429':
          description: Rate limit exceeded, please try again later
        '500':
          description: An unexpected error occurred on the server
  /roles:
    get:
      operationId: v1_roles_retrieve
      description: |-
        Fetch all roles for an account from RBAC system.

        This endpoint retrieves a union of both account-specific roles and
        global (Abnormal-defined) roles for the authenticated account from
        the RBAC service.
      summary: Get a list of roles for an account from RBAC system
      parameters:
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Roles
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleListResponse'
          description: A list of roles available for the account.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          description: Forbidden - Insufficient permissions
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /search:
    post:
      operationId: v1_search_create
      description: |-
        Search for email messages across Abnormal and Quarantine sources. Optionally filter by tenant_ids in the request body. If tenant_ids is not provided, all authorized tenants are searched. The tenant_ids must be a subset of the tenants authorized by the bearer token.

        **Key Filter Fields:**
        - `body_link`: Filter by URLs found in the email body (e.g., phishing links, suspicious domains)
        - `judgement`: Filter by threat classification. Values: 'attack' (confirmed threats), 'borderline' (suspicious but not confirmed), 'spam' (unwanted bulk email), 'graymail' (legitimate bulk email), 'safe' (benign messages)
        - `judgement_source`: Filter by detection source. Values: 'ABNORMAL_SYSTEM' (flagged by Abnormal's own detection), 'CUSTOMER_AI_MODEL' (flagged by a customer-defined Custom AI Model). Only supported for `source=abnormal` (not quarantine).
      summary: Search for email messages
      parameters:
      - in: query
        name: pageNumber
        schema:
          type: integer
        description: 'Page number for pagination (default: 1)'
      - in: query
        name: pageSize
        schema:
          type: integer
        description: 'Number of results per page (default: 100, max: 1000)'
      tags:
      - Search and Respond
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SearchRequest'
            examples:
              AllAvailableSearchFilters:
                value:
                  source: abnormal
                  filters:
                    start_time: '2024-01-01T00:00:00Z'
                    end_time: '2024-01-31T23:59:59Z'
                    subject: 'Urgent: Payment Required'
                    sender_email: suspicious@external-domain.com
                    sender_name: John Doe
                    recipient_email: user@company.com
                    recipient_name: Jane Smith
                    attachment_name: invoice.pdf
                    internet_message_id: <message123@sender.com>
                    body_link: https://suspicious-domain.com
                    sender_ip: 192.0.2.1
                    judgement: attack
                    use_sender_regex: false
                    use_recipient_regex: false
                  tenant_ids:
                  - 123
                  - 456
                summary: All available search filters
              SearchByDateAndSender:
                value:
                  source: abnormal
                  filters:
                    start_time: '2024-01-01T00:00:00Z'
                    end_time: '2024-01-31T23:59:59Z'
                    sender_email: suspicious@external-domain.com
                  tenant_ids:
                  - 123
                  - 456
                summary: Search by date and sender
              SearchBySubjectAndJudgement:
                value:
                  source: abnormal
                  filters:
                    start_time: '2024-01-01T00:00:00Z'
                    end_time: '2024-01-31T23:59:59Z'
                    subject: 'Urgent: Payment Required'
                    judgement: attack
                summary: Search by subject and judgement
              SearchByCustomAIModel(CAIM)Detection:
                value:
                  source: abnormal
                  filters:
                    start_time: '2024-01-01T00:00:00Z'
                    end_time: '2024-01-31T23:59:59Z'
                    judgement_source: CUSTOMER_AI_MODEL
                  tenant_ids:
                  - 123
                summary: Search by Custom AI Model (CAIM) detection
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchResponse'
              examples:
                SuccessfulSearchResponse:
                  value:
                    results:
                    - customer_id: 100
                      tenant_id: 123
                      received_time: '2024-01-15T10:30:00Z'
                      subject: 'Urgent: Wire Transfer Request'
                      sender: attacker@malicious.com
                      sender_display_name: John Doe
                      mailbox_name: user@company.com
                      mailbox_display_name: User Name
                      current_folder_name: Inbox
                      raw_message_id: AAMkAGI2THVSAAA=
                      native_user_id: user@company.com
                      cloud_message_id: abx:CloudMessage:123:456
                      internet_message_id: <message123@sender.com>
                      abnormal_message_id: abc123def456
                      abnormal_message_uuid: uuid-123-456
                      decision_category: attack
                      judgement: attack
                      judgement_source: CUSTOMER_AI_MODEL
                      judgement_source_model_id: '700'
                      judgement_source_model_version: '19'
                      attachments:
                        invoice.pdf:
                          name: invoice.pdf
                          md5_hash: d41d8cd98f00b204e9800998ecf8427e
                      body_links:
                      - https://suspicious-domain.com/phishing
                      sender_ip_addresses:
                      - 192.0.2.1
                    total: 25
                    pageNumber: 1
                    pageSize: 100
                    nextPageNumber: 2
                    metadata:
                      trace_id: abc-123-def-456
                      response_time: '2024-01-15T10:30:05Z'
                  summary: Successful search response
          description: Search completed successfully
        '400':
          description: Invalid request parameters
        '401':
          description: Authentication failed (invalid bearer token) or Authorization
            failed (requested tenant_ids not authorized by bearer token)
        '403':
          description: API not enabled for this customer
        '500':
          description: Internal server error
  /search/activities:
    get:
      operationId: v1_search_activities_retrieve
      description: List activity logs for search and remediation operations. Optionally
        filter by tenant_ids query parameter (e.g., ?tenant_ids=123&tenant_ids=456).
        If tenant_ids is not provided, all authorized tenants are included. The tenant_ids
        must be a subset of the tenants authorized by the bearer token.
      summary: List activity logs
      parameters:
      - in: query
        name: tenant_ids
        schema:
          type: string
        description: Comma-separated list of tenant IDs to filter activities (e.g.,
          '123,456' or '789'). If not provided, all authorized tenants are included.
      - in: query
        name: pageNumber
        schema:
          type: integer
        description: 'Page number for pagination (default: 1)'
      - in: query
        name: pageSize
        schema:
          type: integer
        description: 'Number of results per page (default: 100, max: 1000)'
      - in: query
        name: action
        schema:
          type: string
        description: Filter by remediation action (e.g., delete, move_to_inbox)
      tags:
      - Search and Respond
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActivitiesResponse'
              examples:
                ActivitiesListResponse:
                  value:
                    activities:
                    - activity_id: 12345
                      action: delete
                      status: completed
                      performed_by: Rest API
                      timestamp: '2024-01-15T10:30:00Z'
                      result_count: 5
                      parameters:
                        tenant_ids:
                        - 123
                        source: abnormal
                      submit_d360_case: false
                    - activity_id: 12346
                      action: move_to_inbox
                      status: in_progress
                      performed_by: Rest API
                      timestamp: '2024-01-15T11:00:00Z'
                      result_count: 3
                      parameters:
                        tenant_ids:
                        - 456
                        source: abnormal
                        target_folder: inbox
                      submit_d360_case: false
                    total: 50
                    pageNumber: 1
                    pageSize: 100
                    metadata:
                      trace_id: abc-123-def-456
                      response_time: '2024-01-15T11:05:00Z'
                  summary: Activities list response
          description: Activity logs retrieved successfully
        '400':
          description: Invalid request parameters
        '401':
          description: Authentication failed (invalid bearer token) or Authorization
            failed (requested tenant_ids not authorized by bearer token)
        '403':
          description: API not enabled for this customer
        '500':
          description: Internal server error
  /search/activities/{activity_log_id}/status:
    get:
      operationId: v1_search_activities_status_retrieve
      description: 'Get detailed status of a specific activity including remediation
        results. Authorization is automatically determined by the bearer token - if
        the activity belongs to any tenant authorized by your token, you will be able
        to access it. The activity_log_id is returned in the response from the remediation
        endpoint. '
      summary: Get activity status
      parameters:
      - in: path
        name: activity_log_id
        schema:
          type: integer
        description: The activity log ID returned from the remediation request (use
          'activity_log_id' field from remediation response)
        required: true
      tags:
      - Search and Respond
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActivityStatusResponse'
              examples:
                SuccessfulActivityStatus:
                  value:
                    activity_id: 12345
                    action: delete
                    status: completed
                    performed_by: Rest API
                    timestamp: '2024-01-15T10:30:00Z'
                    result_count: 5
                    remediation_details:
                    - tenant_id: 123
                      raw_message_id: AAMkAGI2THVSAAA=
                      status: success
                      error_message: ''
                    - tenant_id: 123
                      raw_message_id: BBMkAGI2THVSAAA=
                      status: success
                      error_message: ''
                    total: 5
                    pageNumber: 1
                    pageSize: 100
                    metadata:
                      trace_id: abc-123-def-456
                      response_time: '2024-01-15T10:30:01Z'
                  summary: Successful activity status
          description: Activity status retrieved successfully
        '400':
          description: Invalid activity_log_id parameter
        '401':
          description: Authentication failed (invalid bearer token) or the activity
            does not belong to any tenant authorized by your token
        '403':
          description: API not enabled for this customer
        '404':
          description: Activity not found
        '500':
          description: Internal server error
  /search/messages/{message_id}/eml:
    get:
      operationId: v1_search_messages_eml_retrieve
      description: Download the EML file for a specific message by cloud_message_id.
        Returns the EML file content as message/rfc822 format. For quarantine messages,
        provide both 'quarantineIdentity' and 'recipientMailbox' query parameters.
      summary: Download EML file for a message
      parameters:
      - in: path
        name: message_id
        schema:
          type: string
        description: 'The cloud_message_id from the Search API response (format: ''abx:CloudMessage:...'').
          Use the ''cloud_message_id'' field from the search results.'
        required: true
      - in: query
        name: quarantineIdentity
        schema:
          type: string
        description: Quarantine identity for quarantined messages. Required along
          with 'recipientMailbox' to download quarantine messages from S3 cache.
      - in: query
        name: recipientMailbox
        schema:
          type: string
        description: Recipient mailbox email address for quarantined messages. Required
          along with 'quarantineIdentity' to download quarantine messages from S3
          cache.
      tags:
      - Search and Respond
      responses:
        '200':
          content:
            application/json:
              schema:
                type: string
                format: binary
          description: 'EML file downloaded successfully (Content-Type: message/rfc822)'
        '400':
          description: Bad request - invalid message ID format
        '401':
          description: Unauthorized - invalid or expired token
        '403':
          description: Forbidden - API not enabled or unauthorized tenant access
        '404':
          description: Not found - message does not exist or EML not available
        '500':
          description: Internal server error
  /search/messages/attachments/download:
    get:
      operationId: v1_search_messages_attachments_download_retrieve
      description: Download an email attachment for a given message.
      summary: Download email attachment
      parameters:
      - in: query
        name: message_id
        schema:
          type: integer
        description: Message ID
        required: true
      - in: query
        name: attachment_name
        schema:
          type: string
        description: Name of the attachment to download
        required: true
      - in: query
        name: tenant_id
        schema:
          type: integer
        description: Tenant ID
        required: true
      - in: query
        name: raw_message_id
        schema:
          type: string
        description: Raw message ID from cloud provider
        required: true
      - in: query
        name: native_user_id
        schema:
          type: string
        description: Native user ID from cloud provider
        required: true
      - in: query
        name: recipient_mailbox
        schema:
          type: string
        description: Recipient mailbox email address
        required: true
      tags:
      - Search and Respond
      responses:
        '200':
          content:
            application/json:
              schema:
                type: string
                format: binary
          description: Attachment downloaded successfully (binary file)
        '400':
          description: Invalid request parameters
        '401':
          description: Unauthorized
        '404':
          description: Attachment not found
        '502':
          description: Failed to retrieve attachment from cloud provider. The message
            or attachment may have been moved, deleted, or remediated.
        '500':
          description: Internal server error
  /search/remediate:
    post:
      operationId: v1_search_remediate_create
      description: |-
        Remediate email messages by deleting, moving, or submitting them for review. Returns an `activity_log_id` that can be polled via the **Get Activity Status** endpoint.

        ---

        ## Two modes of operation

        **Specific messages** (`remediate_all=false`):
        Provide a `messages` list. Each entry must include `tenant_id`, `raw_message_id`, `mailbox_name`, `native_user_id`, `subject`, `sender`, and `received_time`. The response returns an `activity_log_id`; poll **Get Activity Status** to retrieve per-message results.

        **Bulk / remediate-all** (`remediate_all=true`):
        Provide `search_filters` instead of `messages`. All messages matching the filters are remediated asynchronously. The response returns an `activity_log_id`; poll **Get Activity Status** to track progress.

        ---

        ## Actions

        | `action` | Description |
        |---|---|
        | `delete` | Move messages to the provider's deleted items / recoverable items folder |
        | `move_to_inbox` | Move messages to a specified folder (requires `target_folder`) |

        To attach a Detection 360 case to a remediation, set `submit_d360_case: true` alongside any `action` above.

        ---

        ## Valid action / remediation_reason combinations

        | `action` | Allowed `remediation_reason` values |
        |---|---|
        | `delete` | `false_negative`, `unsolicited`, `other`, `groups_remediation` |
        | `move_to_inbox` | `quarantine_release`, `other`, `false_negative` |

        ---

        ## Validation rules

        - `search_filters` is **required** when `remediate_all=true`.
        - `messages` is **required** when `remediate_all=false`.
        - `target_folder` is **required** when `action=move_to_inbox`.
        - `remediation_reason=quarantine_release` is only valid when `source=quarantine`.
        - `search_filters.start_time` must be strictly before `search_filters.end_time`.
        - `use_sender_regex=true` in `search_filters` requires `sender_email` to be set.
        - `use_recipient_regex=true` in `search_filters` requires `recipient_email` to be set.
        - `submit_d360_case=true` requires `remediation_reason=false_negative`. Detection 360 only supports missed-attack inquiries today; other reasons are rejected at the API boundary.
        - `submit_d360_case=true` with `remediate_all=true` requires `search_filters.subject` to be set.
        - `submit_d360_case=true` with `messages` requires `abnormal_message_uuid` on every message.

        ---

        ## Tenant filtering

        Optionally provide `tenant_ids` to restrict remediation to a subset of tenants. If omitted, all tenants authorized by the bearer token are included. `tenant_ids` must be a subset of the tenants authorized by the bearer token.
      summary: Remediate email messages
      tags:
      - Search and Respond
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemediationRequest'
            examples:
              DeleteSpecificMessages(falseNegative):
                value:
                  action: delete
                  source: abnormal
                  remediation_reason: false_negative
                  submit_d360_case: false
                  remediate_all: false
                  messages:
                  - tenant_id: 123
                    raw_message_id: AAMkAGI2THVSAAA=
                    abnormal_message_id: abc123def456
                    mailbox_name: user@company.com
                    native_user_id: user@company.com
                    subject: 'Urgent: Wire Transfer Request'
                    sender: attacker@malicious.com
                    received_time: '2024-01-15T10:30:00Z'
                  tenant_ids:
                  - 123
                summary: Delete specific messages (false negative)
              MoveSpecificMessagesToInbox(quarantineRelease):
                value:
                  action: move_to_inbox
                  source: quarantine
                  remediation_reason: quarantine_release
                  target_folder: inbox
                  submit_d360_case: false
                  remediate_all: false
                  messages:
                  - tenant_id: 123
                    raw_message_id: AAMkAGI2THVSAAA=
                    mailbox_name: user@company.com
                    native_user_id: user@company.com
                    subject: Quarterly Report
                    sender: partner@trusted.com
                    received_time: '2024-01-15T10:30:00Z'
                  tenant_ids:
                  - 123
                summary: Move specific messages to inbox (quarantine release)
              BulkDeleteUsingSearchFilters(remediateAll):
                value:
                  action: delete
                  source: abnormal
                  remediation_reason: false_negative
                  submit_d360_case: false
                  remediate_all: true
                  search_filters:
                    start_time: '2024-01-01T00:00:00Z'
                    end_time: '2024-01-31T23:59:59Z'
                    sender_email: attacker@malicious.com
                    judgement: attack
                  tenant_ids:
                  - 123
                summary: Bulk delete using search filters (remediate_all)
              DeleteWithD360CaseSubmission:
                value:
                  action: delete
                  source: abnormal
                  remediation_reason: false_negative
                  submit_d360_case: true
                  remediate_all: false
                  messages:
                  - tenant_id: 123
                    raw_message_id: AAMkAGI2THVSAAA=
                    abnormal_message_id: abc123def456
                    abnormal_message_uuid: 550e8400-e29b-41d4-a716-446655440000
                    mailbox_name: user@company.com
                    native_user_id: user@company.com
                    subject: 'Urgent: Wire Transfer Request'
                    sender: attacker@malicious.com
                    received_time: '2024-01-15T10:30:00Z'
                  tenant_ids:
                  - 123
                summary: Delete with D360 case submission
        required: true
      responses:
        '202':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemediationResponse'
              examples:
                RemediationAccepted:
                  value:
                    activity_log_id: 12345
                    metadata:
                      trace_id: abc-123-def-456
                      response_time: '2024-01-15T10:30:00Z'
                  summary: Remediation accepted
          description: Remediation request accepted. Poll GET /v1/search/activity/{activity_log_id}
            to retrieve results or track progress.
        '400':
          description: 'Invalid request. Common causes: missing required fields (`search_filters`
            when `remediate_all=true`, `messages` when `remediate_all=false`, `target_folder`
            when `action=move_to_inbox`), incompatible action/reason combination,
            `quarantine_release` reason with non-quarantine source, or invalid time
            range.'
        '401':
          description: Authentication failed (invalid bearer token) or Authorization
            failed (requested tenant_ids not authorized by bearer token)
        '403':
          description: API not enabled for this customer
        '409':
          description: Concurrent remediation limit exceeded. Retry after the in-progress
            operation completes.
        '500':
          description: Internal server error
  /security-settings:
    get:
      operationId: v1_security_settings_retrieve
      description: |-
        Fetch security settings for an account.

