openapi: 3.1.0 info: title: InsightAppSec Accounts Schedules API description: '
Welcome to the reference documentation for the public APIs available for InsightAppSec.
Here are a few resources to help you learn how to start using our APIs:
After you''ve got the basics down, you can use this API guide to find examples of requests and responses.
This API uses the platform role of a user''s API key to inherit a set of permissions.
Notes:
| Role | Permissions | |
|---|---|---|
| Product Admin | Manage AppsRead Attack TemplatesManage TargetsManage Scan ConfigsManage ScansManage VulnerabilitiesAdminister Vulnerability CommentsManage EnginesManage Engine GroupsManage SchedulesManage BlackoutsManage Global BlackoutsManage FilesManage TagsManage PDF Report | |
| Read Write | Manage AppsRead Attack TemplatesRead TargetsManage Scan ConfigsManage ScansManage VulnerabilitiesManage Vulnerability CommentsRead EnginesRead Engine GroupsManage SchedulesManage BlackoutsManage FilesManage TagsManage PDF Report | |
| Read Only | Read AppsRead Attack TemplatesRead TargetsRead Scan ConfigsRead ScansRead VulnerabilitiesRead Vulnerability CommentsRead EnginesRead Engine GroupsRead SchedulesRead BlackoutsRead FilesRead TagsRead PDF Report |
| Parameter | Description | Example |
|---|---|---|
index | The 0-based index of the page of data desired (default: 0) | ?index=2 |
size | The size of the page of data desired (min: 1, max: 1000, default: 50) | ?size=10 |
sort | The sort terms and (optional) directions for the desired ordering of data (default: specific to each resource) | ?sort=scan.submit_time,DESC,scan.status |
page-token | The page token, used as an alternative to | ?page-token=NDM0NTk0NTIyOjo6X1M6OjpiYW5hbmFz |
When intending to page beyond the 10,000th result, or as an alternative to using the index query parameter, the page-token option may be used instead. After retrieving the first page, the page_token will be present in the metadata section of the response.
For example, with size=99, index=0 to index=99 may be used. To load the next page, use the page_token value used in the response e.g. ?page-token=NDM0NTk0NTIyO
As is generally the accepted practice with REST-ful APIs, creating a resource can be performed by sending an appropriately formatted POST request. Any ID provided for a new resource in a POST request body will simply be ignored (and a new one generated internally and returned as part of the resource in subsequent GET requests), and POST requests to URLs following a format similar to .../resource/ are unsupported and should respond with 415 Method Not Allowed. All requests which successfully create a resource and respond with 201 Created will contain a Location header the value of which is an absolute URI for the resource (the ID of which can be determined as the last section of the path in the given URI). For example:Location: https://us.api.insight.rapid7.com/ias/v1/scans/12345678-1234-5678-90AB-1234567890AB
The value of date and date-time type properties are fixed to the common ISO-8601 format. Unless otherwise specified, all date or date-time data in response bodies are expressed in UTC, and it is also expected that data provided in request bodies are also expressed in UTC.
The first_start and first_end properties of both Blackouts and Schedules, and the last_start property of Blackouts may be specified with a timezone. If the timezone is not specified, it is assumed to be UTC. For example:2019-08-12T14:00:00.000000Z[Asia/Tokyo]
It is also possible to specify the timezone as an offset of either GMT or UTC. For example:2019-09-04T15:00:00.000000Z[GMT+03:00]
| Value | Format | Notes |
|---|---|---|
| Date | YYYY-MM-DD | Defaults to 12 am UTC (if used for a date & time) |
| Date & time only | YYYY-MM-DD''T''hh:mm:ss[.nnn] | Defaults to UTC |
| Date & time in UTC | YYYY-MM-DD''T''hh:mm:ss[.nnn]Z | |
| Date & time with specific timezone | YYYY-MM-DD''T''hh:mm:ss[.nnn]Z[TimeZoneId] |
One characteristic of a powerful API is support for complex search and filtering of resources using a flexible query language. It is entirely possible to provide basic search and filtering functionality on standard GET resource collection operations using HTTP query parameters, but this becomes restrictive when attempting to encode boolean logic. Other solutions are also possible but come with equally restrictive compromises. The most effective way to facilitate this complex search and filtering is to provide it as a top-level API with a robust Domain-Specific Language (DSL).
