openapi: 3.0.1
info:
  title: Cisco Umbrella Reporting API
  description: The Reporting API provides the data to generate the Umbrella reports.
  version: 2.0.0
  contact:
    name: Cloud Security Developer Community
  x-provenance:
    method: harvested
    authored_by: Cisco Umbrella
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    provider_published: true
    source_host: pubhub.devnetcloud.com
    note: 26 first-party OpenAPI 3.0 documents (256 operations) listed by Cisco's own docs-nav config and fetched anonymously.
      Byte-identity reconfirmed 2026-08-19 by SHA-256 against the live source.
  x-evidence:
  - type: source
    url: https://pubhub.devnetcloud.com/media/cloud-security-apis-in-eft/docs/umbrella-config.json
  - type: source
    url: https://developer.cisco.com/docs/cloud-security/
servers:
- url: https://api.umbrella.com/{basePath}
  variables:
    basePath:
      default: reports/v2
tags:
- name: Activity
- name: Top Identities
- name: Identity Distribution
- name: Top Destinations
- name: Top Categories
- name: Top Event Types
- name: Top DNS Query Types
- name: Organization Requests by Hour
- name: Organization Requests by Timerange
- name: Organization Requests by Hour and Category
- name: Organization Requests by Timerange and Category
- name: Deployment Status
- name: Provider Deployment Status
- name: Provider Requests by Hour
- name: Provider Requests by Timerange
- name: Provider Requests by Organization
- name: Provider Requests by Category
- name: Provider Requests by Destination
- name: Provider Category Requests by Organization
- name: Bandwidth by Hour
- name: Bandwidth by Timerange
- name: Top Files
- name: Total Requests
- name: Top Threats
- name: Top Threat Types
- name: Utility
- name: Top IPs
- name: Summary
- name: Summaries by Category
- name: Summaries by Destination
- name: Summaries by Rule (Intrusion)
- name: Umbrella
security:
- oauthFlow: []
paths:
  /activity:
    get:
      tags:
      - Activity
      - Umbrella
      summary: Get Activities (All)
      description: 'List all activities (dns/proxy/firewall/intrusion) within the timeframe.

        **Note:** The IP activity report is not available.


        **Access Scope:** Reports > Granular Events > Read-Only'
      operationId: getActivities
      security:
      - oauthFlow:
        - reports.granularEvents:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/ruleIdParam'
      - $ref: '#/components/parameters/filenameParam'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/xTrafficTypeParam'
      - $ref: '#/components/parameters/isolatedStateParam'
      - $ref: '#/components/parameters/isolatedFileActionParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/httpErrorsParam'
      - $ref: '#/components/parameters/existsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      anyOf:
                      - $ref: '#/components/schemas/ActivityDns'
                      - $ref: '#/components/schemas/ActivityFirewall'
                      - $ref: '#/components/schemas/ActivityIntrusion'
                      - $ref: '#/components/schemas/ActivityProxy'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                meta: {}
                data:
                - externalip: 52.8.160.247
                  internalip: 52.8.160.247
                  policycategories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                  categories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                  verdict: allowed
                  domain: google.com
                  timestamp: 1731002169000
                  time: 06:31:46
                  date: '2019-01-24'
                  identities:
                  - id: 1
                    label: Catch Rate Testing System
                    type:
                      id: 21
                      label: Sites
                      type: site
                    deleted: true
                  threats:
                  - label: Wannacry
                    type: Ransomware
                  allapplications:
                  - id: 1
                    label: label
                    type: NBAR
                    category:
                      id: 1
                      label: category
                  allowedapplications:
                  - id: 1
                    label: label
                    type: NBAR
                    category:
                      id: 1
                      label: category
                  querytype: MX
                  returncode: 2
                  blockedapplications: []
                  type: dns
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /activity/dns:
    get:
      tags:
      - Activity
      - Umbrella
      summary: Get Activity DNS
      description: 'List all DNS entries within the timeframe.


        **Access Scope:** Reports > Granular Events > Read-Only'
      operationId: getActivityDns
      security:
      - oauthFlow:
        - reports.granularEvents:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/orderParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActivityDns'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - externalip: 52.8.160.247
                  internalip: 52.8.160.247
                  policycategories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                  categories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                  verdict: allowed
                  domain: google.com
                  timestamp: 1731002169000
                  time: 06:31:46
                  date: '2019-01-24'
                  identities:
                  - id: 1
                    label: Catch Rate Testing System
                    type:
                      id: 21
                      label: Sites
                      type: site
                    deleted: true
                  threats:
                  - label: Wannacry
                    type: Ransomware
                  allapplications:
                  - id: 1
                    label: label
                    type: NBAR
                    category:
                      id: 1
                      label: category
                  allowedapplications:
                  - id: 1
                    label: label
                    type: NBAR
                    category:
                      id: 1
                      label: category
                  querytype: MX
                  returncode: 2
                  blockedapplications: []
                  type: dns
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /activity/proxy:
    get:
      tags:
      - Activity
      - Umbrella
      summary: Get Activity Proxy
      description: 'List all proxy entries within the timeframe.


        **Access Scope:** Reports > Granular Events > Read-Only'
      operationId: getActivityProxy
      security:
      - oauthFlow:
        - reports.granularEvents:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/orderParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/ruleIdParam'
      - $ref: '#/components/parameters/filenameParam'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/tenantControlsParam'
      - $ref: '#/components/parameters/isolatedStateParam'
      - $ref: '#/components/parameters/isolatedFileActionParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/httpErrorsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActivityProxy'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - destinationip: ''
                  externalip: 32.4.91.7
                  responsesize: 3329530
                  allapplications:
                  - id: 1313
                    label: Netflix
                    category:
                      id: 47
                      label: Media
                  date: '2022-02-18'
                  datalossprevention:
                    state: ''
                  antivirusthreats:
                    puas: []
                    viruses: []
                    others: []
                  internalip: 192.168.1.43
                  referer: ''
                  contenttype: ''
                  tenantcontrols: false
                  securityoverridden: false
                  useragent: ''
                  time: '23:29:42'
                  amp:
                    disposition: ''
                    score: 0
                    malware: ''
                  policycategories: []
                  type: proxy
                  requestsize: 1996
                  port: 443
                  policy:
                    ruleid: 0
                    rulesetid: 0
                    destinationlistids: []
                    timebasedrule: false
                  forwardingmethod: ''
                  categories:
                  - id: 17
                    type: content
                    label: Movies
                    integration: false
                    deprecated: true
                  isolated:
                    state: not-isolated
                    fileaction: ''
                  statuscode: 200
                  egress:
                    ip: 155.190.3.8
                    type: shared
                  blockedfiletype: ''
                  url: https://ipv4-lax2-ix.1.oca.anothervideo.net
                  verdict: allowed
                  responsefilename: ''
                  warnstatus: ''
                  sha256: ''
                  timestamp: 1645226982000
                  blockedapplications: []
                  allowedapplications: []
                  identities:
                  - id: 1
                    type:
                      id: 34
                      type: anyconnect
                      label: Anyconnect Roaming Client
                    label: Vincent's Macbook
                    deleted: false
                  datacenter:
                    label: Los Angeles, US
                    id: LAX
                  threats: []
                  httperrors: []
                  bundleid: 3
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /activity/firewall:
    get:
      tags:
      - Activity
      - Umbrella
      summary: Get Activity Firewall
      description: 'List all firewall activity within the timeframe.


        **Access Scope:** Reports > Granular Events > Read-Only'
      operationId: getActivityFirewall
      security:
      - oauthFlow:
        - reports.granularEvents:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/ruleIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/timezoneParam'
      - $ref: '#/components/parameters/categoriesParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActivityFirewall'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - date: '2019'
                  destinationip: 52.8.160.247
                  sourceip: 192.168.0.1
                  sourceport: 0
                  destinationport: 0
                  categories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                  verdict: allowed
                  time: '12:34'
                  timestamp: 1731002169000
                  identities:
                  - id: 1
                    label: Catch Rate Testing System
                    type:
                      id: 21
                      label: Sites
                      type: site
                    deleted: false
                  protocol:
                    id: 17
                    label: UDP
                  rule:
                    id: 1
                    label: Default Rule
                  type: firewall
                  allapplications:
                  - id: 72
                    label: dns IT Service Management
                    app: ''
                  applicationprotocols:
                  - id: 72
                    label: dns IT Service Management
                    app: ''
                  packetsize: 32
                  direction: towards
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /activity/intrusion:
    get:
      tags:
      - Activity
      - Umbrella
      summary: Get Activity Intrusion
      description: 'List all Intrusion Prevention System (IPS) activity within the timeframe.


        **Access Scope:** Reports > Granular Events > Read-Only'
      operationId: getActivityIntrusion
      security:
      - oauthFlow:
        - reports.granularEvents:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/signaturesParam'
      - $ref: '#/components/parameters/signatureListIdsParam'
      - $ref: '#/components/parameters/intrusionActionParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActivityIntrusion'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - type: intrusion
                  date: 12-02-22
                  destinationip: 10.10.10.10
                  protocol:
                    id: 17
                    label: UDP
                  sourceip: 10.10.10.10
                  signaturelist:
                    id: 1111
                  classification: malicious
                  rule:
                  - id: 391327
                    label: UNKNOWN
                  ipsProfile: PROFILE
                  sourceport: 22
                  sessionid: 190898098
                  verdict: detected
                  destinationport: 33
                  timestamp: 1594557262000
                  time: 09:30
                  identities:
                  - id: 211034846
                    type:
                      id: 34
                      type: anyconnect
                      label: Anyconnect Roaming Client
                    label: omerta
                    deleted: false
                  severity: HIGH
                  signature:
                    generatorid: 1
                    id: 47829
                    label: SERVER-OTHER JBoss Richfaces expression language injection attempt
                    cves:
                    - cve-2015-0279
                    - cve-2018-12532
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /activity/ip:
    get:
      tags:
      - Activity
      - Umbrella
      summary: Get Activity IP
      description: '(Deprecated) List all IP activity within the timeframe.


        **Access Scope:** Reports > Granular Events > Read-Only'
      operationId: getActivityIP
      security:
      - oauthFlow:
        - reports.granularEvents:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items: {}
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data: []
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /activity/amp-retrospective:
    get:
      tags:
      - Activity
      - Umbrella
      summary: Get Activity AMP Retrospective
      description: 'List all AMP retrospective activity within the timeframe.


        **Access Scope:** Reports > Granular Events > Read-Only'
      operationId: getActivityAmpRetrospective
      security:
      - oauthFlow:
        - reports.granularEvents:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActivityAMPRetro'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - timestamp: 1548311506
                  firstseenat: 1548311506
                  disposition: clean
                  score: 10
                  hostname: google.com
                  malwarename: malware
                  sha256: 9495b6c155044053953efe30ebaf804780c114e7b721b14f6a5b0a782769696e
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-identities:
    get:
      tags:
      - Top Identities
      - Umbrella
      summary: Get Top Identities (All)
      description: 'List the identities by the number of requests made, sorted in descending order.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTopIdentities
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopIdentity'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - requests: 3827
                  bandwidth: 7051943359
                  identity:
                    id: 1
                    label: Catch Rate Testing System
                    type:
                      id: 21
                      label: Sites
                      type: site
                    deleted: false
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  rank: 3
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-identities/{type}:
    get:
      tags:
      - Top Identities
      - Umbrella
      summary: Get Top Identities
      description: 'List the identities for the specific traffic type by the number of requests.

