swagger: '2.0'
info:
title: Huntress API Reference Accounts Reseller API
description: "\n© Huntress - All rights reserved
\nIntroduction
\n\nWebhook event payloads are available via the dropdown menu above the search bar on this page.
\n\nThe Huntress API follows a RESTful pattern. Requests are made via resource-oriented URLs as described in this document and API responses are formatted as JSON data.
\n\nA command-line client is also available for interacting with the API from your terminal. It requires Ruby 3.1+ and has no external dependencies. You can download it from https://api.huntress.io/api/huntress-cli.
\n\nAlternatively, if you'd prefer to use an MCP, we have instructions for setting up the Huntress MCP. Note that the MCP is read-only, so this is a good option if you're looking for a safer way to access your Huntress data from an LLM.
\n\nIf you'd like to request additional API endpoints or capabilities, submit feedback through our feedback portal.
\n\nAPI Overview
\n\n\tAuthentication
\n$KEY = echo \"$HUNTRESS_PUBLIC_KEY:$HUNTRESS_PRIVATE_KEY\" | base64\ncurl \"https://api.huntress.io/v1/agents\" \\ -H \"Authorization: Basic $KEY\"\n
\n
To begin, generate your API Key at <your_account_subdomain>.huntress.io. Once you are logged into your account on the Huntress site, check the dropdown menu at the top-right corner of the site header. You should see API Credentials among the options if your account has been granted access to the Huntress API. Click on the option to continue to the API Key generation page.
\n\nOnce on the API Key generation page, click on the green Setup button to begin the process to generate your API Key. You will be redirected to a page where you will be prompted to generate your API Key. Click the Generate button to generate a public and private key pair for Huntress API access. The inputs on the page will be filled in with your access credentials once you have done so.
\n\nYour API Private Key will only be visible at this stage of API Key generation. Be sure to save the value provided somewhere secure, as once you navigate away from this page, this value will no longer be accessible and you must regenerate your API credentials if your secret key value is lost.
\n\nIf necessary, you can repeat the process to regenerate your API credentials with a new API Key and API Secret Key on the same API Key generation page, at <your_account_subdomain>.huntress.io/account/api_credentials.
\n\nThe Huntress API implements basic access authentication. Once you have your API Key and API Secret Key, provide these values as the result of a Base64 encoded string in every request to the Huntress API via the Authorization header. Your request header should look something like Authorization: Basic [Base64Encode(<your_api_key>:<your_api_secret_key>)]. Please refer to the code snippets for further examples.
\n \n\n\tRate Limits
\nEvery Huntress API account is rate limited to 60 requests per minute, on a sliding window. This means that no more than 60 requests can be made within a 60 second time interval between the first request and the last request.
\n\nFor example, if request 1 is made at T0, request 2 is made at T5, and requests 3 through 60 are made at T10, making request 61 at T55 would result in a 429 error response. Making request 61 at T61 would succeed, however making request 62 at T61 would fail, at least until the time has passed T65, corresponding to a minute after request 2 was made.
\n \n\n\tHTTP Response Codes
\nHuntress follows HTTP standards when delivering responses: a 2xx response is a success, a 4xx response indicates an issue with the client request, and a 5xx response indicates an issue with Huntress servers.\n
\n
\nSpecific error codes are detailed in the following table:
\n\n\n| Error Status Code | \nDetails | \n
\n\n\n| 400 | \nThere is an unexpected value in the API request being made. | \n
\n\n| 401 | \nYour request could not be authenticated. Check that your API key is properly formatted and included in the Authorization header. | \n
\n\n| 404 | \nThe requested resource is unavailable: either it doesn't exist, or your account does not hold correct permissions to access it. | \n
\n\n| 429 | \nYou have made too many requests within the rate limit timeframe. See the previous section on rate_limits for details. | \n
\n\n| 500 | \nAn error has occurred within Huntress servers. You could retry the request, but if you encounter continued errors, please contact Support with details of your error. If all traffic from Huntress is resulting in 500 responses, please check our Huntress Status Page. | \n
\n
\n \n\n\t
\nCertain Huntress API endpoints utilize a page_token and limit parameter to specify a window location and size, respectively, to the resources currently being requested.\n
\nEach API request will also return a pagination object with details about your current pagination state based on the parameters provided. The pagination object contains:
\n\n\n\n| Key | \nType | \nDescription | \n
\n\n\n| next_page_token | \nstring | \nThe token used to request the next page in paginated results. If no page token is included, the first page contains all results. | \n
\n\n| next_page_url | \nstring | \nURL containing the next page and the limit provided in the original API request, to be used to continue sequentially accessing resources. Only displays when another page can be accessed. | \n
\n
\n
\nFollowing is a formatted example of the pagination object in an API response:
\n
\n
\n\"pagination\": {\n \"next_page_url\": \"https://api.huntress.io/v1/agents?page_token=MjAyMi0wMy0wMVQxODo1NDoyNFo&limit=10\",\n \"next_page_token\": \"MjAyMi0wMy0wMVQxODo1NDoyNFo\"\n}
\n
\n\n\t
\n\t\n\t\tRequest
\n\t\n
\ncurl \"https://api.huntress.io/v1/agents?organization_id=1&page_token=MjAyMi0wMy0wMVQxODo1NDoyNFo\" -H \"Authorization: Basic <Your B64 encoded hash>\"
The base URL for API requests is api.huntress.io/v1/, followed by the resource requested. Resources can be requested either singularly or as a list, which correspond to /v1/<resources>/:id or /v1/<resources> respectively, with the exception of the /v1/account and /v1/actor endpoints, which only returns the account associated with the API credentials provided.
\n\tAs an example, api.huntress.io/v1/agents would return a list of agents, while api.huntress.io/v1/agents/1 would return a singular agent with ID: 1.
\n\tParameters are provided to the API through a query string. As an example, providing the organization_id filter as a parameter to the /v1/agents endpoint would look like api.huntress/io/v1/agents?organization_id=1. Accessing a sequential page with the same filter active would look like api.huntress.io/v1/agents?organization_id=1&page_token=MjAyMi0wMy0wMVQxODo1NDoyNFo.
\n\t \n\t\n\t\tResponse
\n\tThe Huntress API responds with a JSON object containing requested resources if the request is valid and authorized.
\n\tSingular Case
\n\t\n\t
{\n \"report\": { ... }\n}\n
In the case of accessing a singular resource, the JSON object in question will contain one key that maps the singular resource to the singular representation of the resource name. As an example, if you were to request api.huntress.io/v1/reports/1, the JSON response would contain a single key report that maps to the report with ID: 1.
\n\tMultiple Case
\n{\n \"reports\": [ ... ],\n \"pagination\": { ... }\n}\n
When accessing a list of resources, the JSON response contains two keys at the root level. The first key is the plural representation of that resource. The second is a pagination key that represents the current state of pagination based on parameters provided in the original request. As an example, a request to api.huntress.io/v1/reports returns a JSON object with the keys reports and pagination at its root level. Further details on the fields within the pagination object can be seen at the relevant section.
\n\t \n \n"
version: 1.0.0
host: api.huntress.io
schemes:
- https
produces:
- application/json
security:
- basic:
- basic_auth
tags:
- name: Reseller
description: Operations for Reseller-level API credentials. These are mostly the same endpoints available in the rest of the API. However, the account ID is included in the URL, so that you can specify which account's resources you want to access.
paths:
/v1/reseller/invoices:
get:
summary: List Reseller Invoices
description: 'Shows Invoices associated with the current reseller.
**Note:** To see the details of a given invoice, you will
probably want to also fetch the associated Account Usage Line Items and
Organization Usage Line Items.
**Note:** This endpoint will also return a `pagination` key on the root
level. Please refer to the [pagination
section](https://api.huntress.io/docs#pagination) within our docs for
more information.
'
produces:
- application/json
parameters:
- in: query
name: limit
description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
type: integer
format: int32
default: 10
minimum: 1
maximum: 500
required: false
- in: query
name: page_token
description: Token used to request the next page in paginated results. Defaults to 'null'
type: string
required: false
- in: query
name: status
description: Filter by status. One of open, paid, failed, partial_refund, full_refund, draft, voided, processing
type: string
enum:
- open
- paid
- failed
- partial_refund
- full_refund
- draft
- voided
- processing
required: false
responses:
'200':
description: List Reseller Invoices
schema:
type: object
properties:
invoices:
type: array
items:
$ref: '#/definitions/Invoice'
pagination:
$ref: '#/definitions/Pagination'
required:
- invoices
- pagination
'400':
description: Invalid query parameters
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Invoice'
tags:
- Reseller
operationId: getV1ResellerInvoices
/v1/reseller/invoices/{id}:
get:
summary: Get Reseller Invoice
description: 'Shows a specific Reseller Invoice associated with the current
reseller.
Note: To see the details of this invoice, you will probably
want to also fetch the associated Account Usage Line Items and
Organization Usage Line Items.
'
produces:
- application/json
parameters:
- in: path
name: id
type: integer
format: int32
required: true
responses:
'200':
description: Get Reseller Invoice
schema:
type: object
properties:
invoice:
$ref: '#/definitions/Invoice'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Invoice'
'404':
description: Invoice not found
tags:
- Reseller
operationId: getV1ResellerInvoicesId
/v1/reseller/invoices/{id}/account_usage_line_items:
get:
summary: List Account Usage Line Items
description: "Shows a list of Account Usage Line Items.\n\nThis list provides a detailed breakdown of product usage per account from a given invoice.\n\n**Note:** This endpoint will also return a `pagination` key on the root level. \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n"
produces:
- application/json
parameters:
- in: path
name: id
type: integer
format: int32
required: true
- in: query
name: limit
description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
type: integer
format: int32
default: 10
minimum: 1
maximum: 500
required: false
- in: query
name: page_token
description: Token used to request the next page in paginated results. Defaults to 'null'
type: string
required: false
responses:
'200':
description: List Account Usage Line Items
schema:
type: object
properties:
account_usage_line_items:
type: array
items:
$ref: '#/definitions/AccountUsageLineItem'
pagination:
$ref: '#/definitions/Pagination'
required:
- account_usage_line_items
- pagination
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/AccountUsageLineItem'
tags:
- Reseller
operationId: getV1ResellerInvoicesIdAccountUsageLineItems
/v1/reseller/invoices/{id}/organization_usage_line_items:
get:
summary: List Organization Usage Line Items
description: "Shows a list of Organization Usage Line Items.\n\nThis list provides a detailed breakdown of product usage per organization from a given invoice.\n\n**Note:** This endpoint will also return a `pagination` key on the root level. \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n"
produces:
- application/json
parameters:
- in: path
name: id
type: integer
format: int32
required: true
- in: query
name: limit
description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
type: integer
format: int32
default: 10
minimum: 1
maximum: 500
required: false
- in: query
name: page_token
description: Token used to request the next page in paginated results. Defaults to 'null'
type: string
required: false
responses:
'200':
description: List Organization Usage Line Items
schema:
type: object
properties:
organization_usage_line_items:
type: array
items:
$ref: '#/definitions/OrganizationUsageLineItem'
pagination:
$ref: '#/definitions/Pagination'
required:
- organization_usage_line_items
- pagination
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/OrganizationUsageLineItem'
tags:
- Reseller
operationId: getV1ResellerInvoicesIdOrganizationUsageLineItems
/v1/reseller/subscriptions:
get:
summary: List Reseller Subscriptions
description: 'Shows subscriptions associated with the current reseller''s managed accounts.
**Note:** This endpoint will also return a `pagination` key on the root
level. Please refer to the [pagination
section](https://api.huntress.io/docs#pagination) within our docs for
more information.