For simple data retrieval that supports paging and sorting functionality, use the traditional resource-specific GET collection operations; for more complex data retrieval that supports a user-crafted query DSL, use the global Search operation.
Any response from the API with an HTTP Status Code in the 4xx or 5xx range indicates an error. If in the 4xx range it indicates a client-side error, where in the 5xx range it indicates a server-side error. All responses indicating an error should be JSON formatted, and contain both a "status" and a "message" property indicating the cause of the error, a "r7-correlation-id" header should also always be returned in the format of a UUID, which uniquely identifies the HTTP exchange that took place and caused the error (this header is present on every request). On some occasions, an "error_code" property will be included in the response body, which can provide the support team further context into the cause of the error in cases where the message is not explicitly clear.
When contacting support about error responses received from the API, please attempt to include, at minimum:
Specifically, when a response with an HTTP Status Code of 422 is returned, this indicates a validation error, almost always received in a response from a non-idempotent request (normally PUT, POST or DELETE). In this case, there should be an additional "errors" property included in the JSON response body that should describe the cause of the validation exception; this will almost always require a modification to the request body to resolve.
' version: v1 servers: - url: https://[region].api.insight.rapid7.com/ias/v1 tags: - name: Schedules description: 'A Schedule defines the automated execution of a Scan, using a specified Scan Config. Both the App and Scan Config must be created prior to creating a Schedule. There are two options available to specify how often a schedule can occur, either a frequency or a recurrence rule (rrule). Only frequency supports the use of ONCE only schedules. If providing a rrule, the following fields are permitted:FREQ where FREQ is one of: HOURLY, DAILY, WEEKLY, MONTHLY INTERVALBYDAY where BYDAY is: a single day, SA,SU to represent weekend, or all weekdays. BYMONTHDAY where BYMONTHDAY is a range between: 1 - 31. BYSETPOS where BYSETPOS is one of: -1, 1, 2, 3, 4COUNT where COUNT is the number of occurrences you want the blackout to run forrrule = "FREQ=MONTHLY;INTERVAL=1;BYDAY=FR;BYSETPOS=-1" represents ''Run every month on the last Friday''.ONCE does not require an interval. The permitted types are as follows:ONCEHOURLYDAILYWEEKLYMONTHLYfrequency.type other than ONCE is provided, the date and time of the Schedule recurrences will be calculated based on the frequency or rrule defined, until the threshold of last_start (if one is provided, otherwise until a date considerably far into the future).'
paths:
/schedules:
get:
tags:
- Schedules
summary: Get Schedules
description: Get a page of Schedules, based on supplied pagination parameters. The default sort for Schedules is "name" (ascending); for a full list of sortable properties, refer to the Search Catalog detailed in the Search API.
