{"openapi":"3.0.1","info":{"title":"Spyderbat API UI \u0026 Public APIs","description":"Restful APIs for use by UI \u0026 customers.","termsOfService":"https://www.spyderbat.com/terms-of-use/","contact":{"name":"API Support","url":"https://api.prod.spyderbat.com/openapi","email":"support@spyderbat.com"},"license":{"name":"MIT","url":"https://mit-license.org/"},"version":"1.0.0","x-logo":{"url":"/static/sb-logo.svg","backgroundColor":"#161A21","altText":"Spyderbat Logo"}},"servers":[{"url":"https://api.prod.spyderbat.com/","description":"Spyderbat API Server"}],"paths":{"/api/v1/agent_action/enqueue/{agentUID}":{"post":{"tags":["Agent Action"],"summary":"Enqueue an agent action","description":"\n\tEnqueue an agent action. The action will be executed by the agent at the next opportunity.\n\n\t * Requires action agent_action:Enqueue","operationId":"AgentActionEnqueue","parameters":[{"name":"agentUID","in":"path","description":"Agent UID","required":true,"schema":{"type":"string","description":"Agent UID","maxLength":20}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentActionEnqueueInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/cases/constants":{"get":{"tags":["Cases"],"summary":"Get case enumeration constants","description":"Returns all known enumerations used by the Cases API: agent IDs, states, priorities, sub-statuses, note schemas, and analysis levels.","operationId":"CaseConstants","responses":{"200":{"description":"OK"}}}},"/api/v1/integration/soar/org/{orgUID}/source/":{"get":{"tags":["Source"],"summary":"List sources for integration with SOARs","description":"\nLists the sources of data that match the specified query parameters, and return \nURL entry points into the UI for matching sources. \n\n* Requires the action  *org:ListSources* on the organization\n","operationId":"IntegrationSoarSrcList","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"et","in":"query","description":"optional end time of the query","schema":{"type":"integer","description":"optional end time of the query","format":"int64"}},{"name":"hostname","in":"query","description":"A single hostname to match","schema":{"type":"string","description":"A single hostname to match","maxLength":128}},{"name":"ip_address","in":"query","description":"A single IP address to match","schema":{"type":"string","description":"A single IP address to match","maxLength":128}},{"name":"mac_address","in":"query","description":"A single mac address to match","schema":{"type":"string","description":"A single mac address to match","maxLength":128}},{"name":"page","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"page_size","in":"query","schema":{"type":"integer","format":"int32","maximum":100}},{"name":"st","in":"query","description":"optional start time of the query, if only a start time is provided, end time will be start+10m","schema":{"type":"integer","description":"optional start time of the query, if only a start time is provided, end time will be start+10m","format":"int64"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/ApiSOARListHandlerOutput"}}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/":{"get":{"tags":["Org"],"summary":"List organizations","description":"\nLists organizations\n\n * Will list organizations which the user has the action *org:Load* or *org:LoadExpired* on\n","operationId":"OrgList","parameters":[{"name":"cases_enabled","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"has_resource_policy","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"has_tags","in":"query","schema":{"type":"array","items":{"type":"string"},"maxItems":30},"style":"form","explode":true},{"name":"include_expired","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"name_contains","in":"query","schema":{"type":"string","maxLength":32}},{"name":"owner_uid_equals","in":"query","schema":{"type":"string","maxLength":64}},{"name":"page","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"page_size","in":"query","schema":{"type":"integer","format":"int32","maximum":100,"minimum":10}},{"name":"uid_equals","in":"query","schema":{"type":"string","maxLength":64}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Org"}}}}},"400":{"description":"invalid query parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}":{"get":{"tags":["Org"],"summary":"Load an organization","description":"\nLoads an organization by UID. \n\n * Requires action *org:Load*\n * Requires action *org:LoadExpired* to load expired organizations\n\n","operationId":"OrgLoad","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Org"}}}},"403":{"description":"permission denied"}}},"put":{"tags":["Org"],"summary":"Update an organization","description":"\nUpdates the organization \n\n * Requires the user have the action *org:Update* on the organization\n","operationId":"OrgUpdate","parameters":[{"name":"orgUID","in":"path","description":"Org UID","required":true,"schema":{"type":"string","description":"Org UID","maxLength":64}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrgUpdateInput"}}}},"responses":{"200":{"description":"OK"},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/agent/":{"get":{"tags":["Agent"],"summary":"List agents","description":"\nLists the agents associated with an organization\n\n* Requires the action  *agent:List* on the organization\n\n","operationId":"AgentList","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"agent_registration_uid_equals","in":"query","schema":{"type":"string","maxLength":64}},{"name":"is_archived","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"is_not_archived","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"original_association","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"page","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"page_size","in":"query","schema":{"type":"integer","format":"int32","maximum":100}},{"name":"source_uid_equals","in":"query","schema":{"type":"string","maxLength":64}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Agent"}}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/agent/{agentUID}":{"get":{"tags":["Agent"],"summary":"Load an agent","description":"\nLoad a specified agent\n\n* Requires the action  *agent:Load* on the organization\n\n","operationId":"AgentLoad","parameters":[{"name":"agentUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Agent"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/agent/{agentUID}/archive":{"put":{"tags":["Agent"],"summary":"Archive (hide) an agent","description":"\nArchive a specified agent. This marks that an agent and any associated sources should be hidden in the UI.\n\n* Requires the action  *agent:Archive* on the organization\n\n","operationId":"AgentArchive","parameters":[{"name":"agentUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/agent/{agentUID}/unarchive":{"put":{"tags":["Agent"],"summary":"Unarchive (show) an agent","description":"\nUnarchive a specified agent. This marks that an agent and any associated sources should be shown in the UI.\n\n* Requires the action  *agent:Unarchive* on the organization\n\n","operationId":"AgentUnarchive","parameters":[{"name":"agentUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/agent/{agentUID}/work":{"get":{"tags":["AgentWork"],"summary":"Get agent work data for a specific agent","description":"\nGet the work data for a specified agent.\n\n * Requires *agent_data:GetAgentData*\n","operationId":"AgentGetAgentWork","parameters":[{"name":"agentUID","in":"path","description":"Agent UID","required":true,"schema":{"type":"string","description":"Agent UID"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiAgentWorkOutput"}}}},"400":{"description":"Validation error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}}}},"post":{"tags":["AgentWork"],"summary":"Set agent work data for a specific agent","description":"\nSet the work data for a specified agent.\n\n * Requires *agent_data:Set* \n","operationId":"AgentSetAgentWork","parameters":[{"name":"agentUID","in":"path","description":"Agent UID","required":true,"schema":{"type":"string","description":"Agent UID"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSetAgentWorkInput"}}}},"responses":{"200":{"description":"OK"},"400":{"description":"Validation error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}}}},"delete":{"tags":["AgentWork"],"summary":"Delete agent work data for a specific agent","description":"\nDelet the work data for a specified agent.\n\n * Requires *agent_data:Delete* \n","operationId":"AgentDeleteAgentWork","parameters":[{"name":"agentUID","in":"path","description":"Agent UID","required":true,"schema":{"type":"string","description":"Agent UID"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"400":{"description":"Validation error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}}}}},"/api/v1/org/{orgUID}/agent_action_status":{"get":{"tags":["Agent Action"],"summary":"List agent actions.","description":"\nThis will list agent action statuses.\n* Requires the action *agent:ListActionStatus* on the organization\n\t\t\t","operationId":"AgentActionStatusList","parameters":[{"name":"orgUID","in":"path","description":"Organization UID","required":true,"schema":{"type":"string","description":"Organization UID"}},{"name":"action_taken_by","in":"query","description":"Filter actions by the principal that created the action or the agent that executed the action","schema":{"type":"string","description":"Filter actions by the principal that created the action or the agent that executed the action"}},{"name":"action_type_equals","in":"query","description":"Return actions with a type equal to this value.","schema":{"type":"string","description":"Return actions with a type equal to this value."}},{"name":"action_uid_equals","in":"query","description":"The auto-generated uid for the action","schema":{"type":"string","description":"The auto-generated uid for the action"}},{"name":"agent_uid_equals","in":"query","description":"Return actions for this agent","schema":{"type":"string","description":"Return actions for this agent"}},{"name":"analytic_uid_equals","in":"query","description":"Analytic UID -- the uid that starts with 'action:'","schema":{"type":"string","description":"Analytic UID -- the uid that starts with 'action:'"}},{"name":"object_uid_equals","in":"query","description":"Filter actions by one or more object UIDs","schema":{"type":"array","items":{"type":"string"},"description":"Filter actions by one or more object UIDs"},"style":"form","explode":true},{"name":"page","in":"query","description":"Page number to return","schema":{"type":"integer","description":"Page number to return","format":"int32","minimum":1}},{"name":"page_size","in":"query","description":"Number of results to return (10 by default). If you specify -1, all results are returned","schema":{"type":"integer","description":"Number of results to return (10 by default). If you specify -1, all results are returned","format":"int32","maximum":100}},{"name":"reason_contains","in":"query","description":"Filter actions by the reason","schema":{"type":"string","description":"Filter actions by the reason"}},{"name":"reason_equals","in":"query","description":"Filter actions by the reason","schema":{"type":"string","description":"Filter actions by the reason"}},{"name":"result_code_equals","in":"query","description":"Return actions with a result code equal to this value","schema":{"type":"integer","description":"Return actions with a result code equal to this value","format":"int32"}},{"name":"result_code_not_equals","in":"query","description":"Return actions with a result code not equal to this value","schema":{"type":"integer","description":"Return actions with a result code not equal to this value","format":"int32"}},{"name":"reversed","in":"query","description":"Sort in descending order","allowEmptyValue":true,"schema":{"type":"boolean","description":"Sort in descending order"}},{"name":"sort_by","in":"query","description":"Sort by field. Valid values are 'state', 'resultcode', 'completed', 'validfrom', and 'validto'","schema":{"type":"string","description":"Sort by field. Valid values are 'state', 'resultcode', 'completed', 'validfrom', and 'validto'"}},{"name":"state_equals","in":"query","description":"Return actions with a state equal to this value. Valid values are 'queued', 'delivered', 'expired', and 'completed'","schema":{"type":"string","description":"Return actions with a state equal to this value. Valid values are 'queued', 'delivered', 'expired', and 'completed'"}},{"name":"state_not_equals","in":"query","description":"Return actions with a state not equal to this value. Valid values are 'queued', 'delivered', 'expired', and 'completed'","schema":{"type":"string","description":"Return actions with a state not equal to this value. Valid values are 'queued', 'delivered', 'expired', and 'completed'"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionListActionStatusOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/agent_action_status/{actionUID}":{"get":{"tags":["Agent Action"],"summary":"Load agent action.","description":"\nThis will load an agent action status.\n* Requires the action *agent:LoadActionStatus* on the organization\n\t\t\t","operationId":"AgentActionStatusLoad","parameters":[{"name":"actionUID","in":"path","description":"The uid of the action record","required":true,"schema":{"type":"string","description":"The uid of the action record"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionLoadActionStatusOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"404":{"description":"agent action not found"}}}},"/api/v1/org/{orgUID}/agent_health_notification_settings/":{"get":{"tags":["NotificationsAgentHealth"],"summary":"List agent health notification settings.","operationId":"AgentHealthNotificationSettingsList","parameters":[{"name":"orgUID","in":"path","description":"Filter by the organization UID.","required":true,"schema":{"type":"string","description":"Filter by the organization UID."}},{"name":"action_taken_equals","in":"query","description":"Filter by the action taken on the flag(s). Pulls from the history database table. One of [insert|update|delete|enable|disable]","schema":{"type":"string","description":"Filter by the action taken on the flag(s). Pulls from the history database table. One of [insert|update|delete|enable|disable]"}},{"name":"from_history","in":"query","description":"Retrieves historical custom flags data. Pulls from the history database table","allowEmptyValue":true,"schema":{"type":"boolean","description":"Retrieves historical custom flags data. Pulls from the history database table"}},{"name":"latest_version","in":"query","description":"Filter by the latest version of the flag. Pulls from the history database table","allowEmptyValue":true,"schema":{"type":"boolean","description":"Filter by the latest version of the flag. Pulls from the history database table"}},{"name":"name_contains","in":"query","description":"Filter by the name.","schema":{"type":"string","description":"Filter by the name."}},{"name":"name_equals","in":"query","description":"Filter by the name.","schema":{"type":"string","description":"Filter by the name."}},{"name":"name_or_uid_contains","in":"query","description":"Filter by the name or UID.","schema":{"type":"string","description":"Filter by the name or UID."}},{"name":"name_or_uid_equals","in":"query","description":"Filter by the name or UID.","schema":{"type":"string","description":"Filter by the name or UID."}},{"name":"page","in":"query","description":"Page number to return.","schema":{"type":"integer","description":"Page number to return.","format":"int32"}},{"name":"page_size","in":"query","description":"Number of notification settings to return per page.","schema":{"type":"integer","description":"Number of notification settings to return per page.","format":"int32"}},{"name":"scope_query_contains","in":"query","description":"Filter by the scope query.","schema":{"type":"string","description":"Filter by the scope query."}},{"name":"scope_query_equals","in":"query","description":"Filter by the scope query.","schema":{"type":"string","description":"Filter by the scope query."}},{"name":"uid_equals","in":"query","description":"Filter by the notification settings UID.","schema":{"type":"string","description":"Filter by the notification settings UID."}},{"name":"version","in":"query","description":"Filter by the flag version. Pulls from the history database table","schema":{"type":"integer","description":"Filter by the flag version. Pulls from the history database table","format":"int32"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionAgentHealthNotificationListOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}},"post":{"tags":["NotificationsAgentHealth"],"summary":"Create an agent health notification.","operationId":"AgentHealthNotificationSettingsCreate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentHealthNotificationSettingsCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionAgentHealthNotificationCreateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/agent_health_notification_settings/{ahnUID}":{"get":{"tags":["NotificationsAgentHealth"],"summary":"Get agent health notification settings.","operationId":"AgentHealthNotificationSettingsGet","parameters":[{"name":"ahnUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionAgentHealthNotificationLoadOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"put":{"tags":["NotificationsAgentHealth"],"summary":"Update agent health notification settings.","operationId":"AgentHealthNotificationSettingsUpdate","parameters":[{"name":"ahnUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentHealthNotificationSettingsUpdateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionAgentHealthNotificationUpdateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"delete":{"tags":["NotificationsAgentHealth"],"summary":"Delete agent health notification settings.","operationId":"AgentHealthNotificationSettingsDelete","parameters":[{"name":"ahnUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/agent_registration/":{"get":{"tags":["Agent Registration"],"summary":"List agent registrations","description":"\nLists the agent registrations associated with an organization\n\n* Requires the action  *agent_registration:List* on the organization\n\n","operationId":"AgentRegistrationList","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"page","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"page_size","in":"query","schema":{"type":"integer","format":"int32","maximum":100}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AgentRegistration"}}}}},"403":{"description":"permission denied"}}},"post":{"tags":["Agent Registration"],"summary":"Create an agent registration","description":"\nCreates a new agent registration\n\n* Requires the action  *agent_registration:Create* on the organization\n","operationId":"AgentRegistrationCreate","parameters":[{"name":"orgUID","in":"path","description":"The OrgUID the registration is associated with","required":true,"schema":{"type":"string","description":"The OrgUID the registration is associated with","maxLength":32}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentRegistrationCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiAgentCreateHandlerOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/agent_registration/{uid}":{"get":{"tags":["Agent Registration"],"summary":"Load an agent registration","description":"\nLoad a specified agent registration\n\n* Requires the action  *agent_registration:Load* on the agent registration\n\n","operationId":"AgentRegistrationLoad","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"uid","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentRegistration"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"put":{"tags":["Agent Registration"],"summary":"Update an agent registration","description":"\nUpdates an existing registration\n\n* Requires the action  *agent_registration:Update* on the organization and the registration\n","operationId":"AgentRegistrationUpdate","parameters":[{"name":"orgUID","in":"path","description":"The OrgUID the registration is associated with","required":true,"schema":{"type":"string","description":"The OrgUID the registration is associated with","maxLength":32}},{"name":"uid","in":"path","description":"Agent Registration UID","required":true,"schema":{"type":"string","description":"Agent Registration UID","maxLength":64}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentRegistrationUpdateInput"}}}},"responses":{"200":{"description":"OK"},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/agent_registration/{uid}/download_link":{"get":{"tags":["Agent Registration"],"summary":"Get a download link for this registration","description":"\nCreate a download link for the registration\n\n* Requires the action  *agent_registration:Load* on the agent registration\n\n","operationId":"AgentRegistrationDownloadLink","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"uid","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiAgentRegistrationDownloadLinkHandlerOutput"}}}},"400":{"description":"bad request"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/agent_registration/{uid}/log":{"get":{"tags":["Agent Registration"],"summary":"Get log of recent agent registration activity","description":"\nGet lots relating to recent agent registration activity\n\n* Requires the action  *agent_registration:ListLog* on the agent registration\n\n","operationId":"AgentRegistrationGetLog","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"uid","in":"path","required":true,"schema":{"type":"string"}},{"name":"page","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"page_size","in":"query","schema":{"type":"integer","format":"int32","maximum":100}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DaoAgentLog"}}}}},"400":{"description":"bad request"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/agent_work":{"get":{"tags":["AgentWork"],"summary":"Get agent work data for the organization","description":"\nGet the work data for all agents associated with the organization.\n\n * Requires *agent_data:GetOrgData*\n","operationId":"AgentGetOrgWork","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiAgentWorkOutput"}}}},"400":{"description":"Validation error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}}}},"post":{"tags":["AgentWork"],"summary":"Set agent work data for a specific agent","description":"\nSet the work data for a specified agent.\n\n * Requires *agent_data:SetData*\n","operationId":"AgentSetOrgWork","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSetOrgWorkInput"}}}},"responses":{"200":{"description":"OK"},"400":{"description":"Validation error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}}}},"delete":{"tags":["AgentWork"],"summary":"Delete agent work for an org","description":"\nDelete the work data for all agents for an organization.\n\n * Requires *agent_data:Delete* \n","operationId":"AgentDeleteOrgWork","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"400":{"description":"Validation error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}}}}},"/api/v1/org/{orgUID}/agents/{agentID}/flags":{"get":{"tags":["Cases"],"summary":"List flagged AI analyses for an agent","description":"List flagged AI analyses attributed to the specified AI agent within an optional time window.\nagentID must be 'ai-level-1' or 'ai-level-2'.\nstart and end are optional epoch seconds; results are ordered by flaggedAt descending.\n\n* Requires action case:List","operationId":"CaseAgentFlags","parameters":[{"name":"agentID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"end","in":"query","description":"Window end — epoch seconds","schema":{"type":"number","description":"Window end — epoch seconds","format":"double","nullable":true}},{"name":"start","in":"query","description":"Window start — epoch seconds","schema":{"type":"number","description":"Window start — epoch seconds","format":"double","nullable":true}}],"responses":{"200":{"description":"OK"},"400":{"description":"invalid agent ID"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/analyticspolicy/":{"get":{"tags":["AnalyticsPolicy"],"summary":"List analytics policies","description":"\nThis will list the analytics policies for an org with specific parameters\n\t\t\t\n* Requires the action  *org:ListAnalyticsPolicy* on the organization\n\t\t\t","operationId":"AnalyticsPolicyList","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"from_archive","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"has_tags","in":"query","schema":{"type":"array","items":{"type":"string"},"maxItems":30},"style":"form","explode":true},{"name":"name_contains","in":"query","schema":{"type":"string","maxLength":64}},{"name":"name_equals","in":"query","schema":{"type":"string","maxLength":64}},{"name":"name_or_uid_contains","in":"query","schema":{"type":"string","maxLength":64}},{"name":"name_or_uid_equals","in":"query","schema":{"type":"string","maxLength":64}},{"name":"selector_contains","in":"query","schema":{"type":"string","maxLength":64}},{"name":"selector_hash_equals","in":"query","schema":{"type":"string","maxLength":64}},{"name":"type","in":"query","schema":{"type":"string","maxLength":64}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DaoOutputAnalyticsPolicy"}}}}},"403":{"description":"permission denied"}}},"put":{"tags":["AnalyticsPolicy"],"summary":"Update an analytics policy","description":"\nThis will update a specific analytics policy for an org\n\t\t\t\n* Requires the action  *org:UpdateAnalyticsPolicy* on the organization\n\t\t\t","operationId":"AnalyticsPolicyUpdate","parameters":[{"name":"orgUID","in":"path","description":"Org UID","required":true,"schema":{"type":"string","description":"Org UID"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AnalyticsPolicyUpdateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DaoOutputAnalyticsPolicy"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}},"post":{"tags":["AnalyticsPolicy"],"summary":"Create an analytics policy","description":"\nThis will put a new analytics policy for an org\n\t\t\t\n* Requires the action  *org:CreateAnalyticsPolicy* on the organization\n\t\t\t","operationId":"AnalyticsPolicyCreate","parameters":[{"name":"orgUID","in":"path","description":"The org this source is associated with","required":true,"schema":{"type":"string","description":"The org this source is associated with"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AnalyticsPolicyCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiAnalyticsPolicyCreateHandlerOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/analyticspolicy/{analyticspolicyUID}":{"get":{"tags":["AnalyticsPolicy"],"summary":"Load an analytics policy","description":"\nThis will retrieve a specific analytics policy for an org\n\t\t\t\n* Requires the action  *org:LoadAnalyticsPolicy* on the organization\n\t\t\t","operationId":"AnalyticsPolicyLoad","parameters":[{"name":"analyticspolicyUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"archive_version","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"latest_archive_version","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DaoOutputAnalyticsPolicy"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"delete":{"tags":["AnalyticsPolicy"],"summary":"Delete an analytics policy","description":"\nThis will delete the specified policy from an org\n\t\t\t\n* Requires the action  *org:DeleteAnalyticsPolicy* on the organization\n\t\t\t","operationId":"AnalyticsPolicyDelete","parameters":[{"name":"analyticspolicyUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/analyticsruleset/":{"get":{"tags":["AnalyticsRuleset"],"summary":"List analytics rulesets","description":"\nThis will list the analytics rulesets for an org with specific parameters\n\t\t\t\n* Requires the action  *org:ListAnalyticsRuleset* on the organization\n\t\t\t","operationId":"AnalyticsRulesetList","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"from_archive","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"has_tags","in":"query","schema":{"type":"array","items":{"type":"string"},"maxItems":30},"style":"form","explode":true},{"name":"in_policy","in":"query","description":"UID of a policy with rulesets","schema":{"type":"string","description":"UID of a policy with rulesets","maxLength":64}},{"name":"name_contains","in":"query","schema":{"type":"string","maxLength":64}},{"name":"name_equals","in":"query","schema":{"type":"string","maxLength":64}},{"name":"name_or_uid_contains","in":"query","schema":{"type":"string","maxLength":64}},{"name":"type","in":"query","schema":{"type":"string","maxLength":64}},{"name":"uid_equals","in":"query","schema":{"type":"string","maxLength":64}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DaoOutputAnalyticsRuleset"}}}}},"403":{"description":"permission denied"}}},"put":{"tags":["AnalyticsRuleset"],"summary":"Update an analytics ruleset","description":"\nThis will update a specific analytics ruleset for an org\n\t\t\t\n* Requires the action  *org:UpdateAnalyticsRuleset* on the organization\n\t\t\t","operationId":"AnalyticsRulesetUpdate","parameters":[{"name":"orgUID","in":"path","description":"The org this source is associated with","required":true,"schema":{"type":"string","description":"The org this source is associated with"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AnalyticsRulesetUpdateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DaoOutputAnalyticsRuleset"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"404":{"description":"analytics ruleset not found"}}},"post":{"tags":["AnalyticsRuleset"],"summary":"Create a analytics ruleset","description":"\nThis will create a new analytics ruleset for an org\n\t\t\n* Requires the action  *org:CreateAnalyticsRuleset* on the organization\n\t\t","operationId":"AnalyticsRulesetCreate","parameters":[{"name":"orgUID","in":"path","description":"The org this source is associated with","required":true,"schema":{"type":"string","description":"The org this source is associated with"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AnalyticsRulesetCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiAnalyticsRulesetCreateHandlerOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/analyticsruleset/{analyticsrulesetUID}":{"get":{"tags":["AnalyticsRuleset"],"summary":"Load an analytics ruleset","description":"\nThis will retrieve a specific analytics ruleset for an org\n\t\t\t\n* Requires the action  *org:LoadAnalyticsRuleset* on the organization\n\t\t\t","operationId":"AnalyticsRulesetLoad","parameters":[{"name":"analyticsrulesetUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"archive_version","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"latest_archive_version","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DaoOutputAnalyticsRuleset"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"delete":{"tags":["AnalyticsRuleset"],"summary":"Delete an analytics ruleset","description":"\nThis will delete the specified ruleset from an org\n\t\t\t\n* Requires the action  *org:DeleteAnalyticsRuleset* on the organization\n\t\t\t","operationId":"AnalyticsRulesetDelete","parameters":[{"name":"analyticsrulesetUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/archive/":{"get":{"tags":["Archive"],"summary":"List agent archive zips","description":"\nLists the raw agent archive zip files for one or more sources within a bounded\ntime window. The window between start_time and end_time may not exceed 24 hours;\nif omitted it defaults to the last hour (end_time = now, start_time = now - 1h).