'
produces:
- application/json
parameters:
- in: query
name: limit
description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
type: integer
format: int32
default: 10
minimum: 1
maximum: 500
required: false
- in: query
name: page_token
description: Token used to request the next page in paginated results. Defaults to 'null'
type: string
required: false
- in: query
name: sort_field
description: Field to sort by. Defaults to 'id'.
type: string
default: id
enum:
- id
- status
- minimum
- created_at
- updated_at
required: false
- in: query
name: sort_direction
description: Sort direction. Defaults to 'desc'.
type: string
default: desc
enum:
- asc
- desc
required: false
- in: query
name: product
description: Filter by product type
type: string
enum:
- edr
- ispm
- itdr
- sat
- siem
required: false
- in: query
name: status
description: Filter by status
type: string
enum:
- draft
- approved
- accepted
- active
- completed
required: false
responses:
'200':
description: List Reseller Subscriptions
schema:
type: object
properties:
subscriptions:
type: array
items:
$ref: '#/definitions/Subscription'
pagination:
$ref: '#/definitions/Pagination'
required:
- subscriptions
- pagination
'400':
description: Invalid query parameters
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Subscription'
tags:
- Reseller
operationId: getV1ResellerSubscriptions
post:
summary: Create Reseller Subscription
description: 'Creates a subscription for a product on a reseller-managed account.
**Note:** This endpoint only allows the creation of subscriptions that
use the default terms, conditions, and pricing. Please contact your
account admin for any terms that are not covered by our standard API.
'
produces:
- application/json
consumes:
- application/json
parameters:
- name: SubscriptionCreationParameters
in: body
required: true
schema:
$ref: '#/definitions/SubscriptionCreationParameters'
responses:
'201':
description: Create Reseller Subscription
schema:
type: object
properties:
subscription:
$ref: '#/definitions/Subscription'
'400':
description: Invalid parameters
'404':
description: Record not found (likely the account)
'422':
description: Could not create subscription
tags:
- Reseller
operationId: SubscriptionCreationParameters
/v1/reseller/subscriptions/{id}:
get:
summary: Get Reseller Subscription
description: Shows details on a single subscription associated with the current reseller's managed accounts.
produces:
- application/json
parameters:
- in: path
name: id
type: integer
format: int32
required: true
responses:
'200':
description: Get Reseller Subscription
schema:
type: object
properties:
subscription:
$ref: '#/definitions/Subscription'
'400':
description: Something about the request is malformed.
'404':
description: Record not found.
tags:
- Reseller
operationId: getV1ResellerSubscriptionsId
patch:
summary: Update Reseller Subscription
description: 'Updates a subscription associated with the current reseller''s managed accounts.
For **approved** subscriptions: updates minimum, billing_interval, and purchase_order.
For **active** subscriptions: toggles `auto_renew` and/or adds units via `additional_units` (with optional `purchase_order`).
'
produces:
- application/json
consumes:
- application/json
parameters:
- in: path
name: id
type: integer
format: int32
required: true
- name: SubscriptionUpdateParameters
in: body
required: true
schema:
$ref: '#/definitions/SubscriptionUpdateParameters'
responses:
'200':
description: Update Reseller Subscription
schema:
type: object
properties:
subscription:
$ref: '#/definitions/Subscription'
'400':
description: Something about the request is malformed.
'404':
description: Record not found.
'409':
description: Subscription is not in a valid status for this update.
'422':
description: Could not update subscription.
tags:
- Reseller
operationId: SubscriptionUpdateParameters
/v1/reseller/subscriptions/{id}/upgrade:
post:
summary: Upgrade Reseller Subscription
description: 'Upgrades an active subscription by creating a new subscription with a
higher minimum and/or price tier, replacing the existing one.
This is modeled as a sub-resource because the operation creates a new
subscription record rather than modifying the existing one in place.
'
produces:
- application/json
consumes:
- application/json
parameters:
- in: path
name: id
type: integer
format: int32
required: true
- name: SubscriptionUpgradeParameters
in: body
required: true
schema:
$ref: '#/definitions/SubscriptionUpgradeParameters'
responses:
'201':
description: Upgrade Reseller Subscription
schema:
type: object
properties:
subscription:
$ref: '#/definitions/Subscription'
'400':
description: Something about the request is malformed.
'404':
description: Record not found.
'422':
description: Could not upgrade subscription.
tags:
- Reseller
operationId: SubscriptionUpgradeParameters
/v1/accounts:
get:
summary: List Accounts
description: "Shows all accounts associated with your API credentials.\n\n**Note:** This endpoint will also return a `pagination` key on the root level. \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n"
produces:
- application/json
parameters:
- in: query
name: limit
description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
type: integer
format: int32
default: 10
minimum: 1
maximum: 500
required: false
- in: query
name: page_token
description: Token used to request the next page in paginated results. Defaults to 'null'
type: string
required: false
- in: query
name: sort_field
description: Field to sort by. Defaults to 'id'.
type: string
default: id
enum:
- id
- name
- subdomain
- created_at
- updated_at
required: false
- in: query
name: sort_direction
description: Sort direction. Defaults to 'desc'.
type: string
default: desc
enum:
- asc
- desc
required: false
- in: query
name: status
description: Filter by status.
type: string
enum:
- enabled
- disabled
required: false
- in: query
name: name
description: Filter by account name.
type: string
required: false
- in: query
name: subdomain
description: Filter by subdomain.
type: string
required: false
responses:
'200':
description: List Accounts
schema:
type: object
properties:
accounts:
type: array
items:
$ref: '#/definitions/Account'
pagination:
$ref: '#/definitions/Pagination'
required:
- accounts
- pagination
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Account'
tags:
- Reseller
operationId: getV1Accounts
post:
summary: Create Account
description: Create a new account under the reseller associated with the supplied API credential.
produces:
- application/json
consumes:
- application/json
parameters:
- name: AccountCreationParameters
in: body
required: true
schema:
$ref: '#/definitions/AccountCreationParameters'
responses:
'201':
description: Create Account
schema:
type: object
properties:
account:
$ref: '#/definitions/Account'
'400':
description: Invalid account creation parameters
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Account'
'409':
description: Something about the state of this reseller prevents this account from being created
'422':
description: Could not create account
tags:
- Reseller
operationId: AccountCreationParameters
/v1/accounts/{account_id}:
get:
summary: Get Specific Account
description: Shows the details of a specific account which your API credentials grant access to.
produces:
- application/json
parameters:
- in: path
name: account_id
description: Account ID for an account associated with your API credentials
type: integer
format: int32
required: true
responses:
'200':
description: Get Specific Account
schema:
type: object
properties:
account:
$ref: '#/definitions/Account'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Account'
tags:
- Reseller
operationId: getV1AccountsAccountId
patch:
summary: Update Account
description: Updates the details of a specific account.
produces:
- application/json
consumes:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- name: AccountUpdateParameters
in: body
required: true
schema:
$ref: '#/definitions/AccountUpdateParameters'
responses:
'200':
description: Update Account
schema:
type: object
properties:
account:
$ref: '#/definitions/Account'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Account'
'422':
description: Invalid parameters or unable to update model
tags:
- Reseller
operationId: AccountUpdateParameters
delete:
summary: Permanently Disable an Account
description: "Marks the account as disabled and will be deleted after 10 days from initial request.\n\n**Please Note:** This is irreversible and will uninstall all of the agents for this account, as well as completing other similar operations. \n[Contact support](https://support.huntress.io/hc/en-us) if this was done unintentionally.\n"
produces:
- application/json
parameters:
- in: path
name: account_id
description: Account ID for deletion.
type: integer
format: int32
required: true
responses:
'202':
description: Permanently Disable an Account
schema:
type: object
properties:
account:
$ref: '#/definitions/Account'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Account'
'422':
description: Account failed to be disabled.
tags:
- Reseller
operationId: deleteV1AccountsAccountId
/v1/accounts/{account_id}/agents:
get:
summary: List Agents
description: "Shows Agents associated with your account.\n\n**Note:** This endpoint will also return a `pagination` key on the root level. \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n"
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: query
name: limit
description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
type: integer
format: int32
default: 10
minimum: 1
maximum: 500
required: false
- in: query
name: page_token
description: Token used to request the next page in paginated results. Defaults to 'null'
type: string
required: false
- in: query
name: sort_field
description: Field to sort by. Defaults to 'id'.
type: string
default: id
enum:
- id
- created_at
- updated_at
required: false
- in: query
name: sort_direction
description: Sort direction. Defaults to 'desc'.
type: string
default: desc
enum:
- asc
- desc
required: false
- in: query
name: organization_id
description: Filter by organization ID within Huntress account
type: integer
format: int32
required: false
- in: query
name: platform
description: Filter by platform. One of windows, darwin, linux
type: string
enum:
- windows
- darwin
- linux
required: false
- in: query
name: hostname
description: Filter by hostname.
type: string
required: false
- in: query
name: os
description: Filter by operating system.
type: string
required: false
- in: query
name: version
description: Filter by agent version.
type: string
required: false
responses:
'200':
description: List Agents
schema:
type: object
properties:
agents:
type: array
items:
$ref: '#/definitions/Agent'
pagination:
$ref: '#/definitions/Pagination'
required:
- agents
- pagination
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Agent'
tags:
- Reseller
operationId: getV1AccountsAccountIdAgents
/v1/accounts/{account_id}/agents/{id}:
get:
summary: Get Agent
description: Shows details on a single Agent associated with your account.
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
type: integer
format: int32
required: true
responses:
'200':
description: Get Agent
schema:
type: object
properties:
agent:
$ref: '#/definitions/Agent'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Agent'
tags:
- Reseller
operationId: getV1AccountsAccountIdAgentsId
patch:
summary: Update Agent
description: 'Updates the editable attributes of a single Agent.
**Note that the default account API key is read-only, so you''ll need to create a
user-based API key with the appropriate permissions to access this endpoint.**
'
produces:
- application/json
consumes:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
type: integer
format: int32
required: true
- name: UpdateAgent
in: body
required: true
schema:
$ref: '#/definitions/UpdateAgent'
responses:
'200':
description: Update Agent
schema:
type: object
properties:
agent:
$ref: '#/definitions/Agent'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Agent'
'404':
description: Agent not found.
schema:
$ref: '#/definitions/Agent'
'409':
description: Agent does not support tamper protection.
schema:
$ref: '#/definitions/Agent'
tags:
- Reseller
operationId: UpdateAgent
delete:
summary: Uninstall Agent
description: 'Schedules a remote uninstall of a single Agent, removing the Huntress agent
from the host. Uninstall is asynchronous: the host is tasked to uninstall on
its next callback, and the Agent is immediately removed from your account, so
subsequent requests for it return 404.
This endpoint requires an API key with permission to uninstall agents.
**Note that the default account API key is read-only, so you''ll need to create a
user-based API key with the appropriate permissions to access this endpoint.**
'
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
type: integer
format: int32
required: true
responses:
'204':
description: Agent scheduled for uninstall.
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Agent'
'404':
description: Agent not found.
schema:
$ref: '#/definitions/Agent'
tags:
- Reseller
operationId: UninstallAgent
/v1/accounts/{account_id}/agents/{id}/isolation:
post:
summary: Isolate Agent
description: 'Schedules host isolation for a single Agent, cutting the host off from the
network while leaving Huntress connectivity intact. Isolation is asynchronous:
a successful request returns the Agent with a `firewall_status` of
"Pending Isolation" until the endpoint confirms isolation.
This endpoint requires an API key with permission to isolate agents.