operationId: get-schedules parameters: - name: index in: query schema: type: integer format: int32 - name: size in: query schema: type: integer format: int32 - name: sort in: query schema: type: string - name: page-token in: query schema: type: string responses: '415': description: Unsupported Media Type content: application/json: schema: $ref: '#/components/schemas/Error' '200': description: OK content: application/json: schema: $ref: '#/components/schemas/PageSchedule' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Unauthenticated content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: Resource not found content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: Internal error content: application/json: schema: $ref: '#/components/schemas/Error' post: tags: - Schedules summary: Create Schedule description: Create a new Schedule operationId: create-schedule requestBody: content: application/json: schema: $ref: '#/components/schemas/Schedule' required: true responses: '415': description: Unsupported Media Type content: application/json: schema: $ref: '#/components/schemas/Error' '201': description: Created '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Unauthenticated content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: Resource not found content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: Internal error content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: Action conflict content: application/json: schema: $ref: '#/components/schemas/Error' '422': description: Resource validation error content: application/json: schema: $ref: '#/components/schemas/ValidationErrors' /schedules/{schedule-id}: get: tags: - Schedules summary: Get Schedule description: Get a Schedule operationId: get-schedule parameters: - name: schedule-id in: path required: true schema: type: string format: uuid responses: '415': description: Unsupported Media Type content: application/json: schema: $ref: '#/components/schemas/Error' '200': description: OK content: application/json: schema: $ref: '#/components/schemas/EntityModelSchedule' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Unauthenticated content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: Resource not found content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: Internal error content: application/json: schema: $ref: '#/components/schemas/Error' put: tags: - Schedules summary: Update Schedule description: Update an existing Schedule operationId: update-schedule parameters: - name: schedule-id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/Schedule' required: true responses: '415': description: Unsupported Media Type content: application/json: schema: $ref: '#/components/schemas/Error' '200': description: OK '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Unauthenticated content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: Resource not found content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: Internal error content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: Action conflict content: application/json: schema: $ref: '#/components/schemas/Error' '422': description: Resource validation error content: application/json: schema: $ref: '#/components/schemas/ValidationErrors' delete: tags: - Schedules summary: Delete Schedule description: Delete an existing Schedule operationId: delete-schedule parameters: - name: schedule-id in: path required: true schema: type: string format: uuid responses: '415': description: Unsupported Media Type content: application/json: schema: $ref: '#/components/schemas/Error' '204': description: No Content '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Unauthenticated content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: Resource not found content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: Internal error content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: Action conflict content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: EntityModelSchedule: properties: id: type: string format: uuid description: The ID of the Schedule readOnly: true name: type: string description: The name of the Schedule maxLength: 200 minLength: 1 enabled: type: boolean description: The enabled property of the Schedule scan_config: $ref: '#/components/schemas/RequiredIdResource' first_start: type: string format: date-time description: The first start date and time of the Schedule last_start: type: string format: date-time description: The last start date and time of the Schedule frequency: $ref: '#/components/schemas/frequency' rrule: type: string description: The rrule describes how (and if) the schedule should repeat. Should not be included if a frequency has been provided. links: type: array items: $ref: '#/components/schemas/Link' readOnly: true required: - enabled - first_start - name - scan_config ValidationErrors: properties: status: type: string description: A description of the type of error based on HTTP status code enum: - 100 CONTINUE - 101 SWITCHING_PROTOCOLS - 102 PROCESSING - 103 EARLY_HINTS - 103 CHECKPOINT - 200 OK - 201 CREATED - 202 ACCEPTED - 203 NON_AUTHORITATIVE_INFORMATION - 204 NO_CONTENT - 205 RESET_CONTENT - 206 PARTIAL_CONTENT - 207 MULTI_STATUS - 208 ALREADY_REPORTED - 226 IM_USED - 300 MULTIPLE_CHOICES - 301 MOVED_PERMANENTLY - 302 FOUND - 302 MOVED_TEMPORARILY - 303 SEE_OTHER - 304 NOT_MODIFIED - 305 USE_PROXY - 307 TEMPORARY_REDIRECT - 308 PERMANENT_REDIRECT - 400 BAD_REQUEST - 401 UNAUTHORIZED - 402 PAYMENT_REQUIRED - 403 FORBIDDEN - 404 NOT_FOUND - 405 METHOD_NOT_ALLOWED - 406 NOT_ACCEPTABLE - 407 PROXY_AUTHENTICATION_REQUIRED - 408 REQUEST_TIMEOUT - 409 CONFLICT - 410 GONE - 411 LENGTH_REQUIRED - 412 PRECONDITION_FAILED - 413 PAYLOAD_TOO_LARGE - 413 REQUEST_ENTITY_TOO_LARGE - 414 URI_TOO_LONG - 414 REQUEST_URI_TOO_LONG - 415 UNSUPPORTED_MEDIA_TYPE - 416 REQUESTED_RANGE_NOT_SATISFIABLE - 417 EXPECTATION_FAILED - 418 I_AM_A_TEAPOT - 419 INSUFFICIENT_SPACE_ON_RESOURCE - 420 METHOD_FAILURE - 421 DESTINATION_LOCKED - 422 UNPROCESSABLE_ENTITY - 423 LOCKED - 424 FAILED_DEPENDENCY - 425 TOO_EARLY - 426 UPGRADE_REQUIRED - 428 PRECONDITION_REQUIRED - 429 TOO_MANY_REQUESTS - 431 REQUEST_HEADER_FIELDS_TOO_LARGE - 451 UNAVAILABLE_FOR_LEGAL_REASONS - 500 INTERNAL_SERVER_ERROR - 501 NOT_IMPLEMENTED - 502 BAD_GATEWAY - 503 SERVICE_UNAVAILABLE - 504 GATEWAY_TIMEOUT - 505 HTTP_VERSION_NOT_SUPPORTED - 506 VARIANT_ALSO_NEGOTIATES - 507 INSUFFICIENT_STORAGE - 508 LOOP_DETECTED - 509 BANDWIDTH_LIMIT_EXCEEDED - 510 NOT_EXTENDED - 511 NETWORK_AUTHENTICATION_REQUIRED readOnly: true message: type: string description: A description of the error readOnly: true errorCode: type: string description: An optional code which may help support indicate the underlying cause of the error enum: - E1 - E2 - E3 - E4 - E5 - E6 - E7 - E8 - E9 - E10 - E11 - E12 - E13 - E14 - E15 - E16 - E17 - E18 - E19 - E20 - E22 - E23 - E24 - E25 - E26 - E27 - E28 - E999 readOnly: true errors: type: array description: A list of validation errors, when the HTTP status code is 422 items: $ref: '#/components/schemas/ValidationError' readOnly: true title: ValidationErrors PageMetadata: properties: index: type: integer format: int64 size: type: integer format: int64 sort: type: string total_data: type: integer format: int64 total_pages: type: integer format: int64 page_token: type: string Link: properties: rel: type: string href: type: string profile: type: string name: type: string readOnly: true PageSchedule: properties: data: type: array items: $ref: '#/components/schemas/EntityModelSchedule' metadata: $ref: '#/components/schemas/PageMetadata' links: type: array items: $ref: '#/components/schemas/Link' readOnly: true ValidationError: properties: type: type: string description: The type of the validation error enum: - OBJECT - PROPERTY readOnly: true context: type: string description: An optional contextual indicator of a part of the request which failed validation readOnly: true