        Sort the results in descending order.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTopIdentitiesType
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/typeDnsWebIpFirewallParam'
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopIdentity'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - requests: 3827
                  bandwidth: 7051943359
                  identity:
                    id: 1
                    label: Catch Rate Testing System
                    type:
                      id: 21
                      label: Sites
                      type: site
                    deleted: false
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  rank: 3
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /identity-distribution:
    get:
      tags:
      - Identity Distribution
      - Umbrella
      summary: Get Identity Distribution (All)
      description: 'List the number of requests by identity types.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getIdentityDistribution
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/IdentityDistribution'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  requests: 312
                  unique_identity_count: 12
                  identitytype:
                    id: 21
                    label: Sites
                    type: site
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /identity-distribution/{type}:
    get:
      tags:
      - Identity Distribution
      - Umbrella
      summary: Get Identity Distribution By Type
      description: 'List the number of requests by identity for the type of traffic.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getIdentityDistributionType
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/typeDnsWebParam'
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: The list of identity distributions.
                    items:
                      $ref: '#/components/schemas/IdentityDistribution'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  requests: 312
                  unique_identity_count: 12
                  identitytype:
                    id: 21
                    label: Sites
                    type: site
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-destinations:
    get:
      tags:
      - Top Destinations
      - Umbrella
      summary: Get Top Destinations
      description: 'List the destinations by the number of requests made to this destination.

        Return the results in descending order.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTopDestinations
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetRequiredParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopDestination'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - bandwidth: 223437
                  rank: 4
                  domain: google.com
                  count: 3827
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  categories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                  policycategories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-destinations/{type}:
    get:
      tags:
      - Top Destinations
      - Umbrella
      summary: Get Top Destinations By Type
      description: 'List the destinations by type of destination and the number of requests made

        to this destination. Return the collection in descending order.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTopDestinationsType
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/typeDnsWebIpFirewallParam'
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopDestination'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - bandwidth: 223437
                  rank: 4
                  domain: google.com
                  count: 3827
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  categories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                  policycategories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-urls:
    get:
      tags:
      - Top Destinations
      - Umbrella
      summary: Get Top URLs
      description: 'List the top number of URLs that are requested for a certain domain.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTopUrls
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetRequiredParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopURL'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - count: 884
                  path: /backend-api/conversation
                  categories:
                  - id: 132
                    type: content
                    label: SaaS and B2B
                    integration: false
                    deprecated: false
                  rank: 1
                - count: 123
                  path: ''
                  categories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                  rank: 2
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-categories:
    get:
      tags:
      - Top Categories
      - Umbrella
      summary: Get Top Categories (All)
      description: 'List the categories that received the greatest number of requests.

        Order the number of requests in descending order.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTopCategories
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetRequiredParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopCategory'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - rank: 5
                  category:
                    id: 66
                    label: Malware
                    typse: security
                    integration: true
                  count: 3827
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-categories/{type}:
    get:
      tags:
      - Top Categories
      - Umbrella
      summary: Get Top Categories By Type
      description: 'List the categories for the type of traffic that received the greatest number of requests.

        Order the number of requests in descending order.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTopCategoriesType
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/typeDnsWebIpParam'
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetRequiredParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopCategory'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - rank: 5
                  category:
                    id: 66
                    label: Malware
                    type: security
                    integration: true
                  count: 3827
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-eventtypes:
    get:
      tags:
      - Top Event Types
      - Umbrella
      summary: Get Top Event Types (All)
      description: 'List the top event types by the number of requests made for each type of event.

        Order the number of requests in descending order.

        The valid event types are: `domain_security`, `domain_integration`,

        `url_security`, `url_integration`, `cisco_amp`, and `antivirus`.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTopEventTypes
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopEventType'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - eventtype: antivirus
                  count: 3827
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-dns-query-types:
    get:
      tags:
      - Top DNS Query Types
      - Umbrella
      summary: Get Top DNS Query Types
      operationId: getTopDNSQueryTypes
      description: 'List the top types of DNS query.


        **Access Scope:** Reports > Aggregations > Read-Only'
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/orderParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopDnsQueryType'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - requests: 123
                  querytype: A
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /requests-by-hour:
    get:
      tags:
      - Organization Requests by Hour
      - Umbrella
      summary: Get Requests by Hour (All)
      description: 'List the activity volume within the timeframe.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getRequestsByHour
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RequestsbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /requests-by-hour/{type}:
    get:
      tags:
      - Organization Requests by Hour
      - Umbrella
      summary: Get Requests by Hour
      description: 'List the activity volume within the timeframe.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getOrganizationRequestsByHour
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/typeAllParam'
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RequestsbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /requests-by-timerange:
    get:
      tags:
      - Organization Requests by Timerange
      - Umbrella
      summary: Get Requests by Timerange (All)
      description: 'List the activity volume within the timeframe.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getRequestsByTimerange
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/timerangeParam'
      - $ref: '#/components/parameters/xTrafficTypeParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: The information about the provider's requests within the timerange.
                    items:
                      $ref: '#/components/schemas/RequestsbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /requests-by-timerange/{type}:
    get:
      tags:
      - Organization Requests by Timerange
      - Umbrella
      summary: Get Requests by Timerange
      description: 'List the activity volume within the timeframe.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getRequestsByTimerangeType
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/typeAllParam'
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/timerangeParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RequestsbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /categories-by-hour:
    get:
      tags:
      - Organization Requests by Hour and Category
      - Umbrella
      summary: Get Requests by Hour and Category (All)
      description: 'List the activity volume within the timeframe by type of category.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getRequestsByHourAndCategory
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryByHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                  counts:
                  - category:
                      id: 66
                      label: Malware
                      type: security
                      integration: true
                    requests: 123
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /categories-by-hour/{type}:
    get:
      tags:
      - Organization Requests by Hour and Category
      - Umbrella
      summary: Get Requests by Hour and Category
      description: 'List the activity volume for the type of category within the timeframe.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getRequestsByHourAndCategoryAndType
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/typeDnsWebIpParam'
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryByHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                  counts:
                  - category:
                      id: 66
                      label: Malware
                      type: security
                      integration: true
                    requests: 123
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /categories-by-timerange:
    get:
      tags:
      - Organization Requests by Timerange and Category
      - Umbrella
      summary: Get Requests by Timerange and Category (All)
      description: 'List the activity volume within the timeframe by category.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getRequestsByTimerangeAndCategory
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/timerangeParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryByHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                  counts:
                  - category:
                      id: 66
                      label: Malware
                      type: security
                      integration: true
                    requests: 123
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /categories-by-timerange/{type}:
    get:
      tags:
      - Organization Requests by Timerange and Category
      - Umbrella
      summary: Get Requests by Timerange and Category
      description: 'List the activity volume within the timeframe by category.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getRequestsByTimerangeAndCategoryType
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/typeDnsWebIpParam'
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/timerangeParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryByHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                  counts:
                  - category:
                      id: 66
                      label: Malware
                      type: security
                      integration: true
                    requests: 123
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /deployment-status:
    get:
      tags:
      - Deployment Status
      - Umbrella
      summary: Get Deployment Status
      description: 'List the deployment status within the timeframe.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getDeploymentStatus
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/DeploymentStatus'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - id: 21
                  label: Sites
                  type:
                    id: 1
                    label: Sites
                    type: Sites
                  activecount: 1
                  count: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /bandwidth-by-hour:
    get:
      tags:
      - Bandwidth by Hour
      - Umbrella
      summary: Get Bandwidth by Hour (All)
      description: 'List the bandwidth in bytes within the timeframe. Only returns proxy data.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getBandwidthByHour
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/BandwidthbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - inboundbytes: 123
                  outboundbytes: 456
                  timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /bandwidth-by-timerange:
    get:
      tags:
      - Bandwidth by Timerange
      - Umbrella
      summary: Get Bandwidth by Timerange (All)
      description: 'List the bandwidth in bytes within the timeframe. Only returns proxy data.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getBandwidthByTimerange
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/timerangeParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/BandwidthbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - inboundbytes: 123
                  outboundbytes: 456
                  timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-files:
    get:
      tags:
      - Top Files
      - Umbrella
      summary: Get Top Files (Proxy)
      description: 'List the top files within the timeframe. Only returns proxy data.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTopFilesProxy
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopFile'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - requests: 123
                  sha256: 9495b6c155044053953efe30ebaf804780c114e7b721b14f6a5b0a782769696e
                  categories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                  identitycount: 1
                  filenames: []
                  filetypes: []
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /total-requests:
    get:
      tags:
      - Total Requests
      - Umbrella
      summary: Get Total Requests (All)
      description: 'Get the count of the total requests.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTotalRequests
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/ruleIdParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/TotalRequest'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                  count: 42
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /total-requests/{type}:
    get:
      tags:
      - Total Requests
      - Umbrella
      summary: Get Total Requests (By Type)
      description: 'Get the count of the total requests for the request type.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTotalRequestsByType
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/typeDnsWebIpFirewallParam'
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/ruleIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/TotalRequest'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                  count: 42
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-threats:
    get:
      tags:
      - Top Threats
      - Umbrella
      summary: Get Top Threats (All)
      description: 'Get the top threats within the timeframe. Returns both DNS and proxy data.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTopThreats
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopThreats'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - threat: Wannacry
                  threattype: Ransomware
                  count: 361
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-threats/{type}:
    get:
      tags:
      - Top Threats
      - Umbrella
      summary: Get Top Threats (By Type)
      description: 'Get the top threats within the timeframe.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTopThreatsByType
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/typeDnsWebParam'
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopThreats'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - threat: Wannacry
                  threattype: Ransomware
                  count: 361
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-threat-types:
    get:
      tags:
      - Top Threat Types
      - Umbrella
      summary: Get Top Threat Types (All)
      description: 'List the top types of threat within the timeframe. Returns both DNS and proxy data.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTopThreatTypes
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopThreatTypes'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - threattype: Ransomware
                  threatscount: 10
                  count: 361
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-threat-types/{type}:
    get:
      tags:
      - Top Threat Types
      - Umbrella
      summary: Get Top Threat Types By Type
      description: 'List the top threat-types within the timeframe.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTopThreatTypesByType
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/typeDnsWebParam'
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopThreatTypes'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - threattype: Ransomware
                  threatscount: 10
                  count: 361
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /applications:
    get:
      tags:
      - Utility
      - Umbrella
      summary: Get Applications
      operationId: getApplications
      description: 'List the applications.


        **Access Scope:** Reports > Utilities > Read-Only'
      security:
      - oauthFlow:
        - reports.utilities:read
      parameters:
      - $ref: '#/components/parameters/applicationNameParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/ApplicationsWithCategories'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                  applications:
                  - id: 1
                    label: Web Hosting
                    type: AVC
                    category:
                      id: 40
                      label: Hosting Services
                  categories:
                  - id: 42
                    name: Education
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /categories:
    get:
      tags:
      - Utility
      - Umbrella
      summary: Get Categories
      description: 'List the categories.


        **Access Scope:** Reports > Utilities > Read-Only'
      operationId: getCategories
      security:
      - oauthFlow:
        - reports.utilities:read
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryWithLegacyId'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - id: 66
                  legacyid: 94
                  label: Malware
                  type: security
                  integration: true
                  deprecated: true
                - id: 110
                  legacyid: 176
                  label: DNS Tunneling VPN
                  type: security
                  integration: true
                  deprecated: false
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /identities:
    get:
      tags:
      - Utility
      - Umbrella
      summary: Get Identities
      operationId: getIdentities
      description: 'List the identities.