**Note that the default account API key is read-only, so you''ll need to create a
user-based API key with the appropriate permissions to access this endpoint.**
'
produces:
- application/json
consumes:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
type: integer
format: int32
required: true
- name: IsolateAgent
in: body
required: true
schema:
$ref: '#/definitions/IsolateAgent'
responses:
'201':
description: Isolate Agent
schema:
type: object
properties:
agent:
$ref: '#/definitions/Agent'
'403':
description: There was an issue with your API credential or permissions.
'404':
description: Agent not found.
'409':
description: Agent does not support host isolation, or isolation could not be scheduled.
tags:
- Reseller
operationId: IsolateAgent
delete:
summary: Release Agent Isolation
description: 'Schedules release of host isolation for a single Agent, restoring the host''s
network connectivity. Release is asynchronous: a successful request returns the
Agent with a `firewall_status` of "Pending Release" until the endpoint confirms
the host is back online.
This endpoint requires an API key with permission to release agents.
**Note that the default account API key is read-only, so you''ll need to create a
user-based API key with the appropriate permissions to access this endpoint.**
'
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
type: integer
format: int32
required: true
responses:
'204':
description: There was an issue with your API credential or permissions.
'404':
description: Agent not found.
'409':
description: Agent does not support host isolation, or release could not be scheduled.
tags:
- Reseller
operationId: ReleaseAgent
/v1/accounts/{account_id}/external_ports:
get:
summary: List External Ports
description: Shows external port records from External Recon scans associated with your account.
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: query
name: limit
description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
type: integer
format: int32
default: 10
minimum: 1
maximum: 500
required: false
- in: query
name: page_token
description: Token used to request the next page in paginated results. Defaults to 'null'
type: string
required: false
- in: query
name: sort_field
description: Field to sort by. Defaults to 'id'.
type: string
default: id
enum:
- id
- port
- protocol
- created_at
- updated_at
required: false
- in: query
name: sort_direction
description: Sort direction. Defaults to 'desc'.
type: string
default: desc
enum:
- asc
- desc
required: false
- in: query
name: organization_id
description: Filter by organization ID within Huntress account
type: integer
format: int32
required: false
- in: query
name: protocol
description: Filter by protocol.
type: string
enum:
- TCP
- UDP
required: false
- in: query
name: port
description: Filter by port number.
type: integer
format: int32
required: false
- in: query
name: risky_service
description: Filter by whether the detected service is considered risky.
type: boolean
required: false
- in: query
name: service
description: Filter by the detected service name (lowercase Shodan module name, e.g. 'ssh', 'http', 'rdp').
type: string
required: false
responses:
'200':
description: List External Ports
schema:
type: object
properties:
external_ports:
type: array
items:
$ref: '#/definitions/ExternalPort'
pagination:
$ref: '#/definitions/Pagination'
required:
- external_ports
- pagination
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/ExternalPort'
tags:
- Reseller
operationId: getV1AccountsAccountIdExternalPorts
/v1/accounts/{account_id}/external_ports/{id}:
get:
summary: Get External Port
description: Shows details on a single external port record associated with your account.
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
description: External port record ID
type: integer
format: int32
required: true
responses:
'200':
description: Get External Port
schema:
type: object
properties:
external_port:
$ref: '#/definitions/ExternalPort'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/ExternalPort'
tags:
- Reseller
operationId: getV1AccountsAccountIdExternalPortsId
/v1/accounts/{account_id}/invoices:
get:
summary: List Account Invoices
description: "Shows Invoices associated with your account.\n\n**Note:** This endpoint will also return a `pagination` key on the root level. \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n"
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: query
name: limit
description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
type: integer
format: int32
default: 10
minimum: 1
maximum: 500
required: false
- in: query
name: page_token
description: Token used to request the next page in paginated results. Defaults to 'null'
type: string
required: false
- in: query
name: sort_field
description: Field to sort by. Defaults to 'id'.
type: string
default: id
enum:
- id
- created_at
- updated_at
- status
required: false
- in: query
name: sort_direction
description: Sort direction. Defaults to 'desc'.
type: string
default: desc
enum:
- asc
- desc
required: false
- in: query
name: status
description: Filter by status. One of open, paid, failed, partial_refund, full_refund, draft, voided, processing
type: string
enum:
- open
- paid
- failed
- partial_refund
- full_refund
- draft
- voided
- processing
required: false
- in: query
name: has_usage
description: When true, returns only invoices with usage (subscription-cycle invoices). When false, returns only invoices without usage (manually-created invoices).
type: boolean
required: false
responses:
'200':
description: List Account Invoices
schema:
type: object
properties:
invoices:
type: array
items:
$ref: '#/definitions/Invoice'
pagination:
$ref: '#/definitions/Pagination'
required:
- invoices
- pagination
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Invoice'
tags:
- Reseller
operationId: getV1AccountsAccountIdInvoices
/v1/accounts/{account_id}/invoices/{id}:
get:
summary: Get Account Invoice
description: Shows details on a single Invoice associated with your account.
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
description: Invoice ID within Huntress account
type: integer
format: int32
required: true
responses:
'200':
description: Get Account Invoice
schema:
type: object
properties:
invoice:
$ref: '#/definitions/Invoice'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Invoice'
tags:
- Reseller
operationId: getV1AccountsAccountIdInvoicesId
/v1/accounts/{account_id}/incident_reports:
get:
summary: List Incident Reports
description: "Shows Incident Reports associated with your account.\n\n**Note:** This endpoint will also return a `pagination` key on the root level. \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n"
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: query
name: limit
description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
type: integer
format: int32
default: 10
minimum: 1
maximum: 500
required: false
- in: query
name: page_token
description: Token used to request the next page in paginated results. Defaults to 'null'
type: string
required: false
- in: query
name: sort_field
description: Field to sort by. Defaults to 'id'.
type: string
default: id
enum:
- id
- created_at
- updated_at
required: false
- in: query
name: sort_direction
description: Sort direction. Defaults to 'desc'.
type: string
default: desc
enum:
- asc
- desc
required: false
- in: query
name: indicator_type
description: Filter by indicator type. One of footholds, monitored_files, ransomware_canaries, antivirus_detections, process_detections, managed_identity, mde_detections, siem_detections, favicon_detections, behavioral_detections, email_security_detections, app_control, ai_misuse
type: string
enum:
- footholds
- monitored_files
- ransomware_canaries
- antivirus_detections
- process_detections
- managed_identity
- mde_detections
- siem_detections
- favicon_detections
- behavioral_detections
- email_security_detections
- app_control
- ai_misuse
required: false
- in: query
name: status
description: Filter by status. One of sent, closed, dismissed, auto_remediating, deleting, partner_dismissed
type: string
enum:
- sent
- closed
- dismissed
- auto_remediating
- deleting
- partner_dismissed
required: false
- in: query
name: severity
description: Filter by severity. One of low, high, critical
type: string
enum:
- low
- high
- critical
required: false
- in: query
name: platform
description: Filter by platform. One of windows, darwin, microsoft_365, google, linux, email_security, other
type: string
enum:
- windows
- darwin
- microsoft_365
- google
- linux
- email_security
- other
required: false
- in: query
name: organization_id
description: Filter by organization ID within Huntress account
type: integer
format: int32
required: false
- in: query
name: agent_id
description: Filter by agent ID within Huntress account
type: integer
format: int32
required: false
responses:
'200':
description: List Incident Reports
schema:
type: object
properties:
incident_reports:
type: array
items:
$ref: '#/definitions/IncidentReport'
pagination:
$ref: '#/definitions/Pagination'
required:
- incident_reports
- pagination
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/IncidentReport'
tags:
- Reseller
operationId: getV1AccountsAccountIdIncidentReports
/v1/accounts/{account_id}/incident_reports/{id}:
get:
summary: Get Incident Report
description: Shows details on a single Incident Report associated with your account.
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
description: Incident Report ID within Huntress account
type: integer
format: int32
required: true
responses:
'200':
description: Get Incident Report
schema:
type: object
properties:
incident_report:
$ref: '#/definitions/IncidentReport'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/IncidentReport'
tags:
- Reseller
operationId: getV1AccountsAccountIdIncidentReportsId
/v1/accounts/{account_id}/incident_reports/{id}/resolution:
post:
summary: Create an Incident Report Resolution
description: 'Use this endpoint to resolve a single Incident Report. All remediations belonging to the Incident Report must be approved first.
While resolution updates the report status to resolved, assisted remediations may still be running in the background and manual remediations may still require completion by a user.
This endpoint requires an API key with permissions to resolve incident reports. **Note that the default account API key is read-only, so you''ll need to create a user-based API key with the appropriate permissions to access this endpoint**.
'
produces:
- application/json
consumes:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
type: integer
format: int32
required: true
responses:
'201':
description: Create an Incident Report Resolution
schema:
type: object
properties:
incident_report:
$ref: '#/definitions/IncidentReport'
'403':
description: There was an issue with your API credential or permissions.
'409':
description: Incident Report cannot be resolved. Confirm that all remediations are approved and report status is 'sent'.
'422':
description: Incident Report cannot be resolved unless report status is 'sent'.
tags:
- Reseller
operationId: postV1AccountsAccountIdIncidentReportsIdResolution
/v1/accounts/{account_id}/memberships:
get:
summary: List Memberships
description: "Shows a list of memberships.\n\nBy default, this endpoint returns both account and organization\nmemberships, but if an organization ID is supplied, it will return\nonly organization memberships, instead.\n\nThe example return value shows both an organization and an account, but\na given membership will only have one or the other.\n\n**Note:** This endpoint will also return a `pagination` key on the root level. \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n"
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: query
name: limit
description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
type: integer
format: int32
default: 10
minimum: 1
maximum: 500
required: false
- in: query
name: page_token
description: Token used to request the next page in paginated results. Defaults to 'null'
type: string
required: false
- in: query
name: sort_field
description: Field to sort by. Defaults to 'id'.
type: string
default: id
enum:
- id
- user_id
- created_at
- updated_at
required: false
- in: query
name: sort_direction
description: Sort direction. Defaults to 'desc'.
type: string
default: desc
enum:
- asc
- desc
required: false
- in: query
name: organization_id
description: Filter by organization ID to return only memberships for that organization.
type: integer
format: int32
required: false
- in: query
name: user_id
description: Filter by user ID to return only memberships for that user.
type: integer
format: int32
required: false
- in: query
name: permissions
description: Filter by permission label.
type: string
enum:
- Admin
- Security Engineer
- User
- Read-only
- Finance
- Marketing
- Provisioner
required: false
responses:
'200':
description: List Memberships
schema:
type: object
properties:
memberships:
type: array
items:
$ref: '#/definitions/Membership'
pagination:
$ref: '#/definitions/Pagination'
required:
- memberships
- pagination
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Membership'
tags:
- Reseller
operationId: getV1AccountsAccountIdMemberships
post:
summary: Create a Membership
description: 'This endpoint allows you to invite a user to join your organization or
account. A user will often be a person you wish to grant access to,
but it could also represent a team, an automated system, or any other
type of actor.
If an organization ID is provided, the user will be invited to that
organization. If not, they will be invited to the account associated
with this API credential. Note that while the sample return value
includes both an organization and an account for completeness, in
practice, only one or the other will be included.
Note that this is technically creating a Membership Invitation - the
actual membership won''t be created until the user accepts the
invitation.
'
produces:
- application/json
consumes:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- name: MembershipCreationParameters
in: body
required: true
schema:
$ref: '#/definitions/MembershipCreationParameters'
responses:
'201':
description: Create a Membership
schema:
type: object
properties:
member_invitation:
$ref: '#/definitions/MemberInvitation'
'400':
description: Something about the request is malformed.
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Membership'
'404':
description: Organization not found.