\n\nResults are paginated: when the response includes a non-empty continuation_token,\npass it back (with the other parameters unchanged) to fetch the next page.\n\nEach result includes an opaque *name* that, with its source UID, can be passed to\nthe download endpoint to fetch the zip. The name carries no storage path or prefix.\n\n * Requires action source_data:Query on the organization","operationId":"ArchiveList","parameters":[{"name":"orgUID","in":"path","description":"Organization UID that owns the archives","required":true,"schema":{"type":"string","description":"Organization UID that owns the archives"}},{"name":"continuation_token","in":"query","description":"Opaque token from a prior response's continuation_token, to fetch the next page. The other parameters must be unchanged across pages.","schema":{"type":"string","description":"Opaque token from a prior response's continuation_token, to fetch the next page. The other parameters must be unchanged across pages."}},{"name":"end_time","in":"query","description":"Inclusive upper bound, in Unix seconds; must be after start_time and within 24h of it. Defaults to the current time.","schema":{"type":"integer","description":"Inclusive upper bound, in Unix seconds; must be after start_time and within 24h of it. Defaults to the current time.","format":"int64","minimum":1}},{"name":"limit","in":"query","description":"Maximum number of archives to return in one page. Defaults to 1000.","schema":{"type":"integer","description":"Maximum number of archives to return in one page. Defaults to 1000.","format":"int32","maximum":50000,"minimum":1}},{"name":"source_uid","in":"query","description":"One or more source UIDs (e.g. machine UIDs) to list archives for","required":true,"schema":{"type":"array","items":{"type":"string"},"description":"One or more source UIDs (e.g. machine UIDs) to list archives for","maxItems":100,"minItems":1},"style":"form","explode":true},{"name":"start_time","in":"query","description":"Inclusive lower bound, in Unix seconds, of the time window to list. Defaults to one hour before end_time.","schema":{"type":"integer","description":"Inclusive lower bound, in Unix seconds, of the time window to list. Defaults to one hour before end_time.","format":"int64","minimum":1}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionArchiveListResponse"}}}},"400":{"description":"bad request"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/archive/{sourceUID}/{name}":{"get":{"tags":["Archive"],"summary":"Download an agent archive zip","description":"\nStreams a single raw agent archive zip identified by a source UID and a *name*\nreturned from the list endpoint.\n\n * Requires action source_data:Query on the organization","operationId":"ArchiveDownload","parameters":[{"name":"name","in":"path","description":"Archive identifier returned by the list endpoint, of the form {sourceUID}-{partition}-{seq}-{start}-{end}.zip","required":true,"schema":{"type":"string","description":"Archive identifier returned by the list endpoint, of the form {sourceUID}-{partition}-{seq}-{start}-{end}.zip","maxLength":256}},{"name":"orgUID","in":"path","description":"Organization UID that owns the archive","required":true,"schema":{"type":"string","description":"Organization UID that owns the archive"}},{"name":"sourceUID","in":"path","description":"Source UID the archive belongs to","required":true,"schema":{"type":"string","description":"Source UID the archive belongs to","maxLength":64}}],"responses":{"200":{"description":"OK","content":{"application/zip":{"schema":{"type":"string","description":"The raw archive zip file","format":"binary"}}}},"400":{"description":"bad request"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/assignedrole/":{"get":{"tags":["Org"],"summary":"List assigned roles in organization","description":"\nAllows querying of roles assigned in the organization\n\n * Requires the user have the action *org:ListOrgRoles* on the organization\n","operationId":"OrgListRole","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"role_uid_equals","in":"query","schema":{"type":"string"}},{"name":"user_email_equals","in":"query","schema":{"type":"string"}},{"name":"user_uid_equals","in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DaoOrgRoleResponse"}}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/assignedrole/add":{"post":{"tags":["Org"],"summary":"Assign OrgRole","description":"\nAssigns a role to a particular user on an organization\n\n * Requires the user have the action *user.AssignRole* on the organization\n","operationId":"OrgAssignRole","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrgAssignRoleInput"}}}},"responses":{"200":{"description":"OK"}}}},"/api/v1/org/{orgUID}/assignedrole/del":{"post":{"tags":["Org"],"summary":"Unassign OrgRole","description":"\nUnassigns a role to a particular user on an organization\n\n * Requires the user have the action *user.UnassignRole* on the organization\n","operationId":"OrgUnassignRole","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrgUnassignRoleInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/cases":{"get":{"tags":["Cases"],"summary":"List cases","description":"List cases for an organization. Supports filtering by state, priority, and assignee.\n\n* Requires action case:List","operationId":"CaseList","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"assignedTo","in":"query","description":"Filter by assignee","schema":{"type":"string","description":"Filter by assignee","maxLength":256}},{"name":"lastModified","in":"query","description":"Cursor: return cases modified after this Unix timestamp","schema":{"type":"integer","description":"Cursor: return cases modified after this Unix timestamp","format":"int32","nullable":true}},{"name":"pageSize","in":"query","description":"Page size (default 100, max 1000)","schema":{"type":"integer","description":"Page size (default 100, max 1000)","format":"int32","maximum":1000}},{"name":"priority","in":"query","description":"Filter by priority: Low, Normal, High","schema":{"type":"string","description":"Filter by priority: Low, Normal, High","maxLength":32}},{"name":"sortBy","in":"query","description":"Sort by: creationDate (default) or lastModified","schema":{"type":"string","description":"Sort by: creationDate (default) or lastModified","maxLength":32}},{"name":"state","in":"query","description":"Filter by state: Open, Closed, Snoozed, In Progress","schema":{"type":"string","description":"Filter by state: Open, Closed, Snoozed, In Progress","maxLength":32}},{"name":"traceId","in":"query","description":"Return cases whose rootTraceId or refIds contains this trace ID","schema":{"type":"string","description":"Return cases whose rootTraceId or refIds contains this trace ID","maxLength":256}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}},"post":{"tags":["Cases"],"summary":"Create a case","description":"Create a new case for an organization.\n\n* Requires action case:Create","operationId":"CaseCreate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseCreateInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/cases/bulk-merge":{"post":{"tags":["Cases"],"summary":"Bulk merge source cases into a target","description":"Merge up to 50 source cases into a single target case.\nThe target must be open; snoozed or closed targets are rejected.\nEach source is processed independently; partial failure is permitted.\n\n* Requires action case:Update","operationId":"CaseBulkMerge","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseBulkMergeInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"target case not found"},"422":{"description":"target case is snoozed or closed"}}}},"/api/v1/org/{orgUID}/cases/bulk-retry":{"post":{"tags":["Cases"],"summary":"Bulk re-enqueue errored cases","description":"Re-enqueue up to 100 errored cases to the same (pipeline, agent) pair.\nEach case is processed independently; partial failure is permitted.\nReturns a per-case result list with status 'queued', 'skipped', or 'error'.\n\n* Requires action case:Update","operationId":"CaseBulkRetry","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseBulkRetryInput"}}}},"responses":{"200":{"description":"OK"},"400":{"description":"invalid pipeline/agent combination"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/cases/config":{"get":{"tags":["Cases"],"summary":"Get org-level Cases configuration","description":"Returns the org-level Cases configuration (read-only).\n\n* Requires action case:List","operationId":"CaseOrgConfig","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/cases/search":{"post":{"tags":["Cases"],"summary":"Search cases","description":"Search cases with server-side filtering, sorting, pagination, and facet counts.\n\n* Requires action case:List","operationId":"CaseSearch","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseSearchInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/cases/stats/agent-performance":{"get":{"tags":["Cases"],"summary":"Get windowed agent-performance statistics for an organization","description":"Returns agent-performance statistics over a caller-specified time window.\nstart and end are optional Unix epoch seconds; the window defaults to a rolling 24h when omitted.\n\n* Requires action case:List","operationId":"CaseOrgStatsAgentPerformance","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"end","in":"query","description":"Window end — Unix epoch seconds (optional; defaults to rolling 24h)","schema":{"type":"integer","description":"Window end — Unix epoch seconds (optional; defaults to rolling 24h)","format":"int64","nullable":true}},{"name":"start","in":"query","description":"Window start — Unix epoch seconds (optional; defaults to rolling 24h)","schema":{"type":"integer","description":"Window start — Unix epoch seconds (optional; defaults to rolling 24h)","format":"int64","nullable":true}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/cases/stats/escalation/human":{"get":{"tags":["Cases"],"summary":"Get windowed human-escalation statistics for an organization","description":"Returns human-escalation statistics over a caller-specified time window.\nstart and end are optional Unix epoch seconds; the window defaults to a rolling 24h when omitted.\n\n* Requires action case:List","operationId":"CaseOrgStatsEscalationHuman","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"end","in":"query","description":"Window end — Unix epoch seconds (optional; defaults to rolling 24h)","schema":{"type":"integer","description":"Window end — Unix epoch seconds (optional; defaults to rolling 24h)","format":"int64","nullable":true}},{"name":"start","in":"query","description":"Window start — Unix epoch seconds (optional; defaults to rolling 24h)","schema":{"type":"integer","description":"Window start — Unix epoch seconds (optional; defaults to rolling 24h)","format":"int64","nullable":true}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/cases/stats/escalation/senior":{"get":{"tags":["Cases"],"summary":"Get windowed senior-escalation statistics for an organization","description":"Returns senior-escalation statistics over a caller-specified time window.\nstart and end are optional Unix epoch seconds; the window defaults to a rolling 24h when omitted.\n\n* Requires action case:List","operationId":"CaseOrgStatsEscalationSenior","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"end","in":"query","description":"Window end — Unix epoch seconds (optional; defaults to rolling 24h)","schema":{"type":"integer","description":"Window end — Unix epoch seconds (optional; defaults to rolling 24h)","format":"int64","nullable":true}},{"name":"start","in":"query","description":"Window start — Unix epoch seconds (optional; defaults to rolling 24h)","schema":{"type":"integer","description":"Window start — Unix epoch seconds (optional; defaults to rolling 24h)","format":"int64","nullable":true}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/cases/stats/now/attention":{"get":{"tags":["Cases"],"summary":"Get current-state attention case statistics for an organization","description":"Returns current attention/stuck statistics derived from the cases and case_status tables only.\n\n* Requires action case:List","operationId":"CaseOrgStatsNowAttention","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/cases/stats/now/lifecycle":{"get":{"tags":["Cases"],"summary":"Get current-state lifecycle-stage case statistics for an organization","description":"Returns current lifecycle-stage statistics derived from the cases and case_status tables only.\n\n* Requires action case:List","operationId":"CaseOrgStatsNowLifecycle","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/cases/stats/now/queues":{"get":{"tags":["Cases"],"summary":"Get current-state per-queue case statistics for an organization","description":"Returns current per-queue depth statistics derived from the cases and case_status tables only.\n\n* Requires action case:List","operationId":"CaseOrgStatsNowQueues","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/cases/stats/processing":{"get":{"tags":["Cases"],"summary":"Get windowed processing-time case statistics for an organization","description":"Returns processing-time statistics over a caller-specified time window.\nstart and end are optional Unix epoch seconds; the window defaults to a rolling 24h when omitted.\n\n* Requires action case:List","operationId":"CaseOrgStatsProcessing","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"end","in":"query","description":"Window end — Unix epoch seconds (optional; defaults to rolling 24h)","schema":{"type":"integer","description":"Window end — Unix epoch seconds (optional; defaults to rolling 24h)","format":"int64","nullable":true}},{"name":"start","in":"query","description":"Window start — Unix epoch seconds (optional; defaults to rolling 24h)","schema":{"type":"integer","description":"Window start — Unix epoch seconds (optional; defaults to rolling 24h)","format":"int64","nullable":true}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/cases/stats/throughput":{"get":{"tags":["Cases"],"summary":"Get windowed throughput case statistics for an organization","description":"Returns throughput statistics over a caller-specified time window.\nstart and end are optional Unix epoch seconds; the window defaults to a rolling 24h when omitted.\n\n* Requires action case:List","operationId":"CaseOrgStatsThroughput","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"end","in":"query","description":"Window end — Unix epoch seconds (optional; defaults to rolling 24h)","schema":{"type":"integer","description":"Window end — Unix epoch seconds (optional; defaults to rolling 24h)","format":"int64","nullable":true}},{"name":"start","in":"query","description":"Window start — Unix epoch seconds (optional; defaults to rolling 24h)","schema":{"type":"integer","description":"Window start — Unix epoch seconds (optional; defaults to rolling 24h)","format":"int64","nullable":true}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/cases/stats/transitions":{"get":{"tags":["Cases"],"summary":"Get windowed state-transition case statistics for an organization","description":"Returns state-transition statistics over a caller-specified time window.\nstart and end are optional Unix epoch seconds; the window defaults to a rolling 24h when omitted.\n\n* Requires action case:List","operationId":"CaseOrgStatsTransitions","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"end","in":"query","description":"Window end — Unix epoch seconds (optional; defaults to rolling 24h)","schema":{"type":"integer","description":"Window end — Unix epoch seconds (optional; defaults to rolling 24h)","format":"int64","nullable":true}},{"name":"start","in":"query","description":"Window start — Unix epoch seconds (optional; defaults to rolling 24h)","schema":{"type":"integer","description":"Window start — Unix epoch seconds (optional; defaults to rolling 24h)","format":"int64","nullable":true}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/cases/{caseID}":{"get":{"tags":["Cases"],"summary":"Get a case","description":"Get a specific case by ID.\n\n* Requires action case:Load","operationId":"CaseLoad","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"delete":{"tags":["Cases"],"summary":"Delete a case","description":"Delete a case.\n\n* Requires action case:Delete","operationId":"CaseDelete","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"patch":{"tags":["Cases"],"summary":"Patch a case","description":"Partial update of a case. All body fields are optional; array fields use full-replace semantics when present.\n\n* Requires action case:Update","operationId":"CasePatch","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CasePatchInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/assessment":{"post":{"tags":["Cases"],"summary":"Record an assessment on a case","description":"Record a verdict, AI rating, flag, or note on a case. At least one field must be present.\n\n* Requires action case:Update","operationId":"CaseAssessment","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseAssessmentInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/assign":{"post":{"tags":["Cases"],"summary":"Assign a case to a user","description":"Assign a case to a specific user identified by the assignedTo field.\n\n* Requires action case:Update","operationId":"CaseAssign","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseAssignInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"delete":{"tags":["Cases"],"summary":"Release a case back to the unassigned pool","description":"Release a case back to the unassigned pool.\n\n* Requires action case:Update","operationId":"CaseUnassign","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/augmented":{"post":{"tags":["Cases"],"summary":"Augment a case with additional context","description":"Inject additional context and route a case back to AI-level-2. Async — returns 202 once enqueued.\n\n* Requires action case:Update","operationId":"CaseAugment","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseAugmentInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"},"409":{"description":"case state forbids augmentation"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/claim":{"post":{"tags":["Cases"],"summary":"Claim a case from the unassigned pool","description":"Claim a case from the unassigned pool. The caller becomes the assignee.\n\n* Requires action case:Update","operationId":"CaseClaim","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/close":{"post":{"tags":["Cases"],"summary":"Close a case","description":"Close a case. All body fields are optional; when verdict is provided an assessment row is written.\n\n* Requires action case:Update","operationId":"CaseClose","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseCloseInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/helpers":{"post":{"tags":["Cases"],"summary":"Add a helper to a case","description":"Add a helper user to a case.\n\n* Requires action case:Update","operationId":"CaseAddHelper","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseAddHelperInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/helpers/{userID}":{"delete":{"tags":["Cases"],"summary":"Remove a helper from a case","description":"Remove a helper user from a case.\n\n* Requires action case:Update","operationId":"CaseRemoveHelper","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"userID","in":"path","required":true,"schema":{"type":"string","maxLength":256,"minLength":1}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/merge":{"post":{"tags":["Cases"],"summary":"Merge a case into a target","description":"Merge this case into the case identified by targetCaseId.\n\n* Requires action case:Update","operationId":"CaseMerge","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseMergeInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/notes":{"post":{"tags":["Cases"],"summary":"Add a note to a case","description":"Add a free-text note (1–10000 characters) to a case.\n\n* Requires action case:AddNote","operationId":"CaseAddNote","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseAddNoteInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/notes/{noteID}":{"patch":{"tags":["Cases"],"summary":"Edit a user-authored note","description":"Edit an existing free-text note. Full edit history is preserved.\nNo frozen-state gate — notes are allowed in any case state.\nThe caller must be the original note author.\n\n* Requires action case:AddNote","operationId":"CaseEditNote","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"noteID","in":"path","required":true,"schema":{"type":"string","maxLength":256,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseEditNoteInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied — caller is not the note author"},"404":{"description":"case or note not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/queue-position":{"get":{"tags":["Cases"],"summary":"Get a case's queue position","description":"Returns which AI queue(s) a case is in and its position from the front.\n\n* Requires action case:Load","operationId":"CaseQueuePosition","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/regen-summary":{"post":{"tags":["Cases"],"summary":"Request AI summary regeneration","description":"Enqueue an async AI summary regeneration without changing case state.\nBlocked on snoozed/closed cases. Returns 202 with a correlationId.\n\n* Requires action case:Update","operationId":"CaseRegenSummary","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseRegenSummaryInput"}}}},"responses":{"200":{"description":"OK"},"202":{"description":"regeneration enqueued — body carries a correlationId"},"403":{"description":"permission denied"},"404":{"description":"not found"},"422":{"description":"case is in a frozen state"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/reopen":{"post":{"tags":["Cases"],"summary":"Reopen a case","description":"Reopen a closed case.\n\n* Requires action case:Update","operationId":"CaseReopen","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/send-to-senior-ai":{"post":{"tags":["Cases"],"summary":"Send a case to the senior AI","description":"Re-engage the senior AI (pipeline-2). Async — returns 202 once enqueued. Returns 403 if the caller is not the assignee.\n\n* Requires action case:Update","operationId":"CaseSendToSeniorAI","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseSendToSeniorAIInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied — caller is not the assignee"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/snooze":{"post":{"tags":["Cases"],"summary":"Snooze a case","description":"Snooze a case until the supplied wake time.\n\n* Requires action case:Update","operationId":"CaseSnooze","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CaseSnoozeInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"delete":{"tags":["Cases"],"summary":"Wake a snoozed case","description":"Wake a snoozed case before its scheduled wake time.\n\n* Requires action case:Update","operationId":"CaseWake","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/start":{"post":{"tags":["Cases"],"summary":"Start working a case","description":"Mark a case as actively being worked.\n\n* Requires action case:Update","operationId":"CaseStart","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/stop":{"post":{"tags":["Cases"],"summary":"Stop working a case","description":"Stop actively working a case.\n\n* Requires action case:Update","operationId":"CaseStop","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/user-prioritized":{"post":{"tags":["Cases"],"summary":"Set user-prioritized flag on a case","description":"Mark a case as user-prioritized.\n\n* Requires action case:Update","operationId":"CaseSetUserPrioritized","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"delete":{"tags":["Cases"],"summary":"Clear user-prioritized flag on a case","description":"Clear the user-prioritized flag on a case.\n\n* Requires action case:Update","operationId":"CaseUnsetUserPrioritized","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cases/{caseID}/watch":{"post":{"tags":["Cases"],"summary":"Watch a case","description":"Subscribe to updates on a case.\n\n* Requires action case:Load","operationId":"CaseWatch","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"delete":{"tags":["Cases"],"summary":"Stop watching a case","description":"Unsubscribe from a case's updates.\n\n* Requires action case:Load","operationId":"CaseUnwatch","parameters":[{"name":"caseID","in":"path","required":true,"schema":{"type":"string","maxLength":36,"minLength":1}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/cluster/":{"get":{"tags":["Cluster"],"summary":"List clusters","description":"\nLists known clusters by by org.\n\n * Requires action org:ListClusters","operationId":"ClusterList","parameters":[{"name":"orgUID","in":"path","description":"Org UID","required":true,"schema":{"type":"string","description":"Org UID","maxLength":32}},{"name":"within_retention","in":"query","description":"Only return clusters with data within the org retention period","allowEmptyValue":true,"schema":{"type":"boolean","description":"Only return clusters with data within the org retention period"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/ClusterDetails"}}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/cluster/{clusterUID}":{"get":{"tags":["Cluster"],"summary":"Load cluster details","description":"\nLoads details for a cluster by org and cluster.\n * Requires action org:LoadCluster","operationId":"ClusterLoad","parameters":[{"name":"clusterUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClusterDetails"}}}},"403":{"description":"permission denied"},"404":{"description":"cluster not found"}}}},"/api/v1/org/{orgUID}/customflag/":{"get":{"tags":["CustomFlag"],"summary":"List custom flags","description":"\nThis will list all custom flags for an org\n* Requires the action  *org:ListCustomFlag* on the organization\n\t\t\t","operationId":"CustomFlagList","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"action_taken_equals","in":"query","description":"Filter by the action taken on the flag(s). Pulls from the history database table. One of [insert|update|delete|enable|disable]","schema":{"type":"string","description":"Filter by the action taken on the flag(s). Pulls from the history database table. One of [insert|update|delete|enable|disable]"}},{"name":"content_contains","in":"query","schema":{"type":"string"}},{"name":"flag_type_equals","in":"query","description":"Filter by the flag type","schema":{"type":"string","description":"Filter by the flag type"}},{"name":"from_history","in":"query","description":"Retrieves historical custom flags data. Pulls from the history database table","allowEmptyValue":true,"schema":{"type":"boolean","description":"Retrieves historical custom flags data. Pulls from the history database table"}},{"name":"impact_contains","in":"query","schema":{"type":"string"}},{"name":"is_enabled","in":"query","description":"Filter by the flag enabled status","allowEmptyValue":true,"schema":{"type":"boolean","description":"Filter by the flag enabled status"}},{"name":"is_not_enabled","in":"query","description":"Filter by the flag disabled status","allowEmptyValue":true,"schema":{"type":"boolean","description":"Filter by the flag disabled status"}},{"name":"latest_version","in":"query","description":"Filter by the latest version of the flag. Pulls from the history database table","allowEmptyValue":true,"schema":{"type":"boolean","description":"Filter by the latest version of the flag. Pulls from the history database table"}},{"name":"name_contains","in":"query","schema":{"type":"string"}},{"name":"name_or_uid_contains","in":"query","schema":{"type":"string"}},{"name":"page","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"page_size","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"query_contains","in":"query","schema":{"type":"string"}},{"name":"query_equals","in":"query","schema":{"type":"string"}},{"name":"query_uid_equals","in":"query","description":"Filter by the saved query UID","schema":{"type":"string","description":"Filter by the saved query UID"}},{"name":"reversed","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"schema_equals","in":"query","schema":{"type":"string"}},{"name":"severity_equals","in":"query","schema":{"type":"string"}},{"name":"sort_by","in":"query","description":"Sort the results by a field. One of [name|description|create_time|query|schema|severity|impact|last_updated|is_enabled]","schema":{"type":"string","description":"Sort the results by a field. One of [name|description|create_time|query|schema|severity|impact|last_updated|is_enabled]"}},{"name":"tags_contain","in":"query","schema":{"type":"array","items":{"type":"string"}},"style":"form","explode":true},{"name":"uid_equals","in":"query","schema":{"type":"string"}},{"name":"version","in":"query","description":"Filter by the flag version. Pulls from the history database table","schema":{"type":"integer","description":"Filter by the flag version. Pulls from the history database table","format":"int32"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionListCustomFlagOutput"}}}},"403":{"description":"permission denied"}}},"post":{"tags":["CustomFlag"],"summary":"Create a custom flag.","description":"\nThis will create a new custom flag for an org\n* Requires the action  *org:CreateCustomFlag* on the organization\n\t\t\t","operationId":"CustomFlagCreate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CustomFlagCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionCreateCustomFlagOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/customflag/{customFlagUID}":{"get":{"tags":["CustomFlag"],"summary":"Load a custom flag","description":"\nThis will retrieve a specific custom flag for an org\n* Requires the action  *org:LoadCustomFlag* on the organization\n\t\t\t","operationId":"CustomFlagLoad","parameters":[{"name":"customFlagUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionLoadCustomFlagOutput"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"put":{"tags":["CustomFlag"],"summary":"Update a custom flag.","description":"\nThis will update a specific custom flag for an org\n* Requires the action  *org:UpdateCustomFlag* on the organization\n\t\t\t","operationId":"CustomFlagUpdate","parameters":[{"name":"customFlagUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CustomFlagUpdateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionUpdateCustomFlagOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"delete":{"tags":["CustomFlag"],"summary":"Delete a custom flag.","description":"\nThis will delete a specific custom flag for an org\n* Requires the action  *org:DeleteCustomFlag* on the organization\n\t\t\t","operationId":"CustomFlagDelete","parameters":[{"name":"customFlagUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/customflag/{customFlagUID}/disable":{"put":{"tags":["CustomFlag"],"summary":"Disable a custom flag.","description":"\nThis will disable a specific custom flag for an org\n* Requires the action  *org:DisableCustomFlag* on the organization\n\t\t\t","operationId":"CustomFlagDisable","parameters":[{"name":"customFlagUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/customflag/{customFlagUID}/enable":{"put":{"tags":["CustomFlag"],"summary":"Enable a custom flag.","description":"\nThis will enable a specific custom flag for an org\n* Requires the action  *org:EnableCustomFlag* on the organization\n\t\t\t","operationId":"CustomFlagEnable","parameters":[{"name":"customFlagUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/events/*iterator":{"get":{"tags":["ForwardedEvents"],"summary":"Query for forwarded events for a 3rd-party SIEM","description":"\nReturn forwarded events using the supplied iterator. OLDEST will return the oldest\nevents, LATEST will return return an iterator for the current end of the stream.