        **Access Scope:** Reports > Utilities > Read-Only'
      security:
      - oauthFlow:
        - reports.utilities:read
      parameters:
      - $ref: '#/components/parameters/limitParamIdentitiesUtility'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/searchParam'
      - $ref: '#/components/parameters/identityTypesParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Identity'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - id: 1
                  label: Catch Rate Testing System
                  type:
                    id: 21
                    label: Sites
                    type: site
                  deleted: false
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
    post:
      tags:
      - Utility
      - Umbrella
      summary: Get Identities By IDs
      description: 'Get the identities information by providing a list of identity IDs in the request body.


        **Access Scope:** Reports > Utilities > Read-Only'
      operationId: postIdentities
      security:
      - oauthFlow:
        - reports.utilities:read
      parameters:
      - $ref: '#/components/parameters/limitParam'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              description: Provide an array of identity ID.
              properties:
                identityids:
                  description: A list of identity ID.
                  type: array
                  items:
                    type: integer
                    description: An identity ID.
                    example: 234567891
            example:
              identityids:
              - 234567891
              - 234567892
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Identity'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - id: 1
                  label: Catch Rate Testing System
                  type:
                    id: 21
                    label: Sites
                    type: site
                  deleted: false
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /identities/{identityid}:
    get:
      tags:
      - Utility
      - Umbrella
      summary: Get Identity
      description: 'Get identity by identity ID.


        **Access Scope:** Reports > Utilities > Read-Only'
      operationId: getIdentity
      security:
      - oauthFlow:
        - reports.utilities:read
      parameters:
      - $ref: '#/components/parameters/identityIdParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Identity'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                  id: 1
                  label: Catch Rate Testing System
                  type:
                    id: 21
                    label: Sites
                    type: site
                  deleted: true
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /threat-types:
    get:
      tags:
      - Utility
      - Umbrella
      summary: Get Threat Types
      description: 'List the threat types.


        **Access Scope:** Reports > Utilities > Read-Only'
      operationId: getThreatTypes
      security:
      - oauthFlow:
        - reports.utilities:read
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ThreatType'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - name: Ransomware
                  description: a description
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /threat-types/{threattypeid}:
    get:
      tags:
      - Utility
      - Umbrella
      summary: Get Threat Type By Threat ID
      description: 'List the threat types by threat ID.


        **Access Scope:** Reports > Utilities > Read-Only'
      operationId: getThreatType
      security:
      - oauthFlow:
        - reports.utilities:read
      parameters:
      - $ref: '#/components/parameters/threatTypeIdParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/ThreatType'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                  name: Ransomware
                  description: a description
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /threat-names:
    get:
      tags:
      - Utility
      - Umbrella
      summary: Get Threat Names
      description: 'List the threat names.


        **Access Scope:** Reports > Utilities > Read-Only'
      operationId: getThreatNames
      security:
      - oauthFlow:
        - reports.utilities:read
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ThreatName'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - name: WannaCry
                  description: a description
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /threat-names/{threatnameid}:
    get:
      tags:
      - Utility
      - Umbrella
      summary: Get Threat Name By Threat ID
      description: 'Get the threat name by threat ID.


        **Access Scope:** Reports > Utilities > Read-Only'
      operationId: getThreatName
      security:
      - oauthFlow:
        - reports.utilities:read
      parameters:
      - $ref: '#/components/parameters/threatNameIdParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/ThreatName'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                  name: WannaCry
                  description: WannaCry threat description
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-ips:
    get:
      tags:
      - Top IPs
      - Umbrella
      summary: Get Top IPs
      description: 'List the top IP addresses.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTopIps
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopIP'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - ip: 10.0.0.1
                  count: 42
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /top-ips/internal:
    get:
      tags:
      - Top IPs
      - Umbrella
      summary: Get Top IPs Internal
      description: 'List the top internal IP addresses.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getTopIpsInternal
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TopIP'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - ip: 10.0.0.1
                  count: 42
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /summary:
    get:
      tags:
      - Summary
      - Umbrella
      summary: Get Summary (All)
      description: 'Get the summary report.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getSummary
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/ruleIdParam'
      - $ref: '#/components/parameters/filenameParam'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Summary'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                  applications: 123
                  domains: 82
                  requestsblocked: 189
                  filetypes: 0
                  policycategories: 2
                  policyrequests: 2
                  requests: 189
                  requestsallowed: 10
                  categories: 11
                  identitytypes: 1
                  applicationsblocked: 2
                  files: 5
                  identities: 1
                  applicationsallowed: 2
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /summary/{type}:
    get:
      tags:
      - Summary
      - Umbrella
      summary: Get Summary By Type
      description: 'Get the summary of requests by the traffic type.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getSummaryByType
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/typeDnsWebIpFirewallParam'
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/ruleIdParam'
      - $ref: '#/components/parameters/filenameParam'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      - $ref: '#/components/parameters/timezoneParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Summary'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                  applications: 123
                  domains: 82
                  requestsblocked: 189
                  filetypes: 0
                  policycategories: 2
                  requests: 189
                  requestsallowed: 10
                  categories: 11
                  identitytypes: 1
                  applicationsblocked: 2
                  files: 5
                  identities: 1
                  applicationsallowed: 2
                  policyrequests: 3
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /summaries-by-category:
    get:
      tags:
      - Summaries by Category
      - Umbrella
      summary: Get Summaries by Category (All)
      description: 'List the summaries of requests by category.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getSummariesByCategory
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/ruleIdParam'
      - $ref: '#/components/parameters/filenameParam'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SummaryWithCategory'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - category:
                    id: 66
                    label: Malware
                    type: security
                    integration: true
                  summary:
                    applications: 123
                    domains: 82
                    requestsblocked: 189
                    filetypes: 0
                    policycategories: 2
                    requests: 189
                    requestsallowed: 10
                    categories: 11
                    identitytypes: 1
                    applicationsblocked: 2
                    files: 5
                    identities: 1
                    applicationsallowed: 2
                    policyrequests: 6
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /summaries-by-category/{type}:
    get:
      tags:
      - Summaries by Category
      - Umbrella
      summary: Get Summaries by Category For Type
      description: 'List the summaries by category for the type of request.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getSummariesByCategoryType
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/typeDnsWebIpParam'
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/ruleIdParam'
      - $ref: '#/components/parameters/filenameParam'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SummaryWithCategory'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - category:
                    id: 66
                    label: Malware
                    type: security
                    integration: true
                  summary:
                    applications: 123
                    domains: 82
                    requestsblocked: 189
                    filetypes: 0
                    policycategories: 2
                    requests: 189
                    requestsallowed: 10
                    categories: 11
                    identitytypes: 1
                    applicationsblocked: 2
                    files: 5
                    identities: 1
                    applicationsallowed: 2
                    policyrequests: 4
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /summaries-by-destination:
    get:
      tags:
      - Summaries by Destination
      - Umbrella
      summary: Get Summaries by Destination (All)
      description: 'List the summaries by destination.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getSummariesByDestination
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/ruleIdParam'
      - $ref: '#/components/parameters/filenameParam'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SummaryWithDestination'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - domain: www.google.com
                  summary:
                    applications: 123
                    domains: 82
                    requestsblocked: 189
                    filetypes: 0
                    policycategories: 2
                    policyrequests: 2
                    requests: 189
                    requestsallowed: 10
                    categories: 11
                    identitytypes: 1
                    applicationsblocked: 2
                    files: 5
                    identities: 1
                    applicationsallowed: 2
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /summaries-by-destination/{type}:
    get:
      tags:
      - Summaries by Destination
      - Umbrella
      summary: Get Summaries by Destination For Type
      description: 'List the summaries by destination for the type of traffic.


        **Access Scope:** Reports > Aggregations > Read-Only'
      operationId: getSummariesByDestinationType
      security:
      - oauthFlow:
        - reports.aggregations:read
      parameters:
      - $ref: '#/components/parameters/typeDnsWebParam'
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/ruleIdParam'
      - $ref: '#/components/parameters/filenameParam'
      - $ref: '#/components/parameters/securityOverriddenParam'
      - $ref: '#/components/parameters/bundleIdParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/ampDispositionParam'
      - $ref: '#/components/parameters/antivirusThreatsParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SummaryWithDestination'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - domain: www.google.com
                  summary:
                    applications: 123
                    domains: 82
                    requestsblocked: 189
                    filetypes: 0
                    policycategories: 2
                    policyrequests: 2
                    requests: 189
                    requestsallowed: 10
                    categories: 11
                    identitytypes: 1
                    applicationsblocked: 2
                    files: 5
                    identities: 1
                    applicationsallowed: 2
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /summaries-by-rule/intrusion:
    get:
      tags:
      - Summaries by Rule (Intrusion)
      - Umbrella
      summary: Get Summaries by Rule
      description: 'List the summaries by rule for the intrusion type.


        **Access Scope:** Reports > Summaries by rule > Read-Only'
      operationId: getSummariesByRuleIntrusion
      security:
      - oauthFlow:
        - reports.summariesByRule:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/signaturesParam'
      - $ref: '#/components/parameters/signatureListIdsParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/intrusionActionParam'
      - $ref: '#/components/parameters/portsParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SignatureListSummary'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - signaturelist:
                    id: 1111
                  signatures:
                  - counts:
                      blocked: 0
                      detected: 1
                      wouldblock: 0
                    generatorid: 1
                    lasteventat: 1594557262000
                    id: 47829
                  rule:
                    id: 47
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /providers/categories:
    get:
      tags:
      - Utility
      - Umbrella
      summary: Get Provider Categories
      description: 'List the Provider categories


        **Access Scope:** Reports > Customer > Read-Only'
      operationId: getProviderCategories
      security:
      - oauthFlow:
        - reports.utilities:read
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/CategoryWithLegacyId'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - id: 66
                  legacyid: 94
                  label: Malware
                  type: security
                  integration: true
                  deprecated: false
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /providers/deployments:
    get:
      tags:
      - Provider Deployment Status
      - Umbrella
      summary: Get Deployment Status by Organization
      description: 'List the summary counts of deployment status for the organization within the timeframe.


        **Access Scope:** Reports > Customer > Read-Only'
      operationId: getDeploymentStatusByOrganization
      security:
      - oauthFlow:
        - reports.customers:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/OrganizationDeploymentStatus'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - organization:
                    id: 232323
                    label: Company Name Goes Here
                  counts:
                  - identitytype:
                      id: 21
                      label: Sites
                      type: site
                    activecount: 1
                    count: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /providers/requests-by-hour:
    get:
      tags:
      - Provider Requests by Hour
      - Umbrella
      summary: Get Provider Requests by Hour (All)
      description: 'List the activity volume within the timeframe.


        **Access Scope:** Reports > Customer > Read-Only'
      operationId: getProviderRequestsByHour
      security:
      - oauthFlow:
        - reports.customers:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/sha256Param'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: The information about the provider's requests within the timerange.
                    items:
                      $ref: '#/components/schemas/RequestsbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /providers/requests-by-timerange:
    get:
      tags:
      - Provider Requests by Timerange
      - Umbrella
      summary: Get Provider Requests by Timerange (All)
      description: 'List the activity volume within the timeframe.