'422':
description: Invalid creation parameters.
tags:
- Reseller
operationId: MembershipCreationParameters
/v1/accounts/{account_id}/memberships/{id}:
get:
summary: Get Membership
description: Shows details on a single Membership associated with your account or organization.
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
description: Membership ID within Huntress account
type: integer
format: int32
required: true
responses:
'200':
description: Get Membership
schema:
type: object
properties:
membership:
$ref: '#/definitions/Membership'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Membership'
tags:
- Reseller
operationId: getV1AccountsAccountIdMembershipsId
delete:
summary: Delete Membership
description: Deletes a single Membership associated with your account or organization. Does not delete the user associated with the membership.
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
description: Membership ID within Huntress account
type: integer
format: int32
required: true
responses:
'202':
description: Membership deleted
schema:
type: object
properties:
membership:
$ref: '#/definitions/Membership'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Membership'
'404':
description: Membership not found, possibly because it has already been deleted.
'422':
description: Failed to delete membership. Please contact support.
tags:
- Reseller
operationId: deleteV1AccountsAccountIdMembershipsId
patch:
summary: Update a User's membership
description: ''
produces:
- application/json
consumes:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
description: Membership ID within Huntress account
type: integer
format: int32
required: true
- name: MembershipUpdateParameters
in: body
required: true
schema:
$ref: '#/definitions/MembershipUpdateParameters'
responses:
'200':
description: Update a User's membership
schema:
type: object
properties:
membership:
$ref: '#/definitions/Membership'
'400':
description: Something about the request is malformed.
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Membership'
'422':
description: Something prevented the update.
tags:
- Reseller
operationId: MembershipUpdateParameters
/v1/accounts/{account_id}/organizations:
get:
summary: List Organizations
description: "Shows details of Organizations belonging to the account associated with your API credentials.\n\n**Note:** This endpoint will also return a `pagination` key on the root level. \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n"
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: query
name: limit
description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
type: integer
format: int32
default: 10
minimum: 1
maximum: 500
required: false
- in: query
name: page_token
description: Token used to request the next page in paginated results. Defaults to 'null'
type: string
required: false
- in: query
name: sort_field
description: Field to sort by. Defaults to 'id'.
type: string
default: id
enum:
- id
- created_at
- updated_at
- name
- key
required: false
- in: query
name: sort_direction
description: Sort direction. Defaults to 'desc'.
type: string
default: desc
enum:
- asc
- desc
required: false
- in: query
name: name
description: Filter by organization name.
type: string
required: false
- in: query
name: key
description: Filter by organization key.
type: string
required: false
responses:
'200':
description: List Organizations
schema:
type: object
properties:
organizations:
type: array
items:
$ref: '#/definitions/Organization'
pagination:
$ref: '#/definitions/Pagination'
required:
- organizations
- pagination
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Organization'
tags:
- Reseller
operationId: getV1AccountsAccountIdOrganizations
post:
summary: Create an Organization
description: ''
produces:
- application/json
consumes:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- name: OrganizationCreationParameters
in: body
required: true
schema:
$ref: '#/definitions/OrganizationCreationParameters'
responses:
'201':
description: Create an Organization
schema:
type: object
properties:
organization:
$ref: '#/definitions/Organization'
'400':
description: Something about the request is malformed.
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Organization'
'422':
description: Invalid creation parameters.
tags:
- Reseller
operationId: OrganizationCreationParameters
/v1/accounts/{account_id}/organizations/{id}:
get:
summary: Get Organization
description: Shows details on a single Organization associated with your account.
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
description: Organization ID within Huntress account
type: integer
format: int32
required: true
responses:
'200':
description: Get Organization
schema:
type: object
properties:
organization:
$ref: '#/definitions/OrganizationWithActualProductUsages'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Organization'
tags:
- Reseller
operationId: getV1AccountsAccountIdOrganizationsId
patch:
summary: Update an Organization
description: ''
produces:
- application/json
consumes:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
type: integer
format: int32
required: true
- name: OrganizationUpdateParameters
in: body
required: true
schema:
$ref: '#/definitions/OrganizationUpdateParameters'
responses:
'200':
description: Update an Organization
schema:
type: object
properties:
organization:
$ref: '#/definitions/Organization'
'400':
description: Something about the request is malformed.
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Organization'
'422':
description: Invalid update parameters.
tags:
- Reseller
operationId: OrganizationUpdateParameters
delete:
summary: Delete an Organization
description: 'Deletes the specified Organization.
**Please note:** This will remove the organization and associated configurations across the Huntress Platform, including Managed SAT. For more information, see our [offboarding guide](https://support.huntress.io/hc/en-us/articles/51332785737235-Huntress-Product-Offboarding-Guide).
'
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
description: The id of the organization to be deleted
type: integer
format: int32
required: true
responses:
'202':
description: Organization deleted
schema:
type: object
properties:
organization:
$ref: '#/definitions/Organization'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Organization'
'404':
description: Organization not found, possibly because it has already been deleted.
'409':
description: There is a conflict about the organization that prevents deletion. See error message for more details.
'422':
description: Failed to delete organization. Please contact support.
tags:
- Reseller
operationId: deleteV1AccountsAccountIdOrganizationsId
/v1/accounts/{account_id}/incident_reports/{incident_report_id}/remediations:
get:
summary: List Remediations
description: "Shows details of Remediations belonging to a single Incident Report.\n\n**Note:** This endpoint will also return a `pagination` key on the root level. \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n"
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: incident_report_id
type: integer
format: int32
required: true
- in: query
name: limit
description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
type: integer
format: int32
default: 10
minimum: 1
maximum: 500
required: false
- in: query
name: page_token
description: Token used to request the next page in paginated results. Defaults to 'null'
type: string
required: false
- in: query
name: sort_field
description: Field to sort by. Defaults to 'id'.
type: string
default: id
enum:
- id
- created_at
- updated_at
required: false
- in: query
name: sort_direction
description: Sort direction. Defaults to 'desc'.
type: string
default: desc
enum:
- asc
- desc
required: false
- in: query
name: types[]
description: 'Filter by type of remediation. Must be a comma-separated string containing the values: assisted, manual, containment'
type: array
items:
type: string
enum:
- assisted
- manual
- containment
required: false
- in: query
name: statuses[]
description: 'Filter by status of remediation. Must be a comma-separated string containing the values: unapproved, approved, completed, failed, cancelled'
type: array
items:
type: string
enum:
- unapproved
- approved
- completed
- failed
- cancelled
required: false
responses:
'200':
description: List Remediations
schema:
type: object
properties:
remediations:
type: array
items:
$ref: '#/definitions/Remediation'
pagination:
$ref: '#/definitions/Pagination'
required:
- remediations
- pagination
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Remediation'
tags:
- Reseller
operationId: getV1AccountsAccountIdIncidentReportsIncidentReportIdRemediations
/v1/accounts/{account_id}/incident_reports/{incident_report_id}/remediations/{remediation_id}:
get:
summary: Get Remediation
description: Shows details for a single Remediation belonging to a single Incident Report
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: incident_report_id
type: integer
format: int32
required: true
- in: path
name: remediation_id
description: Incident Report ID
type: integer
format: int32
required: true
responses:
'200':
description: Get Remediation
schema:
type: object
properties:
remediation:
$ref: '#/definitions/Remediation'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Remediation'
tags:
- Reseller
operationId: getV1AccountsAccountIdIncidentReportsIncidentReportIdRemediationsRemediationId
/v1/accounts/{account_id}/incident_reports/{incident_report_id}/remediations/bulk_approval:
post:
summary: Bulk Approve Remediations
description: 'Approve all unapproved remediations for an Incident Report. Approval immediately triggers the execution of assisted remediations.
Manual remediations are not executed, and must be independently completed. Once all remediations are approved,
the incident report becomes eligible for resolution.
This endpoint requires an API key with permissions to write to remediations. **Note that the default account API key is read-only, so you''ll need to create a user-based API key with the appropriate permissions to access this endpoint**.
'
produces:
- application/json
consumes:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: incident_report_id
type: integer
format: int32
required: true
responses:
'201':
description: Bulk Approve Remediations
schema:
type: object
properties:
incident_report:
$ref: '#/definitions/IncidentReport'
'403':
description: There was an issue with your API credential or permissions.
'409':
description: Incident Report must have a status of 'sent'.
'422':
description: Unable to approve remediations
tags:
- Reseller
operationId: postV1AccountsAccountIdIncidentReportsIncidentReportIdRemediationsBulkApproval
/v1/accounts/{account_id}/incident_reports/{incident_report_id}/remediations/bulk_rejection:
post:
summary: Bulk Reject Remediations
description: 'Reject all unapproved remediations for an Incident Report. Rejecting the remediations will send the incident report back to the Huntress SOC.
This endpoint requires an API key with permissions to write to remediations. **Note that the default account API key is read-only, so you''ll need to create a user-based API key with the appropriate permissions to access this endpoint**.
'
produces:
- application/json
consumes:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: incident_report_id
type: integer
format: int32
required: true
- name: RemediationBulkRejectionParameters
in: body
required: true
schema:
$ref: '#/definitions/RemediationBulkRejectionParameters'
responses:
'201':
description: Remediations rejected.
'403':
description: There was an issue with your API credential or permissions.
'409':
description: Incident Report must have a status of 'sent'.
'422':
description: Unable to reject remediations
tags:
- Reseller
operationId: RemediationBulkRejectionParameters
/v1/accounts/{account_id}/reports:
get:
summary: List Summary Reports
description: "Shows Summary Reports associated with your account.\n\n**Note:** This endpoint will also return a `pagination` key on the root level. \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n"
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: query
name: limit
description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
type: integer
format: int32
default: 10
minimum: 1
maximum: 500
required: false
- in: query
name: page_token
description: Token used to request the next page in paginated results. Defaults to 'null'
type: string
required: false
- in: query
name: sort_field
description: Field to sort by. Defaults to 'id'.
type: string
default: id
enum:
- id
- created_at
- updated_at
required: false
- in: query
name: sort_direction
description: Sort direction. Defaults to 'desc'.
type: string
default: desc
enum:
- asc
- desc
required: false
- in: query
name: period_min
description: Filter by an ISO-8601 formatted date string that represents the lower bound of the search range for the period date.
type: string
required: false
- in: query
name: period_max
description: Filter by an ISO-8601 formatted date string that represents the upper bound of the search range for the period date.
type: string
required: false
- in: query
name: organization_id
description: Filter by organization ID within Huntress account
type: integer
format: int32
required: false
- in: query
name: type
description: Filter by report type. One of monthly_summary, quarterly_summary, yearly_summary
type: string
enum:
- monthly_summary
- quarterly_summary
- yearly_summary
required: false
responses:
'200':
description: List Summary Reports
schema:
type: object
properties:
reports:
type: array
items:
$ref: '#/definitions/SummaryReport'
pagination:
$ref: '#/definitions/Pagination'
required:
- reports
- pagination
'403':
description: There was an issue with your API credential or permissions.
tags:
- Reseller
operationId: getV1AccountsAccountIdReports
/v1/accounts/{account_id}/reports/{id}:
get:
summary: Get Summary Report
description: Shows details on a single Summary Report associated with your account.