        This endpoint retrieves security settings including session timeout
        configuration (inactivity timeout and max session time).
      summary: Get security settings including session timeout configuration
      parameters:
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Security Settings
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecuritySettingsResponse'
          description: Security settings for the account including session timeout
            configuration.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          description: Forbidden - Either insufficient permissions or feature not
            enabled for account
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /soar/tokens:
    get:
      operationId: v1_soar_tokens_retrieve
      description: |-
        Fetch all API tokens for the authenticated customer from the Go Token Management Service.

        This endpoint retrieves tokens with response format containing:
        - token_id: UUID of the token
        - name: Token name
        - version: Token version (v1 or v2)
        - status: Token status (active, expired, revoked)
        - created_at: ISO 8601 creation timestamp
        - expires_at: ISO 8601 expiration timestamp
        - permissions: List of permission strings (scope)
      summary: Get a list of API tokens for the authenticated customer
      parameters:
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      - in: query
        name: limit
        schema:
          type: integer
        description: Maximum number of tokens to return (1-200, default 50)
      - in: query
        name: offset
        schema:
          type: integer
        description: Pagination offset (default 0)
      - in: query
        name: show_all
        schema:
          type: boolean
        description: Include expired/revoked tokens (default false)
      - in: query
        name: sort_by
        schema:
          type: string
        description: 'Sort field: created_at, -created_at, expires_at, -expires_at'
      tags:
      - Tokens
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenListResponseSwagger'
          description: A list of API tokens for the customer.
        '400':
          description: Bad Request - Invalid query parameters
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          description: Forbidden - Either insufficient permissions or feature not
            enabled for account
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
        '500':
          description: Internal Server Error
  /spm-v2/posture-catalog:
    get:
      operationId: v1_spm_v2_posture_catalog_retrieve
      description: Get posture catalog containing all available abnormal supported
        postures
      summary: Get posture catalog containing all available abnormal supported postures
      parameters:
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      - in: query
        name: pageSize
        schema:
          type: integer
          minimum: 1
          default: 100
        description: ' Number of items on each page.Default 100. Each page of data
          will have at most pageSize items. Has no effect if filter is not specified.'
      - in: query
        name: pageNumber
        schema:
          type: integer
          minimum: 1
          default: 1
        description: 1-indexed page number to get a particular page of items. Has
          no effect if filter is not specified.
      tags:
      - SPM
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostureCatalogResponse'
          description: Returns the posture catalog with all available postures
        '400':
          description: Bad Request
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /spm-v2/postures/{posture_id}:
    get:
      operationId: v1_spm_v2_postures_retrieve
      description: Get detailed information about a specific security posture evaluation
      summary: Get detailed information about a specific security posture evaluation
      parameters:
      - in: path
        name: posture_id
        schema:
          type: integer
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - SPM
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostureDetail'
          description: Returns detailed posture information
        '400':
          description: Bad Request
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /spm-v2/postures/{posture_id}/timeline:
    get:
      operationId: v1_spm_v2_postures_timeline_retrieve
      description: Get timeline of events for a specific security posture
      summary: Get timeline of events for a specific security posture
      parameters:
      - in: path
        name: posture_id
        schema:
          type: integer
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      - in: query
        name: pageSize
        schema:
          type: integer
          minimum: 1
          default: 100
        description: ' Number of items on each page.Default 100. Each page of data
          will have at most pageSize items. Has no effect if filter is not specified.'
      - in: query
        name: pageNumber
        schema:
          type: integer
          minimum: 1
          default: 1
        description: 1-indexed page number to get a particular page of items. Has
          no effect if filter is not specified.
      tags:
      - SPM
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostureTimelineResponse'
          description: Returns posture timeline events
        '400':
          description: Bad Request
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /spm-v2/postures/query:
    post:
      operationId: v1_spm_v2_postures_query_create
      description: Get a list of all tenant postures
      summary: Get a list of all tenant postures
      parameters:
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      - in: query
        name: pageSize
        schema:
          type: integer
          minimum: 1
          default: 100
        description: ' Number of items on each page.Default 100. Each page of data
          will have at most pageSize items. Has no effect if filter is not specified.'
      - in: query
        name: pageNumber
        schema:
          type: integer
          minimum: 1
          default: 1
        description: 1-indexed page number to get a particular page of items. Has
          no effect if filter is not specified.
      tags:
      - SPM
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostureListParams'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostureListResponse'
          description: Returns a list of all tenant postures
        '400':
          description: Bad Request
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /spm-v2/reports/summary:
    get:
      operationId: v1_spm_v2_reports_summary_retrieve
      description: Get summary report for all postures
      summary: Get summary report for all postures
      parameters:
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - SPM
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SPMReport'
          description: Returns summary report for all postures
        '400':
          description: Bad Request
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /spm-v2/workflow-logs/{workflow_log_id}/raw-json:
    get:
      operationId: v1_spm_v2_workflow_logs_raw_json_retrieve
      description: Get raw JSON for a workflow log
      summary: Get raw JSON for a workflow log
      parameters:
      - in: path
        name: workflow_log_id
        schema:
          type: integer
        required: true
      - in: query
        name: workflow_log_id
        schema:
          type: integer
        description: Workflow Log ID
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - SPM
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkflowLogRawJson'
          description: Returns raw JSON data for the workflow log
        '400':
          description: Bad Request
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /threats:
    get:
      operationId: v1_threats_retrieve
      summary: Get a list of threats
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the keys that are supported for `/threats` are `receivedTime` and `latestTimeRemediated`.
          At least 1 of `gte`/`lte` must be specified, with a datetime string following
          the `YYYY-MM-DDTHH:MM:SSZ format`.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: receivedTime
          LatestTimeRemediated:
            value: latestTimeRemediated gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: latestTimeRemediated
      - in: query
        name: pageSize
        schema:
          type: integer
          minimum: 1
          default: 100
        description: ' Number of threats on each page. Each page of data will have
          at most pageSize threats. Has no effect if filter is not specified.'
      - in: query
        name: pageNumber
        schema:
          type: integer
          minimum: 1
          default: 1
        description: 1-indexed page number to get a particular page of threats. Has
          no effect if filter is not specified.
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - attacks
          - borderline
          - spam
        description: Filters threats based on the source of detection. 'all' returns
          threats from all sources, 'spam' returns only spam threats, 'attacks' returns
          only attack threats, and 'borderline' returns only borderline threats.
      - in: query
        name: sender
        schema:
          type: string
        description: Filters threats based on the name or email address of the sender
      - in: query
        name: recipient
        schema:
          type: string
        description: Filters threats based on the name or email address of the recipient
      - in: query
        name: subject
        schema:
          type: string
        description: Filters threats based on the email subject
      - in: query
        name: topic
        schema:
          type: string
          enum:
          - Billing Account Update
          - Covid-19 Related Attack
          - Cryptocurrency
          - Invoice
          - Invoice Inquiry
        description: Filters threats based on the topic of email contents
      - in: query
        name: attackType
        schema:
          type: string
          enum:
          - Internal-to-Internal Attacks (Email Account Takeover)
          - Spam
          - Reconnaissance
          - Scam
          - Social Engineering (BEC)
          - 'Phishing: Credential'
          - Invoice/Payment Fraud (BEC)
          - Malware
          - Extortion
          - 'Phishing: Sensitive Data'
          - Other
        description: Filters threats based on the type of attack
      - in: query
        name: attackVector
        schema:
          type: string
          enum:
          - Link
          - Attachment
          - Text
          - Others
          - Attachment with Zipped File
          - QR Code
          - Calendar Invite
          - Spam Bomb
        description: Filters threats based on the attack vector
      - in: query
        name: attackStrategy
        schema:
          type: string
          enum:
          - Name Impersonation
          - Internal Compromised Email Account
          - External Compromised Email Account
          - Spoofed Email
          - Unknown Sender
          - Covid 19 Related Attack
        description: Filters threats based on the attack strategy
      - in: query
        name: impersonatedParty
        schema:
          type: string
          enum:
          - VIP
          - Assistants
          - Employee (other)
          - Brand
          - Known Partners
          - Automated System (Internal)
          - Automated System (External)
          - Unknown Partner
          - None / Others
        description: Filters threats based on the impersonated party
      tags:
      - Threats
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedThreats'
          description: A list of the IDs of the top 100 threats identified in Threat
            Log if no filter query parameter is specified, or a paginated list of
            threats if a filter query parameter is specified. The pageNumber and nextPageNumber
            fields will be absent if no filter query parameter is used. The nextPageNumber
            field will be absent if there are no more pages of data.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /threats/{threat_id}:
    get:
      operationId: v1_threats_retrieve_2
      summary: Get details of a threat
      parameters:
      - in: query
        name: pageSize
        schema:
          type: integer
          minimum: 1
          default: 100
        description: Number of messages corresponding to threat in each page. Each
          page of data will have at most pageSize message. Total results returned
          cannot exceed 2000 due to database limitations
      - in: query
        name: pageNumber
        schema:
          type: integer
          minimum: 1
          default: 1
        description: 1-indexed page number to get a particular page of threat messages.
          Currently ignored, only 10 results for `messages` will show. Supported will
          be added in a future version. Total results returned cannot exceed 2000
          due to database limitations
      - in: path
        name: threat_id
        schema:
          type: string
        description: A UUID representing the threat.
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Threats
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatDetails'
          description: A threat identified by Abnormal Security.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/ThreatDoesNotExistError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
    post:
      operationId: v1_threats_create
      description: Use this to remediate or unremediate a threat. If the request is
        found to be something which can be processed, the server will return a '202
        Accept' with an actionId and status URL in the response. This can be used
        to check the status of the request.
      summary: Manage a Threat identified by Abnormal Security
      parameters:
      - in: path
        name: threat_id
        schema:
          type: string
        description: A UUID representing the threat.
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Threats
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostThreatRequest'
        required: true
      responses:
        '202':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostThreatResponse'
          description: Accepted for processing.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/ThreatDoesNotExistError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /threats/{threat_id}/actions/{action_id}:
    get:
      operationId: v1_threats_actions_retrieve
      summary: Check the status of an action requested on a threat.
      parameters:
      - in: path
        name: threat_id
        schema:
          type: string
        description: A UUID representing the threat.
        required: true
      - in: path
        name: action_id
        schema:
          type: string
        description: A UUID representing the action id for a threat.
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Threats
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActionStatus'
          description: Status of the action requested on a threat. This API can be
            used to check the status of a request made to the threats. The response
            will return a descriptive string if the action on threat could not be
            completed.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/ActionDoesNotExistError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /threats/{threat_id}/attachments:
    get:
      operationId: v1_threats_attachments_retrieve
      summary: Get attachment details of a threat campaign.
      parameters:
      - in: path
        name: threat_id
        schema:
          type: string
        description: A UUID representing the threat.
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Threats
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatAttachmentsResponse'
          description: Details of the attachments in a threat campaign. This API can
            be used to obtain the details of the links that are embedded in the email
            messages of a threat.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/ThreatDoesNotExistError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /threats/{threat_id}/links:
    get:
      operationId: v1_threats_links_retrieve
      summary: Get information of links in a threat campagin.
      parameters:
      - in: path
        name: threat_id
        schema:
          type: string
        description: A UUID representing the threat.
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Threats
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatLinksResponse'
          description: Details of the links in a threat campaign. This API can be
            used to obtain the details of the links that are embedded in the email
            messages of a threat.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/ThreatDoesNotExistError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /threats_export/csv:
    get:
      operationId: v1_threats_export_csv_retrieve
      summary: Download data from Threat Log in .csv format
      parameters:
      - in: query
        name: format
        schema:
          type: string
          enum:
          - csv
          - json
      - in: query
        name: filter
        schema:
          type: string
        description: Max time range is 14 days. If only one of the gte or lte filters
          are specified, the time range defaults to 1 day within the specified filter.
          If neither of the gte or lte filters are specified, the time range defaults
          to the previous date to the current date.
        style: spaceDelimited
        examples:
          ReceivedTime:
            value: receivedTime gte 2023-01-01T01:01:01Z lte 2023-01-14T01:01:01Z
            summary: receivedTime
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      - in: query
        name: source
        schema:
          type: string
          default: all
          enum:
          - all
          - attacks
          - borderline
          - spam
        description: Filters threats based on the source of detection. 'all' returns
          threats from all sources, 'spam' returns only spam threats, 'attacks' returns
          only attack threats, and 'borderline' returns only borderline threats.
      - in: header
        name: Accept
        schema:
          type: string
          enum:
          - application/json
          - text/csv
          default: application/json
        description: Controls the response format. Use 'text/csv' to receive data
          in CSV format, or 'application/json' for JSON format (default).
      tags:
      - Threats
      responses:
        '200':
          content:
            text/csv:
              schema:
                type: string
                example: "Date,From Display Name,From Email,Subject,Recipient Email,Job\
                  \ Title of Sender,Job Title of Recipient,Abnormals best guess of\
                  \ attack type,Abnormals best guess of attack strategy,Abnormals\
                  \ best guess of impersonated entity,Abnormals best guess of attack\
                  \ vector,Remediation Status,Remediation Time,Judgement,Abnormal\
                  \ Message ID,Threat ID,Tenant ID,Tenant Name\r\n2020-06-09T17:42:59Z,,support@secure-reply.org,Phishing\
                  \ Email,example@example.com,,,Extortion,Name Impersonation,None\
                  \ / Others,Text,Auto-Remediated,2020-06-09T18:00:00Z,Malicious,4551618356913732000,42,acme-corp"
          description: 'A csv list of all messages in the Threat Log. Headers include
            the following in order: <br />- Date<br />- From Display Name<br />- From
            Email<br />- Subject<br />- Recipient Email<br />- Job Title of Sender<br
            />- Job Title of Recipient<br />- Abnormals best guess of attack type<br
            />- Abnormals best guess of attack strategy<br />- Abnormals best guess
            of impersonated entity<br />- Abnormals best guess of attack vector<br
            />- Remediation Status<br />- Remediation Time<br />- Judgement<br />-
            Abnormal Message ID<br />- Threat ID<br />- Tenant ID<br />- Tenant Name'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /url-rewrite/clicked-events:
    get:
      operationId: v1_url_rewrite_clicked_events_retrieve
      description: Retrieve paginated click and clickthrough events for URL rewrites.
        Supports filtering by Unix time range, user email, and event type. Returns
        events where users clicked on rewritten URLs in email messages.
      summary: Get URL rewrite click and clickthrough events
      parameters:
      - in: query
        name: limit
        schema:
          type: integer
        description: 'Number of results to return per page (default: 20, max: 100)'
      - in: query
        name: start
        schema:
          type: integer
        description: Start time of the time range to filter by (Unix timestamp)
      - in: query
        name: end
        schema:
          type: integer
        description: End time of the time range to filter by (Unix timestamp)
      - in: query
        name: recipient
        schema:
          type: string
        description: Email address recipient of the email message to filter by
      - in: query
        name: event_type
        schema:
          type: string
        description: Event type to filter by (Click/Clickthrough)
      - in: query
        name: offset
        schema:
          type: string
        description: Offset to use for pagination
      tags:
      - URL Rewrite
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClickedEventsResponse'
          description: A paginated list of clicked events
        '400':
          $ref: '#/components/schemas/Error'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
        '500':
          $ref: '#/components/schemas/Error'
  /users:
    get:
      operationId: v1_users_retrieve
      description: Retrieves users for an account from the RBAC user management system.
      summary: Get a list of users from RBAC user management system
      parameters:
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Users
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserListResponse'
          description: A list of users with their roles and resource permissions.
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          description: Forbidden - Insufficient permissions
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /vendor-cases:
    get:
      operationId: v1_vendor_cases_retrieve
      summary: Get a list of vendor cases.
      parameters:
      - in: query
        name: filter
        schema:
          type: string
        description: Value must be of the format `filter={FILTER KEY} gte YYYY-MM-DDTHH:MM:SSZ
          lte YYYY-MM-DDTHH:MM:SSZ`. A `{FILTER KEY}` must be specified, and currently
          the only keys that are supported for `/vendor-cases` are `firstObservedTime`
          and `lastModifiedTime`. At least 1 of `gte`/`lte` must be specified, with
          a datetime string following the `YYYY-MM-DDTHH:MM:SSZ format`.
        style: spaceDelimited
        examples:
          FirstObservedTime:
            value: firstObservedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: firstObservedTime
          LastModifiedTime:
            value: lastModifiedTime gte 2020-01-01T01:01:01Z lte 2021-12-01T01:01:01Z
            summary: lastModifiedTime
      - in: query
        name: pageSize
        schema:
          type: integer
          minimum: 1
          default: 100
        description: Number of vendor cases that are on each page. Each page of data
          will have at most pageSize vendor cases. Has no effect if filter is not
          specified.
      - in: query
        name: pageNumber
        schema:
          type: integer
          minimum: 1
          default: 1
        description: 1-indexed page number to get a particular page of vendor cases.
          Has no effect if filter is not specified.
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Vendors
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedVendorCases'