\nIf no iterator is provided, OLDEST will be used.\n* Requires the action  *source_data:Query* on the organization\n\t\t\t","operationId":"ForwardEvents","parameters":[{"name":"orgUID","in":"path","description":"Organization UID","required":true,"schema":{"type":"string","description":"Organization UID"}},{"name":"limit","in":"query","description":"Requested event count. A request of 10000 lets the server deliver as many events as it wants; smaller values are honored as a strict upper bound.","schema":{"type":"integer","description":"Requested event count. A request of 10000 lets the server deliver as many events as it wants; smaller values are honored as a strict upper bound.","format":"int32","maximum":10000,"minimum":1000}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/files/watchlist":{"get":{"tags":["Watchlist"],"summary":"Query watchlist entries","description":"\nThis will query the watchlist entries for an org\n\n* Requires the action  *org:QueryWatchlist* on the organization\n\t\t\t","operationId":"WatchlistQuery","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DaoWatchlist"}}}}},"403":{"description":"permission denied"}}},"post":{"tags":["Watchlist"],"summary":"Create a watchlist entry","description":"\nThis will create a new watchlist entry for an org\n            \n* Requires the action  *org:CreateWatchlist* on the organization\n            ","operationId":"WatchlistCreate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WatchlistCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiWatchlistCreateHandlerOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/files/watchlist/{watchlistID}":{"get":{"tags":["Watchlist"],"summary":"Load a watchlist entry","description":"\nThis will retrieve a specific watchlist entry for an org\n            \n* Requires the action  *org:LoadWatchlist* on the organization\n            ","operationId":"WatchlistLoad","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"watchlistID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DaoWatchlist"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"put":{"tags":["Watchlist"],"summary":"Update a watchlist entry","description":"\nThis will update a specific watchlist entry for an org\n            \n* Requires the action  *org:UpdateWatchlist* on the organization\n            ","operationId":"WatchlistUpdate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"watchlistID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/WatchlistUpdateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DaoWatchlist"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}},"delete":{"tags":["Watchlist"],"summary":"Delete a watchlist entry","description":"\nThis will delete the specified watchlist entry from an org\n            \n* Requires the action  *org:DeleteWatchlist* on the organization\n            ","operationId":"WatchlistDelete","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"watchlistID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/fingerprint/search":{"post":{"tags":["FingerprintData"],"summary":"Start a fingerprint search job","description":"\nStart a fingerprint search job.\n\n* Requires action *source_data:Query*\n","operationId":"FingerprintDataSearch","parameters":[{"name":"orgUID","in":"path","description":"Organization UID to query","required":true,"schema":{"type":"string","description":"Organization UID to query"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/FingerprintDataSearchInput"}}}},"responses":{"200":{"description":"OK"},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/fingerprint/search/{jobID}":{"post":{"tags":["FingerprintData"],"summary":"Get the results of a fingerprint search job","description":"\nGet the results of a fingerprint search job.\nIf a status is returned, it means the job is still running or has failed.\nTo continue polling for results, use the same jobID in the next request.\n\n* Requires action *source_data:Query*\n","operationId":"FingerprintDataSearchJob","parameters":[{"name":"jobID","in":"path","description":"Job ID to get results for","required":true,"schema":{"type":"string","description":"Job ID to get results for","maxLength":16128}},{"name":"orgUID","in":"path","description":"Organization UID to query","required":true,"schema":{"type":"string","description":"Organization UID to query"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/FingerprintDataSearchJobInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionFingerprintSearchResults"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/initialize_notifications/ref/{refUID}":{"post":{"tags":["Notifications"],"summary":"Initialize notifications for an object. Usually a saved query or custom flag.","operationId":"NotificationSettingsInitialize","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"refUID","in":"path","description":"The uid of the saved query or custom flag to initialize notifications for.","required":true,"schema":{"type":"string","description":"The uid of the saved query or custom flag to initialize notifications for."}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationSettingsInitializeInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionInitializeNotificationSettingsOutput"}}}},"400":{"description":"bad request"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/investigation/":{"get":{"tags":["Investigation"],"summary":"List investigations","description":"\nLists investigations\n\n * Will list investigations which the user has the action *investigation:Load* or *investigation:LoadExpired* on\n","operationId":"InvestigationList","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DaoInvestigation"}}}}},"400":{"description":"invalid query parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}},"post":{"tags":["Investigation"],"summary":"Create an investigation","description":"\nCreate an investigationan\n\n * Requires the user have the action *investigation:Create*\n","operationId":"InvestigationCreate","parameters":[{"name":"orgUID","in":"path","description":"Investigation OrgUID","required":true,"schema":{"type":"string","description":"Investigation OrgUID","maxLength":64,"minLength":9}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvestigationCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiInvestigationCreateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/investigation/{investigationUID}":{"get":{"tags":["Investigation"],"summary":"Load an investigation","description":"\nLoads an investigation by UID. \n\n * Requires action  *investigation:Load* to load an active investigation\n * Requires action *investigation:LoadExpired* to load expired investigations\n\n","operationId":"InvestigationLoad","parameters":[{"name":"investigationUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DaoInvestigation"}}}},"403":{"description":"permission denied"}}},"put":{"tags":["Investigation"],"summary":"Update an investigation","description":"\nUpdates the investigationan\n\n * Requires the user have the action *investigation:Update*\n","operationId":"InvestigationUpdate","parameters":[{"name":"investigationUID","in":"path","description":"Investigation UID","required":true,"schema":{"type":"string","description":"Investigation UID"}},{"name":"orgUID","in":"path","description":"Investigation OrgUID","required":true,"schema":{"type":"string","description":"Investigation OrgUID","maxLength":64,"minLength":9}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvestigationUpdateInput"}}}},"responses":{"200":{"description":"OK"},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}},"delete":{"tags":["Investigation"],"summary":"Delete an investigation","description":"\nDeletes an investigation, by setting valid_to=now so that the investigation is virtually deleted.\n\n * Requires the user have the action *investigation:Delete*\n","operationId":"InvestigationDelete","parameters":[{"name":"investigationUID","in":"path","description":"Investigation UID","required":true,"schema":{"type":"string","description":"Investigation UID"}},{"name":"orgUID","in":"path","description":"Investigation OrgUID","required":true,"schema":{"type":"string","description":"Investigation OrgUID","maxLength":64,"minLength":9}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/investigation/{investigationUID}/version/":{"get":{"tags":["Investigation"],"summary":"List Investigation Versions","description":"\nLists prior version of this investigation\n\n * Requires the user have the action *investigation:ListVersions*\n","operationId":"InvestigationListVersions","parameters":[{"name":"investigationUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DaoInvestigation"}}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/investigation/{investigationUID}/version/{version}":{"get":{"tags":["Investigation"],"summary":"Load Investigation Version","description":"\nLoads a specific version of an investigation\n\n * Requires the user have the action *investigation:LoadVersion*\n","operationId":"InvestigationLoadVersion","parameters":[{"name":"investigationUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"version","in":"path","required":true,"schema":{"type":"integer","format":"int32"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DaoInvestigation"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/invite":{"post":{"tags":["Org"],"summary":"Invite users to an organization","description":"\nInvites users to an organization\n\n * Requires action *org:InviteUsers* on the organization to invite users\n\n","operationId":"OrgInviteUsers","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrgInviteUsersInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/notification_policy":{"put":{"tags":["Org"],"summary":"Update an organization's notification policy","description":"\nUpdates the organization's notification policy\n\nThe policy contains targets, which are named destinations, for example a list of admins, and then rules for how notifications\nare routed. The most basic notification is the default policy assigned to all organizations, which is to send notifications\nto the organization owner. \n\nEach notification has a schema which can be used to filter how notifications are routed. \n\nHere is an example notification policy:\n\n```\n{\n    \"targets\": {\n      \"admins\": {\n        \"emails\": [\n          \"admin1@foo.com\",\n          \"admin2@foo.com\"\n        ]\n      },\n      \"soc\": {\n        \"slack\": {\n          \"url\": \"http://app.slack.com/XXXX\"\n        }\n      }\n    },\n    \"routes\": [\n      {\n        \"target\": \"admins\",\n        \"expr\": {\n          \"schema\": \"agent_offline\"\n        }\n      },\n      {\n        \"target\": \"soc\",\n        \"expr\": {\n          \"schema\": \"spydertrace_updated\"\n        }\n      },\n      {\n        \"destination\": {\n          \"users\": [\n            \"X23hs8234lks\"\n          ]\n        }\n      }\n    ]\n  }\n```\n\nThis policy says that any notification with the schema \"agent_offline\" is send to the admin emails, and that any notifications with the schema \"spydertrace_update\" is send to the soc slack channel, and all other notifications are sent to a user specified by their UserUID. If a destination is an explicit UserUID then the users notification policy will applied, for example to notify them by their notification type of choice.  \n\n * The following destination types are currently supported, UserUID, Email, Slack, Webhook. See the associated destination definition in the notification policy for details. \n * First match for a routing rule wins, and further processsing of the notification stops. \n * If a UserUID is specified the users notification policy may be used to contact that user.\n * Each notification has an associated schema, which is used to provide a consistent schema for the notification.\n * Expressions are optional, if no expression is specified the route matches by default\n * If the content-type is application/hjson the policy will be parsed and stored as hjson, all comments will be lost on an existing hjson policy if it is uploaded as json\n\nThis is an example notification generated using a notification policy and dashboardsearch:\n\n```\n{\n\t\"uid\": \"lQ0Q1lKm\",\n\t\"org_uid\": \"your_org_uid\",\n\t\"valid_from\": \"2021-10-14T19:22:00.869159169Z\",\n\t\"title\": \"Spyderbat: Dashboard search notification Recent interactive (shell) Processes\",\n\t\"message\": \"Spyderbat: Dashboard search notification Recent interactive (shell) Processes\",\n\t\"data\": {\n\t  \"dashboardsearch\": {\n\t\t\"data\": {\n\t\t  \"createTime\": 1634237497.142,\n\t\t  \"createdBy\": \"user@example.com\"\n\t\t},\n\t\t\"description\": \"Recent interactive (shell) Processes\",\n\t\t\"notify\": true,\n\t\t\"notify_frequency\": 300,\n\t\t\"org_uid\": \"spyderbatuid\",\n\t\t\"search\": \"schema:model_process AND interactive:true\",\n\t\t\"uid\": \"RTBQoR3uucyjG8ZeHJmw\"\n\t  }\n\t},\n\t\"schema\": \"dashboard_saved_search\",\n\t\"records\": [\n\t  {\n\t\t\"total_hits\": 0\n\t  }\n\t]\n  }\n```\n\n * Requires the user have the action *org:UpdateNotificationPolicy* on the organization\n","operationId":"OrgUpdateNotificationPolicy","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"The notification policy","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationPolicy"}}},"required":true},"responses":{"200":{"description":"OK"},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/notification_policy/":{"get":{"tags":["Org"],"summary":"Load Notification Policy","description":"\nLoads the notification policy for an organization. The notification policy defines who and how the organization is notified. \n \n * If the content-type is application/hjson the policy will be returned as hjson\n * If the content-type is application/json the policy will be returned as json\n\n\n * Requires the user have the action *org:LoadNotificationPolicy* on the organization\n","operationId":"OrgLoadNotificationPolicy","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/hjson":{"schema":{"$ref":"#/components/schemas/NotificationPolicy"}},"application/json":{"schema":{"$ref":"#/components/schemas/NotificationPolicy"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/notification_policy/test_target":{"post":{"tags":["Org"],"summary":"Test Notification Target","description":"\nSends a test notification to a target.\n\n * Requires the user have the action *org:SendTestNotification* on the organization\n","operationId":"OrgTestNotificationTarget","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrgTestNotificationTargetInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/notification_settings/":{"get":{"tags":["Notifications"],"summary":"List notification settings.","operationId":"NotificationSettingsList","parameters":[{"name":"orgUID","in":"path","description":"Filter by the organization UID.","required":true,"schema":{"type":"string","description":"Filter by the organization UID."}},{"name":"feature_equals","in":"query","description":"Filter by the feature.","schema":{"type":"string","description":"Filter by the feature."}},{"name":"has_target_uid","in":"query","description":"Filter by whether the notification settings have a target UID.","schema":{"type":"string","description":"Filter by whether the notification settings have a target UID."}},{"name":"has_template_uid","in":"query","description":"Filter by whether the notification settings have a template UID.","schema":{"type":"string","description":"Filter by whether the notification settings have a template UID."}},{"name":"is_enabled","in":"query","description":"Filter by whether the notification settings are enabled.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Filter by whether the notification settings are enabled."}},{"name":"name_or_uid_contains","in":"query","description":"Filter by the name or UID.","schema":{"type":"string","description":"Filter by the name or UID."}},{"name":"name_or_uid_equals","in":"query","description":"Filter by the name or UID.","schema":{"type":"string","description":"Filter by the name or UID."}},{"name":"page","in":"query","description":"Page number to return.","schema":{"type":"integer","description":"Page number to return.","format":"int32"}},{"name":"page_size","in":"query","description":"Number of notification settings to return per page.","schema":{"type":"integer","description":"Number of notification settings to return per page.","format":"int32"}},{"name":"refUID_equals","in":"query","description":"Filter by the reference UID.","schema":{"type":"string","description":"Filter by the reference UID."}},{"name":"trigger_equals","in":"query","description":"Filter by the trigger.","schema":{"type":"string","description":"Filter by the trigger."}},{"name":"uid_equals","in":"query","description":"Filter by the notification settings UID.","schema":{"type":"string","description":"Filter by the notification settings UID."}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionListNotificationSettingsOutput"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/notification_settings/ref/{refUID}/disable":{"put":{"tags":["Notifications"],"summary":"Disable notification settings for an object. Usually a saved query or custom flag.","operationId":"NotificationSettingsDisable","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"refUID","in":"path","description":"The uid of the saved query or custom flag to disable notifications for.","required":true,"schema":{"type":"string","description":"The uid of the saved query or custom flag to disable notifications for."}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionDisableNotificationSettingsOutput"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/notification_settings/ref/{refUID}/enable":{"put":{"tags":["Notifications"],"summary":"Enable notification settings for an object. Usually a saved query or custom flag.","operationId":"NotificationSettingsEnable","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"refUID","in":"path","description":"The uid of the saved query or custom flag to enable notifications for.","required":true,"schema":{"type":"string","description":"The uid of the saved query or custom flag to enable notifications for."}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionEnableNotificationSettingsOutput"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/notification_settings/ref/{refUID}/set":{"put":{"tags":["Notifications"],"summary":"Set notification settings for an object. Usually a saved query or custom flag.","operationId":"NotificationSettingsSet","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"refUID","in":"path","description":"The uid of the saved query or custom flag to set notification settings for.","required":true,"schema":{"type":"string","description":"The uid of the saved query or custom flag to set notification settings for."}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationSettingsSetInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionSetNotificationSettingsOutput"}}}},"400":{"description":"bad request"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/notification_settings/{nsUID}":{"get":{"tags":["Notifications"],"summary":"Load a specific notification settings object.","operationId":"NotificationSettingsLoad","parameters":[{"name":"nsUID","in":"path","description":"The uid of the notification settings to load.","required":true,"schema":{"type":"string","description":"The uid of the notification settings to load."}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionLoadNotificationSettingsOutput"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/notification_template/":{"get":{"tags":["NotificationTemplate"],"summary":"List notification templates","description":"\nThis will list all notification templates for an org\n* Requires the action  *org:ListNotificationTemplate* on the organization\n\t\t\t","operationId":"NotificationTemplateList","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"action_taken_equals","in":"query","schema":{"type":"string"}},{"name":"from_history","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"latest_version","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"name_contains","in":"query","schema":{"type":"string"}},{"name":"name_equals","in":"query","schema":{"type":"string"}},{"name":"name_or_uid_contains","in":"query","schema":{"type":"string"}},{"name":"name_or_uid_equals","in":"query","schema":{"type":"string"}},{"name":"page","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"page_size","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"reversed","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"sort_by","in":"query","description":"Sort the results by a field. One of [name|description|create_time|last_updated|type]","schema":{"type":"string","description":"Sort the results by a field. One of [name|description|create_time|last_updated|type]"}},{"name":"tags_contain","in":"query","schema":{"type":"array","items":{"type":"string"}},"style":"form","explode":true},{"name":"type_equals","in":"query","schema":{"type":"string"}},{"name":"version","in":"query","schema":{"type":"integer","format":"int32"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionListNotificationTemplateOutput"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/notification_template/email/":{"post":{"tags":["NotificationTemplate"],"summary":"Create an email notification template.","description":"\nThis will create a new email notification template for an org\n* Requires the action  *org:CreateNotificationTemplate* on the organization\n\t\t\t","operationId":"NotificationTemplateEmailCreate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTemplateEmailCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionCreateNotificationTemplateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/notification_template/email/{notificationTemplateUID}":{"put":{"tags":["NotificationTemplate"],"summary":"Update a notification template.","description":"\nThis will update a specific email notification template for an org\n* Requires the action  *org:UpdateNotificationTemplate* on the organization\n\t\t\t","operationId":"NotificationTemplateEmailUpdate","parameters":[{"name":"notificationTemplateUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"clear_description","in":"query","description":"Clear the description of the notification template.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the description of the notification template."}},{"name":"clear_tags","in":"query","description":"Clear the tags of the notification template.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the tags of the notification template."}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTemplateEmailUpdateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionUpdateNotificationTemplateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/notification_template/pagerduty/":{"post":{"tags":["NotificationTemplate"],"summary":"Create a pagerduty notification template.","description":"\nThis will create a new pagerduty notification template for an org\n* Requires the action  *org:CreateNotificationTemplate* on the organization\n\t\t\t","operationId":"NotificationTemplatePagerDutyCreate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTemplatePagerDutyCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionCreateNotificationTemplateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/notification_template/pagerduty/{notificationTemplateUID}":{"put":{"tags":["NotificationTemplate"],"summary":"Update a notification template.","description":"\nThis will update a specific pagerduty notification template for an org\n* Requires the action  *org:UpdateNotificationTemplate* on the organization\n\t\t\t","operationId":"NotificationTemplatePagerDutyUpdate","parameters":[{"name":"notificationTemplateUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"clear_description","in":"query","description":"Clear the description of the notification template.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the description of the notification template."}},{"name":"clear_tags","in":"query","description":"Clear the tags of the notification template.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the tags of the notification template."}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTemplatePagerDutyUpdateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionUpdateNotificationTemplateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/notification_template/slack/":{"post":{"tags":["NotificationTemplate"],"summary":"Create a slack notification template.","description":"\nThis will create a new slack notification template for an org\n* Requires the action  *org:CreateNotificationTemplate* on the organization\n\t\t\t","operationId":"NotificationTemplateSlackCreate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTemplateSlackCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionCreateNotificationTemplateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/notification_template/slack/{notificationTemplateUID}":{"put":{"tags":["NotificationTemplate"],"summary":"Update a notification template.","description":"\nThis will update a specific slack notification template for an org\n* Requires the action  *org:UpdateNotificationTemplate* on the organization\n\t\t\t","operationId":"NotificationTemplateSlackUpdate","parameters":[{"name":"notificationTemplateUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"clear_description","in":"query","description":"Clear the description of the notification template.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the description of the notification template."}},{"name":"clear_tags","in":"query","description":"Clear the tags of the notification template.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the tags of the notification template."}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTemplateSlackUpdateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionUpdateNotificationTemplateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/notification_template/webhook/":{"post":{"tags":["NotificationTemplate"],"summary":"Create a webhook notification template.","description":"\nThis will create a new webhook notification template for an org\n* Requires the action  *org:CreateNotificationTemplate* on the organization\n\t\t\t","operationId":"NotificationTemplateWebhookCreate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTemplateWebhookCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionCreateNotificationTemplateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/notification_template/webhook/{notificationTemplateUID}":{"put":{"tags":["NotificationTemplate"],"summary":"Update a notification template.","description":"\nThis will update a specific webhook notification template for an org\n* Requires the action  *org:UpdateNotificationTemplate* on the organization\n\t\t\t","operationId":"NotificationTemplateWebhookUpdate","parameters":[{"name":"notificationTemplateUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"clear_description","in":"query","description":"Clear the description of the notification template.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the description of the notification template."}},{"name":"clear_tags","in":"query","description":"Clear the tags of the notification template.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the tags of the notification template."}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTemplateWebhookUpdateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionUpdateNotificationTemplateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/notification_template/{notificationTemplateUID}":{"get":{"tags":["NotificationTemplate"],"summary":"Load a notification template","description":"\nThis will retrieve a specific notification template for an org\n* Requires the action  *org:LoadNotificationTemplate* on the organization\n\t\t\t","operationId":"NotificationTemplateLoad","parameters":[{"name":"notificationTemplateUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionLoadNotificationTemplateOutput"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"delete":{"tags":["NotificationTemplate"],"summary":"Delete a notification template.","description":"\nThis will delete a specific notification template for an org\n* Requires the action  *org:DeleteNotificationTemplate* on the organization\n\t\t\t","operationId":"NotificationTemplateDelete","parameters":[{"name":"notificationTemplateUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/notificationtarget/":{"get":{"tags":["NotificationTarget"],"summary":"List notification targets","description":"\nThis will list all notification targets for an org\n* Requires the action  *org:ListNotificationTarget* on the organization\n\t\t\t","operationId":"NotificationTargetList","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"action_taken_equals","in":"query","description":"Filter by the action taken on the notification target(s). Pulls from the history database table. One of [insert|update|delete]","schema":{"type":"string","description":"Filter by the action taken on the notification target(s). Pulls from the history database table. One of [insert|update|delete]"}},{"name":"from_history","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"include_target_data","in":"query","description":"Include the potentially sensitive target data in the response. This could be emails, webhooks, keys, etc. Increased permissions are required to view this data.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Include the potentially sensitive target data in the response. This could be emails, webhooks, keys, etc. Increased permissions are required to view this data."