        **Access Scope:** Reports > Customer > Read-Only'
      operationId: getProviderRequestsByTimerange
      security:
      - oauthFlow:
        - reports.customers:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/offsetParam'
      - $ref: '#/components/parameters/domainsParam'
      - $ref: '#/components/parameters/urlsParam'
      - $ref: '#/components/parameters/categoriesParam'
      - $ref: '#/components/parameters/policyCategoriesParam'
      - $ref: '#/components/parameters/ipParam'
      - $ref: '#/components/parameters/identityIdsParam'
      - $ref: '#/components/parameters/identityTypesParam'
      - $ref: '#/components/parameters/applicationIdParam'
      - $ref: '#/components/parameters/verdictParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/timerangeParam'
      - $ref: '#/components/parameters/dataLossPreventionStateParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: The information about the provider's requests within the timerange.
                    items:
                      $ref: '#/components/schemas/RequestsbyHour'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - count: 123
                  counts:
                    requests: 123
                    allowedrequests: 60
                    blockedrequests: 63
                  timestamp: 1559836800000
                  date: '2019'
                  time: '16:00:00'
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /providers/requests-by-org:
    get:
      tags:
      - Provider Requests by Organization
      - Umbrella
      summary: Get Provider Requests by Organization
      description: 'List the summary counts of all requests within the timeframe.


        **Access Scope:** Reports > Customer > Read-Only'
      operationId: getProviderRequestsByOrganization
      security:
      - oauthFlow:
        - reports.customers:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RequestsbyOrganization'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - organization:
                    id: 232323
                    label: Company Name Goes Here
                  counts:
                    total: 1
                    totalblocked: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /providers/requests-by-category:
    get:
      tags:
      - Provider Requests by Category
      - Umbrella
      summary: Get Provider Requests by Category
      description: 'List the summary counts of all requests within the timeframe.


        **Access Scope:** Reports > Customer > Read-Only'
      operationId: getProviderRequestsByCategory
      security:
      - oauthFlow:
        - reports.customers:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RequestsbyCategory'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - category:
                    id: 66
                    label: Malware
                    type: security
                    integration: true
                  counts:
                    total: 1
                    totalblocked: 1
                    numberoforganizationsaffected: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /providers/requests-by-destination:
    get:
      tags:
      - Provider Requests by Destination
      - Umbrella
      summary: Get Provider Requests by Destination
      description: 'List the summary counts of all requests within the timeframe.


        **Access Scope:** Reports > Customer > Read-Only'
      operationId: getProviderRequestsByDestination
      security:
      - oauthFlow:
        - reports.customers:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ProviderRequestsbyDestination'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - domain: ''
                  categories:
                  - id: 66
                    label: Malware
                    type: security
                    integration: true
                  counts:
                    total: 1
                    totalblocked: 1
                    numberoforganizationsaffected: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
  /providers/category-requests-by-org:
    get:
      tags:
      - Provider Category Requests by Organization
      - Umbrella
      summary: Get Provider Category Requests by Organization
      description: 'List the summary counts of all requests for each category within the timeframe.


        **Access Scope:** Reports > Customer > Read-Only'
      operationId: getProviderCategoryRequestsByOrganization
      security:
      - oauthFlow:
        - reports.customers:read
      parameters:
      - $ref: '#/components/parameters/fromParam'
      - $ref: '#/components/parameters/toParam'
      - $ref: '#/components/parameters/limitParam'
      - $ref: '#/components/parameters/threatsParam'
      - $ref: '#/components/parameters/threatTypesParam'
      - $ref: '#/components/parameters/filterNoisyDomainsParam'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ProviderCategoryRequestsByOrganization'
                  meta:
                    $ref: '#/components/schemas/Meta'
                required:
                - data
                - meta
              example:
                data:
                - organization:
                    id: 232323
                    label: Company Name Goes Here
                  counts:
                  - category:
                      id: 66
                      label: Malware
                      type: security
                      integration: true
                    requests: 123
                    requestsblocked: 34
                    numberoforganizationswithcategorizedtraffic: 1
                meta: {}
        '400':
          $ref: '#/components/responses/400Error'
        '401':
          $ref: '#/components/responses/401Error'
        '403':
          $ref: '#/components/responses/403Error'
        '404':
          $ref: '#/components/responses/404Error'
        '500':
          $ref: '#/components/responses/500Error'
components:
  parameters:
    fromParam:
      name: from
      in: query
      description: 'A timestamp or relative time string (for example: ''-1days'').

        Filter for data that appears after this time.'
      required: true
      schema:
        type: string
      example: '1639146300000'
    toParam:
      name: to
      in: query
      description: 'A timestamp or relative time string (for example: ''now'').

        Filter for data that appears before this time.'
      required: true
      schema:
        type: string
      example: '1640010300000'
    offsetParam:
      name: offset
      in: query
      description: A number that represents an index in the collection.
      schema:
        type: number
        default: 0
      example: 0
    offsetRequiredParam:
      name: offset
      in: query
      description: A number that represents an index in the collection.
      required: true
      schema:
        type: number
      example: 0
    limitParam:
      name: limit
      in: query
      description: The maximum number of records to return from the collection.
      required: true
      schema:
        type: number
        default: 100
      example: 100
    limitParamIdentitiesUtility:
      name: limit
      in: query
      description: '(Identities utility endpoint) The number of records to return from the collection.

        The default limit is 100. In a single response, the server returns at most 5000 records from the collection.'
      required: true
      schema:
        type: number
        default: 100
      example: 100
    timezoneParam:
      name: timezone
      in: query
      description: 'Display the timestamp of the traffic events in the specified timezone.

        For the timezone, provide a continent and city separated by an url-encoded forward slash (''/''), for example: timezone=''ASIA%2fCALCUTTA''.'
      schema:
        type: string
      example: ASIA%2fCALCUTTA
    domainsParam:
      name: domains
      in: query
      description: A domain name or comma-delimited list of domain name.
      schema:
        type: string
      example: cisco.com,nasa.gov
    urlsParam:
      name: urls
      in: query
      description: A URL or comma-delimited list of URL.
      schema:
        type: string
      example: https://google.com,facebook.com/help
    categoriesParam:
      name: categories
      in: query
      description: A category ID or comma-delimited list of category ID.
      schema:
        type: string
      example: 148,151,66
    policyCategoriesParam:
      name: policycategories
      in: query
      description: 'A category ID or comma-delimited list of category ID.

        Filter the request by the categories that trigger a policy.'
      schema:
        type: string
      example: 67,69
    ipParam:
      name: ip
      in: query
      description: An IP address.
      schema:
        type: string
      example: 10.10.10.10
    orderParam:
      name: order
      in: query
      description: 'A string that describes how to order the results: ascending (`asc`) or descending (`desc`).'
      schema:
        type: string
        enum:
        - asc
        - desc
      example: desc
    portsParam:
      name: ports
      in: query
      description: A port number or comma-delimited list of port numbers.
      schema:
        type: string
      example: 7351,80
    identityIdsParam:
      name: identityids
      in: query
      description: An identity ID or comma-delimited list of identity IDs.
      schema:
        type: string
      example: 1,2,3
    identityTypesParam:
      name: identitytypes
      in: query
      description: An identity type or comma-delimited list of identity types.
      schema:
        type: string
      example: network,roaming
    applicationIdParam:
      name: applicationid
      in: query
      description: The ID of the application.
      schema:
        type: string
      example: '1'
    verdictParam:
      name: verdict
      in: query
      description: A string or comma-delimited string that describes whether the traffic can reach the destination.
      schema:
        type: string
      example: allowed,blocked,proxied
    ruleIdParam:
      name: ruleid
      in: query
      description: The firewall policy rule ID.
      schema:
        type: number
      example: 1
    filenameParam:
      name: filename
      in: query
      description: 'A string that identifies a filename. Filter the request by the filename.

        Supports globbing or use of the wildcard character (''*''). The asterisk (*) matches

        zero or more occurrences of any character.'
      schema:
        type: string
      example: myfilename_*
    securityOverriddenParam:
      name: securityoverridden
      in: query
      description: Specify whether to filter on requests that override security.
      schema:
        type: boolean
      example: true
    bundleIdParam:
      name: bundleid
      in: query
      description: A proxy bundle ID.
      schema:
        type: number
      example: 1
    threatsParam:
      name: threats
      in: query
      description: A threat name or comma-delimited list of threat names.
      schema:
        type: string
    threatTypesParam:
      name: threattypes
      in: query
      description: A threat type or comma-delimited list of threat types.
      schema:
        type: string
    ampDispositionParam:
      name: ampdisposition
      in: query
      description: An AMP disposition string or a comma-delimited list of AMP disposition strings.
      schema:
        type: string
      example: clean,malicious,unknown
    isolatedStateParam:
      name: isolatedstate
      in: query
      description: A string that describes the remote browser isolation (RBI) isolation type.
      schema:
        type: string
        enum:
        - isolated
        - not-isolated
      example: isolated
    isolatedFileActionParam:
      name: isolatedFileAction
      in: query
      description: A string that describes the remote browser isolation (RBI) file action type.
      schema:
        type: string
        enum:
        - viewed
        - downloaded-original-file
        - downloaded-safe-pdf
      example: downloaded-safe-pdf
    dataLossPreventionStateParam:
      name: datalosspreventionstate
      in: query
      description: 'A string that describes the status of a destination.

        Filter for requests that are blocked by the DLP layer security.'
      schema:
        type: string
        enum:
        - blocked
      example: blocked
    sha256Param:
      name: sha256
      in: query
      description: A SHA-256 hash.
      schema:
        type: string
      example: ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
    antivirusThreatsParam:
      name: antivirusthreats
      in: query
      description: A threat name or comma-delimited list of threat names.
      schema:
        type: string
      example: Trojan.Linux.Generic.144075
    xTrafficTypeParam:
      name: x-traffic-type
      in: header
      description: 'A string or comma-delimited list of strings that describes the type of traffic.

        If the header is not set, the default value is `all`. Valid values are: `dns`, `proxy`, `firewall`, and `ip`.'
      schema:
        type: string
      example: dns,proxy,firewall,ip
    tenantControlsParam:
      name: tenantcontrols
      in: query
      description: If set to `true`, filter data for requests that are part of a tenant control policy.
      schema:
        type: boolean
      example: true
    typeDnsWebParam:
      name: type
      in: path
      description: Specify the type of traffic.
      required: true
      schema:
        type: string
        enum:
        - dns
        - proxy
      example: dns
    typeDnsWebIpParam:
      name: type
      in: path
      description: Specify the type of traffic.
      required: true
      schema:
        type: string
        enum:
        - dns
        - proxy
        - ip
      example: ip
    typeDnsWebIpFirewallParam:
      name: type
      in: path
      description: Specify the type of traffic.
      required: true
      schema:
        type: string
        enum:
        - dns
        - proxy
        - firewall
        - ip
      example: firewall
    typeAllParam:
      name: type
      in: path
      description: Specify the type of traffic.
      required: true
      schema:
        type: string
        enum:
        - dns
        - proxy
        - firewall
        - intrusion
        - ip
      example: intrusion
    identityIdParam:
      name: identityid
      in: path
      description: An identity ID.
      required: true
      schema:
        type: number
      example: 42
    threatTypeIdParam:
      name: threattypeid
      in: path
      description: The name of the threat type.
      required: true
      schema:
        type: string
      example: Ransomware
    searchParam:
      name: search
      in: query
      description: 'A string that represents a search parameter.