          description: List of cases of the queried vendor
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /vendor-cases/{case_id}:
    get:
      operationId: v1_vendor_cases_retrieve_2
      summary: Get details of a vendor case
      parameters:
      - in: path
        name: case_id
        schema:
          type: string
        description: The vendor case to query
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Vendors
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VendorCaseDetails'
          description: Details of the queried vendor case
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /vendors:
    get:
      operationId: v1_vendors_retrieve
      summary: Get a list of vendors your organization has interacted with
      parameters:
      - in: query
        name: pageSize
        schema:
          type: integer
          minimum: 1
          default: 100
        description: Number of vendors that are on each page. Each page of data will
          have at most pageSize threats. Has no effect if filter is not specified.
      - in: query
        name: pageNumber
        schema:
          type: integer
          minimum: 1
          default: 1
        description: 1-indexed page number to get a particular page of vendors. Has
          no effect if filter is not specified.
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Vendors
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedVendors'
          description: A paginated list of 100 vendors ordered by risk level (highest
            risk first) followed by domain name
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /vendors/{vendor_domain}/activity:
    get:
      operationId: v1_vendors_activity_retrieve
      summary: Get activity of a vendor your organization has interacted with
      parameters:
      - in: path
        name: vendor_domain
        schema:
          type: string
        description: The vendor domain to query
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Vendors
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VendorActivity'
          description: Activity history of the queried vendor
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
  /vendors/{vendor_domain}/details:
    get:
      operationId: v1_vendors_details_retrieve
      summary: Get details of a vendor your organization has interacted with
      parameters:
      - in: path
        name: vendor_domain
        schema:
          type: string
        description: The vendor domain to query
        required: true
      - in: header
        name: mock-data
        schema:
          type: string
          default: 'False'
          enum:
          - 'False'
          - 'True'
        description: Returns test data if set to `True`
      tags:
      - Vendors
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VendorDetail'
          description: Details of the queried vendor
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '429':
          $ref: '#/components/responses/TooManyRequestsError'
components:
  responses:
    ActionDoesNotExistError:
      description: Action does not exist
    CaseDoesNotExistError:
      description: Abnormal Case does not exist
    ForbiddenError:
      description: Access to the resource is forbidden (e.g. IP not in allowlist)
    InvalidDateError:
      description: A date provided is in the wrong format or the date range is wider
        than the allowed range for this endpoint
    NotFoundError:
      description: Invalid user input when using the filter query parameter. Will
        return various error messages
    ThreatDoesNotExistError:
      description: Threat does not exist
    TooManyRequestsError:
      description: Request count exceeds allowed number of concurrent requests for
        this resource type
    UnauthorizedError:
      description: Access token is missing or invalid
  schemas:
    AbnormalCase:
      type: object
      properties:
        caseId:
          type: string
          description: A unique identifier for this case.
          example: 1234
        description:
          type: string
        severity_level:
          $ref: '#/components/schemas/SeverityLevel3eaEnum'
          description: Description of the severity level for this case.
        confidence:
          $ref: '#/components/schemas/ConfidenceEnum'
          description: The confidence level for this case.
        last_modified:
          type: string
          format: date-time
        first_observed:
          type: string
          format: date-time
        created:
          type: string
          format: date-time
        tenant:
          type: string
          nullable: true
          description: The short name of the tenant associated with this case. Not
            returned for Azure Sentinel integrations.
          example: my-tenant
      required:
      - caseId
      - confidence
      - created
      - description
      - first_observed
      - last_modified
      - severity_level
    AbnormalCaseDetails:
      type: object
      properties:
        caseId:
          type: string
          description: A unique identifier for this case.
          example: 1234
        case_status:
          $ref: '#/components/schemas/CaseStatusEnum'
        severity:
          type: string
          description: Description of the severity level for this case.
          example: Potential Account Takeover
        affectedEmployee:
          type: string
          description: Which employee this case pertains to.
          example: FirstName LastName
        customerVisibleTime:
          type: string
          format: date-time
        firstObserved:
          type: string
          format: date-time
          description: First time suspicious behavior was observed.
          example: '2020-06-09T17:42:59Z'
        threatIds:
          type: array
          items:
            type: string
          description: Threats related to Case
          example:
          - 184712ab-6d8b-47b3-89d3-a314efef79e2
        analysis:
          type: string
        remediation_status:
          $ref: '#/components/schemas/RemediationStatusEnum'
        severity_level:
          $ref: '#/components/schemas/AbnormalCaseDetailsSeverityLevelEnum'
        confidence:
          $ref: '#/components/schemas/ConfidenceEnum'
          description: The confidence level for this case.
        genai_summary:
          type: array
          items:
            type: string
          description: List of AI-generated summary points for the case
        tenant:
          type: string
          nullable: true
          description: The short name of the tenant associated with this case. Not
            returned for Azure Sentinel integrations.
          example: my-tenant
      required:
      - affectedEmployee
      - analysis
      - caseId
      - case_status
      - confidence
      - customerVisibleTime
      - firstObserved
      - genai_summary
      - remediation_status
      - severity
      - severity_level
      - threatIds
    AbnormalCaseDetailsSeverityLevelEnum:
      enum:
      - NONE
      - LOW
      - MEDIUM
      - HIGH
      type: string
    AbuseCampaign:
      type: object
      properties:
        campaignId:
          type: string
          description: An id which maps to an abuse campaign.
          example: fff51768-c446-34e1-97a8-9802c29c3ebd
      required:
      - campaignId
    AbuseCampaignDetails:
      type: object
      properties:
        campaignId:
          type: string
          description: An id which maps to an abuse campaign.
          example: fff51768-c446-34e1-97a8-9802c29c3ebd
        firstReported:
          type: string
          format: date-time
          description: Date abuse campaign was first reported.
          example: '2020-11-11T13:11:40-08:00'
        lastReported:
          type: string
          format: date-time
          description: Date abuse campaign was last reported.
          example: '2020-11-11T13:11:40-08:00'
        messageId:
          type: string
          description: A unique identifier for the first message in the abuse campaign.
          example: -1234567891011121314
        subject:
          type: string
          description: Subject of the first email in the abuse campaign.
          example: 'Fwd: This is spam'
        fromName:
          type: string
          description: The display name of the sender.
          example: Support
        fromAddress:
          type: string
          description: The email address of the sender.
          example: support@secure-reply.org
        recipientName:
          type: string
          description: The display name of the recipient.
          example: Tom
        recipientAddress:
          type: string
          description: The email address of the recipient.
          example: example@example.com
        judgementStatus:
          type: string
          description: Judgement status of message.
          example: Malicious
        overallStatus:
          type: string
          description: Overall status of message.
          example: Could not find original message
        attackType:
          type: string
          description: The type of threat the message represents. This is only present
            for abuse campaigns judged Malicious or Spam
          example: 'Malicious: Phishing'
      required:
      - attackType
      - campaignId
      - firstReported
      - fromAddress
      - fromName
      - judgementStatus
      - lastReported
      - messageId
      - overallStatus
      - recipientAddress
      - recipientName
      - subject
    AbuseMailboxUnanalyzedMessage:
      type: object
      properties:
        subject:
          type: string
          description: Subject of the message
          example: Read me
        abx_message_id:
          type: integer
        reported_datetime:
          type: string
          format: date-time
        recipient:
          $ref: '#/components/schemas/User'
        reporter:
          $ref: '#/components/schemas/User'
        not_analyzed_reason:
          $ref: '#/components/schemas/NotAnalyzedReasonEnum'
      required:
      - abx_message_id
      - not_analyzed_reason
      - recipient
      - reported_datetime
      - reporter
      - subject
    AbuseMailboxUnanalyzedResponse:
      type: object
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/AbuseMailboxUnanalyzedMessage'
          description: A list of representations of messages that were reported to
            AI Security Mailbox (formerly known as Abuse Mailbox) but not analyzed.
      required:
      - results
    ActionEnum:
      enum:
      - search
      - remediation
      - csv_export
      title: ActionEnum
      type: string
    ActionReasonEnum:
      enum:
      - false_negative
      - unsolicited
      - other
      - groups_remediation
      - quarantine_release
      title: ActionReasonEnum
      type: string
    ActionStatus:
      type: object
      properties:
        status:
          $ref: '#/components/schemas/ActionStatusStatusEnum'
        description:
          type: string
          description: Description of the action
          example: The request was completed successfully
        tenantId:
          type: integer
          nullable: true
          description: The tenant ID associated with the threat
          example: 1234
        tenantName:
          type: string
          nullable: true
          description: The short name of the tenant associated with the threat
          example: example-tenant
      required:
      - description
      - status
      - tenantId
      - tenantName
    ActionStatusEnum:
      enum:
      - pending
      - success
      - partial_success
      - error
      title: ActionStatusEnum
      type: string
    ActionStatusStatusEnum:
      enum:
      - acknowledged
      - in_progress
      - done
      - error
      type: string
    ActivitiesResponse:
      properties:
        activities:
          items:
            $ref: '#/components/schemas/ActivityLogEntry'
          title: Activities
          type: array
        total:
          title: Total
          type: integer
        pageNumber:
          title: Pagenumber
          type: integer
        pageSize:
          title: Pagesize
          type: integer
        metadata:
          $ref: '#/components/schemas/MetaData'
      required:
      - activities
      - total
      - pageNumber
      - pageSize
      - metadata
      title: ActivitiesResponse
      type: object
    ActivityLogEntry:
      properties:
        activity_id:
          title: Activity Id
          type: integer
        action:
          $ref: '#/components/schemas/ActionEnum'
        status:
          $ref: '#/components/schemas/ActionStatusEnum'
        performed_by:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Performed By
        timestamp:
          format: date-time
          title: Timestamp
          type: string
        result_count:
          anyOf:
          - type: integer
          - type: 'null'
          default: null
          title: Result Count
        parameters:
          anyOf:
          - additionalProperties: true
            type: object
          - type: 'null'
          default: null
          title: Parameters
        submit_d360_case:
          anyOf:
          - type: boolean
          - type: 'null'
          default: null
          title: Submit D360 Case
      required:
      - activity_id
      - action
      - status
      - timestamp
      title: ActivityLogEntry
      type: object
    ActivityStatusResponse:
      properties:
        activity_id:
          title: Activity Id
          type: integer
        action:
          anyOf:
          - $ref: '#/components/schemas/ActionEnum'
          - type: 'null'
          default: null
        status:
          anyOf:
          - $ref: '#/components/schemas/ActionStatusEnum'
          - type: 'null'
          default: null
        performed_by:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Performed By
        timestamp:
          anyOf:
          - format: date-time
            type: string
          - type: 'null'
          default: null
          title: Timestamp
        result_count:
          anyOf:
          - type: integer
          - type: 'null'
          default: null
          title: Result Count
        remediation_details:
          anyOf:
          - items:
              $ref: '#/components/schemas/RemediationDetail'
            type: array
          - type: 'null'
          default: null
          title: Remediation Details
        total:
          anyOf:
          - type: integer
          - type: 'null'
          default: null
          title: Total
        metadata:
          $ref: '#/components/schemas/MetaData'
      required:
      - activity_id
      - metadata
      title: ActivityStatusResponse
      type: object
    Actor:
      type: object
      properties:
        display_name:
          type: string
          description: Display name of the actor who performed the action
          example: ABNORMAL_SECURITY
    Attachment:
      properties:
        name:
          title: Name
          type: string
        md5_hash:
          title: Md5 Hash
          type: string
      required:
      - name
      - md5_hash
      title: Attachment
      type: object
    AttackFrequency:
      type: object
      properties:
        timeStamp:
          type: string
          format: date-time
          description: The date and time the attack was received.
          example: '2023-08-11T12:34:56Z'
        attackType:
          type: string
          description: The type of attack detected.
          example: Scam
        attackCount:
          type: integer
          description: The amount of attacks detected for the specified attack type.
          example: 200
      required:
      - attackCount
      - attackType
      - timeStamp
    AttackFrequencyResponse:
      type: object
      properties:
        attack_frequency:
          type: array
          items:
            $ref: '#/components/schemas/AttackFrequency'
          description: List detailing the timestamp, the type of attack, and the count
            of that attack type for the given timestamp.
      required:
      - attack_frequency
    AttackStopped:
      type: object
      properties:
        attackTypeName:
          type: string
          description: The type or category of the attack (e.g., 'all' for all types
            of attacks).
          example: all
        attackCount:
          type: integer
          description: The number of attacks detected over a specified period of time.
          example: 2000
        prevAttackCount:
          type: integer
          description: The number of attacks detected prior to the defined time range.
          example: 2001
      required:
      - attackCount
      - attackTypeName
      - prevAttackCount
    AttackStoppedResponse:
      type: object
      properties:
        attack_stopped:
          type: array
          items:
            $ref: '#/components/schemas/AttackStopped'
          description: List detailing the type of attacks stopped, the current count
            of attacks stopped, and the previous count of attacks stopped.
      required:
      - attack_stopped
    AttackStrategyBreakdown:
      type: object
      properties:
        attackStrategy:
          type: string
          description: The specific strategy employed by the attacker.
          example: Name Impersonation
        attackStrategyDescription:
          type: string
          description: A brief explanation of the attack strategy.
          example: Uses sender name and/or email address to impersonate a party.
        attackCount:
          type: integer
          description: The number of occurrences of the attack associated with the
            given strategy in the specified time frame.
          example: 200
      required:
      - attackCount
      - attackStrategy
      - attackStrategyDescription
    AttackStrategyBreakdownResponse:
      type: object
      properties:
        attack_strategy_breakdown:
          type: array
          items:
            $ref: '#/components/schemas/AttackStrategyBreakdown'
          description: List detailing the breakdown of attacks by strategy, along
            with the count for each strategy.
      required:
      - attack_strategy_breakdown
    AttackVectorBreakdown:
      type: object
      properties:
        attackVectorGroup:
          type: string
          description: The category or type of attack vectors used in cyber-attacks.
          example: attachment
        attackCount:
          type: integer
          description: The number of detected attacks associated with the specified
            attack vector.
          example: 200
      required:
      - attackCount
      - attackVectorGroup
    AttackVectorBreakdownResponse:
      type: object
      properties:
        attack_vector_breakdown:
          type: array
          items:
            $ref: '#/components/schemas/AttackVectorBreakdown'
          description: List detailing the breakdown of attacks by vector, along with
            the count for each vector.
      required:
      - attack_vector_breakdown
    AttackerOrigin:
      type: object
      properties:
        regionName:
          type: string
          description: The geographical region name.
          example: Asia
        attackCount:
          type: integer
          description: The count of attacks originating from the specified region.
          example: 1000
        countries:
          type: array
          items:
            $ref: '#/components/schemas/Country'
      required:
      - attackCount
      - countries
      - regionName
    AttackerOriginResponse:
      type: object
      properties:
        attacker_origin:
          type: array
          items:
            $ref: '#/components/schemas/AttackerOrigin'
          description: List detailing the region, countries in that region, and the
            count of attacks originating from each country and region.
      required:
      - attacker_origin
    AuditLog:
      type: object
      properties:
        action:
          type: string
          description: (Optional) The specific action performed during the event.
            This field is optional and may not be present.
        actionDetails:
          allOf:
          - $ref: '#/components/schemas/AuditLogActionDetails'
          description: (Optional) The details of the action performed.
        category:
          type: string
          description: The category of the performed action.
        sourceIp:
          type: string
          description: The IP address of the device that caused the event.
        status:
          type: string
          description: The result of the event. Returned as either SUCCESS or FAILURE.
        tenantName:
          type: string
          description: Name of the tenant the user has access to.
        timestamp:
          type: string
          description: Date/time when the event occurred in UTC.
        user:
          allOf:
          - $ref: '#/components/schemas/AuditLogUser'
          description: Information about the user who caused the event. Currently
            only includes the email address.
      required:
      - category
      - sourceIp
      - status
      - tenantName
      - timestamp
      - user
    AuditLogActionDetails:
      type: object
      properties:
        messageId:
          type: string
          description: ID of the message on which an action was performed.
        providedReason:
          type: string
          description: Reason provided for performing the action.
        requestUrl:
          type: string
          description: URL for the request.
    AuditLogResponse:
      type: object
      properties:
        auditLogs:
          type: array
          items:
            $ref: '#/components/schemas/AuditLog'
        pageNumber:
          type: integer
          description: Current page number of the results
        nextPageNumber:
          type: integer
          description: (Optional) Next page number to query for. Would not be returned
            if it was the last page
      required:
      - auditLogs
      - pageNumber
    AuditLogUser:
      type: object
      properties:
        email:
          type: string
          format: email
          description: Email address of the user.
      required:
      - email
    BadRequestError:
      type: object
      description: 400 Bad Request error response.
      properties:
        error:
          type: string
          default: Bad request
          description: The request was invalid or malformed
    BenchmarksEnum:
      enum:
      - CIS
      type: string
    CaseAnalysis:
      type: object
      properties:
        insights:
          type: array
          items:
            $ref: '#/components/schemas/CaseInsights'
          description: List of case insights
        eventTimeline:
          type: array
          items:
            $ref: '#/components/schemas/CaseEvent'
          readOnly: true
          description: Timeline of flagged events on the case
      required:
      - eventTimeline
      - insights
    CaseEvent:
      oneOf:
      - $ref: '#/components/schemas/RiskEvent'
      - $ref: '#/components/schemas/SignInEvent'
      - $ref: '#/components/schemas/MailRuleEvent'
      - $ref: '#/components/schemas/OutboundMessageEvent'
      - $ref: '#/components/schemas/MFAFailureEvent'
      - $ref: '#/components/schemas/MismatchedMFALocationEvent'
    CaseInsights:
      type: object
      properties:
        signal:
          type: string
        description:
          type: string
      required:
      - description
      - signal
    CaseStatusEnum:
      enum:
      - Action Required
      - Acknowledged (In progress)
      - Acknowledged (Attack resolved)
      - Acknowledged (Not an attack)
      type: string
    ClickedEventsPaginationMetadata:
      type: object
      description: Serializer for pagination metadata on the clicked events response.
      properties:
        nextOffset:
          type: string
          nullable: true
          description: Offset token for the next page if more results exist
        limit:
          type: integer
          nullable: true
          description: Limit of the results
    ClickedEventsResponse:
      type: object
      description: |-
        Serializer for clicked events response.