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
description: Report ID within Huntress account
type: integer
format: int32
required: true
responses:
'200':
description: Get Summary Report
schema:
type: object
properties:
report:
$ref: '#/definitions/SummaryReport'
'403':
description: There was an issue with your API credential or permissions.
tags:
- Reseller
operationId: getV1AccountsAccountIdReportsId
/v1/accounts/{account_id}/signals:
get:
summary: List Signals
description: "Shows details of Signals belonging to the account associated with your API credentials.\n\nSignals are used to highlight interesting user or system behaviors that an analyst can reference during a cyber investigation.\nA detected Signal could be as broad and low fidelity as the detection of a command line user running whoami, or it could be as specific and high fidelity as detecting a known malware file.\n\n**Note:** This endpoint will also return a `pagination` key on the root level. \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n"
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: query
name: limit
description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
type: integer
format: int32
default: 10
minimum: 1
maximum: 500
required: false
- in: query
name: page_token
description: Token used to request the next page in paginated results. Defaults to 'null'
type: string
required: false
- in: query
name: sort_field
description: Field to sort by. Defaults to 'id'.
type: string
default: id
enum:
- id
- created_at
- updated_at
- status
required: false
- in: query
name: sort_direction
description: Sort direction. Defaults to 'desc'.
type: string
default: desc
enum:
- asc
- desc
required: false
- in: query
name: investigated_at_min
description: Filter by an ISO-8601 formatted date string that represents the lower bound of the search range for the investigated_at date.
type: string
required: false
- in: query
name: investigated_at_max
description: Filter by an ISO-8601 formatted date string that represents the upper bound of the search range for the investigated_at date.
type: string
required: false
- in: query
name: entity_type
description: Filter by the entity type that the Signal originated from. This filter can be used without specifying entity_id.
type: string
enum:
- user_entity
- source
- mailbox
- service_principal
- agent
- identity
required: false
- in: query
name: entity_id
description: Filter by the entity ID that the Signal originated from. Must be used in tandem with entity_type parameter.
type: string
required: false
- in: query
name: organization_id
description: Filter by organization ID within Huntress account
type: integer
format: int32
required: false
- in: query
name: types
description: 'Filter by the types of Signal, must be comma-separated string containing the values: `Antivirus, Process Insights, Managed ITDR, Footholds, MDE Detections, SIEM, Ransomware Canaries, Favicon Detections, Attack Disruptions, App Control`'
type: string
required: false
- in: query
name: statuses
description: 'Filter by status. Must be comma-separated string containing the values: `reported`, `closed`'
type: string
required: false
responses:
'200':
description: List Signals
schema:
type: object
properties:
signals:
type: array
items:
$ref: '#/definitions/Signal'
pagination:
$ref: '#/definitions/Pagination'
required:
- signals
- pagination
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Signal'
tags:
- Reseller
operationId: getV1AccountsAccountIdSignals
/v1/accounts/{account_id}/signals/{id}:
get:
summary: Get Signal
description: 'Shows details of a single Signal belonging to the account associated with your API credentials.
Signals are used to highlight interesting user or system behaviors that an analyst can reference during a cyber investigation.
A detected Signal could be as broad and low fidelity as the detection of a command line user running whoami, or it could be as specific and high fidelity as detecting a known malware file.
'
produces:
- application/json
parameters:
- in: path
name: account_id
type: integer
format: int32
required: true
- in: path
name: id
description: Signal ID within Huntress account
type: integer
format: int32
required: true
responses:
'200':
description: Get Signal
schema:
type: object
properties:
signal:
$ref: '#/definitions/Signal'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Signal'
tags:
- Reseller
operationId: getV1AccountsAccountIdSignalsId
/v1/actor:
get:
summary: Get Actor
description: 'Shows details of the entities associated with the supplied API credentials. It will only return the fields relevant to the current credentials.
For more information on User management, see [Product Support](https://support.huntress.io/hc/en-us/articles/4404012574227-Adding-and-Managing-Huntress-Users)
'
produces:
- application/json
responses:
'200':
description: Get Actor
schema:
$ref: '#/definitions/Actor'
'403':
description: There was an issue with your API credential or permissions.
schema:
$ref: '#/definitions/Actor'
tags:
- Reseller
operationId: getV1Actor
definitions:
SubscriptionUpgradeParameters:
type: object
properties:
minimum:
type: integer
format: int32
description: New minimum usage commitment (must be greater than zero)
purchase_order:
type: string
description: Purchase order number (defaults to existing subscription's PO)
on_renewal:
type: boolean
description: Schedule upgrade for next renewal instead of immediately
default: false
required:
- minimum
description: Upgrade Reseller Subscription
Subscription:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A unique identifier for the subscription.
account:
type: Object
example:
id: 1
name: Little Bobby's Table Emporium
description: The account associated with this subscription.
product:
type: string
enum:
- edr
- ispm
- itdr
- sat
- siem
example: edr
description: The product type for this subscription.
status:
type: string
enum:
- draft
- approved
- accepted
- active
- completed
example: active
description: The subscription status.
minimum_usage:
type: integer
format: int64
example: 50
description: The current minimum usage commitment for this subscription.
terminal_minimum_usage:
type: integer
format: int64
example: 100
description: The minimum usage commitment for this subscription after all subscription schedules are completed. Usually, this will be the same as the current minimum, but it may be higher during an ongoing schedule.
billing_interval:
type: string
enum:
- monthly
- annual
example: monthly
description: The billing interval for this subscription.
effective_date:
type: string
example: '2024-01-01T00:00:00Z'
description: ISO-8601 formatted date when this subscription becomes effective.
renewal_date:
type: string
example: '2025-01-01T00:00:00Z'
description: ISO-8601 formatted date when this subscription renews.
auto_renew:
type: boolean
example: true
description: Whether this subscription will auto-renew.
schedules:
type: array
items:
$ref: '#/definitions/SubscriptionSchedule'
example:
- id: 1
minimum: 100
maximum: 500
status: active
target_price: 200
months: 12
promo_units: 0
starts_at: '2024-01-01T00:00:00Z'
ends_at: '2025-01-01T00:00:00Z'
description: The schedules associated with this subscription.
description: Subscription model
OrganizationWithActualProductUsages:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A Huntress-unique identifier for the organization.
agents_count:
type: integer
format: int64
example: 42
description: Number of all agents for the organization.
account_id:
type: integer
format: int64
example: 5
description: The unique identifier of the account associated with the organization.
created_at:
type: string
format: date-time
example: '2022-03-01T18:54:02Z'
description: A timestamp for when the organization was created, formatted as per ISO-8601.
incident_reports_count:
type: integer
format: int64
example: 42
description: Number of incident reports for the organization.
key:
type: string
example: test1
description: The subdomain associated with the organization.
logs_sources_count:
type: integer
format: int64
example: 42
description: Number of SIEM log sources that are billable and eligible for billing.
identity_provider_tenant_id:
type: string
example: dcd219dd-bc68-4b9b-bf0b-4a33a796be35
description: The Identity Provider Tenant ID associated with the organization
billable_identity_count:
type: integer
format: int64
example: 42
description: Number of billable identities for the organization.
name:
type: string
example: Acme Inc.
description: The public facing name for this organization.
report_recipients:
type: array
items:
type: string
example:
- test@test.com
- fakenotificiation@test.com
description: A list of emails Huntress is configured to send notification emails for the organization.
sat_learner_count:
type: integer
format: int64
example: 42
description: Number of SAT learners.
updated_at:
type: string
format: date-time
example: '2022-03-01T18:54:02Z'
description: A timestamp for when the organization was updated, formatted as per ISO-8601.
actual_usages:
type: string
example:
siem:
billable_log_sources_count: 5
retention: 90/7
current_billing_cycle:
online_gb: 12.34
service_period_start: '2026-04-15T00:00:00Z'
service_period_end: '2026-05-15T00:00:00Z'
previous_billing_cycle:
online_gb: 10.5
service_period_start: '2026-03-15T00:00:00Z'
service_period_end: '2026-04-15T00:00:00Z'
edr:
billable_agents_count: 42
unresponsive_agents_count: 2
outdated_agents_count: 1
isolated_agents_count: 0
sat:
learners_count: 25
ispm:
- type: microsoft
identity_provider_tenant_id: abcd-1234
billable_identities_count: 100
total_identities_count: 150
itdr:
- type: microsoft
identity_provider_tenant_id: abcd-1234
billable_identities_count: 100
total_identities_count: 150
- type: google
identity_provider_tenant_id: efgh-5678
billable_identities_count: 50
total_identities_count: 75
description: Actual usage metrics for the organization's active products, broken down by product type. **NOTE:** log usage data has a max retention of 90 days.
required:
- microsoft_365_tenant_id
- microsoft_365_users_count
- notify_emails
description: OrganizationWithActualProductUsages model
Account:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A unique identifier for the account.
name:
type: string
example: Your Account
description: The public facing display name for the account.
subdomain:
type: string
example: exampleaccount
description: The subdomain for the account.
status:
type: string
enum:
- enabled
- disabled
example: enabled
description: The current status of the account.
support_type:
type: string
enum:
- huntress_supported
- partner_supported
- not_applicable
example: huntress_supported
description: For accounts that have been provisioned through a reseller, this field indicates whether the account is huntress supported or partner supported.
neighborhood_watch:
type: Object
example:
edr: 10
ispm: 10
itdr: 10
sat: 10
siem: 10
description: The count of Neighborhood Watch seats assigned to the account, by product.
billing_address:
$ref: '#/definitions/Address'
description: The billing address for the account, or null if not set.
shipping_address:
$ref: '#/definitions/Address'
description: The shipping address for the account, or null if not set.
description: Account model
SubscriptionCreationParameters:
type: object
properties:
account_id:
type: integer
format: int32
description: The reseller subaccount ID
product:
type: string
description: Filter by product type
enum:
- edr
- ispm
- itdr
- sat
- siem
minimum:
type: integer
format: int32
description: Minimum usage commitment (must be greater than zero)
purchase_order:
type: string
description: Purchase order number
billing_interval:
type: string
description: Billing interval
enum:
- monthly
- annual
default: monthly
required:
- account_id
- product
- minimum
- purchase_order
description: Create Reseller Subscription
Agent:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A unique identifier for an agent.
account_id:
type: integer
format: int64
example: 5
description: The unique identifier of the account associated with the agent.
arch:
type: string
example: x86_64
description: The architecture on the host machine.
created_at:
type: string
format: date-time
example: '2022-03-01T20:05:10Z'
description: A timestamp for when the agent was created, formatted as per ISO-8601.
domain_name:
type: string
example: WORKGROUP
description: Domain that refers to the host machine.
edr_version:
type: string
example: 0.3.20
description: The semantic versioning number of the Huntress EDR software installed on the machine or `null` if EDR is not installed.
external_ip:
type: string
example: 198.51.100.42
description: The external IP of the host machine, if applicable.
hostname:
type: string
example: laptop01
description: The hostname of the host machine.
defender_policy_status:
type: string
example: Compliant
description: Policy status of Defender AV for Managed Antivirus.
defender_status:
type: string
example: Healthy
description: Status of Defender AV Managed Antivirus.
defender_substatus:
type: string
example: Up to date
description: Sub-status of Defender AV Managed Antivirus.
firewall_status:
type: string
example: Disabled
description: Status of agent firewall. Can be one of Disabled, Enabled, Pending Isolation, Isolated, Pending Release
tamper_protection_configured:
type: boolean
example: true
description: The desired EDR tamper protection state for the agent. `null` when the agent does not support tamper protection.
tamper_protection_actual:
type: boolean
example: true
description: The tamper protection state most recently reported by the host. May lag `tamper_protection_configured` and is `null` until the host reports.
ipv4_address:
type: string
example: 146.134.139.9
description: The internal IP of the host machine.
last_callback_at:
type: string
format: date-time
example: '2022-03-01T20:05:10Z'
description: A timestamp for when the last time Huntress was able to access the host machine.
last_survey_at:
type: string
format: date-time
example: '2022-03-01T20:05:10Z'
description: A timestamp for when the last Microsoft Defender survey was received by Huntress for this host machine.
