{ "openapi": "3.1.0", "info": { "title": "Stream Security API", "description": "Stream Security API for managing security rules, integrations, AI interactions, and more.", "version": "1.0.0" }, "servers": [ { "url": "https://{app}.streamsec.io/openapi" } ], "paths": { "/attack_paths/details/{resource_id}": { "get": { "operationId": "attackPaths-details", "summary": "Get Resource Attack Path Details", "description": "Retrieves the complete attack path for a specified resource, showing the sequence of network and security components an attacker could traverse to reach it.\n\nThe response returns one or more ordered paths, starting from the origin (e.g., Internet) and listing each intermediate element such as gateways, ACLs, security groups, load balancers, or other relevant resources.\n\nParameters include the unique resource_id (required) and the optional workspace context.\n\nUse this endpoint to visualize potential exposure, assess lateral movement risk, and prioritize remediation actions.", "tags": [ "Attack Paths" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "path", "name": "resource_id", "schema": { "type": "string" }, "required": true } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "paths": { "type": "array", "items": { "type": "array", "items": { "type": "string" } } }, "ports": { "type": "array", "items": { "type": "object", "properties": { "start": { "type": "number" }, "end": { "type": "number" }, "protocol": { "type": "string" } }, "required": [ "start", "end", "protocol" ], "additionalProperties": false } }, "sources": { "type": "array", "items": { "type": "object", "properties": { "resource_id": { "type": "string" }, "port_ranges": { "type": "array", "items": { "type": "object", "properties": { "start": { "type": "number" }, "end": { "type": "number" }, "protocol": { "type": "string" } }, "required": [ "start", "end", "protocol" ], "additionalProperties": false } } }, "required": [ "resource_id" ], "additionalProperties": false } } }, "required": [ "paths" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/attack_paths": { "get": { "operationId": "attackPaths-list", "summary": "Get Attack Paths", "description": "Retrieves all attack paths discovered within a workspace. Attack path is a condition in which an asset is both externally exploitable and has a cloud blast radius that allows it to potentially interact with or compromise internal resources.\n\nEach response entry includes the attack path ID, severity, associated finding types, and violations count.\n\nUse this endpoint to review all known attack paths, track exposed resources, and prioritize remediation efforts across the environment.", "tags": [ "Attack Paths" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "attack_path_ids", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "resource_ids", "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "description": { "type": "string" }, "severity": { "type": "number" }, "finding_types": { "type": "array", "items": { "type": "string", "enum": [ "misconfiguration", "internet_exposed", "insecure_identity", "vulnerability", "high_privileges", "privilege_escalation", "data_access", "crown_jewel_access", "admin_privileges", "external_access", "segmentation_breach" ] } }, "violations_count": { "type": "number" } }, "required": [ "id" ], "additionalProperties": false } } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/attack_paths/violations": { "get": { "operationId": "attackPaths-violations", "summary": "Get Attack Path Violations", "description": "Retrieves all resources that are violating security posture rules and, as a result, create an attack path condition.\n\nAn attack path occurs when an asset is both externally exploitable and has a cloud blast radius that allows it to potentially interact with or compromise internal resources.\n\nThe response includes the resource IDs along with the timestamps indicating when each resource began violating the rule.", "tags": [ "Attack Paths" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "attack_path_id", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "results": { "type": "array", "items": { "type": "object", "properties": { "subject_id": { "type": "string" }, "first_seen_timestamp": { "type": "string" } }, "required": [ "subject_id" ], "additionalProperties": false } }, "total_count": { "type": "number" } }, "required": [ "results", "total_count" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/canaries": { "get": { "operationId": "canaries-list", "summary": "Get Canaries", "description": "Retrieves a list of all deployed and configured canary resources across monitored accounts.\n\nA canary resource is a controlled, decoy asset - such as an S3 bucket - used to detect unauthorized activity by triggering alerts when predefined detection actions occur.\n\nThis endpoint supports filtering by account ID, region, resource type, status, creator, and other attributes. Optional parameters allow inclusion of related activity logs for each canary.\n\nReturned objects include canary metadata, deployment status, detection settings, exclusion rules, and recent activity indicators.", "tags": [ "Canaries" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "accountId", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "activityLogs", "schema": { "type": "boolean" } }, { "in": "query", "name": "createdBy", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "phrase", "schema": { "type": "string" } }, { "in": "query", "name": "region", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "resourceId", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "resourceType", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "status", "schema": { "type": "array", "items": { "type": "string", "enum": [ "active", "disabled", "not_deployed", "deleted" ] } } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "_id": { "type": "string" }, "name": { "type": "string" }, "accountId": { "type": "string" }, "subscriptionId": { "type": "string" }, "resourceGroupId": { "type": "string" }, "region": { "type": "string" }, "resourceType": { "type": "string" }, "description": { "type": "string" }, "status": { "type": "string" }, "createdBy": { "type": "string" }, "createdAt": { "type": "string" }, "attackPaths": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "number" } }, "detectionsCount": { "type": "number" }, "isSandbox": { "type": "boolean" }, "hasActivityLogs": { "type": "boolean" }, "initialTags": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string" }, "value": { "type": "string" } }, "required": [ "key", "value" ], "additionalProperties": false } }, "excludeTags": { "type": "array", "items": { "type": "object", "properties": { "_id": { "type": "string" }, "key": { "type": "string" }, "match_type": { "type": "string" }, "value": { "type": "string" } }, "required": [ "_id", "key", "match_type", "value" ], "additionalProperties": false } }, "resourceId": { "type": "string" }, "iamRoles": { "type": "array", "items": { "type": "string" } }, "allowProjectVmAccess": { "type": "boolean" }, "detectionEnabled": { "type": "boolean" }, "detectionActions": { "type": "array", "items": { "type": "string" } }, "azureStorageAccountId": { "type": "string" } }, "required": [ "_id", "name", "accountId", "region", "resourceType", "status", "createdAt" ], "additionalProperties": false } } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/config-changes/{id}": { "get": { "operationId": "configChanges-details", "summary": "Get Configuration Change Details", "description": "Retrieves the full details of a specific configuration change by its unique ID, including associated violations and attack paths.