openapi: 3.1.0
info:
  title: AWS Security Hub API
  version: '2018-10-26'
  description: |
    AWS Security Hub is a cloud security posture management service that
    aggregates, organizes, and prioritizes security findings from AWS
    services and third-party products. The API exposes REST operations for
    managing security standards, controls, findings, insights, automation
    rules, configuration policies, and member account configuration. All
    requests are signed with AWS Signature Version 4 (SigV4).

    See https://docs.aws.amazon.com/securityhub/1.0/APIReference/Welcome.html
servers:
  - url: https://securityhub.{region}.amazonaws.com
    description: AWS Security Hub regional endpoint
    variables:
      region:
        default: us-east-1
tags:
  - name: Hub
  - name: Findings
  - name: Insights
  - name: Standards
  - name: Controls
  - name: Members
  - name: Invitations
  - name: Automation Rules
  - name: Configuration Policies
  - name: Action Targets
  - name: Tags
security:
  - SigV4: []
paths:
  /accounts:
    post:
      tags: [Hub]
      operationId: EnableSecurityHub
      summary: Enable Security Hub for the account
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
    delete:
      tags: [Hub]
      operationId: DisableSecurityHub
      summary: Disable Security Hub for the account
      responses: { '200': { $ref: '#/components/responses/OK' } }
    get:
      tags: [Hub]
      operationId: DescribeHub
      summary: Describe the Hub configuration
      parameters:
        - name: HubArn
          in: query
          schema: { type: string }
      responses: { '200': { $ref: '#/components/responses/OK' } }
    patch:
      tags: [Hub]
      operationId: UpdateSecurityHubConfiguration
      summary: Update Hub configuration
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /findings:
    post:
      tags: [Findings]
      operationId: GetFindings
      summary: Get findings
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
    patch:
      tags: [Findings]
      operationId: BatchUpdateFindings
      summary: Batch update findings
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /findings/import:
    post:
      tags: [Findings]
      operationId: BatchImportFindings
      summary: Batch import findings from a product
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /findings/history:
    post:
      tags: [Findings]
      operationId: GetFindingHistory
      summary: Get finding history
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /insights:
    post:
      tags: [Insights]
      operationId: CreateInsight
      summary: Create an insight
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /insights/get:
    post:
      tags: [Insights]
      operationId: GetInsights
      summary: Get insights
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /insights/results/{InsightArn}:
    get:
      tags: [Insights]
      operationId: GetInsightResults
      summary: Get insight results
      parameters:
        - name: InsightArn
          in: path
          required: true
          schema: { type: string }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /insights/{InsightArn}:
    patch:
      tags: [Insights]
      operationId: UpdateInsight
      summary: Update an insight
      parameters:
        - name: InsightArn
          in: path
          required: true
          schema: { type: string }
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
    delete:
      tags: [Insights]
      operationId: DeleteInsight
      summary: Delete an insight
      parameters:
        - name: InsightArn
          in: path
          required: true
          schema: { type: string }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /standards:
    get:
      tags: [Standards]
      operationId: DescribeStandards
      summary: List supported standards
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /standards/register:
    post:
      tags: [Standards]
      operationId: BatchEnableStandards
      summary: Enable standards
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /standards/deregister:
    post:
      tags: [Standards]
      operationId: BatchDisableStandards
      summary: Disable standards
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /standards/get:
    get:
      tags: [Standards]
      operationId: GetEnabledStandards
      summary: Get enabled standards
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /standards/controls/{StandardsSubscriptionArn}:
    get:
      tags: [Controls]
      operationId: DescribeStandardsControls
      summary: Describe standards controls
      parameters:
        - name: StandardsSubscriptionArn
          in: path
          required: true
          schema: { type: string }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /securityControls:
    get:
      tags: [Controls]
      operationId: ListSecurityControlDefinitions
      summary: List security control definitions
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /securityControls/get:
    post:
      tags: [Controls]
      operationId: BatchGetSecurityControls
      summary: Batch get security controls
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /members:
    post:
      tags: [Members]
      operationId: CreateMembers
      summary: Create member accounts
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
    get:
      tags: [Members]
      operationId: ListMembers
      summary: List member accounts
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /members/delete:
    post:
      tags: [Members]
      operationId: DeleteMembers
      summary: Delete member accounts
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /members/disassociate:
    post:
      tags: [Members]
      operationId: DisassociateMembers
      summary: Disassociate member accounts
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /members/invite:
    post:
      tags: [Members]
      operationId: InviteMembers
      summary: Invite members
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /invitations:
    get:
      tags: [Invitations]
      operationId: ListInvitations
      summary: List invitations
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /invitations/accept:
    post:
      tags: [Invitations]
      operationId: AcceptInvitation
      summary: Accept an invitation
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /invitations/decline:
    post:
      tags: [Invitations]
      operationId: DeclineInvitations
      summary: Decline invitations
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /automationrules/create:
    post:
      tags: [Automation Rules]
      operationId: CreateAutomationRule
      summary: Create an automation rule
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /automationrules/list:
    get:
      tags: [Automation Rules]
      operationId: ListAutomationRules
      summary: List automation rules
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /automationrules/get:
    post:
      tags: [Automation Rules]
      operationId: BatchGetAutomationRules
      summary: Batch get automation rules
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /automationrules/delete:
    post:
      tags: [Automation Rules]
      operationId: BatchDeleteAutomationRules
      summary: Batch delete automation rules
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /configurationPolicy/create:
    post:
      tags: [Configuration Policies]
      operationId: CreateConfigurationPolicy
      summary: Create a configuration policy
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /configurationPolicy/list:
    get:
      tags: [Configuration Policies]
      operationId: ListConfigurationPolicies
      summary: List configuration policies
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /configurationPolicy/get/{Identifier}:
    get:
      tags: [Configuration Policies]
      operationId: GetConfigurationPolicy
      summary: Get a configuration policy
      parameters:
        - name: Identifier
          in: path
          required: true
          schema: { type: string }
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /actionTargets:
    post:
      tags: [Action Targets]
      operationId: CreateActionTarget
      summary: Create an action target
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
    get:
      tags: [Action Targets]
      operationId: DescribeActionTargets
      summary: Describe action targets
      responses: { '200': { $ref: '#/components/responses/OK' } }
  /tags/{ResourceArn}:
    get:
      tags: [Tags]
      operationId: ListTagsForResource
      summary: List tags
      parameters:
        - $ref: '#/components/parameters/ResourceArn'
      responses: { '200': { $ref: '#/components/responses/OK' } }
    post:
      tags: [Tags]
      operationId: TagResource
      summary: Tag a resource
      parameters:
        - $ref: '#/components/parameters/ResourceArn'
      requestBody: { $ref: '#/components/requestBodies/JsonBody' }
      responses: { '200': { $ref: '#/components/responses/OK' } }
    delete:
      tags: [Tags]
      operationId: UntagResource
      summary: Untag a resource
      parameters:
        - $ref: '#/components/parameters/ResourceArn'
        - name: tagKeys
          in: query
          required: true
          schema:
            type: array
            items: { type: string }
      responses: { '200': { $ref: '#/components/responses/OK' } }
components:
  parameters:
    ResourceArn:
      name: ResourceArn
      in: path
      required: true
      schema: { type: string }
  requestBodies:
    JsonBody:
      required: true
      content:
        application/json:
          schema:
            type: object
            additionalProperties: true
  responses:
    OK:
      description: Successful response
      content:
        application/json:
          schema:
            type: object
            additionalProperties: true
  securitySchemes:
    SigV4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4 signed Authorization header