        Note: the "data" field is injected below via `_declared_fields` because a
        class attribute named `data` would shadow DRF's `Serializer.data` property
        (basedpyright also flags the conflict).
      properties:
        metadata:
          allOf:
          - $ref: '#/components/schemas/ClickedEventsResponseMetadata'
          description: Response metadata including pagination
        data:
          type: array
          items:
            $ref: '#/components/schemas/SoarClickedEvent'
          description: List of clicked events
      required:
      - data
      - metadata
    ClickedEventsResponseMetadata:
      type: object
      description: Serializer for response metadata containing pagination information.
      properties:
        pagination:
          allOf:
          - $ref: '#/components/schemas/ClickedEventsPaginationMetadata'
          description: Pagination information for the response
        requestId:
          type: string
          nullable: true
          description: Request ID for the API request
      required:
      - pagination
    ConfidenceEnum:
      enum:
      - LOW
      - MEDIUM
      - HIGH
      type: string
    Country:
      type: object
      properties:
        regionName:
          type: string
          description: The geographical region name for the country. (This will be
            repetitive within the region array.)
          example: Asia
        country:
          type: string
          description: The name of the country.
          example: India
        countryCode:
          type: string
          description: The country code.
          example: IN
        latitude:
          type: string
          description: Latitude of the country.
          example: 20.5937
        longitude:
          type: string
          description: Longitude of the country.
          example: 78.9629
        attackCount:
          type: integer
          description: The count of attacks originating from the specified country.
          example: 650
      required:
      - attackCount
      - country
      - countryCode
      - latitude
      - longitude
      - regionName
    CreateResource:
      type: object
      description: Serializer for creating a new resource.
      properties:
        name:
          type: string
          description: Name of the resource
          maxLength: 255
          minLength: 1
        description:
          type: string
          nullable: true
          description: Optional description of the resource
          maxLength: 1000
      required:
      - name
    CreateResourceResponse:
      type: object
      description: Serializer for create resource response.
      properties:
        resourceId:
          type: string
          description: ID of the newly created resource
        status:
          type: string
          description: Status of the creation operation
      required:
      - resourceId
      - status
    CustomerOverride:
      type: object
      description: |-
        Serializes customer override attribution for a message.