\n\nConfiguration changes are write audit events analyzed for security impact, such as internet exposure, privilege escalation, or new database access.\n\nUse this endpoint to investigate the change, assess its risk, and understand potential exploitation paths.", "tags": [ "Config Changes" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "details": { "type": "object", "properties": { "_id": { "type": "string" }, "severity": { "type": "number" }, "event_name": { "type": "string" }, "timestamp": { "type": "string" }, "source": { "type": "object", "properties": { "type": { "type": "string" }, "metadata": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} } }, "additionalProperties": false }, "sub_events": { "type": "array", "items": { "type": "object", "properties": { "_id": { "type": "string" }, "is_base": { "type": "boolean" }, "severity": { "type": "number" }, "action_type": { "type": "string" }, "cloud_provider": { "type": "string" }, "cloud_source_ip": { "type": "string" }, "cloud_user_arn": { "type": "string" }, "account_id": { "type": "string" }, "region": { "type": "string" }, "resource_blocks": { "type": "array", "items": { "type": "string" } }, "resource_ids": { "type": "array", "items": { "type": "string" } }, "entities": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "type": { "type": "string" } }, "required": [ "id" ], "additionalProperties": false } }, "config_changes": { "type": "array", "items": { "type": "object", "properties": { "resource_id": { "type": "string" }, "before": {}, "after": {} }, "required": [ "resource_id", "before", "after" ], "additionalProperties": false } }, "user_agent": { "type": "string" }, "comment": { "type": "string" }, "impact_types": { "type": "array", "items": { "type": "string" } }, "hidden": { "type": "boolean" } }, "required": [ "_id" ], "additionalProperties": false } }, "impact_types": { "type": "array", "items": { "type": "string" } }, "account_ids": { "type": "array", "items": { "type": "string" } }, "violations_by_violated_rules_severity": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "number" } }, "raw_event": {} }, "required": [ "_id" ], "additionalProperties": false }, "risks": { "type": "object", "properties": { "violations": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "description": { "type": "string" }, "severity": { "type": "number" } }, "required": [ "id" ], "additionalProperties": false } }, "attackPaths": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "description": { "type": "string" }, "severity": { "type": "number" }, "finding_types": { "type": "array", "items": { "type": "string" } } }, "required": [ "id" ], "additionalProperties": false } } }, "required": [ "violations", "attackPaths" ], "additionalProperties": false } }, "required": [ "details", "risks" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/config-changes": { "get": { "operationId": "configChanges-list", "summary": "Get Configuration Changes", "description": "Retrieves recent configuration changes -write audit events analyzed for security impact, such as internet exposure, privilege escalation, or new database access.\n\nThe response includes what was changed, its severity and time, affected resources, related user and network details, along with any linked events and raw data.\n\nUse this endpoint to investigate recent changes to understand their security implications and identify potential risks.", "tags": [ "Config Changes" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "resource_ids", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "resource_type", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "cloud_user_arn", "schema": { "type": "string" } }, { "in": "query", "name": "account_id", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "from_timestamp", "schema": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$" } }, { "in": "query", "name": "to_timestamp", "schema": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$" } }, { "in": "query", "name": "event_name", "schema": { "type": "string" } }, { "in": "query", "name": "region", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "action_type", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "cloud_source_ip", "schema": { "type": "string" } }, { "in": "query", "name": "user_agent", "schema": { "type": "string" } }, { "in": "query", "name": "severity", "schema": { "type": "array", "items": { "type": "number" } } }, { "in": "query", "name": "pageIndex", "schema": { "description": "The 0-based index of the page to retrieve.", "default": 0, "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, { "in": "query", "name": "pageSize", "schema": { "description": "The number of items to retrieve per page.", "default": 10, "type": "integer", "minimum": 1, "maximum": 100 } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "results": { "type": "array", "items": { "type": "object", "properties": { "_id": { "type": "string" }, "severity": { "type": "number" }, "event_name": { "type": "string" }, "timestamp": { "type": "string" }, "impact_types": { "type": "array", "items": { "type": "string" } }, "account_ids": { "type": "array", "items": { "type": "string" } }, "violations_by_violated_rules_severity": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "number" } }, "source_type": { "type": "string" }, "resource_ids": { "type": "array", "items": { "type": "string" } }, "cloud_user_arn": { "type": "array", "items": { "type": "string" } }, "cloud_source_ip": { "type": "array", "items": { "type": "string" } }, "resource_type": { "type": "array", "items": { "type": "string" } }, "action_type": { "type": "array", "items": { "type": "string" } }, "region": { "type": "array", "items": { "type": "string" } }, "user_agent": { "type": "array", "items": { "type": "string" } } }, "required": [ "_id" ], "additionalProperties": false } }, "total_count": { "type": "number" } }, "required": [ "results", "total_count" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/cve/{cve_id}": { "get": { "operationId": "cve-getCve", "summary": "Get a single CVE by ID", "description": "Retrieves detailed information about a specific CVE by its ID.", "tags": [ "Vulnerabilities" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "path", "name": "cve_id", "schema": { "type": "string" }, "required": true } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "anyOf": [ { "type": "object", "properties": { "cve_id": { "type": "string" }, "severity": { "type": "string", "enum": [ "CRITICAL", "HIGH", "MEDIUM", "LOW", "UNKNOWN" ] }, "severity_numeric": { "type": "number" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "cvss_score": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "epss_score": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "cisa_kev": { "anyOf": [ {}, { "type": "null" } ] }, "cwes": { "anyOf": [ { "type": "array", "items": {} }, { "type": "null" } ] }, "impact_score": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "exploitability_score": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "cvss_scoring_vector": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "packages": { "type": "array", "items": { "type": "string" } }, "fixed_in_versions": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "null" } ] }, "file_paths": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "null" } ] }, "fix_available": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "exploit_available": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "cve_sources": { "type": "array", "items": { "type": "string" } }, "fixed_in_version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "published_date": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "discovery_timestamp": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "remediation": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "package_manager": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "attack_vector": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "attack_complexity": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "privileges_required": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "user_interaction": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "scope": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "confidentiality": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "integrity": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "availability": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "cvss_version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "affected_resources_count": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "affected_images_count": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "internet_exposed": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "container_images": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "null" } ] }, "high_exposure_risk": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "exposure_risk": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "exposure_risk_description": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "null" } ] } }, "required": [ "cve_id", "severity", "severity_numeric", "description", "cvss_score", "epss_score", "cisa_kev", "cwes", "impact_score", "exploitability_score", "cvss_scoring_vector", "packages", "fixed_in_versions", "file_paths", "fix_available", "exploit_available", "cve_sources", "fixed_in_version", "published_date", "discovery_timestamp", "remediation", "package_manager", "attack_vector", "attack_complexity", "privileges_required", "user_interaction", "scope", "confidentiality", "integrity", "availability", "cvss_version", "affected_resources_count", "affected_images_count", "internet_exposed", "container_images", "high_exposure_risk", "exposure_risk", "exposure_risk_description" ], "additionalProperties": false }, { "type": "null" } ] } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/cve/resources": { "get": { "operationId": "cve-listCveResources", "summary": "List resources affected by CVE(s)", "description": "Retrieves a list of resources affected by specified CVE(s) with filtering and pagination.\n\nArray filters accept comma-separated values (e.g., cve_ids=CVE-2021-44228,CVE-2021-45046).\n\nFor complex filters like tags, use the POST /cve/resources/query endpoint instead.", "tags": [ "Vulnerabilities" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "cve_ids", "schema": { "type": "string" } }, { "in": "query", "name": "account_id", "schema": { "type": "string" } }, { "in": "query", "name": "resource_id", "schema": { "type": "string" } }, { "in": "query", "name": "resource_type", "schema": { "type": "string" } }, { "in": "query", "name": "region", "schema": { "type": "string" } }, { "in": "query", "name": "vpc", "schema": { "type": "string" } }, { "in": "query", "name": "cluster_id", "schema": { "type": "string" } }, { "in": "query", "name": "namespace_id", "schema": { "type": "string" } }, { "in": "query", "name": "controller_id", "schema": { "type": "string" } }, { "in": "query", "name": "controller_kind", "schema": { "type": "string" } }, { "in": "query", "name": "container_images", "schema": { "type": "string" } }, { "in": "query", "name": "package", "schema": { "type": "string" } }, { "in": "query", "name": "internet_exposed", "schema": { "type": "boolean" } }, { "in": "query", "name": "high_exposure_risk", "schema": { "type": "boolean" } }, { "in": "query", "name": "skip", "schema": { "default": 0, "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, { "in": "query", "name": "limit", "schema": { "default": 50, "type": "integer", "minimum": 1, "maximum": 500 } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "results": { "type": "array", "items": { "type": "object", "properties": { "resource_id": { "type": "string" }, "resource_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "account_id": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "region": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "cluster_id": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "namespace_id": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "controller_id": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "controller_kind": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "display_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "container_images": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "null" } ] }, "packages": { "anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "package_version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "fixed_in_version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "file_path": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "package_version", "fixed_in_version", "file_path" ], "additionalProperties": false } }, { "type": "null" } ] }, "internet_exposed": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "exposure_risk": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "exposure_risk_description": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "null" } ] }, "child_resources": { "anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "resource_id": { "type": "string" }, "resource_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "display_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "account_id": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "region": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "cluster_id": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "namespace_id": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "container_images": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "null" } ] }, "packages": { "anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "package_version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "fixed_in_version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "file_path": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "package_version", "fixed_in_version", "file_path" ], "additionalProperties": false } }, { "type": "null" } ] }, "internet_exposed": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "exposure_risk": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "exposure_risk_description": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "null" } ] } }, "required": [ "resource_id", "resource_type", "display_name", "account_id", "region", "cluster_id", "namespace_id", "container_images", "packages", "internet_exposed", "exposure_risk", "exposure_risk_description" ], "additionalProperties": false } }, { "type": "null" } ] } }, "required": [ "resource_id", "resource_type", "account_id", "region", "cluster_id", "namespace_id", "controller_id", "controller_kind", "display_name", "container_images", "packages", "internet_exposed", "exposure_risk", "exposure_risk_description", "child_resources" ], "additionalProperties": false } }, "total_count": { "type": "number" } }, "required": [ "results", "total_count" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/cve": { "get": { "operationId": "cve-listCves", "summary": "List CVEs with filtering, sorting, and pagination", "description": "Retrieves a list of detected vulnerabilities (CVEs) across monitored environments, with details such as severity, CVSS score, exploit and fix availability, affected packages, impacted resources, and remediation guidance.