explanation: type: string description: Details of the validation error readOnly: true RequiredIdResource: description: The Scan Config of the Schedule properties: id: type: string format: uuid required: - id Schedule: properties: id: type: string format: uuid description: The ID of the Schedule readOnly: true name: type: string description: The name of the Schedule maxLength: 200 minLength: 1 enabled: type: boolean description: The enabled property of the Schedule scan_config: $ref: '#/components/schemas/RequiredIdResource' first_start: type: string format: date-time description: The first start date and time of the Schedule last_start: type: string format: date-time description: The last start date and time of the Schedule frequency: $ref: '#/components/schemas/frequency' rrule: type: string description: The rrule describes how (and if) the schedule should repeat. Should not be included if a frequency has been provided. required: - enabled - first_start - name - scan_config title: Schedule Error: properties: status: type: string description: A description of the type of error based on HTTP status code enum: - 100 CONTINUE - 101 SWITCHING_PROTOCOLS - 102 PROCESSING - 103 EARLY_HINTS - 103 CHECKPOINT - 200 OK - 201 CREATED - 202 ACCEPTED - 203 NON_AUTHORITATIVE_INFORMATION - 204 NO_CONTENT - 205 RESET_CONTENT - 206 PARTIAL_CONTENT - 207 MULTI_STATUS - 208 ALREADY_REPORTED - 226 IM_USED - 300 MULTIPLE_CHOICES - 301 MOVED_PERMANENTLY - 302 FOUND - 302 MOVED_TEMPORARILY - 303 SEE_OTHER - 304 NOT_MODIFIED - 305 USE_PROXY - 307 TEMPORARY_REDIRECT - 308 PERMANENT_REDIRECT - 400 BAD_REQUEST - 401 UNAUTHORIZED - 402 PAYMENT_REQUIRED - 403 FORBIDDEN - 404 NOT_FOUND - 405 METHOD_NOT_ALLOWED - 406 NOT_ACCEPTABLE - 407 PROXY_AUTHENTICATION_REQUIRED - 408 REQUEST_TIMEOUT - 409 CONFLICT - 410 GONE - 411 LENGTH_REQUIRED - 412 PRECONDITION_FAILED - 413 PAYLOAD_TOO_LARGE - 413 REQUEST_ENTITY_TOO_LARGE - 414 URI_TOO_LONG - 414 REQUEST_URI_TOO_LONG - 415 UNSUPPORTED_MEDIA_TYPE - 416 REQUESTED_RANGE_NOT_SATISFIABLE - 417 EXPECTATION_FAILED - 418 I_AM_A_TEAPOT - 419 INSUFFICIENT_SPACE_ON_RESOURCE - 420 METHOD_FAILURE - 421 DESTINATION_LOCKED - 422 UNPROCESSABLE_ENTITY - 423 LOCKED - 424 FAILED_DEPENDENCY - 425 TOO_EARLY - 426 UPGRADE_REQUIRED - 428 PRECONDITION_REQUIRED - 429 TOO_MANY_REQUESTS - 431 REQUEST_HEADER_FIELDS_TOO_LARGE - 451 UNAVAILABLE_FOR_LEGAL_REASONS - 500 INTERNAL_SERVER_ERROR - 501 NOT_IMPLEMENTED - 502 BAD_GATEWAY - 503 SERVICE_UNAVAILABLE - 504 GATEWAY_TIMEOUT - 505 HTTP_VERSION_NOT_SUPPORTED - 506 VARIANT_ALSO_NEGOTIATES - 507 INSUFFICIENT_STORAGE - 508 LOOP_DETECTED - 509 BANDWIDTH_LIMIT_EXCEEDED - 510 NOT_EXTENDED - 511 NETWORK_AUTHENTICATION_REQUIRED readOnly: true message: type: string description: A description of the error readOnly: true errorCode: type: string description: An optional code which may help support indicate the underlying cause of the error enum: - E1 - E2 - E3 - E4 - E5 - E6 - E7 - E8 - E9 - E10 - E11 - E12 - E13 - E14 - E15 - E16 - E17 - E18 - E19 - E20 - E22 - E23 - E24 - E25 - E26 - E27 - E28 - E999 readOnly: true title: Error frequency: description: The frequency describes how (and if) the Schedule should repeat. Should not be included if a rrule has been provided. properties: id: type: string format: uuid description: The ID of the Schedule readOnly: true name: type: string description: The name of the Schedule maxLength: 200 minLength: 1 enabled: type: boolean description: The enabled property of the Schedule scan_config: $ref: '#/components/schemas/RequiredIdResource' first_start: type: string format: date-time description: The first start date and time of the Schedule last_start: type: string format: date-time description: The last start date and time of the Schedule rrule: type: string description: The rrule describes how (and if) the schedule should repeat. Should not be included if a frequency has been provided. required: - enabled - first_start - name - scan_config title: Schedule