        Present when blocklist or Custom AI Model attribution is enabled.
      properties:
        overrideType:
          type: string
          description: The type of customer override applied.
          example: Customer Blocklist
        reason:
          type: string
          description: The match type that triggered the blocklist override.
          example: Sender Email
        overrideJudgement:
          type: string
          nullable: true
          description: The message judgement applied by the override.
          example: malicious
        value:
          type: string
          nullable: true
          description: The matched blocklist entry value.
          example: support@secure-reply.org
      required:
      - overrideType
      - reason
    DashboardSummary:
      type: object
      properties:
        attackStopped:
          type: array
          items:
            $ref: '#/components/schemas/AttackStopped'
          description: List detailing the attacks stopped.
        attackFrequency:
          type: array
          items:
            $ref: '#/components/schemas/AttackFrequency'
          description: List detailing the attack frequency.
        attackerOrigin:
          type: array
          items:
            $ref: '#/components/schemas/AttackerOrigin'
          description: List detailing the origin of the attacker.
        mostImpersonatedEmployee:
          type: array
          items:
            $ref: '#/components/schemas/MostImpersonatedEmployee'
          description: List detailing the most impersonated employees.
        mostImpersonatedEmployeeVIP:
          type: array
          items:
            $ref: '#/components/schemas/MostImpersonatedEmployeeVIP'
          description: List detailing the most impersonated VIP employees.
        mostImpersonatedEmployeeNonVIP:
          type: array
          items:
            $ref: '#/components/schemas/MostImpersonatedEmployeeNonVIP'
          description: List detailing the most impersonated non-VIP employees.
        trendingAttacks:
          type: array
          items:
            $ref: '#/components/schemas/TrendingAttacks'
          description: List detailing the trending attacks.
        attackVectorBreakdown:
          type: array
          items:
            $ref: '#/components/schemas/AttackVectorBreakdown'
          description: List detailing the attack vectors.
        attackStrategyBreakdown:
          type: array
          items:
            $ref: '#/components/schemas/AttackStrategyBreakdown'
          description: List detailing the attack strategies.
        senderImpersonationBreakdown:
          type: array
          items:
            $ref: '#/components/schemas/SenderImpersonationBreakdown'
          description: List detailing the impersonated sender breakdown.
        mostImpersonatedVendor:
          type: array
          items:
            $ref: '#/components/schemas/MostImpersonatedVendor'
          description: List detailing the most impersonated vendors.
        recipientEmployees:
          type: array
          items:
            $ref: '#/components/schemas/RecipientEmployee'
          description: List detailing the recipient employees targeted in attacks.
        recipientEmployeesVIP:
          type: array
          items:
            $ref: '#/components/schemas/RecipientEmployeeVIP'
          description: List detailing the VIP recipient employees targeted in attacks.
        recipientEmployeesNonVIP:
          type: array
          items:
            $ref: '#/components/schemas/RecipientEmployeeNonVIP'
          description: List detailing the non-VIP recipient employees targeted in
            attacks.
      required:
      - attackFrequency
      - attackStopped
      - attackStrategyBreakdown
      - attackVectorBreakdown
      - attackerOrigin
      - mostImpersonatedEmployee
      - mostImpersonatedEmployeeNonVIP
      - mostImpersonatedEmployeeVIP
      - mostImpersonatedVendor
      - recipientEmployees
      - recipientEmployeesNonVIP
      - recipientEmployeesVIP
      - senderImpersonationBreakdown
      - trendingAttacks
    DateRange:
      type: object
      properties:
        from_date:
          type: string
          format: date-time
          description: Start date for the range filter
          example: '2025-01-01T00:00:00Z'
        to_date:
          type: string
          format: date-time
          description: End date for the range filter
          example: '2025-12-31T23:59:59Z'
    DecisionCategoryEnum:
      enum:
      - malicious
      - spam
      - safe
      - graymail
      title: DecisionCategoryEnum
      type: string
    Detection360Case:
      type: object
      properties:
        id:
          type: integer
        inquiry_type:
          $ref: '#/components/schemas/InquiryTypeEnum'
        messages:
          type: array
          items:
            type: integer
        report:
          $ref: '#/components/schemas/Detection360Report'
        status:
          $ref: '#/components/schemas/Detection360CaseStatusEnum'
        submission_datetime:
          type: string
          format: date-time
        submitted_by:
          $ref: '#/components/schemas/User'
      required:
      - id
      - inquiry_type
      - messages
      - status
      - submission_datetime
      - submitted_by
    Detection360CaseStatusEnum:
      enum:
      - UNREVIEWED
      - CONTAINING_ATTACK
      - IMPROVING_PLATFORM
      - RESOLVED
      - CORRECTING_JUDGEMENT
      type: string
    Detection360Report:
      type: object
      properties:
        analysis:
          type: string
        root_causes:
          type: array
          items:
            $ref: '#/components/schemas/PortalVisibleRootCause'
      required:
      - analysis
      - root_causes
    Detection360ReportRequest:
      oneOf:
      - $ref: '#/components/schemas/FalsePositive'
      - $ref: '#/components/schemas/FalseNegative'
      - $ref: '#/components/schemas/MissedAttack'
      - $ref: '#/components/schemas/MissedSpam'
      - $ref: '#/components/schemas/MissedGraymail'
      discriminator:
        propertyName: report_type
        mapping:
          null: '#/components/schemas/MissedGraymail'
    DisplayId:
      type: object
      properties:
        display_name:
          type: string
          description: Human-readable display name
          example: HIGH
        id:
          type: string
          description: Internal identifier for the item
          example: high
    EmailSourceEnum:
      enum:
      - abnormal
      - quarantine
      title: EmailSourceEnum
      type: string
    EmployeeDetails:
      type: object
      properties:
        name:
          type: string
          description: Name of the employee.
          example: Tom
        email:
          type: string
          description: Email of the employee.
          example: example@example.com
        title:
          type: string
          description: Job title of the employee.
          example: General Manager
        manager:
          type: string
          description: Email address of the employee's manager
          example: manager_email@example.com
      required:
      - email
      - manager
      - name
      - title
    EmployeeGenomeCategory:
      type: object
      properties:
        value:
          type: string
          description: Category value
          example: 203.12.172.182
        percentage:
          type: number
          format: double
          description: Ratio of this category relative to others
          example: 0.9
        total_count:
          type: integer
          description: Number of occurences for this category
          example: 9
      required:
      - percentage
      - total_count
      - value
    EmployeeGenomeDetails:
      type: object
      properties:
        key:
          type: string
          description: Genome key name
          example: ip_address
        name:
          type: string
          description: Genome title
          example: Common IP Addresses
        description:
          type: string
          description: Description of genome object
          example: Common IP Addresses for user logins
        values:
          type: array
          items:
            $ref: '#/components/schemas/EmployeeGenomeCategory'
      required:
      - description
      - key
      - name
      - values
    EmployeeIdentityDetails:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/EmployeeGenomeDetails'
      required:
      - data
    Error:
      type: object
      description: Serializer for bad request error response.
      properties:
        error:
          type: string
          description: Error message
      required:
      - error
    EventLocation:
      type: object
      properties:
        city:
          type: string
          description: The city where the event occurred.
          example: Aldie
        state:
          type: string
          description: The state where the event occurred.
          example: Virginia
        country:
          type: string
          description: The country where the event occurred.
          example: US
      required:
      - city
      - country
      - state
    FalseNegative:
      type: object
      properties:
        report_type:
          $ref: '#/components/schemas/FalseNegativeReportTypeEnum'
          description: Type of report
        recipient_email:
          type: string
          description: Email address of the recipient
          example: alice@aloha.com
        sender_email:
          type: string
          description: Email address of the sender
          example: alice@aloha.com
        subject:
          type: string
          description: Subject of the email
          example: hello!
        received_date:
          type: string
          description: Date the email was received in YYYY-MM-DD format.
          example: 2020/02/01
        description:
          type: string
          description: Free text to provide more context on the issue.
          example: Alice reported this email looked like an attack.
      required:
      - recipient_email
      - report_type
      - sender_email
      - subject
    FalseNegativeReportTypeEnum:
      enum:
      - false-negative
      type: string
    FalsePositive:
      type: object
      properties:
        report_type:
          $ref: '#/components/schemas/FalsePositiveReportTypeEnum'
          description: Type of report
        portal_link:
          type: string
          description: Link in Portal of the False Positive Threat
          example: https://portal.abnormalsecurity.com/home/threat-center/remediation-history/1234567890
        received_date:
          type: string
          description: Date the email was received in YYYY-MM-DD format.
          example: 2020/02/01
        description:
          type: string
          description: Free text to provide more context on the issue.
          example: Alice reported this email was missing from their inbox.
      required:
      - portal_link
      - report_type
    FalsePositiveReportTypeEnum:
      enum:
      - false-positive
      type: string
    GetResourceResponse:
      type: object
      description: Serializer for get resource response.
      properties:
        resource:
          allOf:
          - $ref: '#/components/schemas/Resource'
          description: The requested resource
      required:
      - resource
    InquiryTypeEnum:
      enum:
      - MISSED_ATTACK
      - FALSE_POSITIVE
      type: string
    JudgementEnum:
      enum:
      - attack
      - borderline
      - spam
      - graymail
      - safe
      title: JudgementEnum
      type: string
    JudgementSourceEnum:
      enum:
      - ABNORMAL_SYSTEM
      - CUSTOMER_AI_MODEL
      title: JudgementSourceEnum
      type: string
    ListResourcesResponse:
      type: object
      description: Serializer for list resources response.
      properties:
        resources:
          type: array
          items:
            $ref: '#/components/schemas/Resource'
          description: List of resources
        total:
          type: integer
          description: Total number of resources matching the query
        pageNumber:
          type: integer
          description: Current page number
        nextPageNumber:
          type: integer
          nullable: true
          description: Next page number if more pages exist
      required:
      - pageNumber
      - resources
      - total
    MFAFailureEvent:
      type: object
      properties:
        event_timestamp:
          type: string
          format: date-time
          description: Time when event occurred
          example: '2020-05-19T17:47:30Z'
        category:
          type: string
          description: Type of event
          example: Failed MFA Attempt
        title:
          type: string
          description: Title of the event
          example: Failed MFA Attempt
        field_labels:
          type: object
          additionalProperties: {}
          description: Anomaly labels/tags associated with fields in the event
        ip_address:
          type: string
          description: IP Address where user attempted Multi Factor Authentication
          example: 123.456.78.900
        browser:
          type: string
          description: Browser that was used when attempting to sign in to mailbox
          example: Chrome
        operating_system:
          type: string
          description: Operating system of the device used to attempt sign in
          example: Windows 10
        protocol:
          type: string
          description: Connection protocol used when attempting to sign in
          example: Browser
        application:
          type: string
          description: Mail application used to sign in
          example: GSuite
        location:
          allOf:
          - $ref: '#/components/schemas/EventLocation'
          description: Location of a sign in as detected from case analysis
      required:
      - application
      - browser
      - category
      - event_timestamp
      - field_labels
      - ip_address
      - location
      - operating_system
      - protocol
      - title
    MailRuleEvent:
      type: object
      properties:
        event_timestamp:
          type: string
          format: date-time
          description: Time when event occurred
          example: '2020-05-19T17:47:30Z'
        category:
          type: string
          description: Type of event
          example: Mail Rule
        title:
          type: string
          description: Title of the event
          example: Mail Rule Change
        rule_name:
          type: string
          description: Name of the mail rule that was changed
          example: Delete all messages rule
        condition:
          type: string
          description: Condition of the mail rule
          example: hasNoCondition
        flagging_detectors:
          type: string
          description: Flagging detectors of the mail rule
          example: DELETE_ALL
      required:
      - category
      - condition
      - event_timestamp
      - flagging_detectors
      - rule_name
      - title
    MessageToRemediate:
      properties:
        tenant_id:
          description: Tenant ID
          title: Tenant Id
          type: integer
        raw_message_id:
          description: Raw message ID
          title: Raw Message Id
          type: string
        abnormal_message_id:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Abnormal Message Id
        abnormal_message_uuid:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Abnormal Message Uuid
        mailbox_name:
          description: Mailbox name
          title: Mailbox Name
          type: string
        native_user_id:
          description: Native user ID
          title: Native User Id
          type: string
        subject:
          description: Subject
          title: Subject
          type: string
        sender:
          description: Sender
          title: Sender
          type: string
        received_time:
          description: Received time
          format: date-time
          title: Received Time
          type: string
      required:
      - tenant_id
      - raw_message_id
      - mailbox_name
      - native_user_id
      - subject
      - sender
      - received_time
      title: MessageToRemediate
      type: object
    MetaData:
      properties:
        trace_id:
          title: Trace Id
          type: string
        response_time:
          title: Response Time
          type: string
      required:
      - trace_id
      - response_time
      title: MetaData
      type: object
    MismatchedMFALocationEvent:
      type: object
      properties:
        event_timestamp:
          type: string
          format: date-time
          description: Time when event occurred
          example: '2020-05-19T17:47:30Z'
        category:
          type: string
          description: Type of event
          example: Authentication Events
        title:
          type: string
          description: Title of the event
          example: Different Authentication Factor Locations
        field_labels:
          type: object
          additionalProperties: {}
          description: Anomaly labels/tags associated with fields in the event
        description:
          type: string
          description: Mismatch between session location and second factor authentication
            location
          example: Mismatch between session location and second factor authentication
            location
        session_ip:
          type: string
          description: IP Address where the user signed in
          example: 123.456.78.900 / Indianapolis, IN, US
        second_factor_ip:
          type: string
          description: IP Address where the user attempted to use Multi Factor Authentication
          example: 123.456.78.900 / Indianapolis, IN, US
        used_second_factors:
          type: string
          description: Type of 2FA technology used to make the authentication
          example: MOBILE_APP_NOTIFICATION
        familiarity_statistics:
          type: object
          additionalProperties: {}
          description: Familiarity analysis of the other fields in this event
        location:
          allOf:
          - $ref: '#/components/schemas/EventLocation'
          description: Location of a sign in as detected from case analysis
      required:
      - category
      - description
      - event_timestamp
      - familiarity_statistics
      - field_labels
      - location
      - second_factor_ip
      - session_ip
      - title
      - used_second_factors
    MissedAttack:
      type: object
      properties:
        report_type:
          $ref: '#/components/schemas/MissedAttackReportTypeEnum'
          description: Type of report
        recipient_email:
          type: string
          description: Email address of the sender
          example: alice@aloha.com
        sender_email:
          type: string
          description: Email address of the sender
          example: alice@aloha.com
        subject:
          type: string
          description: Subject of the email
          example: hello!
        received_date:
          type: string
          description: Date the email was received in YYYY-MM-DD format.
        description:
          type: string
          description: Free text to provide more context on the issue.
          example: Alice reported this email looked like an attack.
      required:
      - recipient_email
      - report_type
      - sender_email
      - subject
    MissedAttackReportTypeEnum:
      enum:
      - missed-attack
      type: string
    MissedGraymail:
      type: object
      properties:
        report_type:
          $ref: '#/components/schemas/MissedGraymailReportTypeEnum'
          description: Type of report
        recipient_email:
          type: string
        sender_email:
          type: string
        subject:
          type: string
        received_date:
          type: string
          description: Date the email was received in YYYY-MM-DD format.
        description:
          type: string
          description: Free text to provide more context on the issue.
          example: Alice does not want to see this email in her inbox.
      required:
      - recipient_email
      - report_type
      - sender_email
      - subject
    MissedGraymailReportTypeEnum:
      enum:
      - missed-graymail
      type: string
    MissedSpam:
      type: object
      properties:
        report_type:
          $ref: '#/components/schemas/MissedSpamReportTypeEnum'
          description: Type of report
        recipient_email:
          type: string
        sender_email:
          type: string
        subject:
          type: string
        received_date:
          type: string
          description: Date the email was received in YYYY-MM-DD format.
        description:
          type: string
          description: Free text to provide more context on the issue.
          example: Alice reported this email looked like spam.
      required:
      - recipient_email
      - report_type
      - sender_email
      - subject
    MissedSpamReportTypeEnum:
      enum:
      - missed-spam
      type: string
    MostImpersonatedEmployee:
      type: object
      properties:
        impersonatedEmployeeName:
          type: string
          description: Name of the employee impersonated in attacks.
          example: John Doe
        attackCount:
          type: integer
          description: Number of detected attacks with the impersonated employee in
            the defined time range.
          example: 20
        prevAttackCount:
          type: integer
          description: Number of detected impersonated attacks prior to the defined
            time range.
          example: 20
      required:
      - attackCount
      - impersonatedEmployeeName
      - prevAttackCount
    MostImpersonatedEmployeeNonVIP:
      type: object
      properties:
        impersonatedEmployeeName:
          type: string
          description: The name of the non-VIP employee impersonated in attacks.
          example: John Doe
        attackCount:
          type: integer
          description: Number of detected attacks with the impersonated non-VIP employee
            in the defined time range.
          example: 20
        prevAttackCount:
          type: integer
          description: Number of detected impersonated attacks prior to the defined
            time range.
          example: 20
      required:
      - attackCount
      - impersonatedEmployeeName
      - prevAttackCount
    MostImpersonatedEmployeeNonVIPResponse:
      type: object
      properties:
        most_impersonated_employee_non_vip:
          type: array
          items:
            $ref: '#/components/schemas/MostImpersonatedEmployeeNonVIP'
          description: List detailing the names of the most impersonated non-VIP employees,
            along with the current and previous attack count for each.
      required:
      - most_impersonated_employee_non_vip
    MostImpersonatedEmployeeResponse:
      type: object
      properties:
        most_impersonated_employee:
          type: array
          items:
            $ref: '#/components/schemas/MostImpersonatedEmployee'
          description: List detailing the names of the most impersonated employees,
            along with the current and previous attack count for each.
      required:
      - most_impersonated_employee
    MostImpersonatedEmployeeVIP:
      type: object
      properties:
        impersonatedEmployeeName:
          type: string
          description: The name of the VIP employee impersonated in attacks.
          example: John Doe
        attackCount:
          type: integer
          description: Number of detected attacks with the impersonated VIP employee
            in the defined time range.
          example: 20
        prevAttackCount:
          type: integer
          description: Number of detected impersonated attacks prior to the defined
            time range.
          example: 20
      required:
      - attackCount
      - impersonatedEmployeeName
      - prevAttackCount
    MostImpersonatedEmployeeVIPResponse:
      type: object
      properties:
        most_impersonated_employee_vip:
          type: array
          items:
            $ref: '#/components/schemas/MostImpersonatedEmployeeVIP'
          description: List detailing the names of the most impersonated VIP employees,
            along with the current and previous attack count for each.
      required:
      - most_impersonated_employee_vip
    MostImpersonatedVendor:
      type: object
      properties:
        impersonatedBrandName:
          type: string
          description: The name of the vendor impersonated in attacks.
          example: Apple
        attackCount:
          type: integer
          description: The amount of attacks detected with the respective vendor impersonation.
          example: 20
        prevAttackCount:
          type: integer
          description: The amount of vendor impersonated attacks detected prior to
            the defined time range.
          example: 20
      required:
      - attackCount
      - impersonatedBrandName
      - prevAttackCount
    MostImpersonatedVendorResponse:
      type: object
      properties:
        most_impersonated_vendor:
          type: array
          items:
            $ref: '#/components/schemas/MostImpersonatedVendor'
          description: List detailing the most impersonated vendors, along with their
            attack counts for the current and previous periods.
      required:
      - most_impersonated_vendor
    NotAnalyzedReasonEnum:
      enum:
      - PHISHING_SIMULATION
      - EXCLUDED_SENDER
      - CUSTOM_FILTER
      - INVALID_MAILBOX
      - ORIGINAL_EMAIL_NOT_LOCATED
      - UNKNOWN_REPORTER
      - INVALID_SUBMISSION
      - ROUTED_SUBMISSION
      - COULD_NOT_EXTRACT
      - FROM_PHISHING_MAILBOX
      - NOT_ANALYZED_POV_QUOTA_REACHED
      - AI_CONVERSATION
      type: string
    NotFoundError:
      type: object
      description: 404 Not Found error response.
      properties:
        error:
          type: string
          default: Resource not found
          description: Resource with the specified ID was not found
    OutboundMessageEvent:
      type: object
      properties:
        event_timestamp:
          type: string
          format: date-time
          description: Time when event occurred
          example: '2020-05-19T17:47:30Z'
        category:
          type: string
          description: Type of event
          example: Mail Sent
        title:
          type: string
          description: Title of the event
          example: Unusual Correspondence
        subject:
          type: string
          description: Subject of suspicious email sent
          example: Transaction Sent
        sender:
          type: string
          description: Email of the Sender
          example: john.doe@lamronba.com
        recipient:
          type: string
          description: Name of the recipient
          example: Jane Eyre
      required:
      - category
      - event_timestamp
      - recipient
      - sender
      - subject
      - title
    PaginatedAbuseCampaings:
      type: object
      properties:
        campaigns:
          type: array
          items:
            $ref: '#/components/schemas/AbuseCampaign'
          description: List of abuse campaign IDs.
        pageNumber:
          type: integer
          default: 1
          description: The current page number. Will not be be in the response if
            no filter query parameter is passed in via the request.
        nextPageNumber:
          type: integer
          default: 2
          description: The next page number. Wil not be included in the response if
            there are no more pages of data or if no filter query parameter is passed
            in via the request
      required:
      - campaigns
    PaginatedCases:
      type: object
      properties:
        cases:
          type: array
          items:
            $ref: '#/components/schemas/AbnormalCase'
          description: List of Abnormal Cases.
        pageNumber:
          type: integer
          default: 1
          description: The current page number. Will not be be in the response if
            no filter query parameter is passed in via the request.
        nextPageNumber:
          type: integer
          default: 2
          description: The next page number. Wil not be included in the response if
            there are no more pages of data or if no filter query parameter is passed
            in via the request
      required:
      - cases
    PaginatedThreats:
      type: object
      properties:
        threats:
          type: array
          items:
            $ref: '#/components/schemas/Threat'
          description: List of threat IDs.
        pageNumber:
          type: integer
          default: 1
          description: The current page number. Will not be be in the response if
            no filter query parameter is passed in via the request.
        nextPageNumber:
          type: integer
          default: 2
          description: The next page number. Wil not be included in the response if
            there are no more pages of data or if no filter query parameter is passed
            in via the request
      required:
      - threats
    PaginatedVendorCases:
      type: object
      properties:
        vendorCases:
          type: array
          items:
            $ref: '#/components/schemas/VendorCases'
          description: List of vendor cases.
        pageNumber:
          type: integer
          default: 1
          description: The current page number. Will not be be in the response if
            no filter query parameter is passed in via the request.
        nextPageNumber:
          type: integer
          default: 2
          description: The next page number. Wil not be included in the response if
            there are no more pages of data or if no filter query parameter is passed
            in via the request
      required:
      - vendorCases
    PaginatedVendors:
      type: object
      properties:
        vendors:
          type: array
          items:
            $ref: '#/components/schemas/Vendors'
          description: List of vendors.
        pageNumber:
          type: integer
          default: 1
          description: The current page number. Will not be be in the response if
            no filter query parameter is passed in via the request.
        nextPageNumber:
          type: integer
          default: 2
          description: The next page number. Wil not be included in the response if
            there are no more pages of data or if no filter query parameter is passed
            in via the request
      required:
      - vendors
    PaginationMetadata:
      type: object
      description: Serializer for pagination metadata.
      properties:
        page:
          type: integer
          description: Current page number
          example: 1
        pageSize:
          type: integer
          description: Number of items per page
          example: 10
        totalResults:
          type: integer
          description: Total number of items available
          example: 42
        totalPages:
          type: integer
          description: Total number of pages
          example: 5
      required:
      - page
      - pageSize
      - totalPages
      - totalResults
    PaginationSwagger:
      type: object
      description: Swagger serializer for pagination metadata.
      properties:
        total:
          type: integer
          description: Total number of tokens matching criteria
        limit:
          type: integer
          description: Maximum tokens returned in this response
        offset:
          type: integer
          description: Number of tokens skipped
      required:
      - limit
      - offset
      - total
    PatchedUpdateResource:
      type: object
      description: Serializer for updating an existing resource.
      properties:
        description:
          type: string
          description: Updated description (can be empty string to clear)
          maxLength: 1000
    PerformAction:
      type: object
      description: Serializer for performing an action on a resource.
      properties:
        action:
          $ref: '#/components/schemas/PerformActionActionEnum'
          description: 'Action to perform: refresh or validate'
      required:
      - action
    PerformActionActionEnum:
      enum:
      - refresh
      - validate
      type: string
    PerformActionResponse:
      type: object
      description: Serializer for perform action response.
      properties:
        actionId:
          type: string
          description: Unique ID for the action request
        resourceId:
          type: string
          description: ID of the resource the action was performed on
        status:
          type: string
          description: Status of the action
      required:
      - actionId
      - resourceId
      - status
    PolicySwagger:
      type: object
      description: Swagger serializer for policy object within a role.
      properties:
        resource:
          type: string
          description: The resource name (e.g., 'threats', 'cases')
        permissions:
          type: array
          items:
            type: string
          description: List of permissions granted on this resource
      required:
      - permissions
      - resource
    PortalVisibleRootCause:
      type: object
      properties:
        name:
          type: string
        description:
          type: string
      required:
      - description
      - name
    PostCaseRequest:
      type: object
      properties:
        action:
          $ref: '#/components/schemas/PostCaseRequestActionEnum'
      required:
      - action
    PostCaseRequestActionEnum:
      enum:
      - action_required
      - acknowledge_resolved
      - acknowledge_in_progress
      - acknowledge_not_an_attack
      type: string
    PostCaseResponse:
      type: object
      properties:
        actionId:
          type: string
          description: A unique identifier for this case.
          example: 61e76395-40d3-4d78-b6a8-8b17634d0f5b
        statusUrl:
          type: string
          description: The URL of the status of the case.
          example: https://api.abnormalplatform.com/v1/cases/1234/actions/61e76395-40d3-4d78-b6a8-8b17634d0f5b
      required:
      - actionId
      - statusUrl
    PostThreatRequest:
      type: object
      properties:
        action:
          $ref: '#/components/schemas/PostThreatRequestActionEnum'
      required:
      - action
    PostThreatRequestActionEnum:
      enum:
      - remediate
      - unremediate
      type: string
    PostThreatResponse:
      type: object
      properties:
        action_id:
          type: string
          description: The UUID representing the action id for a threat.
          example: a33a212a-89ff-461f-be34-ea52aff44a67
        status_url:
          type: string
          description: The URL for status of specific threat.
          example: https://api.abnormalplatform.com/v1/threats/184712ab-6d8b-47b3-89d3-a314efef79e2/actions/a33a212a-89ff-461f-be34-ea52aff44a73
        tenantId:
          type: integer
          nullable: true
          description: The tenant ID associated with the threat
          example: 1234
        tenantName:
          type: string
          nullable: true
          description: The short name of the tenant associated with the threat
          example: example-tenant
      required:
      - action_id
      - status_url
      - tenantId
      - tenantName
    PostureArea:
      type: object
      properties:
        title:
          type: string
          description: Title of the posture area
          example: Admin Center Highlights
        description:
          type: string
          description: Description of the posture area with security grade information
          example: <p>Abnormal rates the security grade of Admin Center as &quot;B-&quot;
            because less than 25% of postures in this area are resolved...</p>
        highlights:
          type: array
          items:
            $ref: '#/components/schemas/PostureHighlight'
          description: List of highlighted security postures in this area
    PostureCatalogResponse:
      type: object
      description: Paginated response serializer for posture catalog.
      properties:
        metadata:
          allOf:
          - $ref: '#/components/schemas/ResponseMetadata'
          description: Response metadata including pagination information
        data:
          type: array
          items:
            $ref: '#/components/schemas/PostureItem'
          description: List of available postures in the catalog
    PostureDetail:
      type: object
      properties:
        last_updated_time:
          type: string
          format: date-time
          description: Timestamp when the posture was last updated
          example: '2025-04-29T15:51:41.560354Z'
        posture_name:
          type: string
          description: Name of the security posture
          example: Ensure Microsoft Authenticator is configured to protect against
            MFA fatigue
        status:
          type: string
          description: Current compliance status of the posture
          example: NON_COMPLIANT
        workflow_status:
          type: string
          description: Current workflow status for remediation
          example: UNTRIAGED
        actor:
          allOf:
          - $ref: '#/components/schemas/Actor'
          description: Actor who last modified the posture
        posture_type:
          type: string
          description: Type of posture evaluation (AUTO or MANUAL)
          example: AUTO
        description:
          type: string
          description: Detailed description of the security posture requirement
          example: '**Microsoft Authenticator** should be configured to prevent MFA
            fatigue attacks...'
        risk_level:
          type: string
          description: Risk level associated with this posture
          example: HIGH
    PostureHighlight:
      type: object
      properties:
        title:
          type: string
          description: Title of the highlighted security posture
          example: Ensure Administrative accounts are separate and cloud-only
        description:
          type: string
          description: Description of the security posture highlight
          example: <p><strong>Administrative accounts are separate and cloud-only</strong>
            ensures proper separation of privileged accounts from regular user accounts.</p>
        posture_id:
          type: integer
          description: Unique identifier for the posture
          example: 292
        risk_level:
          type: string
          description: Risk level of the highlighted posture
          example: HIGH
    PostureItem:
      type: object
      description: Serializer for individual posture items in the catalog.
      properties:
        id:
          type: string
          description: Unique identifier for the posture
          example: ensure-microsoft-authenticator-configured
        space_type:
          type: string
          description: Type of space this posture applies to
          example: TENANT
        platform_type:
          type: string
          description: Platform type for this posture
          example: M365
        posture_area:
          type: string
          description: Area or category of the posture
          example: ENTRA
        benchmarks:
          type: array
          items:
            type: string
          description: List of security benchmarks this posture belongs to
          example:
          - CIS
        name:
          type: string
          description: Name of the security posture
          example: Ensure Microsoft Authenticator is configured to protect against
            MFA fatigue
        category:
          type: string
          description: Category classification of the posture
          example: AUTHENTICATION
        risk_level:
          type: string
          description: Risk level associated with this posture
          example: HIGH
        description:
          type: string
          description: Detailed description of the security posture requirement
          example: Microsoft Authenticator should be configured to prevent MFA fatigue
            attacks by requiring number matching...
        insight:
          type: string
          description: Additional insights about the posture
          example: This configuration helps prevent attackers from bypassing MFA through
            fatigue attacks
        remediation_steps:
          type: string
          description: Steps to remediate this posture
          example: 1. Navigate to Azure AD admin center 2. Go to Security > Authentication
            methods...
        created_at:
          type: string
          format: date-time
          description: Timestamp when the posture was created
          example: '2025-01-15T10:30:00Z'
        updated_at:
          type: string
          format: date-time
          description: Timestamp when the posture was last updated
          example: '2025-04-29T15:51:41.560354Z'
    PostureListItem:
      type: object
      properties:
        posture_id:
          type: integer
          description: Unique identifier for the posture
          example: 421
        posture_name:
          type: string
          description: Name of the security posture
          example: Ensure that collaboration invitations are sent to allowed domains
            only
        status:
          type: string
          description: Current compliance status
          example: PENDING_EVALUATION
        workflow_status:
          type: string
          description: Current workflow status
          example: UNTRIAGED
        risk_level:
          allOf:
          - $ref: '#/components/schemas/DisplayId'
          description: Risk level of the posture
        last_updated_time:
          type: string
          format: date-time
          description: Timestamp when the posture was last updated
          example: '2025-04-24T07:50:04.086534Z'
        last_evaluated_at:
          type: string
          format: date-time
          description: Timestamp when the posture was last evaluated
          example: '2025-04-24T07:50:04.087191Z'
        posture_type:
          type: string
          description: Type of posture evaluation
          example: MANUAL
        benchmarks:
          type: array
          items:
            $ref: '#/components/schemas/DisplayId'
          description: List of security benchmarks this posture belongs to
        tags:
          type: array
          items:
            $ref: '#/components/schemas/DisplayId'
          description: List of tags associated with the posture
    PostureListParams:
      type: object
      properties:
        risk_levels:
          type: array
          items:
            $ref: '#/components/schemas/RiskLevelsEnum'
          description: Filter by risk levels
          example:
          - HIGH
          - MED
        statuses:
          type: array
          items:
            $ref: '#/components/schemas/StatusesEnum'
          description: Filter by compliance statuses
          example:
          - PENDING_EVALUATION
          - NON_COMPLIANT
        benchmarks:
          type: array
          items:
            $ref: '#/components/schemas/BenchmarksEnum'
          description: Filter by security benchmarks
          example:
          - CIS
        last_evaluated_at:
          allOf:
          - $ref: '#/components/schemas/DateRange'
          description: Filter by last evaluation date range
        posture_area:
          type: array
          items:
            type: string
          description: Filter by posture areas
          example:
          - ADMIN_CENTER
          - ENTRA
        platform_type:
          type: array
          items:
            type: string
          description: Filter by platform types
          example:
          - M365
        posture_types:
          type: array
          items:
            type: string
          description: Filter by posture types
          example:
          - MANUAL
          - AUTO
    PostureListResponse:
      type: object
      description: Paginated response serializer for posture list.
      properties:
        metadata:
          allOf:
          - $ref: '#/components/schemas/ResponseMetadata'
          description: Response metadata including pagination information
        postures:
          type: array
          items:
            $ref: '#/components/schemas/PostureListItem'
          description: List of postures
    PostureStats:
      type: object
      properties:
        total_postures_count:
          type: integer
          description: Total number of postures in this area
          example: 13
        success_postures_count:
          type: integer
          description: Number of postures that are compliant
          example: 0
        fail_postures_count:
          type: integer
          description: Number of postures that are non-compliant
          example: 13
    PostureTimelineResponse:
      type: object
      description: Paginated response serializer for posture timeline events.
      properties:
        metadata:
          allOf:
          - $ref: '#/components/schemas/ResponseMetadata'
          description: Response metadata including pagination information
        events:
          type: array
          items:
            $ref: '#/components/schemas/TimelineEntry'
          description: List of timeline events for the posture
    QuarantineInfo:
      properties:
        identity:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Identity
        message_id:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Message Id
        policy_type:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Policy Type
        quarantine_reason:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Quarantine Reason
        release_status:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Release Status
        type:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Type
        processed_at:
          anyOf:
          - format: date-time
            type: string
          - type: 'null'
          default: null
          title: Processed At
      title: QuarantineInfo
      type: object
    RecipientEmployee:
      type: object
      properties:
        job_title:
          type: string
          description: The job title of the employee who was the target of the attack.
          example: Software Engineer
        display_name:
          type: string
          description: The display name of the employee who was the target of the
            attack.
          example: Jane Doe
        attack_count:
          type: integer
          description: The number of occurrences of the attack targeting the given
            employee in the specified time frame.
          example: 15
        prev_attack_count:
          type: integer
          description: The number of occurrences of the attack targeting the given
            employee in the previous period.
          example: 10
      required:
      - attack_count
      - display_name
      - job_title
      - prev_attack_count
    RecipientEmployeeNonVIP:
      type: object
      properties:
        job_title:
          type: string
          description: The job title of the non-VIP employee who was the target of
            the attack.
          example: Software Engineer
        display_name:
          type: string
          description: The display name of the non-VIP employee who was the target
            of the attack.
          example: Jane Doe
        attack_count:
          type: integer
          description: The number of occurrences of the attack targeting the given
            non-VIP employee in the specified time frame.
          example: 15
        prev_attack_count:
          type: integer
          description: The number of occurrences of the attack targeting the given
            non-VIP employee in the previous period.
          example: 10
      required:
      - attack_count
      - display_name
      - job_title
      - prev_attack_count
    RecipientEmployeeNonVIPResponse:
      type: object
      properties:
        recipient_employees_non_vip:
          type: array
          items:
            $ref: '#/components/schemas/RecipientEmployeeNonVIP'
          description: List detailing the recipient non-VIP employees, their job titles,
            and the attack counts against them for the current and previous periods.
      required:
      - recipient_employees_non_vip
    RecipientEmployeeResponse:
      type: object
      properties:
        recipient_employees:
          type: array
          items:
            $ref: '#/components/schemas/RecipientEmployee'
          description: List detailing the recipient employees, their job titles, and
            the attack counts against them for the current and previous periods.
      required:
      - recipient_employees
    RecipientEmployeeVIP:
      type: object
      properties:
        job_title:
          type: string
          description: The job title of the VIP employee who was the target of the
            attack.
          example: Software Engineer
        display_name:
          type: string
          description: The display name of the VIP employee who was the target of
            the attack.
          example: Jane Doe
        attack_count:
          type: integer
          description: The number of occurrences of the attack targeting the given
            VIP employee in the specified time frame.
          example: 15
        prev_attack_count:
          type: integer
          description: The number of occurrences of the attack targeting the given
            VIP employee in the previous period.
          example: 10
      required:
      - attack_count
      - display_name
      - job_title
      - prev_attack_count
    RecipientEmployeeVIPResponse:
      type: object
      properties:
        recipient_employees_vip:
          type: array
          items:
            $ref: '#/components/schemas/RecipientEmployeeVIP'
          description: List detailing the recipient VIP employees, their job titles,
            and the attack counts against them for the current and previous periods.
      required:
      - recipient_employees_vip
    RemediationActionEnum:
      enum:
      - delete
      - move_to_inbox
      title: RemediationActionEnum
      type: string
    RemediationDetail:
      properties:
        tenant_id:
          title: Tenant Id
          type: integer
        raw_message_id:
          title: Raw Message Id
          type: string
        subject:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Subject
        sender:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Sender
        mailbox_name:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Mailbox Name
        current_folder_name:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Current Folder Name
        native_user_id:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Native User Id
        date_created:
          anyOf:
          - format: date-time
            type: string
          - type: 'null'
          default: null
          title: Date Created
        date_remediated:
          anyOf:
          - format: date-time
            type: string
          - type: 'null'
          default: null
          title: Date Remediated
        status:
          $ref: '#/components/schemas/ActionStatusEnum'
        status_details:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Status Details
        received_time:
          anyOf:
          - format: date-time
            type: string
          - type: 'null'
          default: null
          title: Received Time
      required:
      - tenant_id
      - raw_message_id
      - status
      title: RemediationDetail
      type: object
    RemediationHistory:
      type: object
      properties:
        remediation_history:
          type: object
          additionalProperties:
            type: string
            format: date-time
          description: Remediation history of a threat.
          example: '"Auto-Remediated": "2023-04-11T20:54:56.244716+00:00"'
        folder_locations:
          type: array
          items:
            type: string
          description: Folder locations.
          example:
          - Junk
      required:
      - folder_locations
      - remediation_history
    RemediationRequest:
      properties:
        action:
          $ref: '#/components/schemas/RemediationActionEnum'
          description: Remediation action
        source:
          $ref: '#/components/schemas/EmailSourceEnum'
          description: Source of the messages
        remediation_reason:
          $ref: '#/components/schemas/ActionReasonEnum'
          description: Reason for remediation
        target_folder:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          description: Target folder for move actions
          title: Target Folder
        submit_d360_case:
          anyOf:
          - type: boolean
          - type: 'null'
          default: false
          title: Submit D360 Case
        messages:
          anyOf:
          - items:
              $ref: '#/components/schemas/MessageToRemediate'
            type: array
          - type: 'null'
          default: null
          title: Messages
        remediate_all:
          anyOf:
          - type: boolean
          - type: 'null'
          default: false
          title: Remediate All
        search_filters:
          anyOf:
          - $ref: '#/components/schemas/SearchFilters'
          - type: 'null'
          default: null
        tenant_ids:
          anyOf:
          - items:
              type: integer
            minItems: 1
            type: array
          - type: 'null'
          default: null
          description: Optional list of tenant IDs to filter remediation. If not provided,
            all authorized tenants are included.
          title: Tenant Ids
      required:
      - action
      - source
      - remediation_reason
      title: RemediationRequest
      type: object
    RemediationResponse:
      properties:
        activity_log_id:
          title: Activity Log Id
          type: integer
        metadata:
          $ref: '#/components/schemas/MetaData'
      required:
      - activity_log_id
      - metadata
      title: RemediationResponse
      type: object
    RemediationStatusEnum:
      enum:
      - Not remediated
      - remediated
      - Remediation attempted
      type: string
    Resource:
      type: object
      description: Serializer for resource representation in responses.
      properties:
        resourceId:
          type: string
          description: Unique identifier for the resource
        name:
          type: string
          description: Human-readable name of the resource
        description:
          type: string
          nullable: true
          description: Optional description of the resource
        tags:
          type: array
          items:
            type: string
          description: List of tags
      required:
      - name
      - resourceId
    ResourcePermissionSwagger:
      type: object
      description: Swagger serializer for resource permissions.
      properties:
        resource:
          type: string
          description: Name of the resource (e.g., 'ato', 'threat_log')
        permissions:
          type: array
          items:
            type: string
          description: List of permissions for this resource (e.g., 'view', 'write',
            'manage')
      required:
      - permissions
      - resource
    ResponseMetadata:
      type: object
      description: Serializer for response metadata containing pagination information.
      properties:
        pagination:
          allOf:
          - $ref: '#/components/schemas/PaginationMetadata'
          description: Pagination information for the response
      required:
      - pagination
    RiskEvent:
      type: object
      properties:
        event_timestamp:
          type: string
          format: date-time
          description: Time when event occurred
          example: '2020-05-19T17:47:30Z'
        category:
          type: string
          description: Type of event
          example: Risk Event
        title:
          type: string
          description: Title of the event
          example: Impossible Travel
        field_labels:
          type: object
          additionalProperties: {}
          description: Anomaly labels/tags associated with fields in the event
        ip_address:
          type: string
          description: IP Address where user accessed mail from
          example: 123.456.78.900
        location:
          allOf:
          - $ref: '#/components/schemas/EventLocation'
          description: Location of a sign in as detected from case analysis
        prev_location:
          allOf:
          - $ref: '#/components/schemas/EventLocation'
          description: Location of a sign in as detected from case analysis
      required:
      - category
      - event_timestamp
      - field_labels
      - ip_address
      - location
      - prev_location
      - title
    RiskLevelsEnum:
      enum:
      - LOW
      - MED
      - HIGH
      type: string
    RoleListResponse:
      type: object
      description: Swagger serializer for role list response.
      properties:
        status:
          type: string
          default: success
          description: Status of the response
        status_code:
          type: integer
          default: 200
          description: HTTP status code
        data:
          type: array
          items:
            $ref: '#/components/schemas/RoleSwagger'
          description: List of global roles from RBAC system
      required:
      - data
    RoleSwagger:
      type: object
      description: Swagger serializer for role object.
      properties:
        id:
          type: integer
          description: The unique identifier for the role
        name:
          type: string
          description: Name of the role
        description:
          type: string
          default: ''
          description: Description of the role
        policies:
          type: array
          items:
            $ref: '#/components/schemas/PolicySwagger'
          description: Simplified view of permissions granted by this role
      required:
      - id
      - name
      - policies
    SPMReport:
      type: object
      properties:
        sections:
          type: array
          items:
            $ref: '#/components/schemas/Section'
          description: List of security posture sections organized by platform area
    SearchFilters:
      properties:
        start_time:
          description: Start time in ISO 8601 format
          format: date-time
          title: Start Time
          type: string
        end_time:
          description: End time in ISO 8601 format
          format: date-time
          title: End Time
          type: string
        subject:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Subject
        sender_email:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Sender Email
        sender_name:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Sender Name
        recipient_email:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Recipient Email
        recipient_name:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Recipient Name
        attachment_name:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Attachment Name
        attachment_md5_hash:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Attachment Md5 Hash
        internet_message_id:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Internet Message Id
        body_link:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Body Link
        sender_ip:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Sender Ip
        judgement:
          anyOf:
          - $ref: '#/components/schemas/JudgementEnum'
          - type: 'null'
          default: null
        judgement_source:
          anyOf:
          - $ref: '#/components/schemas/JudgementSourceEnum'
          - type: 'null'
          default: null
        judgement_source_model_ids:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          default: null
          title: Judgement Source Model Ids
        judgement_source_model_versions:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          default: null
          title: Judgement Source Model Versions
        use_sender_regex:
          anyOf:
          - type: boolean
          - type: 'null'
          default: false
          title: Use Sender Regex
        use_recipient_regex:
          anyOf:
          - type: boolean
          - type: 'null'
          default: false
          title: Use Recipient Regex
      required:
      - start_time
      - end_time
      title: SearchFilters
      type: object
    SearchRequest:
      properties:
        source:
          $ref: '#/components/schemas/EmailSourceEnum'
          description: Source of the search
        filters:
          $ref: '#/components/schemas/SearchFilters'
          description: Search filters
        tenant_ids:
          anyOf:
          - items:
              type: integer
            minItems: 1
            type: array
          - type: 'null'
          default: null
          description: Optional list of tenant IDs to filter the search. If not provided,
            all authorized tenants are included.
          title: Tenant Ids
      required:
      - source
      - filters
      title: SearchRequest
      type: object
    SearchResponse:
      properties:
        results:
          items:
            $ref: '#/components/schemas/SearchResult'
          title: Results
          type: array
        total:
          title: Total
          type: integer
        pageNumber:
          title: Pagenumber
          type: integer
        pageSize:
          title: Pagesize
          type: integer
        nextPageNumber:
          anyOf:
          - type: integer
          - type: 'null'
          default: null
          title: Nextpagenumber
        metadata:
          $ref: '#/components/schemas/MetaData'
      required:
      - results
      - total
      - pageNumber
      - pageSize
      - metadata
      title: SearchResponse
      type: object
    SearchResult:
      properties:
        customer_id:
          anyOf:
          - type: integer
          - type: 'null'
          default: null
          title: Customer Id
        tenant_id:
          anyOf:
          - type: integer
          - type: 'null'
          default: null
          title: Tenant Id
        received_time:
          anyOf:
          - format: date-time
            type: string
          - type: 'null'
          default: null
          title: Received Time
        subject:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Subject
        sender:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Sender
        sender_display_name:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Sender Display Name
        mailbox_name:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Mailbox Name
        mailbox_display_name:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Mailbox Display Name
        current_folder_name:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Current Folder Name
        raw_message_id:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Raw Message Id
        native_user_id:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Native User Id
        cloud_message_id:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Cloud Message Id
        internet_message_id:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Internet Message Id
        abnormal_message_id:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Abnormal Message Id
        abnormal_message_uuid:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Abnormal Message Uuid
        decision_category:
          anyOf:
          - $ref: '#/components/schemas/DecisionCategoryEnum'
          - type: 'null'
          default: null
        judgement:
          anyOf:
          - $ref: '#/components/schemas/JudgementEnum'
          - type: 'null'
          default: null
        judgement_source:
          anyOf:
          - $ref: '#/components/schemas/JudgementSourceEnum'
          - type: 'null'
          default: null
        judgement_source_model_id:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Judgement Source Model Id
        judgement_source_model_version:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Judgement Source Model Version
        attachments:
          anyOf:
          - additionalProperties:
              $ref: '#/components/schemas/Attachment'
            type: object
          - type: 'null'
          default: null
          title: Attachments
        body_links:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          default: null
          title: Body Links
        sender_ip_addresses:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          default: null
          title: Sender Ip Addresses
        quarantine_info:
          anyOf:
          - $ref: '#/components/schemas/QuarantineInfo'
          - type: 'null'
          default: null
      title: SearchResult
      type: object
    Section:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the section
          example: ADMIN_CENTER
        platform_type:
          type: string
          description: Platform type for this section
          example: M365
        display_name:
          type: string
          description: Human-readable name for the section
          example: Admin Center
        stats:
          allOf:
          - $ref: '#/components/schemas/PostureStats'
          description: Statistics about postures in this section
        posture_area:
          allOf:
          - $ref: '#/components/schemas/PostureArea'
          description: Detailed information about the posture area
    SecuritySettingsDataSwagger:
      type: object
      description: Swagger serializer for security settings data.
      properties:
        session_settings:
          allOf:
          - $ref: '#/components/schemas/SessionSettingsSwagger'
          description: Session timeout settings
      required:
      - session_settings
    SecuritySettingsResponse:
      type: object
      description: Swagger serializer for security settings response.
      properties:
        status:
          type: string
          default: success
          description: Status of the response
        status_code:
          type: integer
          default: 200
          description: HTTP status code
        data:
          allOf:
          - $ref: '#/components/schemas/SecuritySettingsDataSwagger'
          description: Security settings data
      required:
      - data
    SenderImpersonationBreakdown:
      type: object
      properties:
        impersonatedPartyName:
          type: string
          description: The specific name or category of the party being impersonated
            in the attack.
          example: VIP
        attackCount:
          type: integer
          description: The number of detected attacks associated with the specific
            impersonated party
          example: 200
      required:
      - attackCount
      - impersonatedPartyName
    SenderImpersonationResponse:
      type: object
      properties:
        sender_impersonation_breakdown:
          type: array
          items:
            $ref: '#/components/schemas/SenderImpersonationBreakdown'
          description: List detailing the breakdown of attacks by impersonated sender,
            along with the count for each impersonated sender type.
      required:
      - sender_impersonation_breakdown
    SessionSettingsSwagger:
      type: object
      description: Swagger serializer for session settings.
      properties:
        inactivity_timeout_minutes:
          type: integer
          nullable: true
          description: Inactivity timeout in minutes (time before session expires
            due to inactivity)
        max_session_time_minutes:
          type: integer
          nullable: true
          description: Maximum session time in minutes (absolute max time before re-authentication
            required)
      required:
      - inactivity_timeout_minutes
      - max_session_time_minutes
    SeverityLevel3eaEnum:
      enum:
      - LOW
      - MEDIUM
      - HIGH
      type: string
    SignInEvent:
      type: object
      properties:
        event_timestamp:
          type: string
          format: date-time
          description: Time when event occurred
          example: '2020-05-19T17:47:30Z'
        category:
          type: string
          description: Type of event
          example: Sign In Event
        title:
          type: string
          description: Title of the event
          example: Suspicious Failed Sign In Attempt
        field_labels:
          type: object
          additionalProperties: {}
          description: Anomaly labels/tags associated with fields in the event
        description:
          type: string
          description: Description of the sign in event
          example: Suspicious Failed Sign In Attempt for foo@bar.com
        ip_address:
          type: string
          description: IP Address where user attempted to sign in from
          example: 123.456.78.900
        isp:
          type: string
          description: ISP that was used when attempting to sign in to mailbox
          example: NGCOM
        browser:
          type: string
          description: Browser that was used when attempting to sign in to mailbox
          example: Chrome
        operating_system:
          type: string
          description: Operating system of the device used to attempt sign in
          example: Windows 10
        device_trust_type:
          type: string
          description: Trust type used by device when signing in
        protocol:
          type: string
          description: Connection protocol used when attempting to sign in
          example: Browser
        application:
          type: string
          description: Mail application used to sign in
          example: GSuite
        location:
          allOf:
          - $ref: '#/components/schemas/EventLocation'
          description: Location of a sign in as detected from case analysis
      required:
      - application
      - browser
      - category
      - description
      - device_trust_type
      - event_timestamp
      - field_labels
      - ip_address
      - isp
      - location
      - operating_system
      - protocol
      - title
    SoarAttachmentSignalsStruct:
      type: object
      description: Serializes a AttachmentSignalsPortalStruct object for Soar payload
      properties:
        attachmentName:
          type: string
          readOnly: true
          description: Name of the attachment file
          example: test_attachment.pdf
        type:
          type: string
          readOnly: true
          description: File type of the attachment
          example: JPEG
        details:
          type: array
          items:
            type: string
          readOnly: true
          description: Details of insights gained from analyzing the attachment
          example:
          - has Javascript
        md5:
          type: string
          nullable: true
          readOnly: true
          description: MD5 algorithm hash of the attachment
          example: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
        sha1:
          type: string
          nullable: true
          readOnly: true
          description: SHA1 hash of the attachment
          example: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0
        sha256:
          type: string
          nullable: true
          readOnly: true
          description: SHA256 hash of the attachment
          example: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
        size:
          type: string
          readOnly: true
          description: Size of the attachment file
          example: 1KB
        createdOn:
          type: string
          format: date-time
          readOnly: true
          description: Timestamp attachment file was created on
          example: '2020-01-01T00:00:00Z'
        lastUpdated:
          type: string
          format: date-time
          readOnly: true
          description: Timestamp attachment file was last updated
          example: '2020-01-01T00:00:00Z'
        url:
          type: array
          items:
            type: string
          readOnly: true
          description: URLs found in the attachment
          example:
          - http://malicious.lamronba.com
        keyPhrases:
          type: array
          items:
            type: string
          readOnly: true
          description: Key phrases flagging the attachment as potential malware
          example:
          - view
          - completed document
      required:
      - attachmentName
      - createdOn
      - details
      - keyPhrases
      - lastUpdated
      - md5
      - sha1
      - sha256
      - size
      - type
      - url
    SoarClickedEvent:
      type: object
      description: Serializer for clicked event representation in responses.
      properties:
        type:
          type: string
          description: Type of click event (click or clickthrough)
        link:
          type: string
          description: The URL that was clicked
        insights:
          type: array
          items:
            type: string
          description: List of insights about the click
        messageMetadata:
          allOf:
          - $ref: '#/components/schemas/SoarMessageMetadata'
          description: Metadata about the email message
        user:
          allOf:
          - $ref: '#/components/schemas/SoarUserAddress'
          description: Information about the user who clicked
        clickedTime:
          type: integer
          description: Unix timestamp when the click occurred
      required:
      - clickedTime
      - insights
      - link
      - messageMetadata
      - type
      - user
    SoarMessageMetadata:
      type: object
      description: |-
        Serializer for message metadata.