        Filter data for requests where the search string appears in the endpoint data.'
      schema:
        type: string
      example: somelabel
    threatNameIdParam:
      name: threatnameid
      in: path
      description: The name of the threat.
      required: true
      schema:
        type: string
      example: WannaCry
    timerangeParam:
      name: timerange
      in: header
      description: 'A string that represents a range of time.

        If the header is not set, the header value defaults to `hour`.'
      schema:
        type: string
        enum:
        - minute
        - hour
        - day
      example: minute
    applicationNameParam:
      name: application
      in: query
      description: Filter on the name of the application.
      schema:
        type: string
      example: Games
    filterNoisyDomainsParam:
      name: filternoisydomains
      in: query
      description: Filter out domains that generate a lot of insignificant traffic (noise).
      schema:
        type: boolean
      example: true
    httpErrorsParam:
      name: httperrors
      in: query
      description: Filter data for requests that resulted in a TLS error or a certificate error.
      schema:
        type: string
        enum:
        - certificateerror
        - tlserror
      example: certificateerror
    signaturesParam:
      name: signatures
      in: query
      description: The signature or comma-separated list of <signatureid>-<generatorid> signatures.
      schema:
        type: string
      example: 1-2,1-4
    signatureListIdsParam:
      name: signaturelistids
      in: query
      description: The signature ID or comma-separated list of signature list IDs.
      schema:
        type: string
      example: 1,2
    intrusionActionParam:
      name: intrusionaction
      in: query
      description: 'An action or list of comma-separated intrusion actions. Valid values are: `would_block`, `blocked`, and
        `detected`.'
      schema:
        type: string
      example: detected,would_block
    existsParam:
      name: exists
      in: query
      description: 'Specify an attribute or comma-separated list of attributes to filter the data.

        Valid values are: `categories`, `policycategories`, `applicationid`,

        `nbarapplicationid`, `nbarapplicationtypeids`, `privateapplicationid`, `applicationgroupids`,

