openapi: 3.2.0
info:
  title: Spyderbat Investigation API
  version: 1.0.0
  contact:
    name: API Support
    url: https://api.prod.spyderbat.com/openapi
    email: support@spyderbat.com
  license:
    name: MIT
    url: https://mit-license.org/
  termsOfService: https://www.spyderbat.com/terms-of-use/
  x-logo:
    url: /static/sb-logo.svg
    backgroundColor: '#161A21'
    altText: Spyderbat Logo
  description: 'Operations tagged Investigation across 2 of this provider''s published API definitions: spyderbat-openapi-original.json, spyderbat-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prod.spyderbat.com/
  description: Spyderbat API Server
security:
- apiToken: []
tags:
- name: Investigation
  description: Investigations can be created by users as a way to have an investigation into a potential attack, allowing users to associate data from one or more sources into a single investigation. An investigation may be utilized by multiple users as part of it's work flow. Investigations have a version history, each change to an investigation will result in a copy of the investigation to be captured and saved, prior versions can then be inspected later.
paths:
  /api/v1/org/{orgUID}/investigation/:
    get:
      tags:
      - Investigation
      summary: List investigations
      description: "\nLists investigations\n\n * Will list investigations which the user has the action *investigation:Load* or *investigation:LoadExpired* on\n"
      operationId: InvestigationList
      parameters:
      - name: orgUID
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/DaoInvestigation'
        '400':
          description: invalid query parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '403':
          description: permission denied
    post:
      tags:
      - Investigation
      summary: Create an investigation
      description: "\nCreate an investigationan\n\n * Requires the user have the action *investigation:Create*\n"
      operationId: InvestigationCreate
      parameters:
      - name: orgUID
        in: path
        description: Investigation OrgUID
        required: true
        schema:
          type: string
          description: Investigation OrgUID
          maxLength: 64
          minLength: 9
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InvestigationCreateInput'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiInvestigationCreateOutput'
        '400':
          description: invalid input parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '403':
          description: permission denied
    servers:
    - url: https://api.prod.spyderbat.com/
      description: Spyderbat API Server
  /api/v1/org/{orgUID}/investigation/{investigationUID}:
    get:
      tags:
      - Investigation
      summary: Load an investigation
      description: "\nLoads an investigation by UID. \n\n * Requires action  *investigation:Load* to load an active investigation\n * Requires action *investigation:LoadExpired* to load expired investigations\n\n"
      operationId: InvestigationLoad
      parameters:
      - name: investigationUID
        in: path
        required: true
        schema:
          type: string
      - name: orgUID
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DaoInvestigation'
        '403':
          description: permission denied
    put:
      tags:
      - Investigation
      summary: Update an investigation
      description: "\nUpdates the investigationan\n\n * Requires the user have the action *investigation:Update*\n"
      operationId: InvestigationUpdate
      parameters:
      - name: investigationUID
        in: path
        description: Investigation UID
        required: true
        schema:
          type: string
          description: Investigation UID
      - name: orgUID
        in: path
        description: Investigation OrgUID
        required: true
        schema:
          type: string
          description: Investigation OrgUID
          maxLength: 64
          minLength: 9
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InvestigationUpdateInput'
      responses:
        '200':
          description: OK
        '400':
          description: invalid input parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '403':
          description: permission denied
    delete:
      tags:
      - Investigation
      summary: Delete an investigation
      description: "\nDeletes an investigation, by setting valid_to=now so that the investigation is virtually deleted.\n\n * Requires the user have the action *investigation:Delete*\n"
      operationId: InvestigationDelete
      parameters:
      - name: investigationUID
        in: path
        description: Investigation UID
        required: true
        schema:
          type: string
          description: Investigation UID
      - name: orgUID
        in: path
        description: Investigation OrgUID
        required: true
        schema:
          type: string
          description: Investigation OrgUID
          maxLength: 64
          minLength: 9
      responses:
        '200':
          description: OK
        '403':
          description: permission denied
    servers:
    - url: https://api.prod.spyderbat.com/
      description: Spyderbat API Server
  /api/v1/org/{orgUID}/investigation/{investigationUID}/version/:
    get:
      tags:
      - Investigation
      summary: List Investigation Versions
      description: "\nLists prior version of this investigation\n\n * Requires the user have the action *investigation:ListVersions*\n"
      operationId: InvestigationListVersions
      parameters:
      - name: investigationUID
        in: path
        required: true
        schema:
          type: string
      - name: orgUID
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/DaoInvestigation'
        '403':
          description: permission denied
    servers:
    - url: https://api.prod.spyderbat.com/
      description: Spyderbat API Server
  /api/v1/org/{orgUID}/investigation/{investigationUID}/version/{version}:
    get:
      tags:
      - Investigation
      summary: Load Investigation Version
      description: "\nLoads a specific version of an investigation\n\n * Requires the user have the action *investigation:LoadVersion*\n"
      operationId: InvestigationLoadVersion
      parameters:
      - name: investigationUID
        in: path
        required: true
        schema:
          type: string
      - name: orgUID
        in: path
        required: true
        schema:
          type: string
      - name: version
        in: path
        required: true
        schema:
          type: integer
          format: int32