}},{"name":"latest_version","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"name_contains","in":"query","schema":{"type":"string"}},{"name":"name_equals","in":"query","schema":{"type":"string"}},{"name":"name_or_uid_contains","in":"query","schema":{"type":"string"}},{"name":"name_or_uid_equals","in":"query","schema":{"type":"string"}},{"name":"page","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"page_size","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"reversed","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"sort_by","in":"query","description":"Sort the results by a field. One of [name|description|create_time|last_updated|type]","schema":{"type":"string","description":"Sort the results by a field. One of [name|description|create_time|last_updated|type]"}},{"name":"tags_contain","in":"query","schema":{"type":"array","items":{"type":"string"}},"style":"form","explode":true},{"name":"type_equals","in":"query","schema":{"type":"string"}},{"name":"type_not_equals","in":"query","schema":{"type":"string"}},{"name":"uid_equals","in":"query","schema":{"type":"string"}},{"name":"uid_in_list","in":"query","schema":{"type":"array","items":{"type":"string"}},"style":"form","explode":true},{"name":"version","in":"query","schema":{"type":"integer","format":"int32"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionNotificationTargetListOutput"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/notificationtarget/email/":{"post":{"tags":["NotificationTarget"],"summary":"Create an email notification target.","description":"\nThis will create a new email notification target for an org\n* Requires the action  *org:CreateNotificationTarget* on the organization\n\t\t\t","operationId":"NotificationTargetEmailCreate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTargetEmailCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionCreateNotificationTargetOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/notificationtarget/email/{notificationTargetUID}":{"put":{"tags":["NotificationTarget"],"summary":"Update a notification target.","description":"\nThis will update a specific email notification target for an org\n* Requires the action  *org:UpdateNotificationTarget* on the organization\n\t\t\t","operationId":"NotificationTargetEmailUpdate","parameters":[{"name":"notificationTargetUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"clear_description","in":"query","description":"Clear the description of the notification target.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the description of the notification target."}},{"name":"clear_tags","in":"query","description":"Clear the tags of the notification target.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the tags of the notification target."}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTargetEmailUpdateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionNotificationTargetUpdateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/notificationtarget/pagerduty/":{"post":{"tags":["NotificationTarget"],"summary":"Create a pagerduty notification target.","description":"\nThis will create a new pagerduty notification target for an org\n* Requires the action  *org:CreateNotificationTarget* on the organization\n\t\t\t","operationId":"NotificationTargetPagerDutyCreate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTargetPagerDutyCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionCreateNotificationTargetOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/notificationtarget/pagerduty/{notificationTargetUID}":{"put":{"tags":["NotificationTarget"],"summary":"Update a notification target.","description":"\nThis will update a specific pagerduty notification target for an org\n* Requires the action  *org:UpdateNotificationTarget* on the organization\n\t\t\t","operationId":"NotificationTargetPagerDutyUpdate","parameters":[{"name":"notificationTargetUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"clear_description","in":"query","description":"Clear the description of the notification target.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the description of the notification target."}},{"name":"clear_tags","in":"query","description":"Clear the tags of the notification target.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the tags of the notification target."}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTargetPagerDutyUpdateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionNotificationTargetUpdateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/notificationtarget/slack/":{"post":{"tags":["NotificationTarget"],"summary":"Create a slack notification target.","description":"\nThis will create a new slack notification target for an org\n* Requires the action  *org:CreateNotificationTarget* on the organization\n\t\t\t","operationId":"NotificationTargetSlackCreate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTargetSlackCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionCreateNotificationTargetOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/notificationtarget/slack/{notificationTargetUID}":{"put":{"tags":["NotificationTarget"],"summary":"Update a notification target.","description":"\nThis will update a specific slack notification target for an org\n* Requires the action  *org:UpdateNotificationTarget* on the organization\n\t\t\t","operationId":"NotificationTargetSlackUpdate","parameters":[{"name":"notificationTargetUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"clear_description","in":"query","description":"Clear the description of the notification target.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the description of the notification target."}},{"name":"clear_tags","in":"query","description":"Clear the tags of the notification target.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the tags of the notification target."}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTargetSlackUpdateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionNotificationTargetUpdateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/notificationtarget/webhook/":{"post":{"tags":["NotificationTarget"],"summary":"Create a webhook notification target.","description":"\nThis will create a new webhook notification target for an org\n* Requires the action  *org:CreateNotificationTarget* on the organization\n\t\t\t","operationId":"NotificationTargetWebhookCreate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTargetWebhookCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionCreateNotificationTargetOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/notificationtarget/webhook/{notificationTargetUID}":{"put":{"tags":["NotificationTarget"],"summary":"Update a notification target.","description":"\nThis will update a specific webhook notification target for an org\n* Requires the action  *org:UpdateNotificationTarget* on the organization\n\t\t\t","operationId":"NotificationTargetWebhookUpdate","parameters":[{"name":"notificationTargetUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"clear_description","in":"query","description":"Clear the description of the notification target.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the description of the notification target."}},{"name":"clear_tags","in":"query","description":"Clear the tags of the notification target.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Clear the tags of the notification target."}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationTargetWebhookUpdateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionNotificationTargetUpdateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/notificationtarget/{notificationTargetUID}":{"get":{"tags":["NotificationTarget"],"summary":"Load a notification target","description":"\nThis will retrieve a specific notification target for an org\n* Requires the action  *org:LoadNotificationTarget* on the organization\n\t\t\t","operationId":"NotificationTargetLoad","parameters":[{"name":"notificationTargetUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"include_target_data","in":"query","description":"Include the potentially sensitive target data in the response. This could be emails, webhooks, keys, etc. Increased permissions are required to view this data.","allowEmptyValue":true,"schema":{"type":"boolean","description":"Include the potentially sensitive target data in the response. This could be emails, webhooks, keys, etc. Increased permissions are required to view this data."}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionNotificationTargetLoadOutput"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"delete":{"tags":["NotificationTarget"],"summary":"Delete a notification target.","description":"\nThis will delete a specific notification target for an org\n* Requires the action  *org:DeleteNotificationTarget* on the organization\n\t\t\t","operationId":"NotificationTargetDelete","parameters":[{"name":"notificationTargetUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/objects/":{"post":{"tags":["AdhocSearch"],"summary":"Get objects by ID","description":"\nReturns objects by ID.\n\n * Requires action source_data:Query","operationId":"Objects","parameters":[{"name":"orgUID","in":"path","description":"Organization UID to query","required":true,"schema":{"type":"string","description":"Organization UID to query"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ObjectsInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionObjectQueryResponse"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/objects/poll_results":{"post":{"tags":["AdhocSearch"],"summary":"Gets the pending results for a given query","description":"\nReturns the next set of objects from a query previously started with\nstart_query. If 'complete' is true in the response, then there are no more\nresults and calling poll_results with the same query ID will return \"not found\".\n\n * Requires action source_data:Query","operationId":"ObjectsPollResults","parameters":[{"name":"orgUID","in":"path","description":"Organization UID to query","required":true,"schema":{"type":"string","description":"Organization UID to query"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ObjectsPollResultsInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionObjectPollResultsResponse"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/objects/start_query":{"post":{"tags":["AdhocSearch"],"summary":"Get objects by ID and graph link rules, returning a query ID for slow results","description":"\nReturns objects from the given IDs and links given with the graph rules.\nIf no rules are present, returns only the objects with the given IDs.\nIf results are slow to fetch, part of the results will be returned with a\nquery ID that can be used to fetch the remaining results from poll_results.\n\n * Requires action source_data:Query","operationId":"ObjectsStartQuery","parameters":[{"name":"orgUID","in":"path","description":"Organization UID to query","required":true,"schema":{"type":"string","description":"Organization UID to query"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ObjectsStartQueryInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionObjectStartQueryResponse"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/objects/stop_query":{"post":{"tags":["AdhocSearch"],"summary":"Terminates a running query","description":"\nTells the objects service that the given query is no longer needed, and\ncan be stopped or cleaned up. Future calls to poll results with this\nquery ID will return \"not found\".\n\n * Requires action source_data:Query","operationId":"ObjectsStopQuery","parameters":[{"name":"orgUID","in":"path","description":"Organization UID of the query","required":true,"schema":{"type":"string","description":"Organization UID of the query"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ObjectsStopQueryInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/objects/walk-graph":{"post":{"tags":["AdhocSearch"],"summary":"Get objects by ID and graph link rules","description":"\nReturns objects from the given IDs and links given with the graph rules.\n\n * Requires action source_data:Query","operationId":"ObjectsWalkGraph","parameters":[{"name":"orgUID","in":"path","description":"Organization UID to query","required":true,"schema":{"type":"string","description":"Organization UID to query"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ObjectsWalkGraphInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/response/agent/killpod/{podUID}":{"post":{"tags":["Agent Action"],"summary":"Kill a pod on an agent.","description":"\nThis will attempt to kill a pod on an kubernetes cluster.\n* Requires the action *agent:KillPod* on the organization\n\t\t\t","operationId":"AgentKillPod","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"podUID","in":"path","description":"The Spyderbat uid of the pod to kill","required":true,"schema":{"type":"string","description":"The Spyderbat uid of the pod to kill"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentKillPodInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionAgentKillPodOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"429":{"description":"too many requests"}}}},"/api/v1/org/{orgUID}/response/agent/killprocess/{processUID}":{"post":{"tags":["Agent Action"],"summary":"Kill a process on an agent.","description":"\nThis will attempt to kill a process on a node that an agent monitors.\n* Requires the action *agent:KillProcess* on the organization\n\t\t\t","operationId":"AgentKillProcess","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"processUID","in":"path","description":"The Spyderbat uid of the process to kill","required":true,"schema":{"type":"string","description":"The Spyderbat uid of the process to kill"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentKillProcessInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionAgentKillProcessOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"429":{"description":"too many requests"}}}},"/api/v1/org/{orgUID}/response/agent/scancontainer/{containerUID}":{"post":{"tags":["Agent Action"],"summary":"Scan a container.","description":"\nThis will run a scan of a container on a cluster that an agent monitors.\n* Requires the action *agent:ScanContainer* on the organization\n\t\t\t","operationId":"AgentScanContainer","parameters":[{"name":"containerUID","in":"path","description":"The Spyderbat uid of the container to scan","required":true,"schema":{"type":"string","description":"The Spyderbat uid of the container to scan"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentScanContainerInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionAgentScanContainerOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"429":{"description":"too many requests"}}}},"/api/v1/org/{orgUID}/role/":{"get":{"tags":["Org"],"summary":"List available roles","description":"\nAllows querying of the roles available to an organization\n\n * Requires the user have the action *org:ListRoles* on the organization\n","operationId":"ListRoles","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"role_uid_equals","in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/RbacRole"}}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/savedquery/":{"get":{"tags":["SavedQuery"],"summary":"List saved queries","description":"\nThis will list all saved queries for an org\n* Requires the action  *org:ListSavedQuery* on the organization\n\t\t\t","operationId":"SavedQueryList","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"has_notifications","in":"query","description":"Filter the results to only include saved queries with notification settings","allowEmptyValue":true,"schema":{"type":"boolean","description":"Filter the results to only include saved queries with notification settings"}},{"name":"name_contains","in":"query","schema":{"type":"string"}},{"name":"name_equals","in":"query","schema":{"type":"string"}},{"name":"name_or_uid_contains","in":"query","schema":{"type":"string"}},{"name":"page","in":"query","description":"0-based page numbers of saved query results.","schema":{"type":"integer","description":"0-based page numbers of saved query results.","format":"int32"}},{"name":"page_size","in":"query","description":"The number of records to return for a single API call. Default 10. -1 means all.","schema":{"type":"integer","description":"The number of records to return for a single API call. Default 10. -1 means all.","format":"int32","maximum":100,"minimum":-1}},{"name":"query_contains","in":"query","schema":{"type":"string"}},{"name":"query_equals","in":"query","schema":{"type":"string"}},{"name":"reversed","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"schema_contains","in":"query","schema":{"type":"string"}},{"name":"schema_equals","in":"query","schema":{"type":"string"}},{"name":"sort_by","in":"query","description":"Sort the results by a field. One of [last_used|name|description|create_time|query|schema]","schema":{"type":"string","description":"Sort the results by a field. One of [last_used|name|description|create_time|query|schema]"}},{"name":"uid_equals","in":"query","schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionListSavedQueryOutput"}}}},"403":{"description":"permission denied"}}},"post":{"tags":["SavedQuery"],"summary":"Saved an Spyderbat Search Language query.","description":"\nThis will save a new search query for an org\n* Requires the action  *org:CreateSavedQuery* on the organization\n\t\t","operationId":"SavedQueryCreate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SavedQueryCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionCreateSavedQueryOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/savedquery/additional-settings":{"get":{"tags":["SavedQuery"],"summary":"Show additional settings for a saved query","description":"\nThis will show the additional settings for a saved query\n\t\t\t","operationId":"SavedQueryShowAdditionalSettings","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"schema","in":"query","description":"The schema to show additional settings for.","required":true,"schema":{"type":"string","description":"The schema to show additional settings for.","maxLength":128}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionSavedQueryShowAdditionalSettingsOutput"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/savedquery/{savedQueryUID}":{"get":{"tags":["SavedQuery"],"summary":"Load a saved query","description":"\nThis will retrieve a specific saved query for an org\n* Requires the action  *org:LoadSavedQuery* on the organization\n\t\t\t","operationId":"SavedQueryLoad","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"savedQueryUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionLoadSavedQueryOutput"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"put":{"tags":["SavedQuery"],"summary":"Update a saved query","description":"\nThis will update a specific saved query for an org\n* Requires the action  *org:UpdateSavedQuery* on the organization\n\t\t\t","operationId":"SavedQueryUpdate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"savedQueryUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SavedQueryUpdateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionUpdateSavedQueryOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}},"delete":{"tags":["SavedQuery"],"summary":"Delete a saved query","description":"\nThis will delete a specific saved query for an org\n* Requires the action  *org:DeleteSavedQuery* on the organization\n\t\t\t","operationId":"SavedQueryDelete","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"savedQueryUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/savedquery/{savedQueryUID}/dependents":{"get":{"tags":["SavedQuery"],"summary":"List dependents of a saved query","description":"\nThis will list the UIDs of all dependents of a saved query within an org\n* Requires the action  *org:LoadSavedQuery* on the organization. And\nRequires permission to list dependents of the saved query.\n\t\t\t","operationId":"SavedQueryDependentsList","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"savedQueryUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionQueryDependentResources"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/savedquery/{savedQueryUID}/updatelastused":{"put":{"tags":["SavedQuery"],"summary":"Update the last used time of a saved query","description":"\nThis will update the last used time of a specific saved query for an org\n* Requires the action  *org:UpdateSavedQuery* on the organization\n\t\t\t","operationId":"SavedQueryUpdateLastUsed","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"savedQueryUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/search/":{"post":{"tags":["AdhocSearch"],"summary":"Start an adhoc search","description":"\nStarts an ahdoc search. Returns an ID that can be used to get results.\n\n * Requires action source_data:Query","operationId":"Search","parameters":[{"name":"orgUID","in":"path","description":"Organization UID to query","required":true,"schema":{"type":"string","description":"Organization UID to query"}},{"name":"limit","in":"query","description":"Maximum number of results to return","schema":{"type":"integer","description":"Maximum number of results to return","format":"int32","maximum":100000000}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SearchInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/search/convert/":{"post":{"tags":["AdhocSearch"],"summary":"Convert an adhoc search","description":"\nConverts an ahdoc search.\n\n * Requires action source_data:Query","operationId":"Convert","parameters":[{"name":"orgUID","in":"path","description":"Organization UID to query","required":true,"schema":{"type":"string","description":"Organization UID to query"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConvertInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/search/parse-query/":{"post":{"tags":["AdhocSearch"],"summary":"Returns a structured representation of a query without running it","description":"\nParses and validates a search query, then returns a structured representation of the parsed query.\nDoes not run the provided query.\n\n * Requires action source_data:Query","operationId":"Parse Search Query","parameters":[{"name":"orgUID","in":"path","description":"Organization UID to query","required":true,"schema":{"type":"string","description":"Organization UID to query"}},{"name":"limit","in":"query","description":"Maximum number of results to return","schema":{"type":"integer","description":"Maximum number of results to return","format":"int32","maximum":100000000}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Parse Search QueryInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/search/schema/":{"get":{"tags":["AdhocSearch"],"summary":"Schema for an adhoc search","description":"\nSchema for an ahdoc search.\n\n * Requires action source_data:Query","operationId":"Schema","parameters":[{"name":"orgUID","in":"path","description":"Organization UID to query","required":true,"schema":{"type":"string","description":"Organization UID to query"}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/search/validate/":{"post":{"tags":["AdhocSearch"],"summary":"Validate an adhoc search","description":"\nValidates an ahdoc search.\n\n * Requires action source_data:Query","operationId":"Validate","parameters":[{"name":"orgUID","in":"path","description":"Organization UID to query","required":true,"schema":{"type":"string","description":"Organization UID to query"}},{"name":"limit","in":"query","description":"Maximum number of results to return","schema":{"type":"integer","description":"Maximum number of results to return","format":"int32","maximum":100000000}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidateInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/search/{jobID}":{"post":{"tags":["AdhocSearch"],"summary":"Start an adhoc search","description":"\nReturns data from an adhoc search job.\n\n * Requires action source_data:Query","operationId":"Results","parameters":[{"name":"jobID","in":"path","description":"Job ID to get results for","required":true,"schema":{"type":"string","description":"Job ID to get results for","maxLength":16128}},{"name":"orgUID","in":"path","description":"Organization UID to query","required":true,"schema":{"type":"string","description":"Organization UID to query"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResultsInput"}}}},"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/searchset/":{"get":{"tags":["SearchSet"],"summary":"List search sets","description":"\nThis will list the search sets for an org with specific parameters\n\n* Requires the action  *org:ListSearchSet* on the organization\n\t\t\t","operationId":"SearchSetList","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"from_archive","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"has_tags","in":"query","schema":{"type":"array","items":{"type":"string"},"maxItems":30},"style":"form","explode":true},{"name":"name_contains","in":"query","schema":{"type":"string","maxLength":64}},{"name":"name_equals","in":"query","schema":{"type":"string","maxLength":64}},{"name":"name_or_uid_contains","in":"query","schema":{"type":"string","maxLength":64}},{"name":"type","in":"query","schema":{"type":"string","maxLength":64}},{"name":"uid_equals","in":"query","schema":{"type":"string","maxLength":64}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DaoOutputSearchSet"}}}}},"403":{"description":"permission denied"}}},"put":{"tags":["SearchSet"],"summary":"Update an search set","description":"\nThis will update a specific search set for an org\n\n* Requires the action  *org:UpdateSearchSet* on the organization\n\t\t\t","operationId":"SearchSetUpdate","parameters":[{"name":"orgUID","in":"path","description":"The org this source is associated with","required":true,"schema":{"type":"string","description":"The org this source is associated with"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SearchSetUpdateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DaoOutputSearchSet"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"},"404":{"description":"search set not found"}}},"post":{"tags":["SearchSet"],"summary":"Create a search set","description":"\nThis will create a new search set for an org\n\n* Requires the action  *org:CreateSearchSet* on the organization\n\t\t","operationId":"SearchSetCreate","parameters":[{"name":"orgUID","in":"path","description":"The org this search set is associated with","required":true,"schema":{"type":"string","description":"The org this search set is associated with"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SearchSetCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiSearchSetCreateHandlerOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/searchset/{searchsetUID}":{"get":{"tags":["SearchSet"],"summary":"Load an search set","description":"\nThis will retrieve a specific search set for an org\n\n* Requires the action  *org:LoadSearchSet* on the organization\n\t\t\t","operationId":"SearchSetLoad","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"searchsetUID","in":"path","required":true,"schema":{"type":"string","maxLength":64}},{"name":"archive_version","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"latest_archive_version","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DaoOutputSearchSet"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"delete":{"tags":["SearchSet"],"summary":"Delete an search set","description":"\nThis will delete the specified searchset from an org\n\n* Requires the action  *org:DeleteSearchSet* on the organization\n\t\t\t","operationId":"SearchSetDelete","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"searchsetUID","in":"path","required":true,"schema":{"type":"string","maxLength":64}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/source/":{"get":{"tags":["Source"],"summary":"List sources","description":"\nLists the sources of data for an organization\n\n* Requires the action  *org:ListSources* on the organization\n","operationId":"SrcList","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"agent_uid_equals","in":"query","schema":{"type":"string","maxLength":64}},{"name":"description_contains","in":"query","schema":{"type":"string","maxLength":32}},{"name":"filter","in":"query","schema":{"type":"string"}},{"name":"has_tags","in":"query","schema":{"type":"array","items":{"type":"string"},"maxItems":10},"style":"form","explode":true},{"name":"is_archived","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"is_not_archived","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"original_association","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"page","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"page_size","in":"query","schema":{"type":"integer","format":"int32","maximum":100}},{"name":"status","in":"query","schema":{"type":"string"}},{"name":"within_retention","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Source"}}}}},"403":{"description":"permission denied"}}},"post":{"tags":["Source"],"summary":"Create a source","description":"\nCreates a new source of data\n\n* Requires the action  *org:CreateSource* on the organization\n","operationId":"SrcCreate","parameters":[{"name":"orgUID","in":"path","description":"The org this source is associated with","required":true,"schema":{"type":"string","description":"The org this source is associated with"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SrcCreateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiSourceCreateHandlerOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/source/{sourceUID}":{"get":{"tags":["Source"],"summary":"Load a source","description":"\nLoads the meta data for a source of data\n\n* Requires the action  *org:LoadSource* on the organization\n","operationId":"SrcLoad","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"sourceUID","in":"path","required":true,"schema":{"type":"string","maxLength":64}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Source"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}},"put":{"tags":["Source"],"summary":"Update a source","description":"\nUpdates the meta data for a source of data\n\n* Requires the action  *org:UpdateSource* on the organization\n","operationId":"SrcUpdate","parameters":[{"name":"orgUID","in":"path","description":"The org this source is associated with","required":true,"schema":{"type":"string","description":"The org this source is associated with","maxLength":64}},{"name":"sourceUID","in":"path","description":"The UID of the source","required":true,"schema":{"type":"string","description":"The UID of the source","maxLength":64}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SrcUpdateInput"}}}},"responses":{"200":{"description":"OK"},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}},"delete":{"tags":["Source"],"summary":"Delete a source","description":"\nDelete a source\n\n* Requires the action  *org:DeleteSource* on the organization\n","operationId":"SrcDelete","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"sourceUID","in":"path","required":true,"schema":{"type":"string","maxLength":64}}],"responses":{"200":{"description":"OK"},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/source/{sourceUID}/data/{dataType}":{"post":{"tags":["SourceData"],"summary":"Send data to a source, this is expected to be gzip compressed nd-json. The 'Content-Encoding' header should be specified with a value of 'gzip'. Alternatively, a multi-part form upload may be used with gzipped data up to a maximum size of 1MB.","description":"Sends data to a source","operationId":"SrcSendData","parameters":[{"name":"dataType","in":"path","required":true,"schema":{"type":"string","maxLength":128}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"sourceUID","in":"path","required":true,"schema":{"type":"string","maxLength":64}}],"requestBody":{"description":"The data sent from the source","content":{"multipart/form-data":{"schema":{"type":"object","properties":{"encoding":{"type":"string","description":"must be gzip"},"file":{"type":"string","description":"The file to upload. The file must be a valid gzip-ed JSON file.","format":"binary"}},"required":["file","encoding"]}}},"required":true},"responses":{"200":{"description":"OK"},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/sourceaggregate/":{"get":{"tags":["Source"],"summary":"Count sources aggregated by a property","description":"\nCount the sources of data for an organization with various filtering options\n\n* Requires the action  *org:ListSources* on the organization\n","operationId":"SrcAggregateCount","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"agent_uid_equals","in":"query","schema":{"type":"string","maxLength":64}},{"name":"count_by","in":"query","description":"Aggregate source counts by this property. One of [status|type]","schema":{"type":"string","description":"Aggregate source counts by this property. One of [status|type]"}},{"name":"description_contains","in":"query","schema":{"type":"string","maxLength":32}},{"name":"filter","in":"query","schema":{"type":"string"}},{"name":"has_tags","in":"query","schema":{"type":"array","items":{"type":"string"},"maxItems":10},"style":"form","explode":true},{"name":"within_retention","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DaoSourceAgg"}}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/sourcecount/":{"get":{"tags":["Source"],"summary":"Count sources","description":"\nCount the sources of data for an organization with various filtering options\n\n* Requires the action  *org:ListSources* on the organization\n","operationId":"SrcListCount","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}},{"name":"agent_uid_equals","in":"query","schema":{"type":"string","maxLength":64}},{"name":"description_contains","in":"query","schema":{"type":"string","maxLength":32}},{"name":"filter","in":"query","schema":{"type":"string"}},{"name":"has_tags","in":"query","schema":{"type":"array","items":{"type":"string"},"maxItems":10},"style":"form","explode":true},{"name":"is_archived","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"is_not_archived","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"original_association","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}},{"name":"page","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"page_size","in":"query","schema":{"type":"integer","format":"int32","maximum":100}},{"name":"status","in":"query","schema":{"type":"string"}},{"name":"within_retention","in":"query","allowEmptyValue":true,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiCountResponse"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/spyctl/diff/":{"post":{"tags":["Spyctl"],"summary":"Diff spyderbat documents","description":"\nThis will diff one or more spyderbat documents with a primary document and return the diff output.