        `sha256`, `filename`, `threats`, `threattypes`, `antivirusthreats`, `destinationlistids`, and `httperrors`.'
      schema:
        type: string
      example: destinationlistids,threattypes
    connectioneventParam:
      name: connectionevent
      in: query
      description: Specify the type of connection event.
      schema:
        type: string
        enum:
        - connected
        - disconnected
        - failed
      example: connected
    osversionsParam:
      name: osversions
      in: query
      description: Specify a comma-separated list of OS versions.
      schema:
        type: string
      example: linux-64-Ubuntu 20.04.5 LTS (Focal Fossa)
    anyconnectversionsParam:
      name: anyconnectversions
      in: query
      description: Specify a comma-separated list of AnyConnect Roaming Security module versions.
      schema:
        type: string
      example: 4.10.05095,5.10
  schemas:
    verdict:
      type: string
      description: The verdict for the entry.
      enum:
      - allowed
      - blocked
      example: allowed
    verdictDetected:
      type: string
      description: The verdict for the entry.
      enum:
      - detected
      example: detected
    categories:
      type: array
      description: The list of categories.
      items:
        $ref: '#/components/schemas/Category'
    policycategories:
      type: array
      description: The list of policy categories.
      items:
        $ref: '#/components/schemas/Category'
    identities:
      type: array
      description: The list of identities for the entry.
      items:
        $ref: '#/components/schemas/Identity'
    allapplications:
      type: array
      description: The list of applications for the entry.
      items:
        $ref: '#/components/schemas/Application'
    sha256:
      type: string
      description: The SHA256 hash for the entry.
    ActivityProxy:
      type: object
      description: The activity of the proxy.
      properties:
        externalip:
          type: string
          description: The external IP for the entry.
        internalip:
          type: string
          description: The internal IP for the entry.
        policycategories:
          $ref: '#/components/schemas/policycategories'
        categories:
          $ref: '#/components/schemas/categories'
        verdict:
          $ref: '#/components/schemas/verdict'
        timestamp:
          $ref: '#/components/schemas/Timestamp'
        identities:
          $ref: '#/components/schemas/identities'
        allapplications:
          $ref: '#/components/schemas/allapplications'
        allowedapplications:
          type: array
          description: The list of allowed applications for the entry.
          items:
            $ref: '#/components/schemas/Application'
        blockedapplications:
          type: array
          description: The list of blocked applications for the entry.
          items:
            $ref: '#/components/schemas/Application'
        responsefilename:
          type: string
          description: The response filename for the entry.
        blockedfiletype:
          type: string
          description: The blocked file type for the entry.
        bundleid:
          type: number
          description: The ID of the bundle type.
        amp:
          $ref: '#/components/schemas/CiscoAMP'
        type:
          type: string
          description: The type of the request. A proxy request is always of type 'proxy'.
        tenantcontrols:
          type: boolean
          description: Specifies whether the request is part of a tenant control policy.
        port:
          type: number
          description: The port used to make the request.
          nullable: true
        antivirusthreats:
          $ref: '#/components/schemas/AntivirusThreats'
        policy:
          $ref: '#/components/schemas/Policy'
        requestmethod:
          type: string
          description: The HTTP request method.
          example: GET
        responsesize:
          type: number
          description: The response size in bytes.
        requestsize:
          type: number
          description: The response size in bytes.
        statuscode:
          type: number
          description: The HTTP status code (`200` or `201`).
          enum:
          - 200
          - 201
          example: 200
        useragent:
          type: string
          description: The name of the browser that made the request.
        referer:
          type: string
          description: The referring domain or URL.
        warnstatus:
          type: string
          description: The warning status.
        sha256:
          type: string
          description: The hex digest of the response content.
        isolated:
          $ref: '#/components/schemas/Isolated'
        datalossprevention:
          $ref: '#/components/schemas/DataLossPreventionState'
        securityoverridden:
          type: boolean
          description: Specifies whether security overrides are configured.
        contenttype:
          type: string
          description: The type of web content, typically text/html.
          example: text/html
        forwardingmethod:
          type: string
          description: The request method (GET, POST, HEAD, etc.)
          example: GET
        httperrors:
          type: array
          items:
            $ref: '#/components/schemas/HttpError'
          description: Certificate & TLS Errors
        threats:
          type: array
          items:
            $ref: '#/components/schemas/Threat'
        egress:
          $ref: '#/components/schemas/Egress'
        datacenter:
          $ref: '#/components/schemas/DataCenter'
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
        destinationip:
          $ref: '#/components/schemas/DestinationIp'
        url:
          type: string
          description: The URL that was requested.
      required:
      - allapplications
      - allowedapplications
      - amp
      - antivirusthreats
      - blockedapplications
      - blockedfiletype
      - bundleid
      - categories
      - contenttype
      - datacenter
      - datalossprevention
      - date
      - destinationip
      - egress
      - externalip
      - forwardingmethod
      - httperrors
      - identities
      - internalip
      - isolated
      - policy
      - policycategories
      - port
      - referer
      - requestsize
      - responsefilename
      - responsesize
      - securityoverridden
      - sha256
      - statuscode
      - tenantcontrols
      - threats
      - time
      - timestamp
      - type
      - url
      - useragent
      - verdict
      - warnstatus
      example:
        destinationip: ''
        externalip: 32.4.91.7
        responsesize: 3329530
        allapplications:
        - id: 1313
          label: Netflix
          category:
            id: 47
            label: Media
        date: '2022-02-18'
        datalossprevention:
          state: ''
        antivirusthreats:
          puas: []
          viruses: []
          others: []
        internalip: 192.168.1.43
        referer: ''
        contenttype: ''
        tenantcontrols: false
        securityoverridden: false
        useragent: ''
        time: '23:29:42'
        amp:
          disposition: ''
          score: 0
          malware: ''
        policycategories: []
        type: proxy
        requestsize: 1996
        port: 443
        policy:
          ruleid: 0
          rulesetid: 0
          destinationlistids: []
          timebasedrule: false
        forwardingmethod: ''
        categories:
        - id: 17
          type: content
          label: Movies
          integration: false
          deprecated: true
        isolated:
          state: not-isolated
          fileaction: ''
        statuscode: 200
        egress:
          ip: 155.190.3.8
          type: shared
        blockedfiletype: ''
        url: https://ipv4-lax2-ix.1.oca.anothervideo.net
        verdict: allowed
        responsefilename: ''
        warnstatus: ''
        sha256: ''
        timestamp: 1645226982000
        blockedapplications: []
        allowedapplications: []
        identities:
        - id: 1
          type:
            id: 34
            type: anyconnect
            label: Anyconnect Roaming Client
          label: Vincent's Macbook
          deleted: false
        datacenter:
          label: Atlanta, US
          id: ATL
        threats: []
        httperrors: []
        bundleid: 3
    ActivityFirewall:
      type: object
      description: The information about the firewall activity.
      properties:
        date:
          $ref: '#/components/schemas/Date'
        destinationip:
          $ref: '#/components/schemas/DestinationIp'
        sourceip:
          $ref: '#/components/schemas/SourceIp'
        sourceport:
          $ref: '#/components/schemas/SourcePort'
        destinationport:
          $ref: '#/components/schemas/DestinationPort'
        categories:
          $ref: '#/components/schemas/categories'
        verdict:
          $ref: '#/components/schemas/verdict'
        time:
          $ref: '#/components/schemas/Time'
        timestamp:
          $ref: '#/components/schemas/Timestamp'
        identities:
          $ref: '#/components/schemas/identities'
        protocol:
          $ref: '#/components/schemas/Protocol'
        rule:
          $ref: '#/components/schemas/Rule'
        type:
          type: string
          description: The type of the request. A firewall request always has type firewall.
          example: firewall
        allapplications:
          type: array
          description: A list of firewall applications
          items:
            $ref: '#/components/schemas/FirewallApplication'
        applicationprotocols:
          type: array
          description: A list of firewall application protocols.
          items:
            $ref: '#/components/schemas/FirewallApplication'
        direction:
          type: string
          description: The direction of the packet. It is destined either towards the internet or to the customer's network.
        packetsize:
          type: number
          description: The size of the packet that was received.
      required:
      - allapplications
      - applicationprotocols
      - date
      - destinationip
      - destinationport
      - direction
      - identities
      - packetsize
      - protocol
      - rule
      - sourceip
      - sourceport
      - time
      - timestamp
      - type
      - verdict
      example:
        date: ''
        destinationip: 52.8.160.247
        sourceip: 192.168.0.1
        sourceport: 0
        destinationport: 0
        direction: toward
        categories:
        - id: 66
          label: Malware
          type: security
          integration: true
        verdict: allowed
        time: '12:34'
        timestamp: 1548311506000
        packetsize: 32
        identities:
        - id: 1
          label: Catch Rate Testing System
          type:
            id: 21
            label: Sites
            type: site
          deleted: false
        protocol:
          id: 17
          label: UDP
        rule:
          id: 1
          label: Default Rule
        type: firewall
        allapplications:
        - id: 72
          label: dns IT Service Management
          app: ''
        applicationprotocols:
        - id: 72
          label: dns IT Service Management
          app: ''
    ActivityIntrusion:
      type: object
      description: The information about the intrusion activity.
      properties:
        classification:
          $ref: '#/components/schemas/Classification'
        date:
          $ref: '#/components/schemas/Date'
        destinationip:
          $ref: '#/components/schemas/DestinationIp'
        destinationport:
          $ref: '#/components/schemas/DestinationPort'
        identities:
          $ref: '#/components/schemas/identities'
        protocol:
          $ref: '#/components/schemas/Protocol'
        sessionid:
          $ref: '#/components/schemas/SessionId'
        severity:
          $ref: '#/components/schemas/Severity'
        signature:
          $ref: '#/components/schemas/Signature'
        signaturelist:
          $ref: '#/components/schemas/SignatureList'
        sourceip:
          $ref: '#/components/schemas/SourceIp'
        sourceport:
          $ref: '#/components/schemas/SourcePort'
        time:
          $ref: '#/components/schemas/Time'
        timestamp:
          $ref: '#/components/schemas/Timestamp'
        type:
          type: string
          description: The type of the request. An intrusion request always has type intrusion.
          example: intrusion
        verdict:
          $ref: '#/components/schemas/verdictDetected'
      required:
      - classification
      - date
      - destinationip
      - destinationport
      - identities
      - protocol
      - sessionid
      - severity
      - signature
      - signaturelist
      - sourceip
      - sourceport
      - time
      - timestamp
      - type
      - verdict
      example:
        type: intrusion
        date: 12-02-22
        destinationip: 10.10.10.10
        protocol:
          id: 17
          label: UDP
        sourceip: 10.10.10.10
        signaturelist:
          id: 1111
        classification: malicious
        sourceport: 22
        sessionid: 190898098
        verdict: detected
        destinationport: 33
        timestamp: 1594557262000
        time: 09:30
        identities:
        - id: 211034846
          type:
            id: 34
            type: anyconnect
            label: Anyconnect Roaming Client
          label: omerta
          deleted: false
        severity: HIGH
        signature:
          generatorid: 1
          id: 47829
          label: SERVER-OTHER JBoss Richfaces expression language injection attempt
          cves:
          - cve-2015-0279
          - cve-2018-12532
    IdentityDistribution:
      type: object
      description: The information about the identity distribution.
      properties:
        counts:
          $ref: '#/components/schemas/RequestCounts'
        requests:
          type: number
          description: The requests made by the identity type.
        unique_identity_count:
          type: number
          description: The number unique identities associated with the identity type.
        identitytype:
          $ref: '#/components/schemas/IdentityType'
      required:
      - counts
      - identitytype
      - requests
      - unique_identity_count
      example:
        counts:
          requests: 123
          allowedrequests: 60
          blockedrequests: 63
        requests: 312
        unique_identity_count: 12
        identitytype:
          id: 21
          label: Sites
          name: site
    OrganizationDeploymentStatus:
      type: object
      description: The deployment status for the organization.
      required:
      - organization
      - counts
      properties:
        organization:
          $ref: '#/components/schemas/Organization'
        counts:
          type: array
          items:
            $ref: '#/components/schemas/ProviderDeploymentStatus'
      example:
        organization:
          id: 232323
          label: Company Name Goes Here
        counts:
        - identitytype:
            id: 21
            label: Sites
            name: site
          activecount: 1
          count: 1
    BandwidthbyHour:
      type: object
      description: The information about the bandwidth by hour.
      properties:
        inboundbytes:
          type: number
          description: The number of inbound bytes.
        outboundbytes:
          type: number
          nullable: true
          description: The number of outbound bytes.
        timestamp:
          $ref: '#/components/schemas/TimestampForBucket'
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
      required:
      - date
      - inboundbytes
      - outboundbytes
      - time
      - timestamp
      example:
        inboundbytes: 123
        outboundbytes: 456
        timestamp: 1559836800000
        date: '2019'
        time: '16:00:00'
    TopFile:
      type: object
      description: The information about the top file requests.
      properties:
        requests:
          type: number
          description: The number of requests for the file.
        sha256:
          $ref: '#/components/schemas/sha256'
        categories:
          $ref: '#/components/schemas/categories'
        identitycount:
          type: number
          description: The count of the identities for the entry.
        filenames:
          type: array
          description: The list of filenames for the entry.
          items:
            type: string
        filetypes:
          type: array
          description: The list of filetypes for the entry.
          items:
            type: string
      required:
      - categories
      - filenames
      - filetypes
      - identitycount
      - requests
      - sha256
      example:
        requests: 123
        sha256: 9495b6c155044053953efe30ebaf804780c114e7b721b14f6a5b0a782769696e
        categories:
        - id: 66
          label: Malware
          type: security
          integration: true
        identitycount: 1
        filenames: []
        filetypes: []
    TopThreats:
      type: object
      description: The information about the top threats.
      properties:
        threat:
          type: string
          description: The name of the threat.
        threattype:
          type: string
          description: The type of the threat.
        count:
          type: number
          description: The number of requests for the threat name.
      required:
      - count
      - threat
      - threattype
      example:
        threat: Wannacry
        threattype: Ransomware
        count: 361
    TopThreatTypes:
      type: object
      description: The information about the top types of threat.
      properties:
        threattype:
          type: string
