openapi: 3.1.0
info:
  title: Cloudsek API
  version: '2026-10-09'
  description: 'GENERATED FROM DOCUMENTATION by API Evangelist on 2026-10-09: 11 operation(s) read from 16 public documentation page(s) (each
    operation names its page in x-source). This is not the provider''s published contract; Cloudsek has published no machine-readable contract
    that the pipeline could find. Engine: local.'
  x-evidence-tiers:
    code-example: 0
    documentation: 11
    pages-with-code: 0
    pages-read: 16
  x-generated-from: documentation
  x-provenance: generated
  x-authored-by: API Evangelist
  x-generated: '2026-10-09'
  x-generator: generate-contract-from-docs.py
  x-engine: local
  x-sources:
  - https://api.cloudsek.com/docs/api/bulk-jobs
  - https://api.cloudsek.com/docs/api/get-alerts
  - https://api.cloudsek.com/docs/api/patch-event
  - https://api.cloudsek.com/docs/api/events-write
  - https://api.cloudsek.com/docs/api/get-alerts-v-2
  - https://api.cloudsek.com/docs/api/patch-incident
  - https://api.cloudsek.com/docs/api/post-event-bulk
  - https://api.cloudsek.com/docs/api/get-event-snapshot
  - https://api.cloudsek.com/docs/api/post-event-comment
  - https://api.cloudsek.com/docs/api/post-incident-bulk
  - https://api.cloudsek.com/docs/api/get-historic-alerts
  - https://api.cloudsek.com/docs/api/patch-event-assignee
  - https://api.cloudsek.com/docs/api/post-event-remediate
  - https://api.cloudsek.com/docs/api/get-incident-snapshot
  - https://api.cloudsek.com/docs/api/post-incident-comment
  - https://api.cloudsek.com/docs/api/get-historic-alerts-v-2
paths:
  /incidents/alerts:
    get:
      operationId: get_incidents_alerts
      tags:
      - Incidents
      summary: Retrieve the latest unprocessed incident alerts for your organization.
      x-source: https://api.cloudsek.com/docs/api/get-alerts
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetIncidentsAlertsResponse'
      x-evidence:
        kind: documentation
  /incidents/historic/alerts:
    get:
      operationId: get_incidents_historic_alerts
      tags:
      - Incidents
      summary: Retrieve historical incident alerts from the last 30 days.
      x-source: https://api.cloudsek.com/docs/api/get-historic-alerts
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetIncidentsHistoricAlertsResponse'
      x-evidence:
        kind: documentation
  /v2/events/{id}/assignee:
    patch:
      operationId: patch_v2_events_id_assignee
      tags:
      - Events
      summary: Reassign an event to a user (by email)
      x-source: https://api.cloudsek.com/docs/api/patch-event-assignee
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchV2EventsIdAssigneeRequest'
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v2/events/{id}/{idid}:
    post:
      operationId: post_v2_events_id_idid
      tags:
      - Events
      summary: Remediate an event (Closed* transition + closure narrative)
      description: 'Triggers the event''s remediation flow: a transition to a Closed* status combined with a comment. Includes the same rescan-redirect
        handling as PATCH /v2/events/{id}. The closure comment is always written. Returns the new comment_id or prior operation_id on identical
        remediation.'
      x-source: https://api.cloudsek.com/docs/api/post-event-remediate
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      - name: idid
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
        collapsed_from: 2 example path(s) differing only at idId
  /v2/incidents/{id}:
    patch:
      operationId: patch_v2_incidents_id
      tags:
      - Incidents
      summary: Update an incident (status / priority / assignee / comment)
      description: 'Applies partial updates to a single incident identified by its Display ID. Idempotent: an identical body against an unchanged
        incident returns a no‑op success.'
      x-source: https://api.cloudsek.com/docs/api/patch-incident
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchV2IncidentsIdRequest'
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PatchV2IncidentsIdResponse'
      x-evidence:
        kind: documentation
  /v2/incidents/alerts:
    get:
      operationId: get_v2_incidents_alerts
      tags:
      - Incidents
      summary: Get live incident alerts with issue metadata (V2)
      x-source: https://api.cloudsek.com/docs/api/get-alerts-v-2
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetV2IncidentsAlertsResponse'
      x-evidence:
        kind: documentation
  /v2/incidents/historic/alerts:
    get:
      operationId: get_v2_incidents_historic_alerts
      tags:
      - Incidents
      summary: Get historic incident alerts with issue metadata (V2)
      description: Retrieve historical incident alerts from the last 30 days with enhanced vulnerability metadata for BeVigil scanner modules.
      x-source: https://api.cloudsek.com/docs/api/get-historic-alerts-v-2
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v2/jobs/{jobid}:
    get:
      operationId: get_v2_jobs_jobid
      tags:
      - Jobs
      summary: Poll a bulk job for state, summary and per-record outcomes
      x-source: https://api.cloudsek.com/docs/api/post-incident-bulk
      parameters:
      - name: jobid
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v2/snapshot/{snapshotid}:
    get:
      operationId: get_v2_snapshot_snapshotid
      tags:
      - Snapshot
      summary: Retrieve a point-in-time snapshot of events for your organization with optional filtering.
      x-source: https://api.cloudsek.com/docs/api/get-event-snapshot
      parameters:
      - name: snapshotid
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
        collapsed_from: 2 example path(s) differing only at snapshotId
  /v2/{v2id}/{id}/comments:
    post:
      operationId: post_v2_v2id_id_comments
      tags:
      - Comments
      summary: Post a comment on an event
      description: Same dedup semantics as incident comments.