\n\t\t\t","operationId":"SpyctlDiff","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SpyctlDiffInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionSpyctlDiffOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/spyctl/guardianpolicy/build/":{"post":{"tags":["Spyctl"],"summary":"Build a new Guardian Policy document","description":"\nThis will build and return a new Guardian Policy document which can then be applied via the AnalyticsPolicy API.\n* Requires the user have the action *spyctl:GuardianPolicyBuild\n\t\t\t","operationId":"GuardianPolicyBuild","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GuardianPolicyBuildInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionSpyctlGuardianPolicyBuildOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/spyctl/merge/":{"post":{"tags":["Spyctl"],"summary":"Merge spyderbat documents","description":"\nThis will merge one or more spyderbat documents into a primary document and return the merged document.\n\t\t\t","operationId":"SpyctlMerge","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SpyctlMergeInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionSpyctlMergeOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/spyctl/report":{"post":{"tags":["Spyctl"],"summary":"Generate a spyderbat report","description":"\nThis will schedule a report to be generated based on provided input report type and arguments.\n\t\t\t","operationId":"SpyctlReportGenerate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SpyctlReportGenerateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionSpyctlReportOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/spyctl/report/":{"get":{"tags":["Spyctl"],"summary":"Get list of spyderbat reports for an org","description":"\nThis will return the list of reports generated for an organization.\n\t\t\t","operationId":"SpyctlReportList","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionSpyctlReportListOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}},"post":{"tags":["Spyctl"],"summary":"Get list of spyderbat reports for an org, paginated","description":"\nThis will return the list of reports generated for an organization, paginated with 1000 reports per page.\n\t\t\t","operationId":"SpyctlReportListPager","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SpyctlReportListPagerInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionSpyctlReportListPagerOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/spyctl/report/download/{id.format}":{"get":{"tags":["Spyctl"],"summary":"Download a spyderbat report","description":"\nThis will download a published report.\n\t\t\t","operationId":"SpyctlReportDownload","parameters":[{"name":"id.format","in":"path","description":"identifier and format, delimited by a dot for the report and format to download","required":true,"schema":{"type":"string","description":"identifier and format, delimited by a dot for the report and format to download"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/spyctl/report/inventory":{"get":{"tags":["Spyctl"],"summary":"Report inventory of spyderbat reports","description":"\nThis will return a report of the inventory of available spyderbat reports to generate and their metadata.\n\t\t\t","operationId":"SpyctlReportInventory","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionSpyctlReportInventoryOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/spyctl/report/status/{id}":{"get":{"tags":["Spyctl"],"summary":"Check status of spyderbat report","description":"\nThis will check for the generation status of a report and return all the report metadata.\n\t\t\t","operationId":"SpyctlReportStatus","parameters":[{"name":"id","in":"path","description":"identifier for the report to check status for","required":true,"schema":{"type":"string","description":"identifier for the report to check status for"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionSpyctlReportOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/spyctl/report/{id}":{"delete":{"tags":["Spyctl"],"summary":"Delete a spyderbat report","description":"\nThis will delete a report.\n\t\t\t","operationId":"SpyctlReportDelete","parameters":[{"name":"id","in":"path","description":"identifier for the report to check status for","required":true,"schema":{"type":"string","description":"identifier for the report to check status for"}},{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionSpyctlReportDeleteOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/spyctl/suppressionpolicy/build/":{"post":{"tags":["Spyctl"],"summary":"Build a new Suppression Policy document","description":"\nThis will build and return a new Suppression Policy document which can then be applied via the AnalyticsPolicy API.\n* Requires the user have the action *spyctl:SuppressionPolicyBuild\n\t\t\t","operationId":"SuppressionPolicyBuild","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SuppressionPolicyBuildInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionSpyctlSuppressionPolicyBuildOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/spyctl/validate/":{"post":{"tags":["Spyctl"],"summary":"Validate a spyderbat document","description":"\nThis will verify that a spyderbat document matches a validation schema. If the document is not valid, this will return a message detailing the error.\n\t\t\t","operationId":"SpyctlValidate","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SpyctlValidateInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionSpyctlValidateOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/suppress/trace":{"post":{"tags":["Suppress"],"summary":"Suppress a trace signature.","description":"\nThis will suppress a trace signature for an org\n* Requires the actions  *org:SuppressTrace, org:CreateAnalyticsPolicy, org:UpdateAnalyticsPolicy* on the organization\n\t\t","operationId":"SuppressTrace","parameters":[{"name":"orgUID","in":"path","description":"Organization UID to query","required":true,"schema":{"type":"string","description":"Organization UID to query"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SuppressTraceInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionSuppressTraceOutput"}}}},"400":{"description":"invalid input parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/test_notification":{"post":{"tags":["Notifications"],"summary":"Test a notification settings object.","description":"\nThis will send test notifications to a specific notification target\n* Requires the action *org:LoadNotificationSettings* on the organization.\n\t\t\t","operationId":"NotificationSettingsTest","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotificationSettingsTestInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionTestNotificationOutput"}}}},"403":{"description":"permission denied"},"404":{"description":"not found"}}}},"/api/v1/org/{orgUID}/type":{"get":{"tags":["OrgType"],"summary":"Load the org type for the organization","description":"\nLoads the org type for the organiation\n\n * Requires action *org:Load*\n","operationId":"OrgTypeLoad","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DaoOrgType"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/type/limit/active_sources":{"get":{"tags":["OrgType"],"summary":"Loads limits regarding active sources","description":"\nLoads the limits regarding active sources allowed on the organization, the active\nsources in an org are calculated on a 5m0s basis. \n\n * Requires action *org:Load*\n","operationId":"OrgTypeLimitActiveSources","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionOrgTypeMaxLimit"}}}},"403":{"description":"permission denied"}}}},"/api/v1/org/{orgUID}/type/limit/org_roles":{"get":{"tags":["OrgType"],"summary":"Loads limits regarding org roles","description":"\nLoads the limit information regarding the number of associated roles allowed\nper an organization\n\n * Requires action *org:Load*\n","operationId":"OrgTypeLimitOrgRoles","parameters":[{"name":"orgUID","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionOrgTypeMaxLimit"}}}},"403":{"description":"permission denied"}}}},"/api/v1/rbac/capabilities/":{"post":{"tags":["RBAC"],"summary":"Query allows actions on objects","description":"Allows for querying of what actions a user can perform; results may be cached for a short period of time.\n\nEach action names the resource it is queried against with a Spyderbat Resource Name (SRN) in\n'resource_name'. An SRN has five colon-separated fields:\n\n    srn:\u003cservice\u003e:\u003cregion\u003e:\u003corg\u003e:\u003cresource\u003e\n\nA field left empty matches broadly for that dimension. To query an org-scoped action without\ntargeting a specific org — for example a global \"load expired orgs\" check — use the org-less SRN\n'srn:org:::' rather than an empty string. A malformed 'resource_name' cannot be evaluated and is\nrejected with a 400 rather than reported as a denied ('can_perform: false') result.\n\nAn unrecognized 'action' does not fail the request: that entry is returned with 'can_perform' false\nand an 'error' set, so a caller probing a mix of actions still gets answers for the valid ones.","operationId":"CanUserPerform","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CanUserPerformInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiRBACActions"}}}},"400":{"description":"A resource_name is not a valid Spyderbat Resource Name","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}}}}},"/api/v1/sts/assumerole":{"post":{"tags":["STS"],"summary":"Assume a role on an org and receive a scoped JWT","description":"\nAssumes a single Org/* role on a single org and returns a short-lived JWT bound to both.\n\n * Requires action *sts:AssumeRole* on resource *srn:sts::\u003corg_uid\u003e:\u003crole_uid\u003e*\n * role_uid must be an Org/* role UID; Global/* roles are not assumable\n * TTL default is 1200 seconds (20m); max is 3600 seconds (1h)\n * The resulting token carries the assumed role on the assumed org only; onward assumption is gated by whether that role grants sts:AssumeRole\n","operationId":"StsAssumeRole","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StsAssumeRoleInput"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiStsAssumeRoleOutput"}}}},"400":{"description":"invalid input","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}},"403":{"description":"permission denied"}}}}},"components":{"schemas":{"Agent":{"type":"object","properties":{"agent_registration_uid":{"type":"string","description":"Agent registration associated with the agent"},"agent_type":{"type":"integer","description":"Agent type","format":"int32"},"agent_version":{"type":"string","description":"Version of the agent installed"},"agent_work_id":{"type":"integer","description":"Agent work Id","format":"int32"},"archived":{"type":"boolean","description":"Is the agent archived?"},"description":{"type":"string","description":"Description of the purpose of the agent"},"kernel_version":{"type":"string","description":"Kernel version of the installed system"},"live_test_ran":{"type":"integer","description":"Did the live test run?","format":"int32"},"live_test_result":{"type":"integer","description":"Result of the live test","format":"int32"},"muid":{"type":"string","description":"Muid created on by the agent on the system"},"org_uid":{"type":"string","description":"Agent OrgUID"},"os_pretty_name":{"type":"string","description":"Pretty name of the operating system the agent is installed on"},"resource_name":{"type":"string","description":"Resource name used for RBAC"},"resource_policy":{"$ref":"#/components/schemas/ResourcePolicy"},"runtime_description":{"type":"string","description":"Description of the runtime of the agent"},"runtime_details":{"$ref":"#/components/schemas/Orc_apiRuntimeDetails"},"standby":{"type":"boolean","description":"Is the agent in standby mode?"},"uid":{"type":"string","description":"Agent UID"},"user_work_id":{"type":"integer","format":"int32"},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"}}},"AgentActionEnqueueInput":{"type":"object","properties":{"analytic_uid":{"type":"string"},"env":{"type":"object","additionalProperties":{"type":"string"}},"object_uid":{"type":"string"},"principal":{"type":"string","description":"Principal that created this action"},"reason":{"type":"string"},"resource_name":{"type":"string","description":"Resource name used for RBAC"},"resource_policy":{"$ref":"#/components/schemas/ResourcePolicy"},"script_hash":{"type":"string","maxLength":64},"script_name":{"type":"string","maxLength":64},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"}},"required":["script_hash","script_name","valid_to"]},"AgentHealthNotificationSettingsCreateInput":{"type":"object","properties":{"description":{"type":"string","maxLength":500},"name":{"type":"string","maxLength":128,"minLength":1},"notification_settings":{"$ref":"#/components/schemas/DaoAgentHealthNotificationSettings"},"scope_query":{"type":"string","maxLength":65535}},"required":["name"]},"AgentHealthNotificationSettingsUpdateInput":{"type":"object","properties":{"description":{"type":"string","maxLength":500},"name":{"type":"string","maxLength":128,"minLength":1},"notification_settings":{"$ref":"#/components/schemas/DaoAgentHealthNotificationSettings"},"scope_query":{"type":"string","maxLength":65535,"minLength":1}},"required":["name"]},"AgentKillPodInput":{"type":"object","properties":{"reason":{"type":"string","description":"The reason for killing the pod","maxLength":500}}},"AgentKillProcessInput":{"type":"object","properties":{"kill_process_group":{"type":"boolean","description":"Whether to kill the entire process group"},"kill_process_tree":{"type":"boolean","description":"Whether to kill the entire process tree with the processUID as the parent"},"reason":{"type":"string","description":"The reason for killing the process","maxLength":500}}},"AgentRegistration":{"type":"object","properties":{"config":{"$ref":"#/components/schemas/DaoAgentConfig"},"created_by":{"type":"string","description":"The user UID of the user who created the agent registration"},"description":{"type":"string","description":"Description of the agent registration","maxLength":512},"name":{"type":"string","description":"Name of the agent registration","maxLength":64},"org_uid":{"type":"string","description":"The OrgUID the registration is associated with","maxLength":32},"resource_name":{"type":"string","description":"Resource name used for RBAC"},"uid":{"type":"string","description":"Agent Registration UID","maxLength":64},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"}}},"AgentRegistrationCreateInput":{"type":"object","properties":{"config":{"$ref":"#/components/schemas/DaoAgentConfig"},"created_by":{"type":"string","description":"The user UID of the user who created the agent registration"},"description":{"type":"string","description":"Description of the agent registration","maxLength":512},"name":{"type":"string","description":"Name of the agent registration","maxLength":64},"resource_name":{"type":"string","description":"Resource name used for RBAC"},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"}}},"AgentRegistrationUpdateInput":{"type":"object","properties":{"config":{"$ref":"#/components/schemas/DaoAgentConfig"},"created_by":{"type":"string","description":"The user UID of the user who created the agent registration"},"description":{"type":"string","description":"Description of the agent registration","maxLength":512},"name":{"type":"string","description":"Name of the agent registration","maxLength":64},"resource_name":{"type":"string","description":"Resource name used for RBAC"},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"}}},"AgentScanContainerInput":{"type":"object","properties":{"reason":{"type":"string","description":"The reason for scanning the container","maxLength":500},"scan_type":{"type":"string","description":"The type of scan to run"}}},"AgentSetAgentWorkInput":{"type":"object","properties":{"tags":{"type":"array","items":{"type":"string"},"description":"User defined tags"},"work":{"$ref":"#/components/schemas/Orc_apiAgentWork"}}},"AgentSetOrgWorkInput":{"type":"object","properties":{"tags":{"type":"array","items":{"type":"string"},"description":"User defined tags"},"work":{"$ref":"#/components/schemas/Orc_apiAgentWork"}}},"AnalyticsPolicyCreateInput":{"type":"object","properties":{"policy":{"$ref":"#/components/schemas/DaoPolicyObject"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":30}},"required":["policy"]},"AnalyticsPolicyUpdateInput":{"type":"object","properties":{"policy":{"$ref":"#/components/schemas/DaoPolicyObject"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":30}},"required":["policy"]},"AnalyticsRulesetCreateInput":{"type":"object","properties":{"ruleset":{"$ref":"#/components/schemas/DaoRulesetObject"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":30}},"required":["ruleset"]},"AnalyticsRulesetUpdateInput":{"type":"object","properties":{"ruleset":{"$ref":"#/components/schemas/DaoRulesetObject"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":30}},"required":["ruleset"]},"ApiAgentCreateHandlerOutput":{"type":"object","properties":{"uid":{"type":"string"}}},"ApiAgentRegistrationDownloadLinkHandlerOutput":{"type":"object","properties":{"agent_registration_uid":{"type":"string"},"orc_host":{"type":"string"},"orc_url":{"type":"string"},"url":{"type":"string"}}},"ApiAgentWorkOutput":{"type":"object","properties":{"tags":{"type":"array","items":{"type":"string"},"description":"User defined tags"},"work":{"$ref":"#/components/schemas/Orc_apiAgentWork"}}},"ApiAnalyticsPolicyCreateHandlerOutput":{"type":"object","properties":{"uid":{"type":"string"}}},"ApiAnalyticsRulesetCreateHandlerOutput":{"type":"object","properties":{"uid":{"type":"string"}}},"ApiCountResponse":{"type":"object","properties":{"count":{"type":"integer","format":"int32"}}},"ApiCreateAPIKeyOutput":{"type":"object","properties":{"jwt":{"type":"string","description":"Signed JWT to use for authentication. Store this now — it will not be returned again."},"uid":{"type":"string","description":"APIKey UID"}}},"ApiInvestigationCreateOutput":{"type":"object","properties":{"uid":{"type":"string"}}},"ApiLoginHintResponse":{"type":"object","properties":{"cognito_provider":{"type":"string"},"login_urls":{"type":"object","additionalProperties":{"type":"string"}},"zitadel_provider":{"type":"string"}}},"ApiRBACActions":{"type":"object","properties":{"actions":{"type":"array","items":{"$ref":"#/components/schemas/RBACAction"},"maxItems":25}}},"ApiSOARListHandlerOutput":{"type":"object","properties":{"investigate_source_url":{"type":"string"},"source":{"$ref":"#/components/schemas/Source"}}},"ApiSearchSetCreateHandlerOutput":{"type":"object","properties":{"uid":{"type":"string"}}},"ApiSourceCreateHandlerOutput":{"type":"object","properties":{"uid":{"type":"string"}}},"ApiStsAssumeRoleOutput":{"type":"object","properties":{"expires_at":{"type":"integer","description":"Unix timestamp (seconds) at which the token expires.","format":"int64"},"token":{"type":"string","description":"Signed scoped JWT. Present in the Authorization header as 'Bearer \u003ctoken\u003e' on subsequent requests."}}},"ApiWatchlistCreateHandlerOutput":{"type":"object","properties":{"id":{"type":"string"}}},"CanUserPerformInput":{"type":"object","properties":{"actions":{"type":"array","items":{"$ref":"#/components/schemas/RBACAction"},"maxItems":25}}},"CaseAddHelperInput":{"type":"object","properties":{"helperUser":{"type":"string","description":"UID of the user to add as a helper","maxLength":256,"minLength":1},"reason":{"type":"string","description":"Optional free-text reason"}},"required":["helperUser"]},"CaseAddNoteInput":{"type":"object","properties":{"text":{"type":"string","description":"Note text (1–10000 characters)","maxLength":10000,"minLength":1}},"required":["text"]},"CaseAssessmentInput":{"type":"object","properties":{"aiRating":{"type":"string","description":"Optional AI rating","maxLength":64},"flag":{"description":"Optional flag payload","nullable":true},"note":{"type":"string","description":"Optional note (max 10000 chars)","maxLength":10000},"verdict":{"type":"string","description":"Optional verdict","maxLength":64}}},"CaseAssignInput":{"type":"object","properties":{"assignedTo":{"type":"string","description":"UID of the target assignee","maxLength":256,"minLength":1}},"required":["assignedTo"]},"CaseAugmentInput":{"type":"object","properties":{"additional_content":{"type":"string","description":"Additional context to feed to the AI","maxLength":100000}}},"CaseBulkMergeInput":{"type":"object","properties":{"note":{"type":"string","description":"Optional free-text note attached to each merge event","maxLength":10000},"sourceIds":{"type":"array","items":{"type":"string"},"description":"IDs of the source cases to merge (1–50)","maxItems":50,"minItems":1},"targetCaseId":{"type":"string","description":"ID of the case to receive all sources","maxLength":36,"minLength":1}},"required":["sourceIds","targetCaseId"]},"CaseBulkRetryInput":{"type":"object","properties":{"agent":{"type":"string","description":"Target agent: 'ai-level-1' or 'ai-level-2'"},"caseIds":{"type":"array","items":{"type":"string"},"description":"IDs of the cases to re-enqueue (1–100)","maxItems":100,"minItems":1},"pipeline":{"type":"string","description":"Target pipeline: 'triage' or 'reprocessing'"},"source":{"type":"string","description":"Source of the re-enqueue action (default 'manual-retry')","maxLength":64}},"required":["agent","caseIds","pipeline"]},"CaseCloseInput":{"type":"object","properties":{"aiRating":{"type":"string","description":"Optional AI rating","maxLength":64},"note":{"type":"string","description":"Optional closing note","maxLength":10000},"verdict":{"type":"string","description":"Verdict; when set, an assessment row is written","maxLength":64},"verdictReason":{"type":"string","description":"Optional verdict reason","maxLength":10000}}},"CaseCreateInput":{"type":"object","properties":{"author":{"type":"string","description":"Author of the case","minLength":1},"priority":{"type":"string","description":"Case priority: Low, Normal, or High"},"refIds":{"type":"array","items":{"type":"string"},"description":"Reference IDs (e.g. alert IDs)"},"rootTraceId":{"type":"string","description":"Root trace ID for the case","minLength":1}},"required":["author","rootTraceId"]},"CaseEditNoteInput":{"type":"object","properties":{"text":{"type":"string","description":"Updated note text (1–10000 characters)","maxLength":10000,"minLength":1}},"required":["text"]},"CaseMergeInput":{"type":"object","properties":{"note":{"type":"string","description":"Optional free-text note attached to both merge events","maxLength":10000},"targetCaseId":{"type":"string","description":"ID of the case to merge into","maxLength":36,"minLength":1}},"required":["targetCaseId"]},"CasePatchInput":{"type":"object","properties":{"assets":{"type":"array","items":{},"description":"Assets (full replace)"},"confidence":{"type":"number","description":"Confidence score (0–9)","format":"double","nullable":true},"keySignals":{"type":"array","items":{},"description":"Key signals (full replace)"},"mitreTactics":{"type":"array","items":{"type":"string"},"description":"MITRE ATT\u0026CK tactic IDs"},"mitreTechniques":{"type":"array","items":{"type":"string"},"description":"MITRE ATT\u0026CK technique IDs"},"narrative":{"type":"string","description":"Updated narrative","nullable":true},"pivots":{"type":"array","items":{},"description":"Pivots (full replace)"},"priority":{"type":"string","description":"Updated priority: Low, Normal, or High","nullable":true},"priorityOverride":{"type":"boolean","description":"User-prioritized flag","nullable":true},"refIds":{"type":"array","items":{"type":"string"},"description":"Reference IDs (full replace)"},"risk":{"type":"number","description":"Risk score (0–9)","format":"double","nullable":true},"summary":{"type":"string","description":"Updated summary","nullable":true},"threatCategory":{"type":"string","description":"Threat category","nullable":true},"title":{"type":"string","description":"Updated title","nullable":true}}},"CaseRegenSummaryInput":{"type":"object","properties":{"draft_summary":{"type":"string","description":"Optional current draft to seed the regeneration","maxLength":10000},"instructions":{"type":"string","description":"Analyst guidance for the LLM (1–10000 characters)","maxLength":10000,"minLength":1}},"required":["instructions"]},"CaseSearchInput":{"type":"object","properties":{"filters":{"description":"Search filters (state, assignedTo, priority, score ranges, MITRE tactic, date ranges, search text)","nullable":true},"includeFacets":{"type":"boolean","description":"Include disjunctive facet counts","nullable":true},"page":{"description":"Pagination {offset, limit}","nullable":true},"sort":{"description":"Sort specification [{field, order}]","nullable":true}}},"CaseSendToSeniorAIInput":{"type":"object","properties":{"instructions":{"type":"string","description":"Optional free-text instructions to the senior AI","maxLength":10000},"priorityOverride":{"type":"boolean","description":"Optional priority override","nullable":true},"references":{"type":"array","items":{"type":"object","additionalProperties":{}},"description":"Optional reference objects"}}},"CaseSnoozeInput":{"type":"object","properties":{"reason":{"type":"string","description":"Optional reason","maxLength":10000},"until":{"type":"string","description":"Wake time (RFC 3339)","format":"date-time"}},"required":["until"]},"ClusterDetails":{"type":"object","properties":{"cluster_details":{"$ref":"#/components/schemas/Orc_apiClusterDetails"},"last_data":{"type":"string","format":"date-time"},"name":{"type":"string","description":"User supplied name of the cluster","maxLength":32},"org_uid":{"type":"string","description":"The org this source is associated with","maxLength":64},"resource_name":{"type":"string","description":"Resource name used for RBAC"},"resource_policy":{"$ref":"#/components/schemas/ResourcePolicy"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":20},"uid":{"type":"string","description":"The UID of the cluster","maxLength":64},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"}}},"ConvertInput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system, and shouldn't be exposed to customers"},"query":{"type":"string"}}},"CustomFlagCreateInput":{"type":"object","properties":{"content":{"type":"string","description":"Optional Markdown content for additional details.","maxLength":1500},"description":{"type":"string","description":"A brief description explaining what the flag detects.","maxLength":500},"impact":{"type":"string","description":"Optional impact this flag has for your organization.","maxLength":500},"is_disabled":{"type":"boolean","description":"Optional flag to disable the custom flag on creation. Default is enabled."},"name":{"type":"string","maxLength":128,"minLength":1},"notification_settings":{"$ref":"#/components/schemas/DaoNotificationSettings"},"saved_query_uid":{"type":"string"},"severity":{"type":"string","description":"Optional severity level of the flag. One of [info|low|medium|high|critical]"},"tags":{"type":"array","items":{"type":"string"},"description":"Optional tags to associate with the custom flag."},"type":{"type":"string","description":"The type of the flag. One of [redflag|opsflag]"}},"required":["description","name","saved_query_uid","severity","type"]},"CustomFlagUpdateInput":{"type":"object","properties":{"content":{"type":"string","description":"Optional Markdown content for additional details.","maxLength":1500},"description":{"type":"string","description":"A brief description explaining what the flag detects.","maxLength":500},"impact":{"type":"string","description":"Optional impact this flag has for your organization.","maxLength":500},"name":{"type":"string","maxLength":128,"minLength":1},"notification_settings":{"$ref":"#/components/schemas/DaoNotificationSettings"},"severity":{"type":"string","description":"Optional severity level of the flag. One of [info|low|medium|high|critical]"},"tags":{"type":"array","items":{"type":"string"},"description":"Optional tags to associate with the custom flag."