          description: The type of the threat.
        threatscount:
          type: number
          description: The count of the threats for the threat type.
        count:
          type: number
          description: The number of requests for the threat type.
      required:
      - count
      - threatscount
      - threattype
      example:
        threattype: Ransomware
        threatscount: 10
        count: 361
    Identity:
      type: object
      description: The information about the identity.
      properties:
        id:
          type: number
          description: The ID of the identity.
        label:
          type: string
          description: The descriptive label for the identity.
        type:
          $ref: '#/components/schemas/IdentityType'
        deleted:
          type: boolean
          description: Indicates whether the identity was deleted.
          example: true
      required:
      - id
      - label
      - type
      - deleted
      example:
        id: 1
        label: Catch Rate Testing System
        type:
          id: 21
          label: Sites
          type: site
        deleted: false
    Summary:
      type: object
      description: The summary information about the requests.
      properties:
        applications:
          type: number
          description: The total number of applications (avc or total).
        domains:
          type: number
          description: The total number of domains.
        requestsblocked:
          type: number
          description: The total number of domains.
        filetypes:
          type: number
          description: The total number of domains.
        policycategories:
          type: number
          description: The total number of blocked categories.
        policyrequests:
          type: number
          description: The total number of policy requests.
        requests:
          type: number
          description: The total number of requests.
        requestsallowed:
          type: number
          description: The total number of allowed requests.
        categories:
          type: number
          description: The total number of categories.
        identitytypes:
          type: number
          description: The total number of identity types.
        applicationsblocked:
          type: number
          description: The total number of blocked applications.
        files:
          type: number
          description: The total number of files.
        identities:
          type: number
          description: The total number of identities.
        applicationsallowed:
          type: number
          description: The total number of allowed applications.
      required:
      - applications
      - applicationsallowed
      - applicationsblocked
      - categories
      - domains
      - files
      - filetypes
      - identities
      - identitytypes
      - policycategories
      - policyrequests
      - requests
      - requestsallowed
      - requestsblocked
      example:
        applications: 123
        domains: 82
        requestsblocked: 189
        filetypes: 0
        policycategories: 2
        policyrequests: 2
        requests: 189
        requestsallowed: 10
        categories: 11
        identitytypes: 1
        applicationsblocked: 2
        files: 5
        identities: 1
        applicationsallowed: 2
    Protocol:
      type: object
      description: The properties of the protocol.
      properties:
        id:
          type: number
          description: The ID of protocol.
        label:
          type: string
          description: The name of the protocol.
      required:
      - id
      - label
    Rule:
      type: object
      description: The properties of the firewall rule.
      properties:
        id:
          type: number
          description: The ID of the rule.
        label:
          type: string
          description: The name of the rule.
        privateapplicationgroup:
          $ref: '#/components/schemas/PrivateApplicationGroup'
      required:
      - id
      - label
    PrivateApplicationGroup:
      type: object
      description: The private application group.
      properties:
        id:
          nullable: true
          type: number
          description: The ID of application group.
        label:
          nullable: true
          type: string
          description: The name of the application group.
    IdentityType:
      type: object
      description: The information about the identity including the type.
      properties:
        id:
          type: number
          description: The ID of the origin type for the identity.
        label:
          type: string
          description: The label of the origin type for the identity.
        type:
          type: string
          description: The name of the origin type for the identity.
    CategoryWithLegacyId:
      type: object
      description: The information about the category with legacy ID.
      properties:
        id:
          type: number
          description: The ID of the category.
        legacyid:
          type: number
          description: The legacy category ID.
        label:
          type: string
          description: The label of the category.
        type:
          type: string
          description: The type of the category.
        integration:
          type: boolean
          description: Specifies whether the category is an integration.
        deprecated:
          type: boolean
          description: Specifies whether the legacy category is deprecated.
          example: true
      required:
      - id
      - integration
      - label
      - legacyid
      - type
      - deprecated
      example:
        id: 66
        legacyid: 94
        label: Malware
        type: security
        integration: true
        deprecated: false
    Category:
      type: object
      description: The properties of the category.
      properties:
        id:
          type: number
          description: The ID of the category.
        label:
          type: string
          description: The descriptive label for the category.
        type:
          type: string
          description: The type of the category.
        integration:
          type: boolean
          description: Specifies whether the category is an integration.
          example: true
        deprecated:
          type: boolean
          description: Specifies whether the category is a legacy category.
          example: true
    rank:
      type: number
      description: The rank of the result based on the number of requests.
    TopIdentity:
      type: object
      description: The information about the top identity requests.
      properties:
        requests:
          type: number
          description: The total number of requests made by this identity.
        bandwidth:
          $ref: '#/components/schemas/bandwidth'
        identity:
          $ref: '#/components/schemas/Identity'
        counts:
          $ref: '#/components/schemas/RequestCounts'
        rank:
          $ref: '#/components/schemas/rank'
      required:
      - bandwidth
      - counts
      - identity
      - rank
      - requests
      example:
        requests: 3827
        bandwidth: 7051943359
        identity:
          id: 1
          label: Catch Rate Testing System
          type:
            id: 21
            label: Sites
            type: site
          deleted: false
        counts:
          requests: 123
          allowedrequests: 60
          blockedrequests: 63
        rank: 3
    bandwidth:
      type: number
      nullable: true
      description: The amount of bandwidth
    TopDestination:
      type: object
      description: The information about the top destination requests.
      properties:
        bandwidth:
          $ref: '#/components/schemas/bandwidth'
        rank:
          $ref: '#/components/schemas/rank'
        domain:
          type: string
          description: The domain name.
        count:
          type: number
          description: The total number of requests made for this destination.
        counts:
          $ref: '#/components/schemas/RequestCounts'
        categories:
          $ref: '#/components/schemas/categories'
        policycategories:
          type: array
          description: The policy categories that are associated with the destination.
          items:
            $ref: '#/components/schemas/Category'
      required:
      - bandwidth
      - categories
      - count
      - counts
      - domain
      - policycategories
      - rank
      example:
        bandwidth: 223437
        rank: 4
        domain: google.com
        count: 3827
        counts:
          requests: 123
          allowedrequests: 60
          blockedrequests: 63
        categories:
        - id: 66
          label: Malware
          type: security
          integration: true
        policycategories:
        - id: 66
          label: Malware
          type: security
          integration: true
    TopCategory:
      type: object
      description: The information about the top category requests.
      properties:
        rank:
          $ref: '#/components/schemas/rank'
        category:
          $ref: '#/components/schemas/Category'
        count:
          type: number
          description: The number of requests that match this category.
        bandwidth:
          $ref: '#/components/schemas/bandwidth'
      required:
      - category
      - count
      - rank
      example:
        rank: 5
        category:
          id: 66
          label: Malware
          type: security
          integration: true
        count: 3827
    TopEventType:
      type: object
      description: The information about the top events.
      properties:
        eventtype:
          type: string
          description: The type of the event.
          enum:
          - domain_security
          - domain_integration
          - url_security
          - url_integration
          - cisco_amp
          - antivirus
        count:
          type: number
          description: The number of requests that match the event type (`eventtype`).
      required:
      - count
      - eventtype
      example:
        eventtype: domain_security
        count: 3827
    RequestsbyHour:
      type: object
      description: The information about the requests by hour.
      properties:
        count:
          type: number
          description: The number of requests in the hour.
          example: 123
        counts:
          $ref: '#/components/schemas/RequestCounts'
        timestamp:
          $ref: '#/components/schemas/TimestampForBucket'
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
      required:
      - count
      - counts
      - date
      - time
      - timestamp
      example:
        count: 123
        counts:
          requests: 123
          allowedrequests: 60
          blockedrequests: 63
        timestamp: 1559836800000
        date: '2019'
        time: '16:00:00'
    RequestsbyOrganization:
      type: object
      description: The information about the requests by organization.
      properties:
        organization:
          $ref: '#/components/schemas/Organization'
        counts:
          $ref: '#/components/schemas/RequestsByOrgCounts'
      required:
      - counts
      - organization
      example:
        organization:
          id: 232323
          label: Company Name Goes Here
        counts:
          total: 1
          totalblocked: 1
    RequestsbyCategory:
      type: object
      description: The information about the requests by category.
      properties:
        category:
          $ref: '#/components/schemas/Category'
        counts:
          $ref: '#/components/schemas/ProviderCountsByCategory'
      required:
      - category
      - counts
      example:
        category:
          id: 66
          label: Malware
          type: security
          integration: true
        counts:
          total: 1
          totalblocked: 1
          numberoforganizationsaffected: 1
    ProviderRequestsbyDestination:
      type: object
      description: The information about the provider's requests by destination.
      properties:
        domain:
          type: string
        categories:
          type: array
          items:
            $ref: '#/components/schemas/Category'
        counts:
          $ref: '#/components/schemas/ProviderCountsByDestination'
      required:
      - categories
      - counts
      - domain
      example:
        domain: ''
        categories:
        - id: 66
          label: Malware
          type: security
          integration: true
        counts:
          total: 1
          totalblocked: 1
          numberoforganizationsaffected: 1
    CategoryByHour:
      required:
      - counts
      - date
      - time
      - timestamp
      type: object
      description: The information about the categories seen by hour.
      properties:
        timestamp:
          $ref: '#/components/schemas/TimestampForBucket'
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
        counts:
          type: array
          description: The list of counts for the category.
          items:
            $ref: '#/components/schemas/CategoryCount'
      example:
        timestamp: 1559836800000
        date: '2019'
        time: '16:00:00'
        counts:
        - category:
            id: 66
            label: Malware
            type: security
            integration: true
          requests: 123
    CategoryCount:
      type: object
      description: The information about the category counts.
      properties:
        category:
          $ref: '#/components/schemas/Category'
        requests:
          type: number
          description: The total number of requests for the category.
      required:
      - category
      - requests
      example:
        category: {}
        requests: 24
    Application:
      type: object
      description: The information about the application.
      properties:
        id:
          type: number
          description: The ID of the application.
        label:
          type: string
          description: The descriptive label for the application.
        type:
          type: string
          description: 'The type of the application: NBAR or AVC.'
          enum:
          - NBAR
          - AVC
          example: AVC
        category:
          type: object
          description: The category of the application.
          properties:
            id:
              type: number
              description: The ID of the application category.
            label:
              type: string
              description: The label of the application category.
      example:
        id: 1
        label: malware
        type: AVC
        category:
          id: 2
          label: Education
    ApplicationCategories:
      type: object
      description: The information about the applications.
      properties:
        id:
          type: number
          description: The ID of the application category.
          example: 1234
        name:
          type: string
          description: The name of the application category.
          example: Travel
      example:
        id: 1234
        name: Travel
    ApplicationsWithCategories:
      type: object
      description: The information about the applications and categories.
      properties:
        applications:
          type: array
          description: The list of applications.
          items:
            $ref: '#/components/schemas/Application'
        categories:
          type: array
          description: The list of application categories.
          items:
            $ref: '#/components/schemas/ApplicationCategories'
      example:
        applications:
        - id: 1
          label: Web Hosting
          type: AVC
          category:
            id: 40
            label: Hosting Services
        categories:
        - id: 42
          name: Education
    FirewallApplication:
      type: object
      description: The information about the applications managed by the firewall.
      properties:
        id:
          type: number
          description: The ID of the application or protocol.
        label:
          type: string
          description: The descriptive label for the application or protocol.
        app:
          type: string
          description: The information about the app type.
          example: IT Service Management (string) - application/protocol type
    ActivityDns:
      type: object
      description: The information about the DNS activity.
      properties:
        externalip:
          type: string
          description: The external IP for the entry.
        internalip:
          type: string
          description: The internal IP for the entry.
        policycategories:
          type: array
          description: The list of the policy categories.
          items:
            $ref: '#/components/schemas/Category'
        categories:
          $ref: '#/components/schemas/categories'
        verdict:
          $ref: '#/components/schemas/verdict'
        domain:
          type: string
          description: The domain name for the entry.
        timestamp:
          $ref: '#/components/schemas/Timestamp'
        identities:
          $ref: '#/components/schemas/identities'
        allapplications:
          type: array
          description: The list of all applications for the entry.
          items:
            $ref: '#/components/schemas/Application'
        threats:
          type: array
          description: The list of threats for the entry.
          items:
            $ref: '#/components/schemas/Threat'
        type:
          type: string
          description: The type of the request. A DNS request always has the type dns.
          enum:
          - dns
          example: dns
        querytype:
          type: string
          description: 'The type of DNS request that was made. For more information,