\n\nSupports filtering by CVE ID, account, resource, resource type, package name, severity, exploit availability, fix availability, internet exposure, and region. Results can be sorted by CVE ID, severity, CVSS score, discovery time, or published date.\n\nUse this endpoint to review and prioritize vulnerabilities for remediation based on severity, exploitability, and exposure context.", "tags": [ "Vulnerabilities" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "cve_id", "schema": { "type": "string" } }, { "in": "query", "name": "severity", "schema": { "type": "string" } }, { "in": "query", "name": "cvss_score", "schema": { "type": "number" } }, { "in": "query", "name": "cvss_score_operator", "schema": { "type": "string", "enum": [ "eq", "gt", "gte", "lt" ] } }, { "in": "query", "name": "epss_score", "schema": { "type": "number" } }, { "in": "query", "name": "epss_score_operator", "schema": { "type": "string", "enum": [ "eq", "gt", "gte", "lt" ] } }, { "in": "query", "name": "packages", "schema": { "type": "string" } }, { "in": "query", "name": "fix_available", "schema": { "type": "boolean" } }, { "in": "query", "name": "exploit_available", "schema": { "type": "boolean" } }, { "in": "query", "name": "cisa_kev", "schema": { "type": "boolean" } }, { "in": "query", "name": "source", "schema": { "type": "string" } }, { "in": "query", "name": "attack_vector_network", "schema": { "type": "boolean" } }, { "in": "query", "name": "high_epss", "schema": { "type": "boolean" } }, { "in": "query", "name": "account_id", "schema": { "type": "string" } }, { "in": "query", "name": "resource_id", "schema": { "type": "string" } }, { "in": "query", "name": "resource_type", "schema": { "type": "string" } }, { "in": "query", "name": "region", "schema": { "type": "string" } }, { "in": "query", "name": "availability_zones", "schema": { "type": "string" } }, { "in": "query", "name": "namespace", "schema": { "type": "string" } }, { "in": "query", "name": "eks_cluster", "schema": { "type": "string" } }, { "in": "query", "name": "ecs_cluster", "schema": { "type": "string" } }, { "in": "query", "name": "subnet", "schema": { "type": "string" } }, { "in": "query", "name": "vpc", "schema": { "type": "string" } }, { "in": "query", "name": "cluster_id", "schema": { "type": "string" } }, { "in": "query", "name": "namespace_id", "schema": { "type": "string" } }, { "in": "query", "name": "container_images", "schema": { "type": "string" } }, { "in": "query", "name": "internet_exposed", "schema": { "type": "boolean" } }, { "in": "query", "name": "high_exposure_risk", "schema": { "type": "boolean" } }, { "in": "query", "name": "risk_focus_enabled", "schema": { "type": "boolean" } }, { "in": "query", "name": "sort_by", "schema": { "default": "cvss_score", "type": "string" } }, { "in": "query", "name": "sort_order", "schema": { "type": "string", "enum": [ "asc", "desc" ] } }, { "in": "query", "name": "skip", "schema": { "default": 0, "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, { "in": "query", "name": "limit", "schema": { "default": 50, "type": "integer", "minimum": 1, "maximum": 500 } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "results": { "type": "array", "items": { "type": "object", "properties": { "cve_id": { "type": "string" }, "severity": { "type": "string", "enum": [ "CRITICAL", "HIGH", "MEDIUM", "LOW", "UNKNOWN" ] }, "severity_numeric": { "type": "number" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "cvss_score": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "epss_score": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "cisa_kev": { "anyOf": [ {}, { "type": "null" } ] }, "cwes": { "anyOf": [ { "type": "array", "items": {} }, { "type": "null" } ] }, "impact_score": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "exploitability_score": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "cvss_scoring_vector": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "packages": { "type": "array", "items": { "type": "string" } }, "fixed_in_versions": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "null" } ] }, "file_paths": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "null" } ] }, "fix_available": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "exploit_available": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "cve_sources": { "type": "array", "items": { "type": "string" } }, "fixed_in_version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "published_date": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "discovery_timestamp": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "remediation": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "package_manager": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "attack_vector": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "attack_complexity": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "privileges_required": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "user_interaction": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "scope": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "confidentiality": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "integrity": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "availability": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "cvss_version": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "affected_resources_count": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "affected_images_count": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "internet_exposed": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "container_images": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "null" } ] }, "high_exposure_risk": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "exposure_risk": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "exposure_risk_description": { "anyOf": [ { "type": "array", "items": { "type": "string" } }, { "type": "null" } ] } }, "required": [ "cve_id", "severity", "severity_numeric", "description", "cvss_score", "epss_score", "cisa_kev", "cwes", "impact_score", "exploitability_score", "cvss_scoring_vector", "packages", "fixed_in_versions", "file_paths", "fix_available", "exploit_available", "cve_sources", "fixed_in_version", "published_date", "discovery_timestamp", "remediation", "package_manager", "attack_vector", "attack_complexity", "privileges_required", "user_interaction", "scope", "confidentiality", "integrity", "availability", "cvss_version", "affected_resources_count", "affected_images_count", "internet_exposed", "container_images", "high_exposure_risk", "exposure_risk", "exposure_risk_description" ], "additionalProperties": false } }, "total_count": { "type": "number" } }, "required": [ "results", "total_count" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/detection_rules/{detection_id}": { "get": { "operationId": "detectionRules-details", "summary": "Get Detection Rule Details", "description": "Retrieves the full definition and configuration of a detection rule by its unique ID.