openapi: 3.0.3
info:
  title: Secureworks Taegis XDR Authentication API
  description: The Secureworks Taegis XDR API provides programmatic access to the Taegis extended detection and response platform via GraphQL. This OpenAPI document describes the REST authentication endpoints and the primary GraphQL endpoint used to access alerts, investigations, endpoint assets, identities, threat intelligence, collectors, connectors, playbooks, audits, and users. Authentication uses OAuth2 client credentials flow with bearer token authorization across multiple regions.
  version: 1.0.0
  contact:
    url: https://docs.taegis.secureworks.com/apis/using_xdr_apis/
servers:
- url: https://api.ctpx.secureworks.com
  description: Taegis XDR API - US1 (Primary)
- url: https://api.delta.taegis.secureworks.com
  description: Taegis XDR API - US2
- url: https://api.foxtrot.taegis.secureworks.com
  description: Taegis XDR API - US3
- url: https://api.echo.taegis.secureworks.com
  description: Taegis XDR API - EU1
- url: https://api.golf.taegis.secureworks.com
  description: Taegis XDR API - EU2
security:
- bearerAuth: []
tags:
- name: Authentication
paths:
  /auth/api/v2/auth/token:
    post:
      operationId: obtainAccessToken
      summary: Obtain Access Token
      description: Exchange client credentials for an OAuth2 bearer access token using the client credentials grant flow. The client_id and client_secret are provided via HTTP Basic authentication. The returned access_token is used in subsequent API requests via the Authorization Bearer header.
      tags:
      - Authentication
      security:
      - basicAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - grant_type
              properties:
                grant_type:
                  type: string
                  enum:
                  - client_credentials
                  description: OAuth2 grant type
      responses:
        '200':
          description: Access token issued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '401':
          description: Invalid client credentials
components:
  schemas:
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
          description: Bearer token for API authentication
        token_type:
          type: string
          enum:
          - Bearer
        expires_in:
          type: integer
          description: Token validity in seconds
        expiry:
          type: string
          format: date-time
          description: Absolute expiry timestamp
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: OAuth2 bearer access token from /auth/api/v2/auth/token
    basicAuth:
      type: http
      scheme: basic
      description: HTTP Basic auth with client_id as username and client_secret as password