mac_addresses:
type: array
items:
type: string
example:
- 7c:a7:b0:16:2f:78
description: The unique media access control (MAC) addresses associated with the agent.
service_pack_major:
type: integer
format: int32
example: 0
description: The major version of the Windows service pack installed on the host machine.
service_pack_minor:
type: integer
format: int32
example: 0
description: The minor version of the Windows service pack installed on the host machine.
organization_id:
type: integer
format: int64
example: 7
description: The unique identifier of the organization associated with the agent.
os:
type: string
example: Windows 8 Pro
description: The operating system of the host machine.
os_build_version:
type: string
example: '19044'
description: The operating system build number of the host machine corresponding to its platform (windows or darwin).
os_major:
type: integer
format: int32
example: 6
description: The major OS version of the host machine. Corresponds with the major releases of Windows operating systems. A list is accessible here.
os_minor:
type: integer
format: int32
example: 2
description: ' The minor OS version of the host machine. Refer to the `os_major` field details for further details.'
os_patch:
type: integer
format: int32
example: 0
description: The patch version of the macOS update installed on the host machine, such as 1 in version 12.5.1.
platform:
type: string
example: windows
description: The platform of the host machine (`darwin`, `windows`, or `linux`).
serial_number:
type: string
example: wtIe1bvDbh
description: The serial number of the host machine as reported to the operating system.
tags:
type: array
items:
type: string
example:
- Server
- Production
description: User classifications on the host machine.
updated_at:
type: string
format: date-time
example: '2022-03-01T20:05:10Z'
description: A timestamp for when the agent was last updated, formatted as per ISO-8601.
version:
type: string
example: 0.11.3
description: The semantic versioning number of the agent installed on the host machine.
version_number:
type: integer
format: int32
example: 720899
description: Windows version number.
win_build_number:
type: integer
format: int32
example: 19044
description: The Windows Build Number. Should correspond to information on the Microsoft site.
description: Agent model
Address:
type: object
properties:
line1:
type: string
description: Street address line 1.
line2:
type: string
description: Street address line 2.
city:
type: string
description: City.
state:
type: string
description: State or province. Required for US and CA addresses.
postal_code:
type: string
description: Postal or ZIP code. Required for US and GB addresses.
country:
type: string
description: Two-letter ISO 3166-1 alpha-2 country code.
OrganizationUpdateParameters:
type: object
properties:
name:
type: string
description: The name of the organization. Value cannot be blank and must be 256 characters or less.
example: Most Amazing Company, Ltd.
key:
type: string
description: Organization keys are used to associate a Huntress Agent into a grouping. Value cannot be blank and must be 256 characters or less.
example: amazing
report_recipients:
type: array
description: Any emails specified here will automatically receive quarterly and monthly branded reports.
example:
- vera@bradley.com
- my@user.net
items: null
description: Update an Organization
AccountUsageLineItem:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A unique identifier for this Account Usage Line Item.
period_start:
type: string
example: 2026-01-10 01:07:08 UTC
description: The time and date that this billing period started.
period_end:
type: string
example: 2026-02-09 01:07:08 UTC
description: The time and date that this billing period ended.
account:
type: Object
example:
id: 123
name: Willy Wonka
subdomain: willy_wonka
description: The account in which this data belongs to.
product:
type: string
enum:
- edr
- ispm
- itdr
- sat
- siem
- siem_extended_retention
example: edr
description: The product that this data pertains to.
subscription:
type: Object
example:
start_date: 2025-11-10 22:35:14 UTC
end_date: 2025-11-10 22:35:14 UTC
minimum: 400
description: Subscription information that is tied to the account and invoice.
usage:
type: Object
example:
billable: 400
non_billable: 0
actual: 300
description: The accounts breakdown of its use of the product and the billing around it.
description: AccountUsageLineItem model
IncidentReport:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A unique identifier for an incident report.
account_id:
type: integer
format: int64
example: 5
description: Unique identifier for the account this incident report is associated with.
agent_id:
type: integer
format: int64
example: 12
description: Unique identifier for the agent this incident report is associated with.
body:
type: string
example:
description: Autogenerated content describing the details of the incident in question.
closed_at:
type: string
format: date-time
example: '2022-03-15T14:22:00Z'
description: ISO-8601 formatted timestamp for when this incident report had its status set to `closed`. Null if non-applicable.
indicator_counts:
type: object
example:
footholds: 1
monitored_files: 0
process_detections: 0
ransomware_canaries: 0
antivirus_detections: 0
description: Mapping of indicator types to number of incidences of that threat in the context of this incident report.
indicator_types:
type: array
items:
type: string
example:
- footholds
description: Unique list of threat indicators that have been found in the context of this incident report.
organization_id:
type: integer
format: int64
example: 4
description: Unique identifier for the organization this incident report is associated with.
platform:
type: string
example: windows
description: The platform of the host machine (`darwin`,`google`,`microsoft_365`,`linux`,`windows`, or `other`).
remediations:
type: object
example:
total_count: 1
has_more: false
items:
- id: 1
type: manual
action: Delete File
parameters:
- name: path
description: c:\windows\system32\tasks\malicious_task
status: completed
approved_at: '2025-06-26T18:57:03Z'
approved_by:
id: '123123'
email: john.smith@example.com
name: John smith
completed_at: '2025-06-26T18:57:03Z'
description: This represents an itemized list of the first 10 remediations for an incident report. If there are more than 10, use the remediations endpoint to retrieve information about them.
sent_at:
type: string
format: date-time
example: '2022-03-01T21:00:00Z'
description: ISO-8601 formatted timestamp for when a Huntress SOC analyst has notified necessary parties regarding this incident report. Null if not sent.
severity:
type: string
example: low
description: The severity of the incident report. Can be one of `low`, `high`, `critical`.
status:
type: string
example: closed
description: Status of the incident report. Can be one of `sent`, `closed`, `dismissed`
status_updated_at:
type: string
format: date-time
example: '2022-03-15T14:22:00Z'
description: ISO-8601 formatted timestamp for when the status of this incident report was last updated.
subject:
type: string
example: LOW - Incident on laptop01 (Test)
description: Autogenerated one-line description of the incident.
summary:
type: string
example: Huntress detected a malicious scheduled task on this host. We recommend removing the file and scheduled task listed in the remediation steps below.
description: Details of the incident report, as provided by a Huntress SOC analyst.
updated_at:
type: string
format: date-time
example: '2022-03-01T20:31:30Z'
description: ISO-8601 formatted timestamp for when this incident report was last updated.
description: IncidentReport model
AccountUpdateParameters:
type: object
properties:
name:
type: string
description: Name of the account
subdomain:
type: string
description: Subdomain this account will use to access the Huntress portal
phone_number:
type: string
description: Primary phone number used to contact account owner
support_type:
type: string
description: 'Specifies whether a reseller account is managed by the partner or by
Huntress.
NOTE: This field is only applicable for Managed Resellers. For all
other types of resellers, there is only one valid support type, so it
cannot be updated.
'
enum:
- huntress_supported
- partner_supported
billing_address:
type: object
description: Billing address for the account. If provided, must be valid.
properties:
line1:
type: string
description: Street address line 1
line2:
type: string
description: Street address line 2
city:
type: string
description: City
state:
type: string
description: State or province (required for US and CA)
postal_code:
type: string
description: Postal or ZIP code (required for US and GB)
country:
type: string
description: Two-letter ISO 3166-1 alpha-2 country code
shipping_address:
type: object
description: Shipping address for the account. If provided, must be valid.
properties:
line1:
type: string
description: Street address line 1
line2:
type: string
description: Street address line 2
city:
type: string
description: City
state:
type: string
description: State or province (required for US and CA)
postal_code:
type: string
description: Postal or ZIP code (required for US and GB)
country:
type: string
description: Two-letter ISO 3166-1 alpha-2 country code
description: Update Account
ReportIncidentRemediation:
type: object
properties:
type:
type: string
example: Remediations::SessionRevocation
description: The remediation type.
subtype:
type: string
example: containment
description: The remediation action category.
MembershipUpdateParameters:
type: object
properties:
permissions:
type: string
description: 'The specific level of permissions that have been granted to the user in the context of this membership. For more information, see our [support article](https://support.huntress.io/hc/en-us/articles/4404012728083-Huntress-Portal-User-Permissions) on permissions. Accepted values:
'
enum:
- Admin
- Finance
- Marketing
- Provisioner
- Read-only
- Security Engineer
- User
example: Security Engineer
description: Update a User's membership
Remediation:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A unique identifier for a remediation.
type:
type: string
example: manual
description: 'The type of the remediation. Can be one of: assisted, manual, containment'
action:
type: string
example: Delete File
description: Description of the remediation's required steps.
parameters:
type: array
items:
type: string
example:
- name: path
description: c:\windows\system32\tasks\malicious_task
description: Additional context on how the remediation will be performed.
For containment remediations, this will be a string showing the entity to which the remediation was applied.
For assisted remediations this will be an array of key value pairs representing all the parameters that are related to the remediation.
Manual remediations will have no information.
status:
type: string
example: completed
description: 'The status of the remediation. Can be one of: unapproved, approved, completed, failed, cancelled'
approved_at:
type: string
format: date-time
example: '2025-06-26T18:57:03Z'
description: ISO-8601 formatted timestamp for when the remediation was approved.
approved_by:
$ref: '#/definitions/User'
example:
id: 123123
name: John Smith
email: john.smith@example.com
description: The user that approved the remediation.
completed_at:
type: string
format: date-time
example: '2025-06-26T18:57:03Z'
description: ISO-8601 formatted timestamp for when the remediation was completed.
description: Remediation model
OrganizationUsageLineItem:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A unique identifier for this Organization Usage Line Item.
period_start:
type: string
example: '2026-02-11T14:12:08Z'
description: The time and date that this billing period started.
period_end:
type: string
example: '2027-02-11T14:12:08Z'
description: The time and date that this billing period ended.
account:
type: Object
example:
id: 123
name: Willy Wonka
subdomain: willy_wonka
description: The account in which this data belongs to.
organization:
type: Object
example:
id: 123
name: Willy Wonka
description: The organization to which this data belongs.
actual_usage:
type: Object
example:
edr: 400
itdr: 20
sat: 300
siem: 50
description: A breakdown by Huntress product of the number of units actually used for an organization.
description: OrganizationUsageLineItem model
AccountCreationParameters:
type: object
properties:
name:
type: string
description: Name of the account to be created
subdomain:
type: string
description: Subdomain this account will use to access the Huntress portal
phone_number:
type: string
description: Primary phone number used to contact account owner
admin:
type: object
properties:
first_name:
type: string
description: First name of the initial admin user for this account
last_name:
type: string
description: Last name of the initial admin user for this account
email:
type: string
description: Email address of the initial admin user for this account
required:
- first_name
- last_name
- email
additional_admin_emails:
type: array
description: Email addresses of additional admin users to invite to this account
example:
- another_admin@example.com
- one_more@example.com
items:
type: string
additionalProperties:
type: String
support_type:
type: string
description: 'Specifies whether a reseller account is managed by the partner or by
Huntress.
NOTE: This field is only required for Managed Resellers. For all
other types of resellers, there is only one valid support type, so it
will be selected automatically.
'
enum:
- huntress_supported
- partner_supported
products:
type: array
description: 'A list of the products to provision for this account.
NOTE: This field is only relevant for Aggregators. For all other
types of resellers, the appropriate trials will be created
automatically and this field will be ignored. (If you aren''t sure
whether this applies to you, you can probably ignore this field.)
'
example:
- edr
- ispm
- itdr
- sat
- siem
items:
type: string
enum:
- edr
- ispm
- itdr
- sat
- siem
additionalProperties:
type: String
product_trials:
type: array
description: 'A list of the products that should receive trials for this account.