\n\nThe response includes the rule\u2019s name, severity, description, classification labels, notification channels, triggering conditions, any exclusion criteria, creation date and status.\n\nUse this endpoint to review or validate a rule\u2019s configuration, troubleshoot false positives, and audit detection coverage.", "tags": [ "Detection Rules" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "path", "name": "detection_id", "schema": { "type": "string" }, "required": true } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "_id": { "type": "string" }, "name": { "type": "string" }, "created_at": { "type": "string" }, "modified_at": { "type": "string" }, "created_by": { "type": "string" }, "description": { "type": "string" }, "enabled": { "type": "boolean" }, "type": { "type": "string", "enum": [ "custom", "identityml", "predefined" ] }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low", "dynamic" ] }, "labels": { "type": "array", "items": { "type": "string" } }, "condition": { "type": "object", "properties": { "main_filter": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } }, "additionalProperties": false }, "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } }, "additionalProperties": false } }, "additionalProperties": false } } }, "additionalProperties": false } } }, "required": [ "operand" ], "additionalProperties": false }, "exclude": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } }, "additionalProperties": false }, "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } }, "additionalProperties": false } }, "additionalProperties": false } } }, "additionalProperties": false } } }, "required": [ "operand" ], "additionalProperties": false } }, "additionalProperties": false }, "notification_channels": { "type": "array", "items": { "type": "object", "properties": { "type": { "anyOf": [ { "type": "string", "enum": [ "webhook", "splunk", "pagerduty", "microsoftteams", "opsgenie", "logzio", "googlecards", "paloaltocortexxsiam", "torq" ] }, { "type": "string", "const": "slack" } ] }, "subtype": { "anyOf": [ { "type": "string", "enum": [ "webhook", "splunk", "pagerduty", "microsoftteams", "opsgenie", "logzio", "googlecards", "paloaltocortexxsiam", "torq" ] }, { "type": "string", "const": "slack" } ] }, "id": { "type": "string" } }, "required": [ "type", "id" ], "additionalProperties": false } }, "custom_config": { "type": "object", "properties": { "log_type": { "type": "string", "enum": [ "identity", "network", "audit", "process", "file", "apis" ] }, "detection_field": { "type": "string", "enum": [ "source", "destination" ] } }, "additionalProperties": false }, "identityml_config": { "type": "object", "properties": { "action": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "contains" ] } }, "additionalProperties": false }, "predefined_config": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "identity", "network", "audit", "canary", "process", "file" ] } }, "additionalProperties": false } }, "required": [ "_id", "name" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/detection_rules": { "get": { "operationId": "detectionRules-list", "summary": "Get Detection Rules", "description": "Retrieves all detection rules in the system. A detection rule specifies the conditions that trigger a security event.\n\nThe response includes each rule\u2019s name, severity, creation and update timestamps, status (enabled or disabled), labels, detection type, and owner.\n\nUse this endpoint to review existing rules, assess detection coverage, and manage configurations.", "tags": [ "Detection Rules" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "skip", "schema": { "default": 0, "type": "number" } }, { "in": "query", "name": "limit", "schema": { "default": 10, "type": "number" } }, { "in": "query", "name": "name", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "_id": { "type": "string" }, "name": { "type": "string" }, "created_at": { "type": "string" }, "modified_at": { "type": "string" }, "created_by": { "type": "string" }, "description": { "type": "string" }, "enabled": { "type": "boolean" }, "type": { "type": "string", "enum": [ "custom", "identityml", "predefined" ] }, "severity": { "type": "string", "enum": [ "critical", "high", "medium", "low", "dynamic" ] }, "labels": { "type": "array", "items": { "type": "string" } } }, "required": [ "_id", "name" ], "additionalProperties": false } } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/detections/comment": { "post": { "operationId": "detections-comment-create", "summary": "Add Detection Comment", "description": "Adds a comment to a detection to capture analyst notes, investigation context, findings, or additional observations for collaboration between analysts.", "tags": [ "Threat Detection" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "detection_id": { "type": "string" }, "comment": { "type": "string", "minLength": 1, "maxLength": 2000 } }, "required": [ "detection_id", "comment" ] } } } }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "inserted_activity_id": { "type": "string" } }, "required": [ "inserted_activity_id" ], "additionalProperties": false } }, "required": [ "data" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/detections": { "get": { "operationId": "detections-list", "summary": "Get Detections", "description": "Retrieves detections from monitored environments, including metadata such as detection ID, timestamp, severity, account, resource details, source, MITRE categories, signal types, and any related anomalous actions.\n\nYou can filter results by detection ID, resource ID, or workspace, and use pagination to control the number of alerts returned. This endpoint is designed for retrieving detection listings - use the investigation endpoint to view full detection details for triage and investigation.", "tags": [ "Threat Detection" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "_id", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "resource_id", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "anomaly_severity", "schema": { "type": "array", "items": { "type": "number", "minimum": 1, "maximum": 4 } } }, { "in": "query", "name": "from_timestamp", "schema": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$" } }, { "in": "query", "name": "to_timestamp", "schema": { "type": "string", "format": "date-time", "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$" } }, { "in": "query", "name": "account_id", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "activity_type", "schema": { "type": "array", "items": { "type": "string", "enum": [ "suspicious_identity_activity", "anomalous_network_traffic", "suspicious_kubernetes_activity", "anomalous_activity", "cost_anomaly", "detection_rule_activity", "third_party_activity", "suspicious_canary_activity", "anomalous_process_activity", "anomalous_files_activity" ] } } }, { "in": "query", "name": "source", "schema": { "type": "array", "items": { "type": "string", "enum": [ "azure_defender", "azure_identity_protection", "stream_runtime", "stream", "crowd_strike", "guard_duty", "sentinel_one", "cortex", "security_command_center" ] } } }, { "in": "query", "name": "cluster", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "region", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "resource_type", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "vpc_id", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "tags", "schema": { "description": "List of Key:Value pairs delimited by \":\"", "type": "array", "items": { "type": "string", "pattern": "^[^:]+:[^:]+$" } } }, { "in": "query", "name": "mitre_categories", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "signal_types", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "rule_id", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "skip", "schema": { "default": 0, "type": "number" } }, { "in": "query", "name": "limit", "schema": { "default": 50, "type": "number" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "results": { "type": "array", "items": { "type": "object", "properties": { "_id": { "type": "string" }, "timestamp": { "type": "string" }, "activity_type": { "type": "string" }, "account_id": { "type": "array", "items": { "type": "string" } }, "anomaly_severity": { "type": "number", "minimum": 1, "maximum": 4 }, "cluster": { "type": "string" }, "container_name": { "type": "string" }, "process_name": { "type": "string" }, "source": { "type": "string" }, "namespace": { "type": "string" }, "resource_id": { "type": "string" }, "resource_type": { "type": "string" }, "resource_cluster": { "type": "string" }, "resource_deployment": { "type": "string" }, "resource_namespace": { "type": "string" }, "resource_controller": { "type": "string" }, "service": { "type": "string" }, "mitre_categories": { "type": "array", "items": { "type": "string" } }, "signal_types": { "type": "array", "items": { "type": "string" } }, "session_list": { "anyOf": [ { "type": "object", "properties": { "ip_addresses": { "type": "array", "items": { "type": "object", "properties": { "Ip": { "type": "string" }, "CountryCode": { "type": "string" } }, "required": [ "Ip", "CountryCode" ], "additionalProperties": false } }, "access_keys": { "type": "array", "items": { "type": "string" } }, "user_agents": { "type": "array", "items": { "type": "string" } }, "src_resource_type": { "type": "array", "items": { "type": "string" } } }, "additionalProperties": false }, { "type": "array", "items": { "type": "object", "properties": { "ip_address": { "type": "string" }, "access_key": { "type": "string" }, "user_agent": { "type": "string" }, "country_code_iso": { "type": "string" }, "mfa": { "type": "boolean" } }, "additionalProperties": false } } ] }, "external_id": { "type": "string" }, "external_url": { "type": "string" }, "json_data": { "type": "string" }, "status": { "type": "string", "enum": [ "open", "in_progress", "closed" ] }, "suspicious_identity_activity_signals": { "type": "object", "propertyNames": {}, "additionalProperties": {} }, "anomalous_network_traffic_signals": { "type": "object", "propertyNames": {}, "additionalProperties": {} }, "suspicious_kubernetes_signals": { "type": "object", "propertyNames": {}, "additionalProperties": {} }, "unusual_activity_signals": { "type": "object", "propertyNames": {}, "additionalProperties": {} }, "cost_anomaly_signals": { "type": "object", "propertyNames": {}, "additionalProperties": {} }, "detection_rule_activity_signals": { "type": "object", "propertyNames": {}, "additionalProperties": {} }, "third_party_signals": { "type": "object", "propertyNames": {}, "additionalProperties": {} }, "triage_summary": { "type": "string" }, "triage_reasoning": { "type": "string" }, "triage_timestamp": { "type": "string" }, "triage_confidence": { "type": "string", "enum": [ "Low", "Medium", "High" ] }, "triage_recommended_verdict": { "type": "string", "enum": [ "Benign", "Suspicious", "Malicious" ] } }, "required": [ "_id" ], "additionalProperties": false } } }, "required": [ "results" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/detections/status": { "put": { "operationId": "detections-setStatus", "summary": "Update Detection Status", "description": "Updates the status of a detection to reflect its current investigation state, such as open, in progress, or closed.", "tags": [ "Threat Detection" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "detections_ids": { "type": "array", "items": { "type": "string" } }, "new_status": { "type": "string", "enum": [ "open", "in_progress", "closed" ] }, "comment": { "type": "string", "maxLength": 100 } }, "required": [ "detections_ids", "new_status" ] } } } }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "updated_count": { "type": "number" } }, "required": [ "updated_count" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/detections/{detection_id}/ai_summary": { "get": { "operationId": "detections-summary", "summary": "Get Detection AI Summary", "description": "Retrieves an AI-generated summary for a specific detection, providing a concise verdict, confidence score, and contextual explanation of the activity. This includes relevant behaviors, potential risks, and whether further investigation is recommended.\n\nUse this endpoint to quickly understand the nature and severity of a detection before deciding on next steps.", "tags": [ "Threat Detection" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "path", "name": "detection_id", "schema": { "type": "string" }, "required": true } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "summary": { "type": "string" } }, "required": [ "summary" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/integrations/ecs": { "get": { "operationId": "integrations-ecs-list", "summary": "Get Integrated ECS Clusters", "description": "Retrieves a list of ECS clusters integrated with the platform, along with their connection status, agent types, runtime agent reporting metrics, version, and last seen timestamp.\n\nEach cluster entry includes its display name, cloud provider, account, connection state, number of reporting runtime agents, and platform version.\n\nUse this endpoint to monitor the health and status of all integrated ECS clusters across environments.", "tags": [ "Integrations" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "_id": { "type": "string" }, "type": { "type": "string" }, "created_by": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "display_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "aws_region": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "ecs_cluster_arn": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "collection_token": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "status": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "creation_date": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "full_scan_period": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "cloud_account_id": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "metrics_period": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "runtime_agent_enabled": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "tracing_policies": { "anyOf": [ { "type": "object", "properties": { "network": { "type": "boolean" }, "process": { "type": "boolean" }, "files": { "type": "boolean" }, "api": { "default": false, "type": "boolean" } }, "required": [ "network", "process", "files", "api" ], "additionalProperties": false }, { "type": "null" } ] }, "last_seen_at": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "last_metric_at": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "nodes_last_seen_at": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "runtime_agent_deployed": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "cluster_agent_version": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "is_latest_version": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "latest_cluster_agent_version": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "unhealthy_agents_count": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "connected_agents_count": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "disconnected_agents_count": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "non_deployed_agents_count": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "tasks_count": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "health_reason": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "inInventory": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "cluster_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "_id", "type" ], "additionalProperties": false } } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/integrations/kubernetes": { "get": { "operationId": "integrations-kubernetes-list", "summary": "Get Integrated K8s Clusters", "description": "Retrieves a list of Kubernetes clusters integrated with the platform, along with their connection status, agent types, runtime agent reporting metrics, version, and last seen timestamp.