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DaoInvestigation'
        '403':
          description: permission denied
    servers:
    - url: https://api.prod.spyderbat.com/
      description: Spyderbat API Server
components:
  schemas:
    InvestigationCreateInput:
      type: object
      properties:
        created_by:
          type: string
          description: UID of user who created the investigation
        data:
          type: object
          additionalProperties: {}
          description: JSON Object associated with the investigation
        modified_by:
          type: string
          description: UID of the user who last modified the investigation
        modified_on:
          type: string
          description: Date the investigation was last modified
          format: date-time
        name:
          type: string
          description: Name of the investigation
        resource_name:
          type: string
          description: Resource name used for RBAC
        resource_policy:
          $ref: '#/components/schemas/ResourcePolicy'
        tags:
          type: array
          items:
            type: string
          description: User supplied tags
          maxItems: 20
        valid_from:
          type: string
          description: Valid from date, the first date this object was valid
          format: date-time
        valid_to:
          type: string
          description: Valid to date, the date this object is valid to
          format: date-time
        version:
          type: integer
          description: Version of the investigation
          format: int32
    RbacStatement:
      type: object
      properties:
        actions:
          type: array
          items:
            type: string
          description: The actions that may be performed
          maxItems: 50
          minItems: 1
        condition:
          $ref: '#/components/schemas/RbacConditionMap'
        effect:
          type: string
          description: The effect of the statement, i.e. allow or deny
          maxLength: 5
        resources:
          type: array
          items:
            type: string
          description: The resource the statement applies to
          maxItems: 25
          minItems: 1
        sid:
          type: string
          description: Statement ID, used to identify the statement in audit logs
          maxLength: 32
      required:
      - effect
      - sid
    DaoInvestigation:
      type: object
      properties:
        created_by:
          type: string
          description: UID of user who created the investigation
        data:
          type: object
          additionalProperties: {}
          description: JSON Object associated with the investigation
        modified_by:
          type: string
          description: UID of the user who last modified the investigation
        modified_on:
          type: string
          description: Date the investigation was last modified
          format: date-time
        name:
          type: string
          description: Name of the investigation
        org_uid:
          type: string
          description: Investigation OrgUID
          maxLength: 64
          minLength: 9
        resource_name:
          type: string
          description: Resource name used for RBAC
        resource_policy:
          $ref: '#/components/schemas/ResourcePolicy'
        tags:
          type: array
          items:
            type: string
          description: User supplied tags
          maxItems: 20
        uid:
          type: string
          description: Investigation UID
        valid_from:
          type: string
          description: Valid from date, the first date this object was valid
          format: date-time
        valid_to:
          type: string
          description: Valid to date, the date this object is valid to
          format: date-time
        version:
          type: integer
          description: Version of the investigation
          format: int32
    ResourcePolicy:
      type: object
      properties:
        name:
          type: string
          description: Name of the resource policy
          maxLength: 32
        statements:
          type: array
          items:
            $ref: '#/components/schemas/RbacStatement'
          description: List of statements to be examined by the resource policy
        version:
          type: string
          maxLength: 24
      description: Resource policy for RBAC
    InvestigationUpdateInput:
      type: object
      properties:
        created_by:
          type: string
          description: UID of user who created the investigation
        data:
          type: object
          additionalProperties: {}
          description: JSON Object associated with the investigation
        modified_by:
          type: string
          description: UID of the user who last modified the investigation
        modified_on:
          type: string
          description: Date the investigation was last modified
          format: date-time
        name:
          type: string
          description: Name of the investigation
        resource_name:
          type: string
          description: Resource name used for RBAC
        resource_policy:
          $ref: '#/components/schemas/ResourcePolicy'
        tags:
          type: array
          items:
            type: string
          description: User supplied tags
          maxItems: 20
        valid_from:
          type: string
          description: Valid from date, the first date this object was valid
          format: date-time
        valid_to:
          type: string
          description: Valid to date, the date this object is valid to
          format: date-time
        version:
          type: integer
          description: Version of the investigation
          format: int32
    ApiInvestigationCreateOutput:
      type: object
      properties:
        uid:
          type: string
    RbacConditionMap:
      type: object
      description: Additional conditions which may be applied
    ValidationError:
      type: object
      properties:
        err_msg:
          type: string
          description: Message regarding the validation failure
        field:
          type: string
          description: Field name which failed validation
        property:
          type: string
          description: JSON property name of the field which failed validation
        tags:
          type: string
          description: Validation tag which failed
  securitySchemes:
    apiToken:
      type: http
      scheme: bearer
      bearerFormat: JWT
x-refined-from:
- spyderbat-openapi-original.json
- spyderbat-openapi.json