Only applies to trial-supporting resellers (this field is ignored
for Aggregators). If omitted, trials are started for every product
enabled for the reseller. If supplied, must include at least one
product, and each listed product must be enabled for the reseller.
'
example:
- edr
- ispm
- itdr
- sat
- siem
items:
type: string
enum:
- edr
- ispm
- itdr
- sat
- siem
additionalProperties:
type: String
product_trials_start_date:
type: string
description: 'The date that the trials in product_trials should start in ISO-8601
format (YYYY-MM-DD).
Only applies if product_trials are provided. If product_trials
are provided and product_trials_start_date is left blank, trials
will start today. The date is assumed to be in the API caller''s time
zone.
'
billing_address:
type: object
description: Billing address for the account. If provided, must be valid.
properties:
line1:
type: string
description: Street address line 1
line2:
type: string
description: Street address line 2
city:
type: string
description: City
state:
type: string
description: State or province (required for US and CA)
postal_code:
type: string
description: Postal or ZIP code (required for US and GB)
country:
type: string
description: Two-letter ISO 3166-1 alpha-2 country code
shipping_address:
type: object
description: Shipping address for the account. If provided, must be valid.
properties:
line1:
type: string
description: Street address line 1
line2:
type: string
description: Street address line 2
city:
type: string
description: City
state:
type: string
description: State or province (required for US and CA)
postal_code:
type: string
description: Postal or ZIP code (required for US and GB)
country:
type: string
description: Two-letter ISO 3166-1 alpha-2 country code
required:
- name
- subdomain
- phone_number
- admin
description: Create Account
User:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A unique identifier for the user.
email:
type: string
example: john.smith@example.com
description: The user's email.
name:
type: string
example: John Smith
description: The user's name.
Actor:
type: object
properties:
reseller:
type: Object
example:
id: 12345
name: ResellerCo
description: Information about the reseller associated with the supplied API credentials (if any).
account:
type: Object
example:
id: 12345
name: Huntress
subdomain: huntress
status: enabled
description: Information about the account associated with the supplied API credentials (if any).
user:
type: Object
example:
id: 12345
email: email@example.com
name: Your User
description: Information about the user associated with the supplied API credentials (if any).
description: Actor model
ReportExternalService:
type: object
properties:
name:
type: string
example: SSH
description: The name of the external service.
risky:
type: boolean
example: true
description: Whether this service is considered risky.
Organization:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A Huntress-unique identifier for the organization.
agents_count:
type: integer
format: int64
example: 42
description: Number of all agents for the organization.
account_id:
type: integer
format: int64
example: 5
description: The unique identifier of the account associated with the organization.
created_at:
type: string
format: date-time
example: '2022-03-01T18:54:02Z'
description: A timestamp for when the organization was created, formatted as per ISO-8601.
incident_reports_count:
type: integer
format: int64
example: 42
description: Number of incident reports for the organization.
key:
type: string
example: test1
description: The subdomain associated with the organization.
logs_sources_count:
type: integer
format: int64
example: 42
description: Number of SIEM log sources that are billable and eligible for billing.
identity_provider_tenant_id:
type: string
example: dcd219dd-bc68-4b9b-bf0b-4a33a796be35
description: The Identity Provider Tenant ID associated with the organization
billable_identity_count:
type: integer
format: int64
example: 42
description: Number of billable identities for the organization.
name:
type: string
example: Acme Inc.
description: The public facing name for this organization.
report_recipients:
type: array
items:
type: string
example:
- test@test.com
- fakenotificiation@test.com
description: A list of emails Huntress is configured to send notification emails for the organization.
sat_learner_count:
type: integer
format: int64
example: 42
description: Number of SAT learners.
updated_at:
type: string
format: date-time
example: '2022-03-01T18:54:02Z'
description: A timestamp for when the organization was updated, formatted as per ISO-8601.
required:
- microsoft_365_tenant_id
- microsoft_365_users_count
- notify_emails
description: Organization model
ExternalPort:
type: object
properties:
id:
type: integer
format: int64
example: 42
description: A unique identifier for an external port record.
ip_address:
type: string
example: 203.0.113.5
description: The public IPv4 address associated with this external port.
port:
type: integer
format: int32
example: 22
description: The port number.
protocol:
type: string
example: TCP
description: The transport protocol (usually TCP or UDP).
service:
type: string
example: ssh
description: The service or application detected on the port.
risky_service:
type: boolean
example: true
description: Whether the detected service is considered risky.
last_scan_at:
type: string
format: date-time
example: '2026-03-15T12:00:00Z'
description: Timestamp of the last Huntress scan, formatted as per ISO-8601.
last_external_scan_at:
type: string
format: date-time
example: '2026-03-14T08:00:00Z'
description: Timestamp of the last external scan, formatted as per ISO-8601.
organization_ids:
type: array
example:
- 1
- 5
description: IDs of organizations associated with this external port that are accessible to the current user.
description: ExternalPort model
SummaryReport:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A unique identifier for the summary report.
agents_count:
type: integer
format: int64
example: 2
description: The number of agents deployed.
allowed_exclusions_count:
type: integer
format: int64
example: 0
description: The number of allowed exclusions.
analyst_name:
type: string
example: Jane Doe
description: The name of the analyst who reviewed this report.
analyst_note:
type: string
example: Everything is awesome! Thanks for using Huntress.
description: The analyst note for this report.
analyst_threats:
type: array
items:
type: string
example:
- Ransomware
- Dridex
- Jupyter
description: Global threat landscape information curated by the analyst.
analyst_title:
type: string
example: Senior Security Analyst
description: The title of the analyst who reviewed this report.
antivirus_exclusions_count:
type: integer
format: int64
example: 0
description: The number of antivirus exclusions.
autorun_events:
type: integer
format: int64
example: 0
description: The total number of autorun (auto-starting application) events in this report.
autorun_signals_detected:
type: integer
format: int64
example: 0
description: The total number of autorun (auto-starting application) signals detected
autorun_signals_reviewed:
type: integer
format: int64
example: 0
description: The number of autorun signals (auto-starting application) reviewed.
autoruns_reviewed:
type: integer
format: int64
example: 0
description: A count of all the autoruns (auto-starting application) reviewed.
blocked_malware_count:
type: integer
format: int64
example: 0
description: A count of blocked malware.
created_at:
type: string
format: date-time
example: '2022-03-01T20:56:15Z'
description: ISO-8601 formatted timestamp for when this summary report was created.
deployed_canaries_count:
type: integer
format: int64
example: 0
description: The number of canaries deployed.
events_analyzed:
type: integer
format: int64
example: 0
description: A count of the events analyzed.
external_ips_count:
type: integer
format: int64
example: 3
description: The number of external IP addresses discovered.
external_ports_count:
type: integer
format: int64
example: 12
description: The number of external ports discovered.
external_services:
type: array
items:
$ref: '#/definitions/ReportExternalService'
example:
- name: SSH
risky: true
- name: HTTP
risky: false
description: Details of external services discovered during reconnaissance.
firewall_disabled_count:
type: integer
format: int64
example: 0
description: The number of endpoints with firewall disabled.
firewall_disabled_with_conflict_count:
type: integer
format: int64
example: 0
description: The number of endpoints with firewall disabled due to a conflict.
firewall_enabled_count:
type: integer
format: int64
example: 10
description: The number of endpoints with firewall enabled.
firewall_enabled_with_conflict_count:
type: integer
format: int64
example: 0
description: The number of endpoints with firewall enabled but with a conflict.
global_threats_note:
type: string
example: World peace! No threats to see here.
description: The global threats note for this report.
host_processes_analyzed:
type: integer
format: int64
example: 0
description: A count of host processes analyzed.
incident_indicator_counts:
type: Object
example:
managed_av: 0
description: A map of incident indicators (as strings) to counts (as integers).
incident_log:
type: array
items:
type: string
example: []
description: A JSON representation of any critical or high severity incidents from this report.
incident_product_counts:
type: Object
example:
edr: 16
itdr: 0
siem: 0
description: A map of product names (as strings) to counts (as integers).
incident_severity_counts:
type: Object
example:
low: 16
description: A map of incident severities (as strings) to counts (as integers).
incidents_reported:
type: integer
format: int64
example: 16
description: The total number of incidents reported.
incidents_resolved:
type: integer
format: int64
example: 1
description: The total number of incidents resolved.
investigated_mav_detection_count:
type: integer
format: int64
example: 0
description: A count of investigated Managed Antivirus (MAV) detections.
investigations_completed:
type: integer
format: int64
example: 0
description: The total number of investigations completed in this report.
itdr_entities:
type: integer
format: int64
example: 0
description: A count of Identity Threat Detection Response entities
itdr_events:
type: integer
format: int64
example: 0
description: A count of Identity Threat Detection Response events
itdr_incidents_reported:
type: integer
format: int64
example: 0
description: The number of Identity Threat Detection Response incidents reported
itdr_investigations_completed:
type: integer
format: int64
example: 0
description: A count of Identity Threat Detection Response investigations completed
itdr_signals:
type: integer
format: int64
example: 0
description: The total number of Identity Threat Detection Response signals
itdr_billable_identity_count:
type: integer
format: int64
example: 50
description: The number of billable identities for Identity Threat Detection Response.
itdr_non_billable_identity_count:
type: integer
format: int64
example: 10
description: The number of non-billable identities for Identity Threat Detection Response.
itdr_license_distribution:
type: Object
example:
Microsoft 365 E3: 25
Microsoft 365 E5: 15
Other: 10
description: A breakdown of Identity Threat Detection Response license types and their counts.
itdr_usage_locations:
type: array
items:
type: string
example:
- US
- CA
- GB
- DE
description: Top usage locations for Identity Threat Detection Response, as ISO country codes.
linux_agent_count:
type: integer
format: int64
example: 0
description: The number of Linux agents.
macos_agent_count:
type: integer
format: int64
example: 0
description: The number of MacOS agents.
macos_agents:
type: boolean
example: false
description: Indicates whether there are _any_ MacOS agents.
mav_incident_report_count:
type: integer
format: int64
example: 0
description: A count of Managed Antivirus (MAV) incident reports.
new_exclusions_count:
type: integer
format: int64
example: 0
description: The number of new exclusions since the last summary report.
only_macos_agents:
type: boolean
example: false
description: Indicates whether there are _only_ MacOS agents.
organization_id:
type: integer
format: int64
example: 7
description: Unique identifier for the organization this summary report is associated with.
period:
type: string
example: 2022-02-01...2022-03-02
description: A date range representing the coverage of the report, formatted as `start_date...end_date`.
powerful_application_count:
type: integer
format: int64
example: 3
description: The number of powerful applications detected.
potential_threat_indicators:
type: integer
format: int64
example: 0
description: A count of the potential threat indicators.
process_detections:
type: integer
format: int64
example: 0
description: The total number of process detections.
process_detections_reported:
type: integer
format: int64
example: 0
description: ' A count of the process detections reported.'
process_detections_reviewed:
type: integer
format: int64
example: 0
description: ' A count of the process detections reviewed.'
protected_profiles_count:
type: integer
format: int64
example: 0
description: The number of protected profiles.
ransomware_note:
type: string
example: No ransoms to report, all is well.
description: The ransomware note for this report.
risky_exclusions_removed_count:
type: integer
format: int64
example: 0
description: The number of risky exclusions removed.
risky_services_count:
type: integer
format: int64
example: 1
description: The number of risky external services discovered.
rogue_app_incidents:
type: array
items:
$ref: '#/definitions/ReportIncident'
description: Details of rogue application incidents detected.
servers_agent_count:
type: integer
format: int64
example: 0
description: The number of server agents.