\n\nEach cluster entry includes its display name, cloud provider, account, connection state, number of reporting runtime agents, and platform version.\n\nUse this endpoint to monitor the health and status of all integrated Kubernetes clusters across environments.\n\nSupports pagination with skip and limit parameters.", "tags": [ "Integrations" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "cursor", "schema": { "type": "number" } }, { "in": "query", "name": "limit", "schema": { "default": 50, "type": "number" } }, { "in": "query", "name": "status", "schema": { "type": "array", "items": { "type": "string", "enum": [ "connected", "disconnected", "unhealthy", "not_deployed" ] } } }, { "in": "query", "name": "accounts", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "agent_type", "schema": { "type": "array", "items": { "type": "string", "enum": [ "cluster_only", "cluster_runtime" ] } } }, { "in": "query", "name": "cloud_provider", "schema": { "type": "array", "items": { "type": "string", "enum": [ "eks", "aks", "gcp_gke_cluster" ] } } }, { "in": "query", "name": "cluster_name", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "version", "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "_id": { "type": "string" }, "type": { "type": "string" }, "created_by": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "display_name": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "aws_region": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "eks_arn": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "aks_resource_id": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "gke_resource_id": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "collection_token": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "status": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "creation_date": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "full_scan_period": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "cloud_account_id": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "metrics_period": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "runtime_agent_enabled": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "tracing_policies": { "anyOf": [ { "type": "object", "properties": { "network": { "type": "boolean" }, "process": { "type": "boolean" }, "files": { "type": "boolean" }, "api": { "default": false, "type": "boolean" } }, "required": [ "network", "process", "files", "api" ], "additionalProperties": false }, { "type": "null" } ] }, "last_seen_at": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "last_metric_at": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "runtime_agent_deployed": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "cluster_agent_version": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "is_latest_version": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "latest_cluster_agent_version": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "unhealthy_agents_count": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "connected_agents_count": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "disconnected_agents_count": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "non_deployed_agents_count": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "nodes_count": { "anyOf": [ { "type": "number" }, { "type": "null" } ] }, "health_reason": { "anyOf": [ { "type": "string" }, { "type": "null" }, { "not": {} } ] }, "inInventory": { "anyOf": [ { "type": "boolean" }, { "type": "null" } ] }, "cluster_type": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "_id", "type" ], "additionalProperties": false } } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/inventory/resource/configuration": { "get": { "operationId": "inventory-configuration", "summary": "Get Resource Configuration", "description": "Retrieves the translated configuration data for a specific resource by its ID.\n\nThe translated data contains enriched and normalized resource attributes, which vary depending on the resource type and cloud provider. This may include identity details, networking, tags, hierarchical context, and provider-specific settings.\n\nUse this endpoint to obtain a resource\u2019s processed configuration for inventory browsing, compliance review, or investigation purposes.", "tags": [ "Inventory" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "resource_id", "schema": { "type": "string" }, "required": true } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": {} } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/inventory/crown_jewels": { "get": { "operationId": "inventory-crownJewels", "summary": "Get Crown Jewels", "description": "Validates whether the specified resources are marked as as crown jewels \u2014 high-value or business-critical assets.\n\nIf none of the provided resources are marked as crown jewels, the response will be empty.\n\nUse this endpoint to programmatically verify the crown jewel status of specific resources across your environment.", "tags": [ "Inventory" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "resource_ids", "schema": { "type": "array", "items": { "type": "string" } }, "required": true } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "resource_id": { "type": "string" }, "description": { "type": "string" }, "resource_type": { "type": "string" } }, "required": [ "resource_id", "description", "resource_type" ], "additionalProperties": false } } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/inventory/resource": { "get": { "operationId": "inventory-details", "summary": "Get Resource Details", "description": "Retrieves detailed metadata and configuration for a specific resource, including its type, display name, cloud provider, account, region, accessibility status, tags, and associated network interfaces.\n\nThe response also includes translated and enriched data such as cluster or namespace context, container specifications, environment variables, volume mounts, owner references, conditions, and node selectors. Depending on the resource type, additional attributes like security settings, probes, and connected services may be included.