},"type":{"type":"string","description":"The type of the flag. One of [redflag|opsflag]"}}},"DaoActionStatus":{"type":"object","properties":{"action_taken_by":{"type":"string"},"action_type":{"type":"string"},"agent_uid":{"type":"string"},"analytic_uid":{"type":"string"},"completed":{"type":"string","format":"date-time","nullable":true},"error":{"$ref":"#/components/schemas/Orc_apiAgentActionError"},"object_uid":{"type":"string","nullable":true},"org_uid":{"type":"string"},"principal":{"type":"string"},"reason":{"type":"string","nullable":true},"result_code":{"type":"integer","format":"int32","nullable":true},"state":{"type":"string"},"uid":{"type":"string"},"valid_from":{"type":"string","format":"date-time"},"valid_to":{"type":"string","format":"date-time","nullable":true}},"description":"The action status record"},"DaoAgentClass":{"type":"object","properties":{"name":{"type":"string","maxLength":64},"rbac_roles":{"type":"array","items":{"type":"string"},"maxItems":10}},"required":["name"]},"DaoAgentConfig":{"type":"object","properties":{"classes":{"type":"array","items":{"$ref":"#/components/schemas/DaoAgentClass"},"description":"Agent classes","maxItems":10,"minItems":1},"description":{"type":"string","description":"Description of the agent config","maxLength":512},"name":{"type":"string","description":"Name of the agent config","maxLength":32},"source_tags":{"type":"array","items":{"type":"string"},"description":"Tags to be applied to a source upon agent registration","maxItems":10},"type":{"type":"string","description":"Type of agent config","maxLength":20}},"description":"Initial configuration to use when creating an agent","required":["classes"]},"DaoAgentHealthNotificationSettings":{"type":"object","properties":{"agent_healthy":{"$ref":"#/components/schemas/DaoNotificationSettingsObj"},"agent_offline":{"$ref":"#/components/schemas/DaoNotificationSettingsObj"},"agent_online":{"$ref":"#/components/schemas/DaoNotificationSettingsObj"},"agent_unhealthy":{"$ref":"#/components/schemas/DaoNotificationSettingsObj"}}},"DaoAgentLog":{"type":"object","properties":{"agent_registration_uid":{"type":"string"},"agent_uid":{"type":"string"},"bytes_sent":{"type":"integer","format":"int32"},"err_uid":{"type":"string"},"error":{"type":"string"},"ip_address":{"type":"string"},"msg":{"type":"string"},"org_uid":{"type":"string"},"runtime_details":{"$ref":"#/components/schemas/Orc_apiRuntimeDetails"},"source_uid":{"type":"string"},"time":{"type":"number","format":"double"},"type":{"type":"string"}}},"DaoAllowedFlagRule":{"type":"object","properties":{"class":{"type":"string"},"display_name":{"type":"string"},"display_severity":{"type":"string"}}},"DaoAnalyticResourceObject":{"type":"object","properties":{"apiVersion":{"type":"string","description":"API Version"},"data":{"type":"object","additionalProperties":{},"description":"Data"},"kind":{"type":"string","description":"Kind"},"metadata":{"type":"object","additionalProperties":{},"description":"Metadata"},"spec":{"type":"object","additionalProperties":{},"description":"Spec"}},"description":"The object to validate.","required":["apiVersion","kind","metadata"]},"DaoAuthPolicy":{"type":"object","description":"Authentication policy"},"DaoClusterSelectorV2":{"type":"object","properties":{"matchFields":{"type":"object","additionalProperties":{"type":"string"}},"matchFieldsExpressions":{"type":"array","items":{"$ref":"#/components/schemas/DaoExpression"}}}},"DaoContainerSelectorV2":{"type":"object","properties":{"containerID":{"type":"array","items":{"type":"string"}},"containerName":{"type":"array","items":{"type":"string"}},"image":{"type":"array","items":{"type":"string"}},"imageID":{"type":"array","items":{"type":"string"}},"matchFields":{"type":"object","additionalProperties":{"type":"string"}},"matchFieldsExpressions":{"type":"array","items":{"$ref":"#/components/schemas/DaoExpression"}}}},"DaoExpression":{"type":"object","properties":{"key":{"type":"string"},"operator":{"type":"string"},"values":{"type":"array","items":{"type":"string"}}}},"DaoInvestigation":{"type":"object","properties":{"created_by":{"type":"string","description":"UID of user who created the investigation"},"data":{"type":"object","additionalProperties":{},"description":"JSON Object associated with the investigation"},"modified_by":{"type":"string","description":"UID of the user who last modified the investigation"},"modified_on":{"type":"string","description":"Date the investigation was last modified","format":"date-time"},"name":{"type":"string","description":"Name of the investigation"},"org_uid":{"type":"string","description":"Investigation OrgUID","maxLength":64,"minLength":9},"resource_name":{"type":"string","description":"Resource name used for RBAC"},"resource_policy":{"$ref":"#/components/schemas/ResourcePolicy"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":20},"uid":{"type":"string","description":"Investigation UID"},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"},"version":{"type":"integer","description":"Version of the investigation","format":"int32"}}},"DaoLinuxServiceSelectorV2":{"type":"object","properties":{"cgroup":{"type":"string"},"matchFields":{"type":"object","additionalProperties":{"type":"string"}},"matchFieldsExpressions":{"type":"array","items":{"$ref":"#/components/schemas/DaoExpression"}}}},"DaoLoginHint":{"type":"object","properties":{"cognito_provider":{"type":"string","description":"Cognito Provider","maxLength":1024},"login_urls":{"type":"object","additionalProperties":{"type":"string"},"description":"Login URL"},"zitadel_provider":{"type":"string","description":"ZITADEL federation IdP key for brokered SSO","maxLength":32}},"description":"Login Hint"},"DaoMachineSelectorV2":{"type":"object","properties":{"hostname":{"type":"array","items":{"type":"string"}},"machineUID":{"type":"array","items":{"type":"string"}},"matchFields":{"type":"object","additionalProperties":{"type":"string"}},"matchFieldsExpressions":{"type":"array","items":{"$ref":"#/components/schemas/DaoExpression"}}}},"DaoNamespaceSelectorV2":{"type":"object","properties":{"matchExpressions":{"type":"array","items":{"$ref":"#/components/schemas/DaoExpression"}},"matchLabels":{"type":"object","additionalProperties":{"type":"string"}}}},"DaoNotificationSettings":{"type":"object","properties":{"aggregate":{"type":"boolean","description":"Aggregate notifications sent for this object. If enabled, notifications are aggregated over a minute before being sent out as a single notification."},"aggregate_by":{"type":"array","items":{"type":"string"},"description":"Aggregate notifications by the specified fields. By default, Spyderbat will identify the best fields to aggregate by."},"aggregate_seconds":{"type":"integer","description":"Overwrite the default notification aggregation window.","format":"int64"},"cooldown":{"type":"integer","description":"Cooldown in seconds for the notification.","format":"int64"},"cooldown_by":{"type":"array","items":{"type":"string"},"description":"Cooldown by the specified fields."},"is_enabled":{"type":"boolean"},"target_map":{"type":"object","additionalProperties":{"type":"string"},"description":"Map of notification targets to optional templates."},"uid":{"type":"string","description":"Not required for creation, will be auto-generated. Included in return values for reference."}}},"DaoNotificationSettingsDBObj":{"type":"object","properties":{"aggregate":{"type":"boolean","description":"Aggregate notifications sent for this object. If enabled, notifications are aggregated over a minute before being sent out as a single notification."},"aggregate_by":{"type":"array","items":{"type":"string"},"description":"Aggregate notifications by the specified fields. By default, Spyderbat will identify the best fields to aggregate by."},"aggregate_seconds":{"type":"integer","description":"Overwrite the default notification aggregation window.","format":"int64"},"cooldown":{"type":"integer","description":"Cooldown in seconds for the notification.","format":"int64"},"cooldown_by":{"type":"array","items":{"type":"string"},"description":"Cooldown by the specified fields."},"feature":{"type":"string"},"is_enabled":{"type":"boolean"},"org_uid":{"type":"string"},"ref_uid":{"type":"string"},"resource_name":{"type":"string"},"target_map":{"type":"object","additionalProperties":{"type":"string"},"description":"Map of notification targets to optional templates."},"trigger":{"type":"string"},"uid":{"type":"string","description":"Not required for creation, will be auto-generated. Included in return values for reference."},"valid_from":{"type":"string","format":"date-time"}}},"DaoNotificationSettingsObj":{"type":"object","properties":{"aggregate":{"type":"boolean","description":"Aggregate notifications sent for this object. If enabled, notifications are aggregated over a minute before being sent out as a single notification."},"aggregate_by":{"type":"array","items":{"type":"string"},"description":"Aggregate notifications by the specified fields. By default, Spyderbat will identify the best fields to aggregate by."},"aggregate_seconds":{"type":"integer","description":"Overwrite the default notification aggregation window.","format":"int64"},"cooldown":{"type":"integer","description":"Cooldown in seconds for the notification.","format":"int64"},"cooldown_by":{"type":"array","items":{"type":"string"},"description":"Cooldown by the specified fields."},"is_enabled":{"type":"boolean"},"target_map":{"type":"object","additionalProperties":{"type":"string"},"description":"Map of notification targets to optional templates."},"uid":{"type":"string","description":"Not required for creation, will be auto-generated. Included in return values for reference."}}},"DaoOrgQuota":{"type":"object","properties":{"cases":{"$ref":"#/components/schemas/DaoOrgQuotaCases"},"max_active_sources":{"type":"integer","description":"Maximum number of active sources","format":"int32","maximum":10000},"max_agent_health_notifications":{"type":"integer","description":"Maximum number of agent health notifications settings","format":"int32","maximum":10000,"minimum":1},"max_custom_flags":{"type":"integer","description":"Maximum number of custom flags","format":"int32","maximum":10000,"minimum":1},"max_notification_targets":{"type":"integer","description":"Maximum number of notification targets","format":"int32","maximum":10000,"minimum":1},"max_notification_templates":{"type":"integer","description":"Maximum number of notification templates","format":"int32","maximum":10000,"minimum":1},"max_org_roles":{"type":"integer","description":"Maximum number of associated organizational roles","format":"int32","maximum":2000,"minimum":1},"max_saved_queries":{"type":"integer","description":"Maximum number of saved queries","format":"int32","maximum":10000,"minimum":1}},"description":"Default quota for the orgtype","required":["max_active_sources","max_org_roles"]},"DaoOrgQuotaCases":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Enable case creation (L1 analysis) for this org"},"l2_enabled":{"type":"boolean","description":"Enable L2 (senior AI) analysis for this org; requires enabled"},"score_threshold":{"type":"integer","description":"Minimum spydertrace score for case creation; 0 means the cases service default applies","format":"int32","maximum":10000},"ui":{"type":"boolean","description":"Expose the cases UI in the console for this org; requires enabled"}},"description":"Per-org feature gates for the cases service; replaces the existing block when present"},"DaoOrgRoleResponse":{"type":"object","properties":{"org_name":{"type":"string","description":"The organization name the user has the assigned role on"},"org_uid":{"type":"string","description":"The organization UID the user has the assigned role on"},"role_uid":{"type":"string","description":"The role the user is assigned"},"user_email":{"type":"string","description":"The email address associated with the user"},"user_uid":{"type":"string","description":"The user uid for the user"}}},"DaoOrgRoles":{"type":"object","properties":{"default_roles":{"type":"array","items":{"type":"string"},"description":"Default roles for the user","maxItems":32,"minItems":1},"org_uid":{"type":"string","description":"Org UID","maxLength":32}}},"DaoOrgType":{"type":"object","properties":{"default_quota":{"$ref":"#/components/schemas/DaoOrgQuota"},"description":{"type":"string","description":"Type of organization","maxLength":64,"minLength":3},"org_uid":{"type":"string"},"policy":{"$ref":"#/components/schemas/DaoOrgTypePolicy"},"uid":{"type":"string","description":"UID for OrgType","maxLength":64}},"required":["default_quota","policy"]},"DaoOrgTypePolicy":{"type":"object","properties":{"processing_stack":{"type":"string","description":"Name of the processing stack","maxLength":64,"minLength":3},"retention_period":{"type":"integer","description":"Retention period for stored data, in days","format":"int32","maximum":3650,"minimum":1}},"description":"Policy for the org","required":["processing_stack","retention_period"]},"DaoOrgUser":{"type":"object","properties":{"email":{"type":"string","description":"The email address of the user who belongs to this org","format":"email"},"roles":{"type":"array","items":{"type":"string"},"description":"The roles of the user who belongs to this org","maxItems":5,"minItems":1}},"required":["email","roles"]},"DaoOutputAnalyticsPolicy":{"type":"object","properties":{"created_by":{"type":"string","description":"Resource name of the user who created this object"},"last_updated":{"type":"string","description":"Last updated date","format":"date-time"},"last_updated_by":{"type":"string","description":"Resource name of the user who last updated this object"},"name":{"type":"string","description":"Name of the analytics policy","maxLength":64,"minLength":3},"orgid":{"type":"string","description":"Org UID","maxLength":64},"policy":{"$ref":"#/components/schemas/DaoPolicyObject"},"selector_hash":{"type":"string","description":"MD5 Hash of the policy's selectors"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":20},"type":{"type":"string","description":"type","maxLength":64},"uid":{"type":"string","description":"Analytics Policy UID","maxLength":64},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"},"version":{"type":"integer","description":"Version of the object","format":"int32"}},"required":["name","type"]},"DaoOutputAnalyticsRuleset":{"type":"object","properties":{"created_by":{"type":"string","description":"Created by, the principal who created this object"},"last_updated":{"type":"string","description":"Last updated date, the date this object was last updated","format":"date-time"},"last_updated_by":{"type":"string","description":"Last updated by, the principal who last updated this object"},"name":{"type":"string","description":"Name of the analytics ruleset","maxLength":64,"minLength":3},"orgid":{"type":"string","description":"Org UID","maxLength":64},"resource_name":{"type":"string","description":"Resource name utilized by RBAC"},"ruleset":{"$ref":"#/components/schemas/DaoRulesetObject"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":20},"type":{"type":"string","description":"type","maxLength":64},"uid":{"type":"string","description":"Analytics Ruleset UID","maxLength":64},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"},"version":{"type":"integer","description":"Ruleset version","format":"int32"}},"required":["name","type"]},"DaoOutputSearchSet":{"type":"object","properties":{"created_by":{"type":"string","description":"Created by, the principal who created this object"},"last_updated":{"type":"string","description":"Last updated date, the date this object was last updated","format":"date-time"},"last_updated_by":{"type":"string","description":"Last updated by, the principal who last updated this object"},"name":{"type":"string","description":"Name of the analytics searchset","maxLength":64,"minLength":3},"orgid":{"type":"string","description":"Org UID","maxLength":64},"resource_name":{"type":"string","description":"Resource name utilized by RBAC"},"searchset":{"$ref":"#/components/schemas/DaoSearchSetObject"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":20},"type":{"type":"string","description":"type","maxLength":64},"uid":{"type":"string","description":"Search Set UID","maxLength":64},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"},"version":{"type":"integer","description":"SearchSet version","format":"int32"}},"required":["name","type"]},"DaoPlan":{"type":"object","properties":{"policies":{"type":"array","items":{"$ref":"#/components/schemas/DaoPolicy"},"description":"Policies for the plan"}},"description":"Plan"},"DaoPolicy":{"type":"object","properties":{"allowed_providers":{"type":"array","items":{"type":"string"},"description":"Allowed providers (use direct for direct sign-in)","maxItems":32,"minItems":1},"auth_policy":{"$ref":"#/components/schemas/DaoAuthPolicy"},"comment":{"type":"string","description":"comment","maxLength":4096},"email_regex":{"type":"string","description":"Regular expression for email addresses","maxLength":128,"minLength":3},"login_hint":{"$ref":"#/components/schemas/DaoLoginHint"},"signup_policy":{"$ref":"#/components/schemas/DaoSignupPolicy"}},"required":["allowed_providers","email_regex","signup_policy"]},"DaoPolicyObject":{"type":"object","properties":{"apiVersion":{"type":"string","description":"API Version"},"kind":{"type":"string","description":"Kind"},"metadata":{"type":"object","additionalProperties":{},"description":"Metadata"},"spec":{"type":"object","additionalProperties":{},"description":"Spec"}},"description":"Policy","required":["apiVersion","kind","metadata","spec"]},"DaoRulesetObject":{"type":"object","properties":{"apiVersion":{"type":"string","description":"API Version"},"kind":{"type":"string","description":"Kind"},"metadata":{"type":"object","additionalProperties":{},"description":"Metadata"},"spec":{"type":"object","additionalProperties":{},"description":"Spec"}},"description":"User supplied ruleset","required":["apiVersion","kind","metadata","spec"]},"DaoSearchSetObject":{"type":"object","properties":{"apiVersion":{"type":"string","description":"API Version"},"metadata":{"type":"object","additionalProperties":{},"description":"Metadata"},"spec":{"type":"array","items":{"type":"string"},"description":"Spec"}},"description":"User supplied searchset","required":["apiVersion","metadata","spec"]},"DaoSignupPolicy":{"type":"object","properties":{"create_personal_org":{"type":"boolean","description":"Create a personal org for the user"},"default_org_roles":{"type":"array","items":{"$ref":"#/components/schemas/DaoOrgRoles"},"description":"Default org roles for new orgs","maxItems":32},"requires_approval":{"type":"boolean","description":"Require admin approval for new orgs"}},"description":"Signup policy"},"DaoSourceAgg":{"type":"object","properties":{"count":{"type":"integer","description":"The count for the property value","format":"int64"},"propertyvalue":{"type":"string","description":"The value of a property being aggregated upon"}}},"DaoTraceSelectorV2":{"type":"object","properties":{"matchFields":{"type":"object","additionalProperties":{"type":"string"}},"matchFieldsExpressions":{"type":"array","items":{"$ref":"#/components/schemas/DaoExpression"}},"triggerAncestors":{"type":"array","items":{"type":"string"}},"triggerClass":{"type":"array","items":{"type":"string"}}}},"DaoTraceSuppressionMetadata":{"type":"object","properties":{"name":{"type":"string"},"type":{"type":"string"},"uid":{"type":"string"}},"required":["name","type"]},"DaoTraceSuppressionPolicy":{"type":"object","properties":{"apiVersion":{"type":"string"},"kind":{"type":"string"},"metadata":{"$ref":"#/components/schemas/DaoTraceSuppressionMetadata"},"spec":{"$ref":"#/components/schemas/DaoTraceSuppressionSpec"}},"required":["apiVersion","kind","metadata","spec"]},"DaoTraceSuppressionSpec":{"type":"object","properties":{"allowedFlags":{"type":"array","items":{"$ref":"#/components/schemas/DaoAllowedFlagRule"}},"clusterSelector":{"$ref":"#/components/schemas/DaoClusterSelectorV2"},"containerSelector":{"$ref":"#/components/schemas/DaoContainerSelectorV2"},"enabled":{"type":"boolean"},"machineSelector":{"$ref":"#/components/schemas/DaoMachineSelectorV2"},"mode":{"type":"string"},"namespaceSelector":{"$ref":"#/components/schemas/DaoNamespaceSelectorV2"},"serviceSelector":{"$ref":"#/components/schemas/DaoLinuxServiceSelectorV2"},"traceSelector":{"$ref":"#/components/schemas/DaoTraceSelectorV2"},"userSelector":{"$ref":"#/components/schemas/DaoUserSelectorV2"}},"required":["allowedFlags","enabled","mode","traceSelector"]},"DaoUserSelectorV2":{"type":"object","properties":{"matchFields":{"type":"object","additionalProperties":{"type":"string"}},"matchFieldsExpressions":{"type":"array","items":{"$ref":"#/components/schemas/DaoExpression"}},"user":{"type":"array","items":{"type":"string"}}}},"DaoWatchlist":{"type":"object","properties":{"files":{"type":"array","items":{"type":"string"}},"id":{"type":"string"},"name":{"type":"string"},"org_uid":{"type":"string"},"resource_name":{"type":"string","description":"Resource name utilized by RBAC"},"updated_at":{"type":"string"},"valid_from":{"type":"string"}}},"Expr":{"type":"object","properties":{"and":{"type":"array","items":{"$ref":"#/components/schemas/Expr"},"description":"True if all sub-expressions are true"},"array_contains_str":{"type":"string","description":"True if array property contains the string"},"contains_str":{"type":"string","description":"True if property contains the string"},"equals":{"description":"True if property equals the value"},"exists":{"type":"boolean","description":"True if property exists"},"greater_than":{"type":"number","description":"True if property is greater than the value"},"has_prefix":{"type":"string","description":"True if property starts with the string"},"has_suffix":{"type":"string","description":"True if property ends with the string"},"in":{"type":"array","items":{},"description":"True if property matches any value"},"less_than":{"type":"number","description":"True if property is less than the value"},"not":{"$ref":"#/components/schemas/Expr"},"or":{"type":"array","items":{"$ref":"#/components/schemas/Expr"},"description":"True if any sub-expression is true"},"property":{"type":"string","description":"Property to match against, in dotted notation"},"re_match":{"type":"string","description":"True if property matches the regex"},"schema":{"type":"string","description":"Matches records with the specified schema"}},"description":"A filter expression node. Exactly one condition field must be specified. Use `and`, `or`, `not` for compound expressions."},"FingerprintDataSearchInput":{"type":"object","properties":{"case_sensitive":{"type":"boolean","description":"Whether the query is case sensitive (default false)"},"cluster_uid":{"type":"string","description":"An optional pre-filter field that restricts results to one cluster"},"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system, and shouldn't be exposed to customers"},"end_time":{"type":"integer","description":"End time to query","format":"int32"},"latest_version":{"type":"boolean","description":"Whether to pre-filter the results to only search with the latest version of each object (default true)","nullable":true},"muid":{"type":"string","description":"An optional pre-filter field that restricts results to one machine"},"policy_types":{"type":"array","items":{"type":"string"},"description":"Filters fingerprints by metadata.type. Valid values: container, linux-service. Adds (metadata.type = 'X' OR ...) to query."},"query":{"type":"string","description":"Query to execute","maxLength":65536},"start_time":{"type":"integer","description":"Start time to query","format":"int32"}},"required":["end_time","query","start_time"]},"FingerprintDataSearchJobInput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system, and shouldn't be exposed to customers"},"policy_types":{"type":"array","items":{"type":"string"},"description":"Analytics policy types to load for computing covered_by_policy on each result. Valid values: container, linux-service. Should match the policy_types used in the search request."},"unique":{"type":"boolean","description":"Whether to return unique results (default false)"}},"required":["policy_types"]},"GuardianPolicyBuildInput":{"type":"object","properties":{"input_objects":{"type":"array","items":{"$ref":"#/components/schemas/DaoAnalyticResourceObject"},"description":"Fingerprints, FingerprintGroup, or Baseline to create a Guardian Policy from."},"mode":{"type":"string","description":"The enforcement mode of the policy."},"name":{"type":"string","description":"Custom name for the suppression policy","maxLength":64}},"required":["input_objects","mode"]},"InvestigationCreateInput":{"type":"object","properties":{"created_by":{"type":"string","description":"UID of user who created the investigation"},"data":{"type":"object","additionalProperties":{},"description":"JSON Object associated with the investigation"},"modified_by":{"type":"string","description":"UID of the user who last modified the investigation"},"modified_on":{"type":"string","description":"Date the investigation was last modified","format":"date-time"},"name":{"type":"string","description":"Name of the investigation"},"resource_name":{"type":"string","description":"Resource name used for RBAC"},"resource_policy":{"$ref":"#/components/schemas/ResourcePolicy"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":20},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"},"version":{"type":"integer","description":"Version of the investigation","format":"int32"}}},"InvestigationUpdateInput":{"type":"object","properties":{"created_by":{"type":"string","description":"UID of user who created the investigation"},"data":{"type":"object","additionalProperties":{},"description":"JSON Object associated with the investigation"},"modified_by":{"type":"string","description":"UID of the user who last modified the investigation"},"modified_on":{"type":"string","description":"Date the investigation was last modified","format":"date-time"},"name":{"type":"string","description":"Name of the investigation"},"resource_name":{"type":"string","description":"Resource name used for RBAC"},"resource_policy":{"$ref":"#/components/schemas/ResourcePolicy"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":20},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"},"version":{"type":"integer","description":"Version of the investigation","format":"int32"}}},"NDJSONStream":{"type":"string","description":"A line-separated list of json objects","format":"ndjson"},"NotificationPolicy":{"type":"object","properties":{"routes":{"type":"array","items":{"type":"object","properties":{"data":{"description":"UI-supplied data"},"description":{"type":"string"},"destination":{"$ref":"#/components/schemas/NotificationPolicyDestination"},"expr":{"$ref":"#/components/schemas/Expr"},"target":{"type":"string","description":"One of the targets specified in `targets`"}}}},"targets":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/NotificationPolicyDestination"}}},"description":"A notification policy in json or hjson","required":["routes","targets"]},"NotificationPolicyDestination":{"type":"object","properties":{"data":{"description":"UI-supplied data"},"description":{"type":"string"},"email":{"type":"array","items":{"type":"string","format":"email"}},"org_uid":{"type":"string"},"slack":{"type":"object","properties":{"url":{"type":"string","format":"url"}},"required":["url"]},"users":{"type":"array","items":{"type":"string"}},"webhook":{"type":"object","properties":{"no_tls_validation":{"type":"boolean"},"url":{"type":"string","format":"url"}},"required":["url"]}},"description":"A notification policy destination, containing one and only one of the available types","maxProperties":3,"minProperties":1},"NotificationSettingsInitializeInput":{"type":"object","properties":{"notification_targets":{"type":"array","items":{"type":"string"},"description":"The uids of the notification targets to send notifications to. This can be configured later."}}},"NotificationSettingsSetInput":{"type":"object","properties":{"notification_settings":{"$ref":"#/components/schemas/DaoNotificationSettings"},"trigger":{"type":"string","description":"Used when setting the notifications for a specific trigger is required. Agent health has multiple so it must be specified."}}},"NotificationSettingsTestInput":{"type":"object","properties":{"notification_settings_uid":{"type":"string","description":"The notification settings UID to test."},"record":{"type":"object","additionalProperties":{},"description":"Record is the data to use when testing the notification. Fields in the record can be dereferenced by the template. For saved query notifications this will be the model or event record that matched the query."},"target_uid":{"type":"string","description":"The target UID to test."},"template_uid":{"type":"string","description":"The template UID to test."}}},"NotificationTargetEmailCreateInput":{"type":"object","properties":{"description":{"type":"string","description":"Description of the notification target.","maxLength":500},"emails":{"type":"array","items":{"type":"string"},"description":"List of email addresses to send notifications to.","maxItems":100,"minItems":1},"name":{"type":"string","description":"Name of the notification target."},"tags":{"type":"array","items":{"type":"string"}}},"required":["emails","name"]},"NotificationTargetEmailUpdateInput":{"type":"object","properties":{"description":{"type":"string","description":"Description of the notification target.","maxLength":500},"emails":{"type":"array","items":{"type":"string"},"description":"List of email addresses to send notifications to.","maxItems":100,"minItems":1},"name":{"type":"string","description":"Name of the notification target."},"tags":{"type":"array","items":{"type":"string"}}},"required":["emails","name"]},"NotificationTargetPagerDutyCreateInput":{"type":"object","properties":{"description":{"type":"string","description":"Description of the notification target.","maxLength":500},"name":{"type":"string","description":"Name of the notification target."},"routing_key":{"type":"string","description":"Routing key for the PagerDuty service."},"tags":{"type":"array","items":{"type":"string"}}},"required":["name","routing_key"]},"NotificationTargetPagerDutyUpdateInput":{"type":"object","properties":{"description":{"type":"string","description":"Description of the notification target.","maxLength":500},"name":{"type":"string","description":"Name of the notification target."},"routing_key":{"type":"string","description":"Routing key for the PagerDuty service."},"tags":{"type":"array","items":{"type":"string"}}},"required":["name","routing_key"]},"NotificationTargetSlackCreateInput":{"type":"object","properties":{"description":{"type":"string","description":"Description of the notification target.","maxLength":500},"name":{"type":"string","description":"Name of the notification target."},"tags":{"type":"array","items":{"type":"string"}},"url":{"type":"string","description":"URL to send the notification to."}},"required":["name","url"]},"NotificationTargetSlackUpdateInput":{"type":"object","properties":{"description":{"type":"string","description":"Description of the notification target.","maxLength":500},"name":{"type":"string","description":"Name of the notification target."},"tags":{"type":"array","items":{"type":"string"}},"url":{"type":"string","description":"URL to send the notification to."}},"required":["name","url"]},"NotificationTargetWebhookCreateInput":{"type":"object","properties":{"description":{"type":"string","description":"Description of the notification target.","maxLength":500},"name":{"type":"string","description":"Name of the notification target."},"password":{"type":"string","description":"Optional password for basic auth."},"tags":{"type":"array","items":{"type":"string"}},"url":{"type":"string","description":"URL to send the webhook to."},"user_name":{"type":"string","description":"Optional username for basic auth."}},"required":["name","url"]},"NotificationTargetWebhookUpdateInput":{"type":"object","properties":{"description":{"type":"string","description":"Description of the notification target.","maxLength":500},"name":{"type":"string","description":"Name of the notification target."},"password":{"type":"string","description":"Optional password for basic auth."},"tags":{"type":"array","items":{"type":"string"}},"url":{"type":"string","description":"URL to send the webhook to."},"user_name":{"type":"string","description":"Optional username for basic auth."