shadow_workflow_incidents:
type: array
items:
$ref: '#/definitions/ReportIncident'
description: Details of shadow workflow incidents detected.
siem_incidents_reported:
type: integer
format: int64
example: 0
description: The number of Security Information & Event Management incidents reported
siem_ingested_logs:
type: integer
format: int64
example: 0
description: A count of Security Information & Event Management ingested logs
siem_investigations_completed:
type: integer
format: int64
example: 0
description: A count of Security Information & Event Management signals that have been investigated
siem_signals:
type: integer
format: int64
example: 0
description: The total number of Security Information & Event Management signals
siem_total_logs:
type: integer
format: int64
example: 0
description: A count of Security Information & Event Management total logs
signals_detected:
type: integer
format: int64
example: 0
description: A count of total signals detected.
signals_investigated:
type: integer
format: int64
example: 0
description: A count of total signals investigated.
top_incident_av_threats:
type: array
items:
type: string
example:
- some_threat
- another_threat
- threats_threats_threats
description: A list of the top av threats.
top_incident_hosts:
type: array
items:
type: string
example:
- some_host
- another_host
- hosts_hosts_hosts
description: A list of the top hosts by number of incidents.
total_entities:
type: integer
format: int64
example: 2
description: A count of the total entities included in this report.
total_mav_detection_count:
type: integer
format: int64
example: 0
description: A count of the Managed Antivirus (MAV) detections.
type:
type: string
example: monthly_summary
description: The report type. Can be one of `monthly_summary`, `quarterly_summary`, `yearly_summary`.
unwanted_access_incidents:
type: array
items:
$ref: '#/definitions/ReportIncident'
description: Details of unwanted access incidents detected.
updated_at:
type: string
format: date-time
example: '2022-03-01T20:56:15Z'
description: ISO-8601 formatted timestamp for when this summary report was last updated.
url:
type: string
example: https://huntress.io/rails/active_storage/blobs/redirect/uuid.pdf?disposition=download
description: The direct url to the pdf version of this summary report.
windows_agent_count:
type: integer
format: int64
example: 2
description: The number of Windows agents.
weak_application_count:
type: integer
format: int64
example: 1
description: The number of weak applications detected.
windows_agents:
type: boolean
example: true
description: Indicates whether there are _any_ Windows agents.
description: SummaryReport model
UpdateAgent:
type: object
properties:
tags:
type: array
description: The full set of user classifications on the host. The supplied list replaces any existing tags. Values are normalized to lowercase, hyphenated values (for example, "My Server" becomes "my-server"), and blank or duplicate values are dropped.
items:
type: object
properties:
? ''
: type: array
description: The full set of user classifications on the host. The supplied list replaces any existing tags. Values are normalized to lowercase, hyphenated values (for example, "My Server" becomes "my-server"), and blank or duplicate values are dropped.
items:
type: string
tamper_protection_configured:
type: boolean
description: Enable or disable EDR tamper protection for the agent. Applies asynchronously, so the host-reported state is exposed separately as tamper_protection_actual. Requires an API key with permission to manage agent security settings, and the agent must support tamper protection.
description: Update Agent
Pagination:
type: object
properties:
next_page_url:
type: string
next_page_token:
type: string
description: Pagination model
Membership:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A unique identifier for this membership. Note that this is _not_ the id of the user, account, etc. Instead, it identifies this specific relationship, which can be used to modify or delete the membership.
permissions:
type: string
enum:
- Admin
- Security Engineer
- User
- Read-only
- Finance
- Marketing
- Admin-Read-only
- Provisioner
example: Read-only
description: The specific level of permissions that have been granted to this user in the context of this membership.
account:
type: Object
example:
id: 1234
name: Exemplary Accounting, LLC
description: The account associated with this membership (if any).
organization:
type: Object
example:
id: 5678
name: Organic Zations
description: The organization associated with this membership (if any).
user:
type: Object
example:
id: 90210
email: little_bobby@example.com
name: Robert Tables
description: The user associated with this membership.
created_at:
type: string
example: 2026-01-22 01:07:08 UTC
description: The time and date that this membership was created.
updated_at:
type: string
example: 2026-01-22 01:07:08 UTC
description: The time and date that this membership was last updated.
description: Membership model
IsolateAgent:
type: object
properties:
reason:
type: string
description: Reason recorded for the isolation.
strict_isolation:
type: boolean
description: Apply strict isolation. Only honored on Windows (WFP) and Linux (eBPF).
default: false
description: Isolate Agent
MembershipCreationParameters:
type: object
properties:
email:
type: string
description: The email address of the user you are inviting.
example: accounting@example.com
first_name:
type: string
description: The first name of the user you are inviting.
example: Accounting
last_name:
type: string
description: The last name of the user you are inviting.
example: Department
permissions:
type: string
description: The specific permissions this membership will grant to the user.
enum:
- Admin
- Security Engineer
- User
- Read-only
- Finance
- Marketing
- Provisioner
example: Read-only
organization_id:
type: integer
format: int32
description: Include this parameter to invite a user to an organization instead of your account.
example: 123456
required:
- email
- first_name
- last_name
- permissions
description: Create a Membership
SubscriptionUpdateParameters:
type: object
properties:
minimum:
type: integer
format: int32
description: Minimum usage commitment (must be greater than zero)
purchase_order:
type: string
description: Purchase order number
billing_interval:
type: string
description: Billing interval
enum:
- monthly
- annual
additional_units:
type: integer
format: int32
description: Units to add (active subscriptions only)
auto_renew:
type: boolean
description: Set auto-renew (active subscriptions only)
description: Update Reseller Subscription
SubscriptionSchedule:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A unique identifier for the subscription schedule.
minimum:
type: integer
format: int64
example: 100
description: The minimum usage commitment for this schedule period.
maximum:
type: integer
format: int64
example: 500
description: The maximum usage limit for this schedule period.
status:
type: string
enum:
- active
- completed
- pending
example: active
description: The schedule status.
target_price:
type: integer
format: int64
example: 200
description: The target price per unit for this schedule period.
months:
type: integer
format: int64
example: 12
description: The number of months this schedule period covers.
promo_units:
type: integer
format: int64
example: 0
description: The number of promotional units for this schedule period.
starts_at:
type: string
example: '2024-01-01T00:00:00Z'
description: ISO-8601 formatted date when this schedule period starts.
ends_at:
type: string
example: '2025-01-01T00:00:00Z'
description: ISO-8601 formatted date when this schedule period ends.
MemberInvitation:
type: object
properties:
permissions:
type: string
example: Read-only
description: The specific level of permissions that have been granted to this user in the context of this membership.
account:
type: Object
example:
id: 1234
name: Exemplary Accounting, LLC
description: The account associated with this membership (if any).
organization:
type: Object
example:
id: 5678
name: Organic Zations
description: The organization associated with this membership (if any).
user:
type: Object
example:
email: little_bobby@example.com
name: Robert Tables
description: The user associated with this membership.
description: MemberInvitation model
Signal:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A unique identifier for the signal.
created_at:
type: string
format: date-time
example: '2025-06-26T18:57:03Z'
description: ISO-8601 formatted timestamp for when this signal was created.
details:
type: object
example:
rule_name: Firewall Disabled via Netsh
username: admin22
process_name: C:\WINDOWS\system32\netsh.exe
command_line: NetSh.exe Advfirewall set allprofiles state off
registry_key: ''
file_path: ''
file_rename_target: ''
cleartext: ''
description: Additional details attached to this signal. These details differ based on the signal type and contain information about where the signal originated.
entity:
type: object
example:
id: 72183
name: Laptop 52
type: agent
description: Additional details about the entity from which the signal originated. This will always contain an ID, Type and Name.
investigated_at:
type: string
example: '2025-06-26T18:57:03Z'
description: ISO-8601 formatted timestamp for when this signal was investigated.
investigation_context:
type: string
example: False Positive, Business Accepted Risk
description: Represents categories attached to the signal by a SOC analyst which give extra insight on the investigation.
name:
type: string
example: Firewall Disabled via Netsh
description: The name of the signal.
organization:
type: object
example:
id: 232
name: Huntress
description: Contains information about the organization this signal came from. Includes the organization ID and name.
status:
type: string
example: closed
description: 'The status of the signal. Can be one of: `reported`, `closed`'
type:
type: string
example: Process Insights
description: 'The type of the signal. Can be one of: `Antivirus, Process Insights, Managed ITDR, Footholds, MDE Detections, SIEM, Ransomware Canaries, Favicon Detections, Attack Disruptions, App Control`'
updated_at:
type: string
format: date-time
example: '2025-06-26T18:57:03Z'
description: ISO-8601 formatted timestamp for when this signal was last updated.
description: Signal model
RemediationBulkRejectionParameters:
type: object
properties:
comment:
type: string
description: A description of why the remediations were rejected. This explanation helps Huntress SOC analysts fix the remediation plan and re-issue the incident report.
useful:
type: boolean
description: Whether or not the remediation plan was useful.
name:
type: string
description: Name of the user rejecting the remediations. Falls back to the user attached to the API key if not provided.
phone_number:
type: string
description: Phone number to be contacted by the Huntress SOC. Falls back to the phone number of the user attached to the API key if not provided.
email:
type: string
description: Email to be contacted by the Huntress SOC. Falls back to the email of the user attached to the API key if not provided.
required:
- comment
- useful
description: Bulk Reject Remediations Remediations
Invoice:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A unique identifier for the invoice.
amount:
type: integer
format: int32
example: 303
description: The amount intended to be collected by this invoice. Mimics Stripe..
created_at:
type: string
format: date-time
example: '2022-03-01T20:56:15Z'
description: ISO-8601 formatted timestamp for when this invoice was created.
currency_type:
type: string
example: usd
description: The currency type, using a ISO-4217 three-letter code in lowercase.
plan:
type: string
example: Huntress Partner 100 Agents
description: The corresponding name of huntress subscription plan sku.
quantity:
type: integer
format: int64
example: 101
description: The total count of licensed agents accounted for in this invoice.
receipt:
type: string
example: https://pay.stripe/com/invoice/invst_uuid
description: A direct link to stripe payment invoice for this invoice.
status:
type: string
example: paid
description: The invoice status. Can be one of `open`, `paid`, `failed`, `partial_refund`, `full_refund`.
has_usage:
type: boolean
example: true
description: Whether this invoice has associated usage line items.
updated_at:
type: string
format: date-time
example: '2022-03-01T20:56:15Z'
description: ISO-8601 formatted timestamp for when this invoice was last updated.
description: Invoice model
ReportIncident:
type: object
properties:
id:
type: integer
format: int64
example: 12345678
description: The incident report identifier.
severity:
type: string
example: critical
description: The severity level of the incident.
sent_at:
type: string
example: '2026-04-17T12:34:56Z'
description: ISO-8601 formatted timestamp for when the incident was sent.
event_summary:
type: string
example: Suspicious login detected from unusual location.
description: A brief summary of the incident event.
body:
type: string
example: A suspicious login was detected from an unusual location.
description: The full description of the incident.
remediations:
type: array
items:
$ref: '#/definitions/ReportIncidentRemediation'
description: Remediation actions taken for this incident.
OrganizationCreationParameters:
type: object
properties:
name:
type: string
description: The name of the organization. Value cannot be blank and must be 256 characters or less.
example: Most Amazing Company, Ltd.
key:
type: string
description: Organization keys are used to associate a Huntress Agent into a grouping. Value cannot be blank and must be 256 characters or less.
example: amazing
required:
- name
- key
description: Create an Organization
securityDefinitions:
basic_auth:
type: basic
desc: Base 64 encoded string of your Huntress Account API key and API secret.