            see Common DNS Request Types.'
        date:
          $ref: '#/components/schemas/Date'
        time:
          $ref: '#/components/schemas/Time'
        returncode:
          type: number
          description: 'The DNS return code for this request.

            For more information, see Common DNS return codes for any

            DNS service (and Umbrella).'
        allowedapplications:
          type: array
          description: The list of allowed applications.
          items:
            $ref: '#/components/schemas/Application'
        blockedapplications:
          type: array
          description: The list of blocked applications.
          items:
            $ref: '#/components/schemas/Application'
      required:
      - allapplications
      - allowedapplications
      - blockedapplications
      - categories
      - date
      - domain
      - externalip
      - identities
      - internalip
      - policycategories
      - querytype
      - returncode
      - threats
      - time
      - timestamp
      - type
      - verdict
      example:
        externalip: 52.8.160.247
        internalip: 52.8.160.247
        policycategories:
        - id: 66
          label: Malware
          type: security
          integration: true
        categories:
        - id: 66
          label: Malware
          type: security
          integration: true
        verdict: allowed
        domain: google.com
        timestamp: 1548311506000
        time: 06:31:46
        date: '2019-01-24'
        identities:
        - id: 1
          label: Catch Rate Testing System
          type:
            id: 21
            label: Sites
            type: site
          deleted: true
        threats:
        - label: Wannacry
          type: Ransomware
        allapplications:
        - id: 1
          label: label
          type: NBAR
          category:
            id: 1
            label: category
        allowedapplications:
        - id: 1
          label: label
          type: NBAR
          category:
            id: 1
            label: category
        querytype: MX
        returncode: 2
        blockedapplications: []
        type: dns
    ActivityAMPRetro:
      type: object
      description: The information about the AMP activity.
      properties:
        timestamp:
          $ref: '#/components/schemas/TimestampInSeconds'
        firstseenat:
          type: number
          description: The date and time (a timestamp expressed in seconds) when the malware event was first recorded.
          example: 1548311506
        disposition:
          type: string
          description: The disposition for the entry.
        score:
          type: number
          description: The score for the entry.
        hostname:
          type: string
          description: The hostname for the entry.
        malwarename:
          type: string
          description: The name of the malware for the entry.
        sha256:
          $ref: '#/components/schemas/sha256'
      required:
      - disposition
      - firstseenat
      - hostname
      - malwarename
      - score
      - sha256
      - timestamp
      example:
        timestamp: 1548311506
        firstseenat: 1548311506
        disposition: clean
        score: 10
        hostname: google.com
        malwarename: malware
        sha256: 9495b6c155044053953efe30ebaf804780c114e7b721b14f6a5b0a782769696e
    CiscoAMP:
      type: object
      description: The properties of the AMP disposition and score for the malware.
      properties:
        score:
          type: number
          description: The AMP score.
        disposition:
          type: string
          description: The AMP disposition.
        malware:
          type: string
          description: The AMP malware.
      required:
      - disposition
      - malware
      - score
    AntivirusThreats:
      type: object
      description: The information about the antivirus threats.
      properties:
        puas:
          type: array
          description: The list of potentially unwanted applications.
          items:
            type: object
        viruses:
          type: array
          description: The list of viruses.
          items:
            type: string
        others:
          type: array
          description: The list of other antivirus threats.
          items:
            type: object
      required:
      - others
      - puas
      - viruses
    Threat:
      type: object
      description: The information about the threat.
      properties:
        label:
          type: string
          description: The descriptive label for the threat name.
        type:
          type: string
          description: The type of the threat.
    Organization:
      type: object
      description: The information about the organization.
      properties:
        id:
          type: number
          description: orgid
        label:
          type: string
          description: The name of the organization.
    RequestsByOrgCounts:
      type: object
      description: The information about the number of requests by organization.
      properties:
        total:
          type: number
          description: The total number of requests.
        totalblocked:
          type: number
          description: The total number of blocked requests.
      required:
      - total
      - totalblocked
    ProviderCategoryRequestsByOrganization:
      required:
      - counts
      - organization
      type: object
      description: The information about the provider's category requests by organization.
      properties:
        organization:
          $ref: '#/components/schemas/Organization'
        counts:
          type: array
          items:
            $ref: '#/components/schemas/CategoryRequests'
      example:
        organization:
          id: 232323
          label: Company Name Goes Here
        counts:
        - category:
            id: 66
            label: Malware
            type: security
            integration: true
          requests: 123
          requestsblocked: 34
          numberoforganizationswithcategorizedtraffic: 1
    ProviderCountsByCategory:
      type: object
      description: The information about the provider's categories.
      properties:
        total:
          type: number
          description: The total number of requests.
        totalblocked:
          type: number
          description: The total number of blocked requests.
        numberoforganizationsaffected:
          type: number
          description: The number of organizations with traffic for that category.
      required:
      - numberoforganizationsaffected
      - total
      - totalblocked
    ProviderCountsByDestination:
      type: object
      description: The information about the provider's destinations.
      properties:
        total:
          type: number
          description: The total number of requests.
        totalblocked:
          type: number
          description: The total number of blocked requests.
        numberoforganizationsaffected:
          type: number
          description: The number of organizations with traffic for that category.
      required:
      - numberoforganizationsaffected
      - total
      - totalblocked
    ProviderDeploymentStatus:
      type: object
      description: The information about the provider's deployment status.
      properties:
        identitytype:
          $ref: '#/components/schemas/IdentityType'
        activecount:
          type: number
          description: The number of active identity types.
        count:
          type: number
          description: The total number of identity type.
      required:
      - activecount
      - count
      - identitytype
      example:
        identitytype:
          id: 21
          label: Sites
          name: site
        activecount: 1
        count: 1
    CategoryRequests:
      type: object
      description: The information about categories and requests.
      properties:
        category:
          $ref: '#/components/schemas/Category'
        requests:
          type: number
          description: The number of requests.
        requestsblocked:
          type: number
          description: The number of requests that were blocked.
        numberoforganizationswithcategorizedtraffic:
          type: number
          description: The number of organizations with traffic for that category.
    DataCenter:
      type: object
      description: The information about the data center.
      properties:
        id:
          type: string
          description: The unique ID for the data center.
        label:
          type: string
          description: The name of the data center.
      required:
      - id
      - label
      example:
        id: LAX
        label: Los Angeles, US
    DataLossPreventionState:
      type: object
      description: The information about the Data Loss Prevention state.
      properties:
        state:
          type: string
          description: Indicates the status of the DLP. The state is either `blocked` or the empty string (` `).
          enum:
          - blocked
          - ''
      required:
      - state
      example:
        state: blocked
    DeploymentStatus:
      type: object
      description: The information about the deployment status.
      properties:
        type:
          $ref: '#/components/schemas/IdentityType'
        activecount:
          type: number
          description: The count of the active identity type.
        count:
          type: number
          description: The total count of the identity type.
      required:
      - activecount
      - count
      - type
      example:
        type:
          id: 21
          label: Sites
          name: site
        activecount: 1
        count: 1
    Egress:
      type: object
      description: The information about the egress IP.
      properties:
        ip:
          type: string
          description: The egress IP.
        type:
          type: string
          description: The type of the egress IP.
          example: shared
      required:
      - ip
      - type
      example:
        ip: 155.190.3.8
        type: shared
    TopIP:
      type: object
      description: The information about the top IP addresses.
      properties:
        ip:
          type: string
          description: The comma-delimited list of IP addresses.
        count:
          type: number
          description: The number of requests to the top IP addresses.
      required:
      - count
      - ip
      example:
        ip: 10.0.0.1
        count: 42
    RequestCounts:
      type: object
      description: The information about the requests.
      properties:
        requests:
          type: number
          description: The total number of requests.
        allowedrequests:
          type: number
          description: The number of requests that were allowed.
        blockedrequests:
          type: number
          description: The number of requests that were blocked.
    requests:
      type: number
      description: The total number of requests.
    TopDnsQueryType:
      type: object
      description: The information about the top DNS queries.
      properties:
        requests:
          $ref: '#/components/schemas/requests'
        querytype:
          type: string
          description: The type of the DNS query.
          example: AAAA
      required:
      - querytype
      - requests
      example:
        requests: 123
        querytype: A
    count:
      type: number
      description: The total number of requests.
    TopURL:
      type: object
      description: The information about the top URLs.
      properties:
        count:
          $ref: '#/components/schemas/count'
        path:
          type: string
          description: The URL path.
        categories:
          $ref: '#/components/schemas/categories'
        rank:
          type: number
          description: The numeric rank of the top URL.
      required:
      - categories
      - count
      - path
      - rank
      example:
        count: 123
        path: ''
        categories:
        - id: 66
          label: Malware
          type: security
          integration: true
        rank: 1
    TotalRequest:
      type: object
      description: The total number of requests.
      properties:
        count:
          $ref: '#/components/schemas/count'
      required:
      - count
      example:
        count: 42
    SummaryWithCategory:
      type: object
      description: The properties of the category and summary.
      properties:
        category:
          $ref: '#/components/schemas/Category'
        summary:
          $ref: '#/components/schemas/Summary'
      required:
      - category
      - summary
      example:
        category:
          id: 66
          label: Malware
          type: security
          integration: true
        summary:
          applications: 123
          domains: 82
          requestsblocked: 189
          filetypes: 0
          policycategories: 2
          policyrequests: 2
          requests: 189
          requestsallowed: 10
          categories: 11
          identitytypes: 1
          applicationsblocked: 2
          files: 5
          identities: 1
          applicationsallowed: 2
    SummaryWithDestination:
      type: object
      description: The summary and destination information.
      properties:
        domain:
          type: string
          description: destination domain
        summary:
          $ref: '#/components/schemas/Summary'
      required:
      - domain
      - summary
      example:
        domain: www.google.com
        summary:
          applications: 123
          domains: 82
          requestsblocked: 189
          filetypes: 0
          policycategories: 2
          policyrequests: 2
          requests: 189
          requestsallowed: 10
          categories: 11
          identitytypes: 1
          applicationsblocked: 2
          files: 5
          identities: 1
          applicationsallowed: 2
    SignatureListSummary:
      type: object
      description: The summary information about the signature lists.
      properties:
        signaturelist:
          $ref: '#/components/schemas/SignatureList'
        signatures:
          type: array
          description: The list of information about the signatures.
          items:
            type: object
            properties:
              generatorid:
                type: number
                description: The generator ID of the signature.
              id:
                type: number
                description: The ID of the signature.
              lasteventat:
                type: number
                description: The date and time in milliseconds of the last event.
              counts:
                type: object
                properties:
                  blocked:
                    type: number
                    description: The number of blocked signatures.
                  detected:
                    type: number
                    description: The number of detected signatures.
                  wouldblock:
                    type: number
                    description: The number of signatures to block.
                required:
                - blocked
                - detected
                - wouldblock
        rule:
          $ref: '#/components/schemas/RuleParam'
      example:
        signaturelist:
          id: 1111
        signatures:
        - counts:
            blocked: 0
            detected: 1
            wouldblock: 0
          generatorid: 1
          lasteventat: 1594557262000
          id: 47829
        rule:
          id: 47
    ThreatType:
      type: object
      description: The properties of the threat type.
      properties:
        name:
          type: string
          description: The name of the threat type.
        description:
          type: string
          description: The name of the threat type.
      required:
      - name
      - description
      example:
        name: Ransomware
        description: a description
    ThreatName:
      type: object
      description: The properties of the threat name.
      properties:
        name:
          type: string
          description: The name of the threat.
        description:
          type: string
          description: The description of the threat name.
      required:
      - name
      - description
      example:
        name: WannaCry
        description: a description
    Policy:
      type: object
      description: The properties of the rules in the policy.
      required:
      - destinationlistids
      - ruleid
      - rulesetid
      - timebasedrule
      properties:
        timebasedrule:
          type: boolean
          description: Specify whether the policy triggered a time-of-day rule.
        destinationlistids:
          type: array
          description: The list of destination lists that the rules triggered.
          items:
            type: number
        ruleid:
          type: number
          description: The ID of the rule in the policy.
          nullable: true
        rulesetid:
          type: number
          description: The ID of the ruleset in the policy.
          nullable: true
    HttpError:
      type: object
      description: The properties of the HTTP error.
      properties:
        type:
          type: string
          description: The type of the error, either `CertificateError` or `TLSError`.
          enum:
          - CertificateError
          - TLSError
        code:
          type: number
          description: The HTTP error code.
        reason:
          type: string
          description: The name of the error.
        attributes:
          type: object
          description: The properties of the additional information for the error.
    Isolated:
      type: object
      description: The properties of the isolated file.
      properties:
        state:
          type: string
          description: The state of the isolated file.
        fileaction:
          type: string
          description: The action taken for the file.
      required:
      - state
      - fileaction
      example:
        state: not-isolated
        fileaction: ''
    Meta:
      type: object
      description: The properties of the metadata.
      example: {}
    Signature:
      type: object
      description: The properties of the signature.
      properties:
        generatorid:
          type: number
          description: The unique ID that is assigned to the part of the IPS, which generated the event.
        id:
          type: number
          description: The ID that is used to uniquely identify signatures.
        label:
          type: string
          description: A descriptive label for the the signature.
        cves:
          type: array
          description: The list of common vulnerabilites and exposures (CVEs).
          items:
            $ref: '#/components/schemas/CVE'
      required:
      - generatorid
      - id
      - label
      - cves
      example:
        generatorid: 148
        id: 2
        label: (cip) CIP data is non-conforming to ODVA standard
        cves:
        - cve-2015-0279
    SignatureList:
      type: object
      description: The properties of the signature list.
      properties:
        id:
          type: number
          description: The unique ID assigned to a default or custom signature list.
      required:
      - id
      example:
        id: 1112
    RuleParam:
      type: object
      description: The properties of the rule parameter.
      properties:
        id:
          type: number
          description: The ID of the ruleset for the signature.
          example: 47
    Classification:
      type: string
      description: The category of attack detected by a rule that is part of a more general type of attack class, such as
        trojan-activity, attempted-user, and unknown.
      example: trojan-activity
    CVE:
      type: string
      description: An identifier for a known security vulnerability/exposure.
      example: cve-2015-0279
    Date:
      type: string
      description: The date from the timestamp based on the timezone parameter.
      example: '2020-07-12'
    DestinationIp:
      type: string
      description: The destination IP for the entry.
      example: 12.10.10.10
    DestinationPort:
      type: number
      description: The destination port for entry.
      example: 89
    SessionId:
      type: number
      description: The unique identifier of a session, which is used to group the correlated events between various services.
      example: 7878797
    Severity:
      type: string
      description: The severity level of the rule.
      enum:
      - HIGH
      - MEDIUM
      - LOW
      - VERY LOW
      example: HIGH
    SourceIp:
      type: string
      description: The source IP for the entry.
      example: 10.11.10.10
    SourcePort:
      type: number
      description: The source port for the entry.
      example: 3000
    Time:
      type: string
      description: The time in 24-hour format based on the timezone parameter.
      example: '12:34'
    Timestamp:
      type: number
      description: The timestamp represented in milliseconds.
      example: 1594557263000
    TimestampInSeconds:
      type: number
      description: The timestamp represented in seconds.
      example: 1594557263
    TimestampForBucket:
      type: number
      description: The timestamp represented in milliseconds for the bucket.
      example: 1594557263000
  securitySchemes:
    oauthFlow:
      type: oauth2
      description: client credential flow
      flows:
        clientCredentials:
          tokenUrl: https://api.umbrella.com/auth/v2/token
          scopes:
            reports.granularEvents:read: Read reports granular events
            reports.utilities:read: Read reports utilities
            reports.aggregations:read: Read reports aggregations
            reports.summariesByRule:read: Read reports for the summaries of the rule
            reports.customers:read: Read reports for the customers
  responses:
    400Error:
      description: Bad Request
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            example:
              message: Bad Request
    401Error:
      description: Unauthorized
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            example:
              message: Unauthorized
    403Error:
      description: Forbidden
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            example:
              message: Forbidden
    404Error:
      description: Not Found
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            example:
              message: Not Found
    500Error:
      description: Internal Server Error
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
            example:
              message: Internal Server Error
x-provenance:
  method: harvested
  first_party: true
  harvested: '2026-08-19'
  source: https://pubhub.devnetcloud.com/media/cloud-security-apis-in-eft/docs/reference/reports/reporting.yaml
  publisher: Cisco Systems, Inc. (Cisco DevNet Cloud Security docs)
x-evidence:
  fetched: '2026-08-19'
  url: https://pubhub.devnetcloud.com/media/cloud-security-apis-in-eft/docs/reference/reports/reporting.yaml
  http_status: 200
  docs: https://developer.cisco.com/docs/cloud-security/