      x-source: https://api.cloudsek.com/docs/api/post-event-comment
      parameters:
      - name: v2id
        in: path
        required: true
        schema:
          type: string
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
        collapsed_from: 2 example path(s) differing only at v2Id
  /v2/{v2id}/bulk:
    post:
      operationId: post_v2_v2id_bulk
      tags:
      - Bulk
      summary: Bulk update events (async job)
      description: Bulk analogue of POST /v2/incidents/bulk for events. Selection is by explicit event_record_identifiers list only (max 500 per
        request). Returns 202 with a job_id. Omitting event_record_identifiers (or sending an empty list) is rejected with 400 VALIDATION_ERROR
        naming the missing field.
      x-source: https://api.cloudsek.com/docs/api/post-event-bulk
      parameters:
      - name: v2id
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV2V2IdBulkRequest'
      responses:
        '201':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostV2V2IdBulkResponse'
      x-evidence:
        kind: documentation
        collapsed_from: 2 example path(s) differing only at v2Id
components:
  schemas:
    GetIncidentsAlertsResponse:
      type: object
      properties:
        '200':
          type: string
          description: Successfully retrieved alerts
        '400':
          type: string
          description: Bad Request - Invalid parameters
        '401':
          type: string
          description: Unauthorized - Invalid or missing authentication token
        '429':
          type: string
          description: Too Many Requests - Rate limit exceeded
    GetIncidentsHistoricAlertsResponse:
      type: object
      properties:
        '200':
          type: string
          description: Successfully retrieved historic alerts
        '400':
          type: string
          description: Bad Request
        '401':
          type: string
          description: Unauthorized
        '429':
          type: string
          description: Too Many Requests
    PatchV2EventsIdAssigneeRequest:
      type: object
      properties:
        assignee_email:
          type: string
          description: Email of the user to assign the event to; set to null to unassign.
    PatchV2IncidentsIdRequest:
      type: object
      properties:
        status:
          type: string
          description: client‑facing status label
        priority:
          type: string
          description: P0, P1 or P2 (case‑sensitive exact match)
        assignee_email:
          type: string
          description: email of the new assignee, or null to unassign
        comment:
          type: string
          description: free‑text comment attached to the incident
        external_reference:
          type: string
          description: optional { system, ticket_id, url } passed through to the changelog
    PatchV2IncidentsIdResponse:
      type: object
      properties:
        '200':
          type: string
          description: Update applied. data contains the post‑update incident snapshot.
        '400':
          type: string
          description: Validation failure. See error.code (VALIDATION_ERROR, INVALID_STATUS_TRANSITION, COMMENT_REQUIRED, USER_NOT_FOUND, INVALID_DISPLAY_ID,
            BULK_ACTION_FIELD_MISMATCH, BULK_LIMIT_EXCEEDED).
        '401':
          type: string
          description: 'UNAUTHORIZED: missing or invalid bearer token, or wrong token type for a write route.'
        '403':
          type: string
          description: Access denied. Possible codes are ACCESS_DENIED, TWO_WAY_DISABLED, MODULE_ACCESS_DENIED, INCIDENT_ARCHIVED, org/user inactive,
            or integration configuration inactive.
        '404':
          type: string
          description: Target entity (or job) not found in the token's org tree.
        '429':
          type: string
          description: 'RATE_LIMIT_EXCEEDED: the per‑token budget is exhausted. Retry‑After header indicates wait time.'
        '503':
          type: string
          description: 'INTEGRATION_PLATFORM_UNAVAILABLE or INTEGRATION_AUTH_UNAVAILABLE: transient upstream failure, safe to retry.'
    GetV2IncidentsAlertsResponse:
      type: object
      properties:
        '200':
          type: string
          description: Successfully retrieved alerts with issue metadata
        '400':
          type: string
          description: Bad Request - Invalid parameters
        '401':
          type: string
          description: Unauthorized - Invalid or missing authentication token
        '429':
          type: string
          description: Too Many Requests - Rate limit exceeded
    PostV2V2IdBulkRequest:
      type: object
      properties:
        event_record_identifiers:
          type: array
          description: List of event record identifiers (max 500 per request).
      required:
      - event_record_identifiers
    PostV2V2IdBulkResponse:
      type: object
      properties:
        '202':
          type: string
          description: Job accepted.
        '400':
          type: string
          description: Validation failure. See error.code (VALIDATION_ERROR, INVALID_STATUS_TRANSITION, COMMENT_REQUIRED, USER_NOT_FOUND, INVALID_DISPLAY_ID,
            BULK_ACTION_FIELD_MISMATCH, BULK_LIMIT_EXCEEDED).
        '401':
          type: string
          description: 'UNAUTHORIZED: missing or invalid bearer token, or wrong token type for a write route.'
        '403':
          type: string
          description: Access denied. Possible codes are ACCESS_DENIED, TWO_WAY_DISABLED, MODULE_ACCESS_DENIED, INCIDENT_ARCHIVED, org/user inactive,
            or integration configuration inactive.
        '429':
          type: string
          description: 'RATE_LIMIT_EXCEEDED: the per-token budget is exhausted. Back off per the Retry-After header.'
        '503':
          type: string
          description: 'INTEGRATION_PLATFORM_UNAVAILABLE or INTEGRATION_AUTH_UNAVAILABLE: transient upstream failure, safe to retry.'
  securitySchemes:
    Bearer_token:
      type: http
      scheme: bearer
      x-source: https://api.cloudsek.com/docs/intro/
tags:
- name: Bulk
- name: Comments
- name: Events
- name: Incidents
- name: Jobs
- name: Snapshot
security:
- Bearer_token: []