}},"required":["name","url"]},"NotificationTemplateEmailCreateInput":{"type":"object","properties":{"body_html":{"type":"string","description":"HTML body of the email."},"body_text":{"type":"string","description":"Simple text body of the email."},"description":{"type":"string","description":"A brief description explaining what the template is for.","maxLength":500},"name":{"type":"string","description":"Name of the notification template."},"subject":{"type":"string","description":"Subject of the email."},"tags":{"type":"array","items":{"type":"string"}}},"required":["name","subject"]},"NotificationTemplateEmailUpdateInput":{"type":"object","properties":{"body_html":{"type":"string","description":"HTML body of the email."},"body_text":{"type":"string","description":"Simple text body of the email."},"description":{"type":"string","description":"A brief description explaining what the template is for.","maxLength":500},"name":{"type":"string","description":"Name of the notification template."},"subject":{"type":"string","description":"Subject of the email."},"tags":{"type":"array","items":{"type":"string"}}},"required":["name","subject"]},"NotificationTemplatePagerDutyCreateInput":{"type":"object","properties":{"class":{"type":"string","description":"The class/type of the event."},"component":{"type":"string","description":"Component of the source machine that is responsible for the event."},"custom_details":{"type":"object","additionalProperties":{},"description":"Custom details to include in the event."},"dedup_key":{"type":"string","description":"A unique identifier for the event, used to deduplicate events.","maxLength":255},"description":{"type":"string","description":"A brief description explaining what the template is for.","maxLength":500},"group":{"type":"string","description":"Logical grouping of components of a service, useful for filtering alerts."},"name":{"type":"string","description":"Name of the notification template."},"severity":{"type":"string","description":"The perceived severity of the notification. Can be one of info, warning, error, or critical or dereference a field or use a template function to populate it such as {{ __pd_severity__ }}."},"source":{"type":"string","description":"The Source machine of the event."},"summary":{"type":"string","description":"A brief text summary of the event, used to generate the summaries/titles of any associated alerts."},"tags":{"type":"array","items":{"type":"string"}}},"required":["name","severity","source","summary"]},"NotificationTemplatePagerDutyUpdateInput":{"type":"object","properties":{"class":{"type":"string","description":"The class/type of the event."},"component":{"type":"string","description":"Component of the source machine that is responsible for the event."},"custom_details":{"type":"object","additionalProperties":{},"description":"Custom details to include in the event."},"dedup_key":{"type":"string","description":"A unique identifier for the event, used to deduplicate events.","maxLength":255},"description":{"type":"string","description":"A brief description explaining what the template is for.","maxLength":500},"group":{"type":"string","description":"Logical grouping of components of a service, useful for filtering alerts."},"name":{"type":"string","description":"Name of the notification template."},"severity":{"type":"string","description":"The perceived severity of the notification. Can be one of info, warning, error, or critical or dereference a field or use a template function to populate it such as {{ __pd_severity__ }}."},"source":{"type":"string","description":"The Source machine of the event."},"summary":{"type":"string","description":"A brief text summary of the event, used to generate the summaries/titles of any associated alerts."},"tags":{"type":"array","items":{"type":"string"}}},"required":["name","severity","source","summary"]},"NotificationTemplateSlackCreateInput":{"type":"object","properties":{"blocks":{"type":"array","items":{"type":"object","additionalProperties":{}},"description":"Blocks to send to Slack."},"description":{"type":"string","description":"A brief description explaining what the template is for.","maxLength":500},"name":{"type":"string","description":"Name of the notification template."},"tags":{"type":"array","items":{"type":"string"}},"text":{"type":"string","description":"Message to send to Slack."}},"required":["name","text"]},"NotificationTemplateSlackUpdateInput":{"type":"object","properties":{"blocks":{"type":"array","items":{"type":"object","additionalProperties":{}},"description":"Blocks to send to Slack."},"description":{"type":"string","description":"A brief description explaining what the template is for.","maxLength":500},"name":{"type":"string","description":"Name of the notification template."},"tags":{"type":"array","items":{"type":"string"}},"text":{"type":"string","description":"Message to send to Slack."}},"required":["name","text"]},"NotificationTemplateWebhookCreateInput":{"type":"object","properties":{"description":{"type":"string","description":"A brief description explaining what the template is for.","maxLength":500},"entire_object":{"type":"boolean","description":"Send the entire object as the payload. Overrides the payload field."},"name":{"type":"string","description":"Name of the notification template."},"payload":{"type":"object","additionalProperties":{},"description":"Custom payload to send to the webhook."},"tags":{"type":"array","items":{"type":"string"}}},"required":["name"]},"NotificationTemplateWebhookUpdateInput":{"type":"object","properties":{"description":{"type":"string","description":"A brief description explaining what the template is for.","maxLength":500},"entire_object":{"type":"boolean","description":"Send the entire object as the payload. Overrides the payload field."},"name":{"type":"string","description":"Name of the notification template."},"payload":{"type":"object","additionalProperties":{},"description":"Custom payload to send to the webhook."},"tags":{"type":"array","items":{"type":"string"}}},"required":["name"]},"ObjectsInput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system, and shouldn't be exposed to customers"},"ids":{"type":"array","items":{"type":"string"},"description":"Array of IDs to resolve into records","maxItems":2000,"minItems":1}},"required":["ids"]},"ObjectsPollResultsInput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system, and shouldn't be exposed to customers"},"query_id":{"type":"string","description":"Query ID returned by start query","maxLength":128}},"required":["query_id"]},"ObjectsStartQueryInput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system, and shouldn't be exposed to customers"},"ids":{"type":"array","items":{"type":"string"},"description":"Array of IDs to resolve into records","maxItems":2000,"minItems":1},"rules":{"type":"array","items":{"$ref":"#/components/schemas/SessionGraphLinkRule"},"description":"The rules to use to walk the graph","maxItems":2000}},"required":["ids"]},"ObjectsStopQueryInput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system, and shouldn't be exposed to customers"},"query_id":{"type":"string","description":"Query ID returned by start query","maxLength":128}},"required":["query_id"]},"ObjectsWalkGraphInput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system, and shouldn't be exposed to customers"},"ids":{"type":"array","items":{"type":"string"},"description":"Array of IDs to resolve into records","maxItems":2000,"minItems":1},"rules":{"type":"array","items":{"$ref":"#/components/schemas/SessionGraphLinkRule"},"description":"The rules to use to walk the graph","maxItems":2000}},"required":["ids"]},"Orc_apiAgentActionError":{"type":"object","properties":{"message":{"type":"string","description":"A human-readable error message containing context about how or why the error occurred","maxLength":1024},"reason":{"type":"string","description":"A short, predictable string that identifies the type of error","maxLength":128}}},"Orc_apiAgentWork":{"type":"object","properties":{"work":{"type":"array","items":{"$ref":"#/components/schemas/Orc_apiBatWork"},"description":"Array of bats to execute","maxItems":32}},"description":"Agent work, which is sent to the agents"},"Orc_apiBatWork":{"type":"object","properties":{"arguments":{"type":"array","items":{"type":"string"},"description":"arguments to pass to the commandline","maxItems":64},"bat_uid":{"type":"string","description":"ID of this specific type of bat, specified by Spyderbat","maxLength":32},"enabled":{"type":"boolean","description":"Execute this bat or not?"},"parameters":{"type":"object","additionalProperties":{},"description":"input parameters to the bat"},"start_order":{"type":"integer","description":"Order in which to start this bat","format":"int32"},"uid":{"type":"string","description":"uid of the specific bat work for a specific agent","maxLength":32},"version":{"type":"object","additionalProperties":{},"description":"Newest version of the bat from the repository"}}},"Orc_apiClusterDetails":{"type":"object","properties":{"agent_uid":{"type":"string","maxLength":64},"cluid":{"type":"string","maxLength":64},"cluster_name":{"type":"string","maxLength":64},"cluster_uid":{"type":"string"},"spyder_tags":{"type":"object","additionalProperties":{"type":"string"}},"src_uid":{"type":"string","maxLength":64}},"description":"Cluster details","required":["cluster_uid"]},"Orc_apiRuntimeDetails":{"type":"object","properties":{"agent_arch":{"type":"string"},"agent_registration_uid":{"type":"string"},"agent_status":{"type":"string"},"agent_type":{"type":"integer","format":"int32"},"agent_uid":{"type":"string"},"agent_version":{"type":"string"},"boot_time":{"type":"number","format":"double"},"cloud_account_id":{"type":"string"},"cloud_image_id":{"type":"string"},"cloud_instance_id":{"type":"string"},"cloud_region":{"type":"string"},"cloud_tags":{"type":"array","items":{"type":"string"}},"cloud_type":{"type":"string"},"cpu_cores":{"type":"integer","format":"int32"},"cpu_make":{"type":"string"},"cpu_model":{"type":"string"},"error_msg":{"type":"string"},"hostname":{"type":"string"},"ip_addresses":{"type":"array","items":{"type":"string"}},"live_test_ran":{"type":"integer","format":"int32"},"live_test_result":{"type":"integer","format":"int32"},"mac_addresses":{"type":"array","items":{"type":"string"}},"memory_total_bytes":{"type":"integer","format":"int64"},"memory_total_gb":{"type":"number","format":"double"},"os_name":{"type":"string"},"os_pretty_name":{"type":"string"},"request_ip":{"type":"string"},"spyder_tags":{"type":"object","additionalProperties":{"type":"string"}},"src_uid":{"type":"string"},"uname":{"type":"string"}},"description":"Runtime details"},"Org":{"type":"object","properties":{"active_sources":{"type":"integer","description":"Total number of active sources within the last 5 minutes","format":"int32"},"active_users":{"type":"integer","description":"Total number of active users within the last 7 days (which might be active on a different org)","format":"int32"},"name":{"type":"string","description":"Name of the organization","maxLength":64,"minLength":3},"org_type_uid":{"type":"string","description":"Organization Type","maxLength":64},"owner_email":{"type":"string","description":"The email address of the user who owns this org","format":"email"},"owner_uid":{"type":"string","description":"The user UID who owns this organization","maxLength":64},"processing_stack":{"type":"string","description":"Deployment stack the org runs on, extracted from the org type's policy (e.g. 'saas', 'enterprise-us')"},"quota":{"$ref":"#/components/schemas/DaoOrgQuota"},"resource_name":{"type":"string","description":"Resource name utilized by RBAC"},"resource_policy":{"$ref":"#/components/schemas/ResourcePolicy"},"standby":{"type":"boolean","description":"Is this org in standby mode?"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":20},"total_sources":{"type":"integer","description":"Total number of sources","format":"int32"},"total_users":{"type":"integer","description":"Total number of users","format":"int32"},"uid":{"type":"string","description":"Org UID","maxLength":64},"user_workid":{"type":"integer","description":"User selected workid","format":"int32"},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"}},"required":["name","owner_email"]},"OrgAssignRoleInput":{"type":"object","properties":{"role_uid":{"type":"string","description":"RoleUID","maxLength":64},"user_uid":{"type":"string","description":"UserUID"}}},"OrgInviteUsersInput":{"type":"object","properties":{"emails":{"type":"array","items":{"type":"string"},"maxItems":64,"minItems":1},"roles":{"type":"array","items":{"type":"string"},"maxItems":10,"minItems":1}}},"OrgTestNotificationTargetInput":{"type":"object","properties":{"target":{"type":"string","maxLength":64,"minLength":1}}},"OrgUnassignRoleInput":{"type":"object","properties":{"role_uid":{"type":"string","description":"RoleUID","maxLength":64},"user_uid":{"type":"string","description":"UserUID"}}},"OrgUpdateInput":{"type":"object","properties":{"active_sources":{"type":"integer","description":"Total number of active sources within the last 5 minutes","format":"int32"},"active_users":{"type":"integer","description":"Total number of active users within the last 7 days (which might be active on a different org)","format":"int32"},"name":{"type":"string","description":"Name of the organization","maxLength":64,"minLength":3},"org_type_uid":{"type":"string","description":"Organization Type","maxLength":64},"owner_email":{"type":"string","description":"The email address of the user who owns this org","format":"email"},"owner_uid":{"type":"string","description":"The user UID who owns this organization","maxLength":64},"processing_stack":{"type":"string","description":"Deployment stack the org runs on, extracted from the org type's policy (e.g. 'saas', 'enterprise-us')"},"quota":{"$ref":"#/components/schemas/DaoOrgQuota"},"resource_name":{"type":"string","description":"Resource name utilized by RBAC"},"resource_policy":{"$ref":"#/components/schemas/ResourcePolicy"},"standby":{"type":"boolean","description":"Is this org in standby mode?"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":20},"total_sources":{"type":"integer","description":"Total number of sources","format":"int32"},"total_users":{"type":"integer","description":"Total number of users","format":"int32"},"user_workid":{"type":"integer","description":"User selected workid","format":"int32"},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"}},"required":["name","owner_email"]},"Parse Search QueryInput":{"type":"object","properties":{"case_sensitive":{"type":"boolean","description":"Whether the query is case sensitive (default false)"},"cluster_uid":{"type":"string","description":"An optional pre-filter field that restricts results to one cluster"},"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system, and shouldn't be exposed to customers"},"end_time":{"type":"integer","description":"End time to query","format":"int32"},"group_by":{"type":"array","items":{"$ref":"#/components/schemas/SessionGrouping"},"description":"What fields to use for grouping, a non-empty array causes the output to be treated as a histogram"},"latest_version":{"type":"boolean","description":"Whether to pre-filter the results to only search with the latest version of each object (default true)","nullable":true},"muid":{"type":"string","description":"An optional pre-filter field that restricts results to one machine"},"order_by":{"description":"Fields to order the results by","nullable":true},"output_fields":{"type":"array","items":{"type":"string"},"description":"What fields to output from the query; default: [\"id\"]"},"query":{"type":"string","description":"Query to execute","maxLength":65536},"schema":{"type":"string","description":"Schema to query","maxLength":512},"start_time":{"type":"integer","description":"Start time to query","format":"int32"}},"required":["end_time","query","schema","start_time"]},"RBACAction":{"type":"object","properties":{"action":{"type":"string","description":"Action which meets the requirements of RBAC action naming","maxLength":32},"can_perform":{"type":"boolean","description":"Return result of querying the users RBAC capabilities"},"error":{"type":"string","description":"Error returned from permission checking"},"resource_name":{"type":"string","description":"ResourceName which meets the requirements of RBAC resource naming","maxLength":128}}},"RbacConditionMap":{"type":"object","description":"Additional conditions which may be applied"},"RbacRole":{"type":"object","properties":{"description":{"type":"string"},"name":{"type":"string"},"statements":{"type":"array","items":{"$ref":"#/components/schemas/RbacStatement"}},"uid":{"type":"string"},"version":{"type":"string"}}},"RbacStatement":{"type":"object","properties":{"actions":{"type":"array","items":{"type":"string"},"description":"The actions that may be performed","maxItems":50,"minItems":1},"condition":{"$ref":"#/components/schemas/RbacConditionMap"},"effect":{"type":"string","description":"The effect of the statement, i.e. allow or deny","maxLength":5},"resources":{"type":"array","items":{"type":"string"},"description":"The resource the statement applies to","maxItems":25,"minItems":1},"sid":{"type":"string","description":"Statement ID, used to identify the statement in audit logs","maxLength":32}},"required":["effect","sid"]},"ResourcePolicy":{"type":"object","properties":{"name":{"type":"string","description":"Name of the resource policy","maxLength":32},"statements":{"type":"array","items":{"$ref":"#/components/schemas/RbacStatement"},"description":"List of statements to be examined by the resource policy"},"version":{"type":"string","maxLength":24}},"description":"Resource policy for RBAC"},"ResultsInput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system, and shouldn't be exposed to customers"},"limit":{"type":"integer","description":"Maximum number of results to return","format":"int32","maximum":10000},"token":{"type":"string","description":"Where to start the query in the result set from","maxLength":128}}},"SavedQueryCreateInput":{"type":"object","properties":{"additional_settings":{"type":"object","additionalProperties":{}},"description":{"type":"string","maxLength":500},"name":{"type":"string","maxLength":128,"minLength":1},"notification_settings":{"$ref":"#/components/schemas/DaoNotificationSettings"},"query":{"type":"string","maxLength":65535,"minLength":1},"schema":{"type":"string","maxLength":64}},"required":["name","query","schema"]},"SavedQueryUpdateInput":{"type":"object","properties":{"additional_settings":{"type":"object","additionalProperties":{}},"description":{"type":"string","maxLength":500,"minLength":1},"name":{"type":"string","maxLength":128,"minLength":1},"notification_settings":{"$ref":"#/components/schemas/DaoNotificationSettings"},"query":{"type":"string","maxLength":65535}}},"SearchInput":{"type":"object","properties":{"case_sensitive":{"type":"boolean","description":"Whether the query is case sensitive (default false)"},"cluster_uid":{"type":"string","description":"An optional pre-filter field that restricts results to one cluster"},"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system, and shouldn't be exposed to customers"},"end_time":{"type":"integer","description":"End time to query","format":"int32"},"group_by":{"type":"array","items":{"$ref":"#/components/schemas/SessionGrouping"},"description":"What fields to use for grouping, a non-empty array causes the output to be treated as a histogram"},"latest_version":{"type":"boolean","description":"Whether to pre-filter the results to only search with the latest version of each object (default true)","nullable":true},"muid":{"type":"string","description":"An optional pre-filter field that restricts results to one machine"},"order_by":{"description":"Fields to order the results by","nullable":true},"output_fields":{"type":"array","items":{"type":"string"},"description":"What fields to output from the query; default: [\"id\"]"},"query":{"type":"string","description":"Query to execute","maxLength":65536},"schema":{"type":"string","description":"Schema to query","maxLength":512},"start_time":{"type":"integer","description":"Start time to query","format":"int32"}},"required":["end_time","query","schema","start_time"]},"SearchSetCreateInput":{"type":"object","properties":{"searchset":{"$ref":"#/components/schemas/DaoSearchSetObject"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":30}},"required":["searchset"]},"SearchSetUpdateInput":{"type":"object","properties":{"searchset":{"$ref":"#/components/schemas/DaoSearchSetObject"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":30}},"required":["searchset"]},"SessionAgentHealthNotificationCreateOutput":{"type":"object","properties":{"uid":{"type":"string"}}},"SessionAgentHealthNotificationListOutput":{"type":"object","properties":{"agent_health_notifications_settings_list":{"type":"array","items":{"$ref":"#/components/schemas/SessionOutputAgentHealthNotification"}},"search_total":{"type":"integer","format":"int32"},"total_agent_health_notifications":{"type":"integer","format":"int32"},"total_pages":{"type":"integer","format":"int32"}}},"SessionAgentHealthNotificationLoadOutput":{"type":"object","properties":{"agent_health_notification_settings":{"$ref":"#/components/schemas/SessionOutputAgentHealthNotification"}}},"SessionAgentHealthNotificationUpdateOutput":{"type":"object","properties":{"agent_health_notification_settings":{"$ref":"#/components/schemas/SessionOutputAgentHealthNotification"}}},"SessionAgentKillPodOutput":{"type":"object","properties":{"action_uid":{"type":"string","description":"The uid of the action record"}}},"SessionAgentKillProcessOutput":{"type":"object","properties":{"action_uid":{"type":"string","description":"The uid of the action record"}}},"SessionAgentScanContainerOutput":{"type":"object","properties":{"action_uid":{"type":"string","description":"The uid of the action record"}}},"SessionArchiveListResponse":{"type":"object","properties":{"continuation_token":{"type":"string","description":"If present, more archives match; pass it back as continuation_token (with the same other parameters) to fetch the next page"},"results":{"type":"array","items":{"$ref":"#/components/schemas/SessionArchiveObject"},"description":"Archives matching the query, in no particular order"}}},"SessionArchiveObject":{"type":"object","properties":{"end_time":{"type":"integer","description":"Unix seconds of the latest record contained in the archive","format":"int64"},"name":{"type":"string","description":"Archive identifier; pass to the download endpoint to fetch the zip. Of the form {sourceUID}-{partition}-{seq}-{start}-{end}.zip"},"size":{"type":"integer","description":"Size of the zip, in bytes","format":"int64"},"source_uid":{"type":"string","description":"Source UID the archive belongs to"},"start_time":{"type":"integer","description":"Unix seconds of the earliest record contained in the archive","format":"int64"}}},"SessionCreateCustomFlagOutput":{"type":"object","properties":{"uid":{"type":"string"}}},"SessionCreateNotificationTargetOutput":{"type":"object","properties":{"uid":{"type":"string"}}},"SessionCreateNotificationTemplateOutput":{"type":"object","properties":{"uid":{"type":"string"}}},"SessionCreateSavedQueryOutput":{"type":"object","properties":{"uid":{"type":"string"}}},"SessionDisableNotificationSettingsOutput":{"type":"object","properties":{"notification_settings":{"$ref":"#/components/schemas/DaoNotificationSettings"}}},"SessionEnableNotificationSettingsOutput":{"type":"object","properties":{"notification_settings":{"$ref":"#/components/schemas/DaoNotificationSettings"}}},"SessionFingerprintSearchResults":{"type":"object","properties":{"errors":{"type":"array","items":{},"description":"Errors encountered during object hydration."},"result_count":{"type":"integer","description":"The number of results returned.","format":"int32"},"results":{"type":"array","items":{},"description":"Fingerprint objects with covered_by_policy boolean indicating if matched by any analytics policy of the requested types."},"status":{"type":"string","description":"The status of the query. If non-empty, the job is still running or failed - poll again."}}},"SessionGraphLinkRule":{"type":"object","properties":{"field":{"type":"string","description":"The field of the object which contains an ID or list of IDs"},"max_depth":{"type":"integer","description":"The maximum number of times to resolve this link","format":"int32","nullable":true},"object_schema":{"type":"string","description":"The short schema of the objects with this link"}},"required":["field","object_schema"]},"SessionGrouping":{"type":"object","properties":{"bins":{"type":"array","items":{"type":"number","format":"double"},"description":"The bins to use for grouping this field, if it is numeric"},"name":{"type":"string","description":"The field name to group by"}}},"SessionInitializeNotificationSettingsOutput":{"type":"object","properties":{"NotificationSettings":{"$ref":"#/components/schemas/DaoNotificationSettings"}}},"SessionListActionStatusOutput":{"type":"object","properties":{"action_statuses":{"type":"array","items":{"$ref":"#/components/schemas/DaoActionStatus"},"description":"The list of action status records"},"search_total":{"type":"integer","description":"The total number of items","format":"int32"},"total_pages":{"type":"integer","description":"The total number of pages","format":"int32"}}},"SessionListCustomFlagOutput":{"type":"object","properties":{"custom_flags":{"type":"array","items":{"$ref":"#/components/schemas/SessionOutputCustomFlag"},"description":"List of custom flags"},"search_total":{"type":"integer","description":"Total number of custom flags matching the search criteria","format":"int32"},"total_flags":{"type":"integer","description":"Total number of custom flags","format":"int32"},"total_pages":{"type":"integer","description":"Total number of pages","format":"int32"}}},"SessionListNotificationSettingsOutput":{"type":"object","properties":{"notification_settings":{"type":"array","items":{"$ref":"#/components/schemas/DaoNotificationSettingsDBObj"}},"search_total":{"type":"integer","format":"int32"},"total_notification_settings":{"type":"integer","format":"int32"},"total_pages":{"type":"integer","format":"int32"}}},"SessionListNotificationTemplateOutput":{"type":"object","properties":{"notification_templates":{"type":"array","items":{"$ref":"#/components/schemas/SessionOutputNotificationTemplate"}},"search_total":{"type":"integer","format":"int32"},"total_pages":{"type":"integer","format":"int32"},"total_templates":{"type":"integer","format":"int32"}}},"SessionListSavedQueryOutput":{"type":"object","properties":{"saved_queries":{"type":"array","items":{"$ref":"#/components/schemas/SessionOutputSavedQuery"},"description":"List of saved queries"},"search_total":{"type":"integer","description":"Total number of saved queries matching the search criteria","format":"int32"},"total_pages":{"type":"integer","description":"Total number of pages of search results","format":"int32"},"total_queries":{"type":"integer","description":"Total number of saved queries","format":"int32"}}},"SessionLoadActionStatusOutput":{"type":"object","properties":{"action_status":{"$ref":"#/components/schemas/DaoActionStatus"}}},"SessionLoadCustomFlagOutput":{"type":"object","properties":{"custom_flag":{"$ref":"#/components/schemas/SessionOutputCustomFlag"}}},"SessionLoadNotificationSettingsOutput":{"type":"object","properties":{"notification_settings":{"$ref":"#/components/schemas/DaoNotificationSettingsDBObj"}}},"SessionLoadNotificationTemplateOutput":{"type":"object","properties":{"notification_template":{"$ref":"#/components/schemas/SessionOutputNotificationTemplate"}}},"SessionLoadSavedQueryOutput":{"type":"object","properties":{"saved_query":{"$ref":"#/components/schemas/SessionOutputSavedQuery"}}},"SessionNotificationTargetListOutput":{"type":"object","properties":{"notification_targets":{"type":"array","items":{"$ref":"#/components/schemas/SessionOutputNotificationTarget"}},"search_total":{"type":"integer","format":"int32"},"total_pages":{"type":"integer","format":"int32"},"total_targets":{"type":"integer","format":"int32"}}},"SessionNotificationTargetLoadOutput":{"type":"object","properties":{"notification_target":{"$ref":"#/components/schemas/SessionOutputNotificationTarget"}}},"SessionNotificationTargetUpdateOutput":{"type":"object","properties":{"notification_target":{"$ref":"#/components/schemas/SessionOutputNotificationTarget"}}},"SessionObjectPollResultsResponse":{"type":"object","properties":{"complete":{"type":"boolean","description":"Whether or not the data is complete, meaning there are no more results"},"errors":{"type":"array","items":{},"description":"List of errors from object query"},"results":{"type":"array","items":{},"description":"Objects matching the requested ids"}}},"SessionObjectQueryResponse":{"type":"object","properties":{"err_array":{"type":"array","items":{},"description":"List of errors from object query"},"results":{"type":"array","items":{},"description":"Objects matching the requested ids"},"retryable":{"type":"array","items":{"type":"string"},"description":"List of IDs that were not found and can be retried"}}},"SessionObjectStartQueryResponse":{"type":"object","properties":{"errors":{"type":"array","items":{},"description":"List of ids that are not in the database"},"query_id":{"type":"string","description":"Optional ID that can be passed to poll results to get the rest of the results","maxLength":128},"results":{"type":"array","items":{},"description":"Objects matching the requested ids"}}},"SessionOrgTypeMaxLimit":{"type":"object","properties":{"current_value":{"type":"number","description":"What is the current value","format":"double"},"description":{"type":"string","description":"Description of the limit"},"limit_exceeded":{"type":"boolean","description":"Has the limit been met or exceeded"},"limit_value":{"type":"number","description":"What is the max limit value","format":"double"},"remaining_capacity":{"type":"number","description":"How many items can be added to the current value before it is exceeded","format":"double"},"time_window_in_seconds":{"type":"integer","description":"The time window in seconds that the limit is calculated on","format":"int32"}}},"SessionOutputAgentHealthNotification":{"type":"object","properties":{"action_taken":{"type":"string"},"action_time":{"type":"integer","format":"int64"},"action_user":{"type":"string"},"created_by":{"type":"string"},"description":{"type":"string"},"last_updated":{"type":"integer","format":"int64"},"last_updated_by":{"type":"string"},"name":{"type":"string"},"notification_settings":{"$ref":"#/components/schemas/DaoAgentHealthNotificationSettings"},"org_uid":{"type":"string"},"resource_name":{"type":"string"},"revision":{"type":"integer","format":"int32"},"scope_query":{"type":"string"},"uid":{"type":"string"},"valid_from":{"type":"integer","format":"int64"},"version":{"type":"integer","format":"int32"}}},"SessionOutputCustomFlag":{"type":"object","properties":{"action_taken":{"type":"string"},"action_time":{"type":"integer","format":"int64"},"action_user":{"type":"string"},"content":{"type":"string"},"created_by":{"type":"string"},"description":{"type":"string"},"impact":{"type":"string"},"is_enabled":{"type":"boolean"},"last_updated":{"type":"integer","format":"int64"},"last_updated_by":{"type":"string"},"name":{"type":"string"},"notification_settings":{"$ref":"#/components/schemas/DaoNotificationSettingsObj"},"org_uid":{"type":"string"},"query":{"type":"string"},"revision":{"type":"string"},"saved_query_uid":{"type":"string"},"schema":{"type":"string"},"severity":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"uid":{"type":"string"},"valid_from":{"type":"integer","format":"int64"},"version":{"type":"integer","format":"int32"}}},"SessionOutputNotificationTarget":{"type":"object","properties":{"action_taken":{"type":"string"},"action_time":{"type":"integer","format":"int64"},"action_user":{"type":"string"},"created_by":{"type":"string"},"description":{"type":"string","description":"Description of the notification target.","maxLength":500},"last_updated":{"type":"integer","format":"int64"},"last_updated_by":{"type":"string"},"name":{"type":"string","description":"Name of the notification target."