        Note: the "from" field is injected below via `_declared_fields` because
        `from` is a Python keyword and cannot be declared as a class attribute.
      properties:
        subject:
          type: string
          nullable: true
          description: Subject of the email message
        sender:
          allOf:
          - $ref: '#/components/schemas/SoarUserAddress'
          description: Sender of the email message
        to:
          type: array
          items:
            $ref: '#/components/schemas/SoarUserAddress'
          description: Recipients of the email message
        cc:
          type: array
          items:
            $ref: '#/components/schemas/SoarUserAddress'
          description: CC recipients of the email message
        from:
          allOf:
          - $ref: '#/components/schemas/SoarUserAddress'
          description: Sender of the email message
      required:
      - cc
      - from
      - sender
      - to
    SoarUserAddress:
      type: object
      description: Serializer for user address information.
      properties:
        name:
          type: string
          nullable: true
          description: Display name of the user
        emailAddress:
          type: string
          description: Email address of the user who clicked the link
      required:
      - emailAddress
    StatusesEnum:
      enum:
      - NON_COMPLIANT
      - COMPLIANT
      - PENDING_EVALUATION
      - PERMISSIONS_NEEDED
      type: string
    TextBlock:
      type: object
      properties:
        type:
          type: string
          description: Type of text block (TEXT, LINK, or STATUS)
          example: TEXT
        text:
          type: string
          description: Text content of the block
          example: Abnormal Security
        href:
          type: string
          description: URL for link type blocks
          example: /home/knowledge/tenant/41ef22d1-8ada-4f0b-a384-5d78274bcedb
    Threat:
      type: object
      properties:
        threatId:
          type: string
          description: An id which maps to a threat campaign. A threat campaign might
            be received by multiple users.
          example: 184712ab-6d8b-47b3-89d3-a314efef79e2
      required:
      - threatId
    ThreatAttachments:
      type: object
      properties:
        abxMessageId:
          type: integer
          description: An integer representing a unique identifier for an individual
            message within a threat (i.e email campaign). This is deprecated, use
            abxMessageIdStr instead.
          deprecated: true
          example: 4551618356913732000
        abxMessageIdStr:
          type: string
          description: A string representing a unique identifier for an individual
            message within a threat (i.e email campaign).
          example: 4551618356913732000
        attachmentName:
          type: string
          description: Name of the attachment
          example: attachment1.jpg
      required:
      - abxMessageId
      - abxMessageIdStr
      - attachmentName
    ThreatAttachmentsResponse:
      type: object
      properties:
        attachments:
          type: array
          items:
            $ref: '#/components/schemas/ThreatAttachments'
          description: List of attachments in the email messages of a threat
        tenantId:
          type: integer
          nullable: true
          description: The tenant ID associated with the threat
          example: 1234
        tenantName:
          type: string
          nullable: true
          description: The short name of the tenant associated with the threat
          example: example-tenant
      required:
      - attachments
      - tenantId
      - tenantName
    ThreatDetails:
      type: object
      properties:
        threatId:
          type: string
          description: An id which maps to a threat campaign. A threat campaign might
            be received by multiple users.
          example: 184712ab-6d8b-47b3-89d3-a314efef79e2
        recipientCount:
          type: integer
          description: The total number of unique recipients who received messages
            in this threat campaign.
        messages:
          type: array
          items:
            $ref: '#/components/schemas/ThreatMessage'
          description: A list of messages comprised in this threat (i.e email campaign).
        tenantId:
          type: integer
          nullable: true
          description: The tenant ID associated with the threat
          example: 1234
        tenantName:
          type: string
          nullable: true
          description: The short name of the tenant associated with the threat
          example: example-tenant
        pageNumber:
          type: integer
          default: 1
          description: The current page number
        nextPageNumber:
          type: integer
          default: 2
          description: The next page number. Wil not be includedin the response if
            there are no more pages of data
      required:
      - messages
      - recipientCount
      - tenantId
      - tenantName
      - threatId
    ThreatLinks:
      type: object
      properties:
        abxMessageId:
          type: integer
          description: An integer representing a unique identifier for an individual
            message within a threat (i.e email campaign). This is deprecated, use
            abxMessageIdStr instead.
          deprecated: true
          example: 4551618356913732000
        abxMessageIdStr:
          type: string
          description: A string representing a unique identifier for an individual
            message within a threat (i.e email campaign).
          example: 4551618356913732000
        domainLink:
          type: string
          description: The domain name of the link
          example: lamronba.com
        linkType:
          type: string
          description: The type of link in the email
          example: html href
        source:
          type: string
          description: The location in the email where the link may be found
          example: body
        displayText:
          type: string
          description: The link's display text
          example: This is not a spoof!
        linkUrl:
          type: string
          description: The URL of the link
          example: http://spoof.lamronba.com
      required:
      - abxMessageId
      - abxMessageIdStr
      - displayText
      - domainLink
      - linkType
      - linkUrl
      - source
    ThreatLinksResponse:
      type: object
      properties:
        links:
          type: array
          items:
            $ref: '#/components/schemas/ThreatLinks'
          description: List of links in the email messages of a threat
        tenantId:
          type: integer
          nullable: true
          description: The tenant ID associated with the threat
          example: 1234
        tenantName:
          type: string
          nullable: true
          description: The short name of the tenant associated with the threat
          example: example-tenant
      required:
      - links
      - tenantId
      - tenantName
    ThreatMessage:
      type: object
      properties:
        threatId:
          type: string
          description: An id which maps to a threat campaign. A threat campaign might
            be received by multiple users.
          example: 184712ab-6d8b-47b3-89d3-a314efef79e2
        abxMessageId:
          type: integer
          description: An integer representing a unique identifier for an individual
            message within a threat (i.e email campaign). This is deprecated, use
            abxMessageIdStr instead.
          deprecated: true
          example: 4551618356913732000
        abxMessageIdStr:
          type: string
          description: A string representing a unique identifier for an individual
            message within a threat (i.e email campaign).
          example: 4551618356913732000
        abxPortalUrl:
          type: string
          description: The URL at which the specific message details are viewable
            in Abnormal Security's Portal web interface.
          example: https://portal.abnormalsecurity.com/home/threat-center/remediation-history/4551618356913732076
        subject:
          type: string
          description: The email subject.
          example: Phishing Email
        fromAddress:
          type: string
          description: The email address of the sender.
          example: support@secure-reply.org
        fromName:
          type: string
          description: The display name of the sender.
          example: Support
        senderDomain:
          type: string
          description: Email domain of sender (only available for IESS customers)
          example: secure-reply.org
        toAddresses:
          type: string
          description: All the email addresses to which the message was sent, comma-separated
            & truncated at 255 chars.
          example: example@example.com, another@example.com
        recipientAddress:
          type: string
          description: The email address of the user who actually received the message.
          example: example@example.com
        receivedTime:
          type: string
          format: date-time
          description: The timestamp at which this message arrived.
          example: '2020-06-09T17:42:59Z'
        sentTime:
          type: string
          format: date-time
          description: The timestamp at which this message was sent.
          example: '2020-06-09T17:42:59Z'
        internetMessageId:
          type: string
          description: The internet message ID, per RFC 822
          example: <5edfca1c.1c69fb81.4b055.8fd5@mx.google.com>
        remediationStatus:
          type: string
          description: The remediation status of the email threat.
          example: Auto Remediated
        attackType:
          type: string
          description: The type of threat the message represents.
          example: Extortion
        attackStrategy:
          type: string
          description: The strategy of threat the message represents.
          example: Name Impersonation
        returnPath:
          type: string
          description: The path where this message was sent.
          example: support@secure-reply.org
        replyToEmails:
          type: array
          items:
            type: string
          description: The 'reply-to' list of emails.
          example:
          - reply-to@example.com
        ccEmails:
          type: array
          items:
            type: string
          description: List of email addresses CC'ed.
          example:
          - cc@example.com
        senderIpAddress:
          type: string
          description: IP address of sender.
          example: 100.101.102.103
        impersonatedParty:
          type: string
          description: Impersonated party, if any.
          example: None / Others
        attackVector:
          type: string
          description: The attack medium.
          example: Text
        attachmentNames:
          type: array
          items:
            type: string
          description: List of attachment names, if any.
          example:
          - attachment.pdf
        attachmentCount:
          type: integer
          description: Number of attachments in email (only available for IESS customers)
        urls:
          type: array
          items:
            type: string
          description: URLs present in the email body, if any.
          example:
          - https://www.google.com/
        urlCount:
          type: integer
          description: Number of urls in email (only available for IESS customers)
        summaryInsights:
          type: array
          items:
            type: string
          description: A summary of insights into this attack.
          example:
          - Bitcoin Topics
          - Personal Information Theft
          - Unusual Sender
        remediationTimestamp:
          type: string
          format: date-time
          description: The timestamp at which this message was remediated, or empty
            if it has not been remediated.
          example: '2020-06-09T17:42:59Z'
        isRead:
          type: boolean
          description: Whether an email has been read
          example: 'true'
        attackedParty:
          type: string
          description: The party that was targeted by an attack.
          example: VIP
        autoRemediated:
          type: boolean
          description: Indicates whether Abnormal has automatically detected and remediated
            the message from the user's Inbox. Note``:`` Abnormal has retained this
            field and the postRemediated field to support prior integrations, but
            in newly created integrations, you should capture this information from
            the remediationStatus field.
          example: 'True'
        postRemediated:
          type: boolean
          description: Indicates whether Abnormal remediated the campaign at a later
            time, after landing in the user's Inbox. Note``:`` Abnormal has retained
            this field and the autoRemediated field to support prior integrations,
            but in newly created integrations, you should capture this information
            from the remediationStatus field.
          example: 'False'
        source:
          type: string
          nullable: true
          description: A string representing the judgement of the message.
          example: Attack
        tenantId:
          type: integer
          nullable: true
          description: The tenant ID associated with this message.
          example: 1000
        tenantName:
          type: string
          nullable: true
          description: The tenant name associated with this message.
          example: acme-corp
        customerOverride:
          allOf:
          - $ref: '#/components/schemas/CustomerOverride'
          nullable: true
      required:
      - abxMessageId
      - abxMessageIdStr
      - abxPortalUrl
      - attachmentCount
      - attachmentNames
      - attackStrategy
      - attackType
      - attackVector
      - attackedParty
      - autoRemediated
      - ccEmails
      - fromAddress
      - fromName
      - impersonatedParty
      - internetMessageId
      - isRead
      - postRemediated
      - receivedTime
      - recipientAddress
      - remediationStatus
      - remediationTimestamp
      - replyToEmails
      - returnPath
      - senderDomain
      - senderIpAddress
      - sentTime
      - subject
      - summaryInsights
      - threatId
      - toAddresses
      - urlCount
      - urls
    TimelineEntry:
      type: object
      properties:
        entry_type:
          type: string
          description: Type of timeline entry (WORKFLOW_ITEM or NOTABLE_EVENT)
          example: WORKFLOW_ITEM
        detail:
          allOf:
          - $ref: '#/components/schemas/TimelineEntryDetail'
          description: Detailed information about the timeline entry
    TimelineEntryDetail:
      type: object
      properties:
        id:
          type: integer
          description: Unique identifier for the timeline entry
          example: 175
        title:
          type: string
          description: Title of the timeline event
          example: Posture Workflow Status Updated
        created_at:
          type: string
          format: date-time
          description: Timestamp when the event was created
          example: '2025-04-29T15:51:46.564185Z'
        updated_at:
          type: string
          format: date-time
          description: Timestamp when the event was last updated
          example: '2025-04-29T15:51:46.564185Z'
        description:
          type: array
          items:
            $ref: '#/components/schemas/TextBlock'
          description: Structured description of the event as text blocks
        category:
          allOf:
          - $ref: '#/components/schemas/DisplayId'
          description: Category classification for the event
        event_id:
          type: string
          description: External event identifier
          example: 33646635-3331-6332-3964-363137646630
        risk:
          allOf:
          - $ref: '#/components/schemas/DisplayId'
          description: Risk level associated with the event
        abnormality:
          allOf:
          - $ref: '#/components/schemas/DisplayId'
          description: Abnormality level of the event
    TokenListResponseSwagger:
      type: object
      description: Swagger serializer for token list response.
      properties:
        status:
          type: string
          default: success
          description: Response status
        status_code:
          type: integer
          default: 200
          description: HTTP status code
        data:
          type: array
          items:
            $ref: '#/components/schemas/TokenSwagger'
          description: List of API tokens
        pagination:
          allOf:
          - $ref: '#/components/schemas/PaginationSwagger'
          description: Pagination metadata
      required:
      - data
      - pagination
    TokenSwagger:
      type: object
      description: Swagger serializer for token object.
      properties:
        token_id:
          type: string
          description: Unique token identifier (UUID)
        name:
          type: string
          description: Token name
        version:
          type: string
          description: Token version (v1 or v2)
        status:
          type: string
          description: Token status (active, expired, revoked)
        created_at:
          type: string
          format: date-time
          description: Token creation timestamp (ISO 8601)
        expires_at:
          type: string
          format: date-time
          description: Token expiration timestamp (ISO 8601)
        permissions:
          type: array
          items:
            type: string
          description: List of endpoint permissions (e.g., soar_v1_read_threats, soar_v1_manage_threat)
      required:
      - created_at
      - expires_at
      - name
      - permissions
      - status
      - token_id
      - version
    TrendingAttacks:
      type: object
      properties:
        attackCount:
          type: integer
          description: The number of occurrences of the attack for the specified attack
            type in the current time frame.
          example: 200
        attackType:
          type: string
          description: The name or type of the attack detected.
          example: Scam
        attackTypeDescription:
          type: string
          description: A detailed description of the attack type detected.
          example: Advance fee fraud and similar scams
        prevAttackCount:
          type: integer
          description: The number of occurrences of the attack in the previous time
            frame.
          example: 201
      required:
      - attackCount
      - attackType
      - attackTypeDescription
      - prevAttackCount
    TrendingAttacksResponse:
      type: object
      properties:
        trending_attacks:
          type: array
          items:
            $ref: '#/components/schemas/TrendingAttacks'
          description: List detailing various trending attacks, along with the current
            and previous attack counts for each.
      required:
      - trending_attacks
    UpdateResourceResponse:
      type: object
      description: Serializer for update resource response.
      properties:
        resourceId:
          type: string
          description: ID of the updated resource
        status:
          type: string
          description: Status of the update operation
      required:
      - resourceId
      - status
    User:
      type: object
      properties:
        name:
          type: string
          description: The name of the user
          example: Ching Li-Hsieh
        email:
          type: string
          description: The email address of the user
          example: lhching@bigcompany.com
      required:
      - name
    UserListResponse:
      type: object
      description: Swagger serializer for user list response.
      properties:
        status:
          type: string
          default: success
          description: Status of the response
        status_code:
          type: integer
          default: 200
          description: HTTP status code
        data:
          type: array
          items:
            $ref: '#/components/schemas/UserSwagger'
          description: List of users from RBAC system with their roles and resource
            permissions
      required:
      - data
    UserSwagger:
      type: object
      description: Swagger serializer for user object.
      properties:
        user_id:
          type: integer
          description: The unique identifier for the user
        email:
          type: string
          format: email
          description: Email address of the user
        groups:
          type: array
          items:
            type: string
          default: []
          description: List of group IDs the user belongs to
        local_login_enabled:
          type: boolean
          default: false
          description: Whether local login is enabled for the user
        sso_enabled:
          type: boolean
          default: true
          description: Whether SSO is enabled for the user
        role:
          allOf:
          - $ref: '#/components/schemas/RoleSwagger'
          description: Role assigned to the user with associated permissions
        resource_permissions:
          type: array
          items:
            $ref: '#/components/schemas/ResourcePermissionSwagger'
          description: List of resource permissions granted to the user through their
            role (only includes enabled permissions)
      required:
      - email
      - user_id
    VendorActivity:
      type: object
      properties:
        eventTimeline:
          type: array
          items:
            $ref: '#/components/schemas/VendorActivityEvent'
      required:
      - eventTimeline
    VendorActivityEvent:
      oneOf:
      - $ref: '#/components/schemas/VendorFederatedEventTimeline'
      - $ref: '#/components/schemas/VendorInvestigationEventTimeline'
    VendorCaseDetails:
      type: object
      properties:
        vendorCaseId:
          type: integer
          description: Unique ID of vendor case.
          example: 0
        vendorDomain:
          type: string
          description: Domain of vendor.
          example: vendor.com
        firstObservedTime:
          type: string
          format: date-time
          description: The timestamp at which the first message associated with this
            vendor case arrived.
          example: '2020-06-09T17:42:59Z'
        lastModifiedTime:
          type: string
          format: date-time
          description: The latest timestamp when details of the vendor case was last
            modified.
          example: '2020-06-09T17:42:59Z'
        insights:
          type: array
          items:
            $ref: '#/components/schemas/VendorCaseInsights'
          readOnly: true
          description: List of insights generated by Abnormal Security.
        timeline:
          type: array
          items:
            $ref: '#/components/schemas/VendorCaseTimeline'
          readOnly: true
          description: List of timeline events relevant to case.
      required:
      - firstObservedTime
      - insights
      - lastModifiedTime
      - timeline
      - vendorCaseId
      - vendorDomain
    VendorCaseInsights:
      type: object
      properties:
        highlight:
          type: string
          readOnly: true
        description:
          type: string
          readOnly: true
      required:
      - description
      - highlight
    VendorCaseTimeline:
      type: object
      properties:
        eventTimestamp:
          type: string
          format: date-time
          readOnly: true
          description: Timestamp of event
          example: '2021-01-01T00:00:00Z'
        senderAddress:
          type: string
          description: Sender Address
          example: alice@vendor.com
        recipientAddress:
          type: string
          description: Recipient Address
          example: bob@company.com
        subject:
          type: string
          description: Subject of the event
          example: Click Me!
        markedAs:
          type: string
          readOnly: true
          description: Indication if your organisation has interacted with email
          example: Malicious
        threatId:
          type: string
          description: Unique ID of email threat. May be used in /threats endpoint
          example: 184712ab-6d8b-47b3-89d3-a314efef79e2
      required:
      - eventTimestamp
      - markedAs
      - recipientAddress
      - senderAddress
      - subject
      - threatId
    VendorCases:
      type: object
      properties:
        vendorCaseId:
          type: integer
          description: Unique ID of vendor case.
      required:
      - vendorCaseId
    VendorDetail:
      type: object
      properties:
        vendorDomain:
          type: string
          readOnly: true
          description: The domain used by the vendor.
          example: vendor.com
        riskLevel:
          type: string
          readOnly: true
          description: The risk level of the vendor.
          example: High
        vendorContacts:
          type: array
          items:
            type: string
          readOnly: true
          description: Mailboxes from the vendor that had prior interaction with.
          example:
          - alice@vendor.com
        companyContacts:
          type: array
          items:
            type: string
          readOnly: true
          description: Mailboxes from your organisation that had prior interaction
            with vendor.
          example:
          - bob@company.com
        vendorCountries:
          type: array
          items:
            type: string
          readOnly: true
          description: Countries which vendor interactions originated from.
          example:
          - United States
        analysis:
          type: array
          items:
            type: string
          readOnly: true
          description: Analysis provided by Abnormal Security.
          example:
          - Vendor compromise observed in Abnormal Community
        vendorIpAddresses:
          type: array
          items:
            type: string
          readOnly: true
          description: IP addresses which vendor interactions originated from.
          example:
          - 127.0.0.1
      required:
      - analysis
      - companyContacts
      - riskLevel
      - vendorContacts
      - vendorCountries
      - vendorDomain
      - vendorIpAddresses
    VendorFederatedEventTimeline:
      type: object
      properties:
        eventTimestamp:
          type: string
          format: date-time
          readOnly: true
          description: Timestamp of event
          example: '2021-01-01T00:00:00Z'
        eventType:
          type: string
          readOnly: true
          description: Type of event detected
          example: Federated Signal
        suspiciousDomain:
          type: string
          readOnly: true
          description: Domain which event originated from
          example: alice@vendor.com
        domainIp:
          type: string
          readOnly: true
          description: IP address which event originated from
          example: 127.0.0.1
        ipGeolocation:
          type: string
          readOnly: true
          description: Country Code which event originated from
          example: US
        attackGoal:
          type: string
          readOnly: true
          description: Objectives behind event
          example: malware and ransom
      required:
      - attackGoal
      - domainIp
      - eventTimestamp
      - eventType
      - ipGeolocation
      - suspiciousDomain
    VendorInvestigationEventTimeline:
      type: object
      properties:
        eventTimestamp:
          type: string
          format: date-time
          readOnly: true
          description: Timestamp of event
          example: '2021-01-01T00:00:00Z'
        eventType:
          type: string
          readOnly: true
          description: Type of event detected
          example: Targeted Attack
        suspiciousDomain:
          type: string
          readOnly: true
          description: Domain which event originated from
          example: alice@vendor.com
        attackGoal:
          type: string
          readOnly: true
          description: Objectives behind event
          example: malware and ransom
        actionTaken:
          type: string
          readOnly: true
          description: Actions taken by Abnormal Security
          example: Post Remediated
        hasEngagement:
          type: boolean
          readOnly: true
          description: Indication if your organisation has interacted with email
          example: 'False'
        recipient:
          type: string
          readOnly: true
          description: Recipient of email
          example: bob@company.com
        threatId:
          type: string
          readOnly: true
          description: Unique ID of email threat. May be used in /threats endpoint
          example: 184712ab-6d8b-47b3-89d3-a314efef79e2
      required:
      - actionTaken
      - attackGoal
      - eventTimestamp
      - eventType
      - hasEngagement
      - recipient
      - suspiciousDomain
      - threatId
    Vendors:
      type: object
      properties:
        vendorDomain:
          type: string
          description: The domain used by the vendor.
          example: vendor.com
      required:
      - vendorDomain
    WorkflowLogRawJson:
      type: object
      description: Serializer for the workflow log raw json response.
      properties:
        raw_json:
          type: string
          description: Raw JSON data from the workflow log
          example: '{"status": "updated", "workflow_status": "UNTRIAGED", "timestamp":
            "2025-04-29T15:51:46.564185Z"}'
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
servers:
- url: https://api.abnormalplatform.com/v1
  description: Production Server for managing threats
- url: https://eu.rest.abnormalsecurity.com/v1
  description: EU Production Server for managing threats.
tags:
- name: Dashboard Aggregations
  description: APIs to manage Dashboard metrics
- name: Threats
  description: APIs to manage threats notified in the Abnormal Threat Log
- name: Cases
  description: APIs to manage Abnormal Cases
- name: Messages
  description: API to manage message details
- name: AI Security Mailbox (formerly known as Abuse Mailbox)
  description: API to manage AI Security Mailbox (formerly known as Abuse Mailbox)
- name: Employee Insights
  description: API to manage employees
- name: Vendors
  description: API to manage Vendorbase and threats from Vendors
- name: Audit Logs
  description: API to retrieve audit logs for Portal
- name: Roles
  description: API to retrieve roles from RBAC system
- name: Users
  description: API to retrieve users from RBAC system
- name: Tokens
  description: API to manage SOAR API tokens
- name: Security Settings
  description: API to retrieve security settings including session timeout configuration
security:
- BearerAuth: []