},"org_uid":{"type":"string"},"revision":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"target_data":{"type":"object","additionalProperties":{}},"target_type":{"type":"string"},"uid":{"type":"string"},"valid_from":{"type":"integer","format":"int64"},"version":{"type":"integer","format":"int32"}},"required":["name"]},"SessionOutputNotificationTemplate":{"type":"object","properties":{"action_taken":{"type":"string"},"action_time":{"type":"integer","format":"int64"},"action_user":{"type":"string"},"created_by":{"type":"string"},"description":{"type":"string","description":"A brief description explaining what the template is for.","maxLength":500},"last_updated":{"type":"integer","format":"int64"},"last_updated_by":{"type":"string"},"name":{"type":"string","description":"Name of the notification template."},"org_uid":{"type":"string"},"revision":{"type":"string"},"settings":{"type":"object","additionalProperties":{}},"tags":{"type":"array","items":{"type":"string"}},"template_data":{"type":"object","additionalProperties":{}},"template_type":{"type":"string"},"uid":{"type":"string"},"valid_from":{"type":"integer","format":"int64"},"version":{"type":"integer","format":"int32"}},"required":["name"]},"SessionOutputSavedQuery":{"type":"object","properties":{"additional_settings":{"type":"object","additionalProperties":{}},"created_by":{"type":"string"},"description":{"type":"string"},"last_used":{"type":"integer","format":"int64"},"name":{"type":"string"},"notification_settings":{"$ref":"#/components/schemas/DaoNotificationSettingsObj"},"org_uid":{"type":"string"},"query":{"type":"string"},"schema":{"type":"string"},"uid":{"type":"string"},"valid_from":{"type":"integer","format":"int64"}}},"SessionQueryDependentResources":{"type":"object","properties":{"custom_flags":{"type":"array","items":{"type":"string"}}}},"SessionSavedQueryShowAdditionalSettingsOutput":{"type":"object","properties":{"additional_settings":{"type":"object","additionalProperties":{},"description":"Additional settings fields and their corresponding types"}}},"SessionSetNotificationSettingsOutput":{"type":"object","properties":{"NotificationSettings":{"$ref":"#/components/schemas/DaoNotificationSettings"}}},"SessionSpyctlDiffOutput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system"},"diff_data":{"type":"string"},"irrelevant":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}},"description":"Includes any objects that were irrelevant to the diff. The include_irrelevant option must be set to true to return this data."}}},"SessionSpyctlGuardianPolicyBuildOutput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system"},"policy":{"$ref":"#/components/schemas/DaoPolicyObject"}}},"SessionSpyctlMergeOutput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system"},"merged_object":{"$ref":"#/components/schemas/DaoAnalyticResourceObject"}}},"SessionSpyctlReportDeleteOutput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system"}}},"SessionSpyctlReportInventoryOutput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system"},"inventory":{"type":"array","items":{"$ref":"#/components/schemas/SessionSpyctlReportSpec"},"description":"The inventory of reports available to generate for the org"}}},"SessionSpyctlReportListOutput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system"},"reports":{"type":"array","items":{"$ref":"#/components/schemas/SessionSpyctlReportOutput"},"description":"List of reports"}}},"SessionSpyctlReportListPagerOutput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system"},"continuation_token":{"type":"string","description":"Continuation token for the next page of reports"},"reports":{"type":"array","items":{"$ref":"#/components/schemas/SessionSpyctlReportOutput"},"description":"List of reports"}}},"SessionSpyctlReportOutput":{"type":"object","properties":{"change_log":{"type":"array","items":{"type":"array","items":{}},"description":"Change log of the report generation process"},"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system"},"error":{"type":"string","description":"Error message if the report generation failed"},"formats":{"type":"array","items":{"type":"string"},"description":"List of formats available for the report"},"id":{"type":"string","description":"Identifier for the generated report, to use in subsequent status update requests"},"input":{"type":"object","additionalProperties":{},"description":"Input arguments for the report"},"status":{"type":"string","description":"Status of the report generation"}}},"SessionSpyctlReportSpec":{"type":"object","properties":{"args":{"type":"array","items":{"$ref":"#/components/schemas/SessionSpyctlReportSpecArgument"},"description":"List of arguments for the report"},"description":{"type":"string","description":"Long form description of the report"},"id":{"type":"string","description":"Name of the report"},"short":{"type":"string","description":"Short form description of the report"},"supported_formats":{"type":"array","items":{"type":"string"},"description":"List of output formats available for the report"}}},"SessionSpyctlReportSpecArgument":{"type":"object","properties":{"default":{"type":"string","description":"Suggested default value for the argument"},"description":{"type":"string","description":"Long form description of the argument"},"name":{"type":"string","description":"Name of the argument"},"required":{"type":"boolean","description":"Is the argument required"},"short":{"type":"string","description":"Short form description of the argument"},"type":{"type":"string","description":"Type of the argument"}}},"SessionSpyctlSuppressionPolicyBuildOutput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system"},"policy":{"$ref":"#/components/schemas/DaoPolicyObject"}}},"SessionSpyctlValidateOutput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system"},"invalid_message":{"type":"string","description":"If the input object is invalid, InvalidMessage will be populated with descriptions of the detected syntax errors"}}},"SessionSuppressTraceOutput":{"type":"object","properties":{"applied_policy":{"$ref":"#/components/schemas/DaoOutputAnalyticsPolicy"},"matching_policy_exists":{"type":"boolean","description":"Indicates if a suppression policy already exists for the trace signature"},"policy_preview":{"$ref":"#/components/schemas/DaoTraceSuppressionPolicy"},"update_performed":{"type":"boolean","description":"Indicates if an existing suppression policy was updated instead of a new one being created"},"warnings":{"type":"array","items":{"type":"string"}}}},"SessionTestNotificationOutput":{"type":"object","properties":{"message":{"type":"string","description":"Contains information on inspecting the success or failure of the test notification."}}},"SessionUpdateCustomFlagOutput":{"type":"object","properties":{"custom_flag":{"$ref":"#/components/schemas/SessionOutputCustomFlag"}}},"SessionUpdateNotificationTemplateOutput":{"type":"object","properties":{"notification_template":{"$ref":"#/components/schemas/SessionOutputNotificationTemplate"}}},"SessionUpdateSavedQueryOutput":{"type":"object","properties":{"saved_query":{"$ref":"#/components/schemas/SessionOutputSavedQuery"}}},"Source":{"type":"object","properties":{"active":{"type":"integer","description":"Is this source considered active","format":"int32"},"agent_uid":{"type":"string","description":"The agent this source is associated with"},"archived":{"type":"boolean","description":"Is the source archived?"},"description":{"type":"string","description":"User supplied description of the source","maxLength":256},"last_data":{"type":"string","format":"date-time"},"last_ingest_chunk_end_time":{"type":"string","description":"The end of the last chunk ingested from the agent","format":"date-time"},"last_stored_chunk_end_time":{"type":"string","description":"The end of the last chunk stored from the agent","format":"date-time"},"name":{"type":"string","description":"User supplied name of the source","maxLength":32},"org_uid":{"type":"string","description":"The org this source is associated with","maxLength":64},"resource_name":{"type":"string","description":"Resource name used for RBAC"},"resource_policy":{"$ref":"#/components/schemas/ResourcePolicy"},"runtime_description":{"type":"string","description":"Description of the runtime of the source"},"runtime_details":{"$ref":"#/components/schemas/Orc_apiRuntimeDetails"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":20},"type":{"type":"string","description":"Type of source"},"uid":{"type":"string","description":"The UID of the source","maxLength":64},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"}},"required":["uid"]},"SpyctlDiffInput":{"type":"object","properties":{"content_type":{"type":"string","description":"The content type of the diff output. Possible values are: text, json."},"diff_objects":{"type":"array","items":{"$ref":"#/components/schemas/DaoAnalyticResourceObject"},"description":"The object(s) to diff the primary object with."},"full_diff":{"type":"boolean","description":"When content_type is omitted or set to text this returns the full diff text instead of a summary."},"include_irrelevant":{"type":"boolean","description":"When set to true, the output of this API will return lists of objects, by kind, that had no impact on the diff. This option may increase compute time."},"object":{"$ref":"#/components/schemas/DaoAnalyticResourceObject"}},"required":["diff_objects","object"]},"SpyctlMergeInput":{"type":"object","properties":{"merge_objects":{"type":"array","items":{"$ref":"#/components/schemas/DaoAnalyticResourceObject"},"description":"The object(s) to merge into the primary object."},"object":{"$ref":"#/components/schemas/DaoAnalyticResourceObject"}},"required":["merge_objects","object"]},"SpyctlReportGenerateInput":{"type":"object","properties":{"report_args":{"type":"object","additionalProperties":{},"description":"name value pair arguments for the report to generate"},"report_id":{"type":"string","description":"identifier for the type of report to generate"},"report_tags":{"type":"object","additionalProperties":{},"description":"name value pairs to tag the report to generate"}},"required":["report_args","report_id"]},"SpyctlReportListPagerInput":{"type":"object","properties":{"continuation_token":{"type":"string","description":"token to continue the list of reports"},"scheduled_time_from":{"type":"number","description":"Get only reports that were scheduled after this timestamp. If omitted, defaulted to 1 week ago.","format":"float"},"scheduled_time_to":{"type":"number","description":"Get only reports that were scheduled before this timestamp. If omitted, defaults to current time.","format":"float"}}},"SpyctlValidateInput":{"type":"object","properties":{"object":{"$ref":"#/components/schemas/DaoAnalyticResourceObject"}},"required":["object"]},"SrcCreateInput":{"type":"object","properties":{"description":{"type":"string","description":"User supplied description of the source","maxLength":256},"name":{"type":"string","description":"User supplied name of the source","maxLength":32},"runtime_description":{"type":"string","description":"Description of the runtime of the source"},"runtime_details":{"$ref":"#/components/schemas/Orc_apiRuntimeDetails"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":20},"type":{"type":"string","description":"Type of source"},"uid":{"type":"string","description":"The UID of the source","maxLength":64}}},"SrcUpdateInput":{"type":"object","properties":{"active":{"type":"integer","description":"Is this source considered active","format":"int32"},"agent_uid":{"type":"string","description":"The agent this source is associated with"},"archived":{"type":"boolean","description":"Is the source archived?"},"description":{"type":"string","description":"User supplied description of the source","maxLength":256},"last_data":{"type":"string","format":"date-time"},"last_ingest_chunk_end_time":{"type":"string","description":"The end of the last chunk ingested from the agent","format":"date-time"},"last_stored_chunk_end_time":{"type":"string","description":"The end of the last chunk stored from the agent","format":"date-time"},"name":{"type":"string","description":"User supplied name of the source","maxLength":32},"resource_name":{"type":"string","description":"Resource name used for RBAC"},"resource_policy":{"$ref":"#/components/schemas/ResourcePolicy"},"runtime_description":{"type":"string","description":"Description of the runtime of the source"},"runtime_details":{"$ref":"#/components/schemas/Orc_apiRuntimeDetails"},"tags":{"type":"array","items":{"type":"string"},"description":"User supplied tags","maxItems":20},"type":{"type":"string","description":"Type of source"},"valid_from":{"type":"string","description":"Valid from date, the first date this object was valid","format":"date-time"},"valid_to":{"type":"string","description":"Valid to date, the date this object is valid to","format":"date-time"}}},"StsAssumeRoleInput":{"type":"object","properties":{"correlation_id":{"type":"string","description":"Audit/tracing identifier for this assumption (alphanumeric, max 64 chars)","maxLength":64},"org_uid":{"type":"string","description":"UID of the org the scoped token will be locked to"},"role_uid":{"type":"string","description":"UID of the Org/* role the scoped token will carry","maxLength":64},"ttl_seconds":{"type":"integer","description":"Requested lifetime in seconds. Clamped to [60, 3600]; 0 or unset applies the default (1200)","format":"int32","maximum":3600}},"required":["org_uid","role_uid"]},"SuppressTraceInput":{"type":"object","properties":{"ignore_warnings":{"type":"boolean","description":"If true, the suppression policy will be created even if there are warnings. If false, the suppression policy will not be created if there are warnings and a preview will be returned."},"name":{"type":"string","description":"Name of the suppression policy (overrides the auto-generated name)","maxLength":128},"preview":{"type":"boolean","description":"If true, the traces within scope will not be suppressed. Instead, the Trace Suppression Policy will be returned. If there are any warnings, this API will return a preview and list of warnings."},"scope_by_cluster":{"type":"boolean","description":"If true, the suppression policy will be scoped by the cluster the trace is a part of (if applicable). Will generate a warning if the trace is not part of a cluster."},"scope_by_container":{"type":"boolean","description":"If true, the suppression policy will be scoped by the container the trace is a part of (if applicable). Will generate a warning if the trace is not part of a container."},"scope_by_linux_service":{"type":"boolean","description":"If true, the suppression policy will be scoped by the Linux service the trace is a part of (if applicable). Will generate a warning if the trace is not part of a Linux service."},"scope_by_machine":{"type":"boolean","description":"If true, the suppression policy will be scoped by the machine the trace is a part of."},"scope_by_namespace":{"type":"boolean","description":"If true, the suppression policy will be scoped by the namespace the trace is a part of (if applicable). Will generate a warning if the trace is not part of a namespace."},"scope_by_user":{"type":"boolean","description":"If true, the suppression policy will be scoped by the user who triggered the trace"},"trace_uid":{"type":"string","description":"The UID of the trace signature to suppress. Does not suppress the trace itself, but all traces that match the signature going forward."}},"required":["trace_uid"]},"SuppressionPolicyBuildInput":{"type":"object","properties":{"name":{"type":"string","description":"Custom name for the suppression policy","maxLength":64},"object_uid":{"type":"string","description":"The uid of the object to suppress","maxLength":64},"scope_to_users":{"type":"boolean","description":"If set to true, the policy will automatically be scoped to the users associated with the object referenced by ObjUID; unless overwritten by the selectors.","default":false},"selectors":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}},"description":"The way to define a custom scope for the policy. Possible keys are: trigger-class, trigger-ancestors, users, interactive-users, non-interactive-users. Values may be wildcarded with '*'.","maxProperties":5},"type":{"type":"string","maxLength":64}},"required":["type"]},"ValidateInput":{"type":"object","properties":{"context_uid":{"type":"string","description":"Context UID for this query, it's used to track the query as it flows through the system, and shouldn't be exposed to customers"},"group_by":{"type":"array","items":{"$ref":"#/components/schemas/SessionGrouping"},"description":"What fields to use for grouping, a non-empty array causes the output to be treated as a histogram"},"is_for_realtime_search":{"type":"boolean"},"order_by":{"description":"Fields to order the results by","nullable":true},"output_fields":{"type":"array","items":{"type":"string"},"description":"What fields to output from the query; default: [\"id\"]"},"query":{"type":"string"},"schema":{"type":"string"}}},"ValidationError":{"type":"object","properties":{"err_msg":{"type":"string","description":"Message regarding the validation failure"},"field":{"type":"string","description":"Field name which failed validation"},"property":{"type":"string","description":"JSON property name of the field which failed validation"},"tags":{"type":"string","description":"Validation tag which failed"}}},"WatchlistCreateInput":{"type":"object","properties":{"files":{"type":"array","items":{"type":"string"}},"name":{"type":"string"}},"required":["files","name"]},"WatchlistUpdateInput":{"type":"object","properties":{"files":{"type":"array","items":{"type":"string"}},"name":{"type":"string"}},"required":["files","name"]}},"securitySchemes":{"apiToken":{"type":"http","scheme":"bearer","bearerFormat":"JWT"}}},"tags":[{"name":"AdhocSearch","description":"Ad-hoc Search interface for complex queries\n"},{"name":"Agent","description":"\nAgents represent a sepecific agent which collects data for one or more sources.\n"},{"name":"Agent Action","description":"\nAgent Action defines actions that can be executed on remote agents in response to events."},{"name":"Agent Registration","description":"\nAgents registrations are used to authorize and group agents by the registration. \n"},{"name":"AgentWork","description":"\nAgentWork API is intended for use by the UI to convey work \u0026 configuration to agents, this data can be specific to an agent or gloal to an organization. \n\nAn example use case is configuration data for a specific bat. The agents then overlay the global work data atop, the organizationan work (if defined), atop the specific agent work. \n\n\t"},{"name":"AnalyticsPolicy","description":"\nAn API to allow management of the organizations analytics policies.  These will be used throughout the system to take various actions."},{"name":"AnalyticsRuleset","description":"\nAn API to allow the management of analytics rulesets. Analytics rulesets are used within some types of analytics rulesets."},{"name":"Archive","description":"Access to raw agent archive data."},{"name":"Cases","description":"Cases management API"},{"name":"Cluster","description":"\nCluster represents known clusters, such as Kubernetes clusters running an appropriate agent."},{"name":"CustomFlag","description":"\nAn API to allow the management of custom flags. Custom flags allow users to define custom detections within Spyderbat."},{"name":"FingerprintData","description":"\nEach source may send fingerprint data which is stored and processed by the system.\n"},{"name":"ForwardedEvents","description":"\nAn API to allow retrieval of observations for a SIEM."},{"name":"Investigation","description":"Investigations can be created by users as a way to have an investigation into a potential attack, allowing users to associate data from one or more sources into a single investigation. An investigation may be utilized by multiple users as part of it's work flow. Investigations have a version history, each change to an investigation will result in a copy of the investigation to be captured and saved, prior versions can then be inspected later."},{"name":"NotificationTarget","description":"\nAn API to allow the management of notification targets. Notification targets allow users to define where notifications are sent."},{"name":"NotificationTemplate","description":"\nAn API to allow the management of notification templates. Notification templates allow users to define custom notifications within Spyderbat."},{"name":"Notifications","description":"\nAn API for retrieving, enabling, and disabling notification settings."},{"name":"NotificationsAgentHealth","description":"\nAn API for creating, retrieving, updating, and deleting agent health notification settings."},{"name":"Org","description":"\nOrganizations hold resources \u0026 data associated with an organization, users must be associated via roles with an organization to have permissions to interact with the organization. Each user my have multiple and different roles on different organizations and each organization may have multiple users with roles on the organization. Each user is has an organization assigned to the user during signup. Users may then assign other users various roles on the organization.\n"},{"name":"OrgType","description":"\nOrganizational types specify both limits and defaults for organizations, they are used by the system to determine the resource utilization for an organization and associated settings. \n"},{"name":"RBAC","description":"# Introduction \n\nThis RBAC model is based off of Amazon's model with some simplifications and generic assumptions\n\nA user has some number of roles on some number of organizations, each role defines some statements\nwhich determine determine if the user has access to some resources. These role based statements\nare combined with a policy which may be attached to the resource to be accessed. \n\nSo essentially acccess is determined by the combination of identity based polices and resource\nbased policies. \n\nAll associated statements from both the user's roles and the resources policy are considered before\naccess is granted. If any statement denies access then access is denied, at least one statement\nmust explicitly grant access to the resource, and if no statement denies or grants access then \naccess is not granted. \n\n\nThe resulting access decision is a combination of:\n\n```\nEvaluate(Roles(User,Org),Resource) - will evaluate all possible user roles on the resource\nEvaluate(GlobalRoles(User),Resource) - will evaluate all possible user roles on the resource\nEvaluate(CrossOrgRoles(User,Org),Resource) - will evaluate all possible cross org roles on the resource\nEvaluate(Resource.Policy,User) - will evalute the requesting user against the resource policy\n```\n\nThis means that a user role can specify what the user can access, while a specific resource\npolicy has the ability to deny access to a single user, or a user based upon roles or\ntags. \n\n# Example user role\n\n```json\n{\n\t\"name\":\"CatFeeder\",\n\t\"version\":\"1.0.0\",\n\t\"statements\":[\n\t\t{\n\t\t\t\"sid\":\"FeedCats\",\n\t\t\t\"effect\":\"allow\",\n\t\t\t\"actions\":[ \"cat:feed\" ],\n\t\t\t\"resources\":[ \"srn:cat:::*\" ],\n\t\t\t\"condition\": { \"not\": { \"has_tag\":\"obese\"}}\n\t\t}\n\n\t]\n}\n```\n\nThis example user role defines a role called 'CatFeeder', which is allowed to perform 'cat:feed' on all resources which match 'srn\\:cat\\:::\\*', as long as the cat the role\nis being used on does not have the tag 'obese'.\n\n# Global vs Organization roles\n\nA global role is a role which does not have a specific context, it is 'global' in that it \napplies to all resources a user might interact with. An organizational role is assigned to a\nspecific organization, and therefore limited to the context of that organization. \n\nFor example a global role is one which allows a user to change their own password, or\nperform other actions which do not involve an organization. An organizational role\nis a role which allows actions on resources owned by an organization. \n\nAn example of this is a typical user:\n\n * Global Role (User) \n  * Allows the user to modify their own settings, change their password, etc. \n * Org Role (OrgOwner) \n  * Allows the user to modify an organization\n  * Applied to specific organizations\n\n# User Roles\n\nUsers may zero or more roles defined on different organizations, along with global roles\n, a role is defined with the following attributes\n\n * Name - Name of the policy, used to match to roles associated with users\n * Version  - Version of the role schema\n * Statements - Some number of statements\n\n# Resource Policy\n\nA resource may have a single policy with multiple statements associated with it, it has\nthe following attributes\n \n * Name - Name of the policy, used to match to roles associated with users\n * Version  - Version of the role schema\n * Statements - Some number of statements\n\n# Statement\n\nEach role or policy has some statements defined with it, each statement defines\nwhat actions are allowed or dissallowed\n\nStatements have the following attributes\n\n * SID - statment ID used for debugging and identification\n * Effect - the result of the statement (deny, allow)\n * Actions - a list of actions \n * Resources - a list of resource queries\n * Condition - an optional condition that will be applied to statements to determine if they apply\n\n## Statement Effects\n\nTo determine if access may be granted the statements associated with the user roles,\ncross account roles, and resources are evaluated. If any statement returns a deny then \nall further evaluation is stopped and the result is a denial. At least one statement\nmust allow access for access to be granted. If no statement denies or allows access\nthen the system will not allow access.\n\n## Actions\n\nActions are a combination of Service:Action, and also have a few wild card patterns:\n\n```\n* \t\t- match any action\nservice:* \t- match any action on this service\nservice:action\t- match this explicit combination of action and service\n```\n\n## Spyderbat Resource Names\n\nEach resource in the RBAC system is given a name like so:\n\n```\nsrn:service:region:org:resource\n```\n\nThe resource name is expected to expand into a path like resource name when a hierarchy is needed, \nfor example:\n\n```\nsrn:report:aws-us-west-1:org-1:agent-usage-report/download.pdf\n```\n\nThese resource names are matched in policies against resource queries:\n\n```\nsrn:report:::*/*.pdf\n```\n\nIs an example of resource query which would match the above resource. \n\nThe following globs are supported in resource names\n\n```\n/**/   - match zero or more directories\n{a,b}  - match a or b, no spaces\n*      - match any non-separator char\n?      - match a single non-separator char\n**/    - match any directory, start of pattern only\n/**    - match any this directory, end of pattern only\n!      - removes matches from resultset, start of pattern only\n```\n\n```\n* \t\t\t- match all resources\nsrn::::*\t \t- match all resources\nsrn:report::::* \t- match all report resources\nsrn:report::org-1:* \t- match all resources in a specific org\n```\n\n## Conditions\n\nThe system will first evalute if the requested resource and the requested action\nmatch, if so then the system will evaluate any conditions which are specified on \nthe statement. \n\nThe following conditions are supported:\n\n```\n{ not: condition } - not of the specified condition\n{ and: [....] }\t - and of all contained conditions\n{ or: [....] } \t - or of all contained conditions\n{ has_tag:\"tag\"}\t -  returns true if the resource has the associated tag\n{ has_role:\"role\", on_org:\"org-1\" } - returns true if the user has a role of 'role' on 'org-1'\n```\n\n# User Roles\n\nUsers are mapped to roles within an organization via a userToRole relationship, \nwhich allows for a user to have many roles on many organizations. \n\n```\n(User, Org, Role)...\n```\n\n*This means that a user can have many different roles on different organizations* \n\nFor example the user David may have roles on multiple organizations:\n\n````\nDavid\n\tOrg1: Analyat\n\tOrg1: Operator\n\tOrg2: Analyst\n\t...\n````\n\nThese roles are mapped by name to a specific role implementation.\n\n## Cross Org Roles\n\nCross org roles for use by MSSPs are supported by having the managed \norganization defining a special cross-org role with the following\nattributes:\n\n * Org - The org the cross org role applies to\n * Condition - The condition to evaluate\n * AssumeRole - The role the user may assume\n\n## Example cross org role\n\n```json\n{\n\t\"org\":\"house-1\",\n\t\"assume_role\":\"CatPetter\",\n\t\"version\":\"1.0.1\",\n\t\"condition\": { \"has_role\":\"CatPetter\", \"on_org\":\"house-2\" }\n}\n```\n\nThis role will allow any user who has the role 'CatPetter' in the org 'house-2' to assume\nthe role 'CatPetter' in 'house-1'\n\n\n\n\n\n\n"},{"name":"STS","description":"\nSecurity Token Service endpoints. Trusted services assume a role on a single org and receive a short-lived, org-locked JWT for downstream consumers. The caller's authority to assume is gated by the sts:AssumeRole action on srn:sts::\u003corg\u003e:\u003crole_uid\u003e; the resulting token carries the assumed role on the assumed org only.\n"},{"name":"SavedQuery","description":"\nAn API to allow the management of saved queries. Saved queries are used to quickly run Athena searches."},{"name":"SearchSet","description":"\nAn API to allow the management of search sets. Search sets can be used to augment queries in search."},{"name":"Source","description":"\nSources are used to represent a container for source of security data, such as a machine,\nor other potential source. \n\nThe source itself has data associated with the source, see the 'Source Data' APIs for \naccess to source data.\n"},{"name":"SourceData","description":"\nEach source may send data which is stored and processed by the system. So for example a machine will send data\nin a raw form which is then analyzed, both the raw machine data and the analyzed data is available for querying.\n"},{"name":"Spyctl","description":"\nA way to execute specific Spyctl logic via the API."},{"name":"Suppress","description":"\nAn API that provides direct access to Spyderbat's tuning features."},{"name":"Watchlist","description":"\nAn API to manage the watchlist for files within an organization."}],"security":[{"apiToken":[]}]}