\n\nUse this endpoint to obtain a comprehensive view of a resource\u2019s identity, configuration, and operational state for inventory, compliance, or investigation purposes.", "tags": [ "Inventory" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "resource_id", "schema": { "type": "string" }, "required": true } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "resource_id": { "type": "string" }, "resource_type": { "type": "string" }, "display_name": { "type": "string" }, "display_id": { "type": "string" }, "instance_type": { "type": "string" }, "availability_zones": { "type": "array", "items": { "type": "string" } }, "comment": { "type": "string" }, "action": { "type": "string" }, "end_action": { "type": "string" }, "cloud": { "type": "string" }, "provider": { "type": "string" }, "parent": { "type": "array", "items": { "type": "string" } }, "parent_type": { "type": "string" }, "account_id": { "type": "string" }, "EksId": { "type": "string" }, "raw": {}, "region": { "type": "string" }, "vpc_id": { "type": "string" }, "auto_scaling_group": { "anyOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] }, "controller_id": { "type": "string" }, "controller_kind": { "type": "string" }, "cluster_id": { "type": "string" }, "cluster_type": { "type": "string" }, "namespace_id": { "type": "string" }, "deployment_id": { "type": "string" }, "container_id": { "type": "string" }, "external_ids": { "type": "array", "items": { "type": "string" } }, "image_repository_id": { "type": "string" }, "image_registry_id": { "type": "string" }, "image_type": { "type": "string" }, "container_images": { "type": "array", "items": { "type": "string" } }, "start_timestamp": { "type": "number" }, "end_timestamp": { "type": "number" }, "publicly_accessible": { "type": "boolean" }, "public_address": { "type": "string" }, "addresses": { "type": "array", "items": { "type": "string" } }, "role_arn_list": { "type": "array", "items": { "type": "string" } }, "associated_resource_ids": { "type": "array", "items": { "type": "string" } }, "tags": { "type": "array", "items": { "type": "object", "properties": { "Key": { "type": "string" }, "Value": { "type": "string" } }, "additionalProperties": false } }, "cloud_tags": { "type": "array", "items": { "type": "object", "properties": { "Key": { "type": "string" }, "Value": { "type": "string" } }, "additionalProperties": false } }, "deleted": { "type": "boolean" }, "is_network_endpoint": { "type": "boolean" }, "endpoint_types": { "type": "array", "items": { "type": "string" } }, "private_endpoint_ids": { "type": "array", "items": { "type": "string" } }, "reachable_vpc_list": { "type": "array", "items": { "type": "string" } }, "predicted_monthly_cost": { "type": "number" }, "ownerless": { "type": "boolean" }, "translated": {} }, "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/inventory": { "get": { "operationId": "inventory-list", "summary": "Get Resources", "description": "Retrieves cloud and platform resources across monitored environments, returning normalized metadata such as resource ID, type, display name, account ID, region, cloud provider, parent lineage, public accessibility status, and end timestamp.\n\nThis endpoint is useful for building an inventory, performing lookups, and pivoting between related assets.", "tags": [ "Inventory" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "phrase", "schema": { "description": "Search resources by IDs, IPs or display names", "type": "string" } }, { "in": "query", "name": "skip", "schema": { "default": 0, "type": "number" } }, { "in": "query", "name": "limit", "schema": { "default": 10, "type": "number" } }, { "in": "query", "name": "tags", "schema": { "description": "List of Key:Value pairs delimited by \":\"", "type": "array", "items": { "type": "string", "pattern": "^[^:]+:[^:]+$" } } }, { "in": "query", "name": "resource_id", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "associated_resource_id", "schema": { "type": "string" } }, { "in": "query", "name": "resource_type", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "account_id", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "region", "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "results": { "type": "array", "items": { "type": "object", "properties": { "resource_id": { "type": "string" }, "resource_type": { "type": "string" }, "parent": { "type": "array", "items": { "type": "string" } }, "display_name": { "type": "string" }, "account_id": { "type": "string" }, "region": { "type": "string" }, "vpc_id": { "type": "string" }, "publicly_accessible": { "type": "boolean" }, "cloud": { "type": "string" }, "cloud_tags": { "type": "array", "items": { "type": "object", "properties": { "Key": { "type": "string" }, "Value": { "type": "string" } }, "required": [ "Key", "Value" ], "additionalProperties": false } } }, "additionalProperties": false } }, "total_count": { "type": "number" }, "error": { "type": "string" } }, "required": [ "results", "total_count" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/inventory/types": { "get": { "operationId": "inventory-type", "summary": "Get Resource Inventory Summary", "description": "Returns a summary of resources grouped by type, including the count of each resource type across the environment.\n\nUse this endpoint to quickly assess resource distribution and identify concentration areas across your environment.", "tags": [ "Inventory" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "resource_type": { "type": "string" }, "count": { "type": "number" } }, "required": [ "resource_type", "count" ], "additionalProperties": false } } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/network/identity-logs": { "get": { "operationId": "network-identityLogs", "summary": "Get IAM Identity Activity Logs", "description": "Retrieves identity-related activity logs from monitored environments, including event metadata, principal and destination details, network information, and the raw event payload.\n\nSupports filtering by account, action, identity, principal attributes, destination attributes, error details, region, timestamp, user agent, and other session context.\n\nUse this endpoint to review identity activity and correlate actions with other security detections.", "tags": [ "Network & Identity Logs" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "src_ip", "schema": { "type": "string" } }, { "in": "query", "name": "identity", "schema": { "type": "string" } }, { "in": "query", "name": "principal_type", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "cloud_type", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "action", "schema": { "type": "string" } }, { "in": "query", "name": "region", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "destination", "schema": { "type": "string" } }, { "in": "query", "name": "activity_resource_id", "schema": { "type": "string" } }, { "in": "query", "name": "user_agent", "schema": { "type": "string" } }, { "in": "query", "name": "error_message", "schema": { "type": "string" } }, { "in": "query", "name": "account_id", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "src_resource_id", "schema": { "type": "string" } }, { "in": "query", "name": "src_resource_type", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "src_geo_iso", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "src_display_name", "schema": { "type": "string" } }, { "in": "query", "name": "src_nic_id", "schema": { "type": "string" } }, { "in": "query", "name": "src_is_tor", "schema": { "type": "boolean" } }, { "in": "query", "name": "src_ip_score", "schema": { "type": "array", "items": { "type": "number" } } }, { "in": "query", "name": "dst_type", "schema": { "type": "array", "items": { "type": "string", "enum": [ "s3_bucket", "dynamodb_table", "iam_role" ] } } }, { "in": "query", "name": "aggregate_by", "schema": { "type": "string", "enum": [ "default" ] } }, { "in": "query", "name": "principal_id", "schema": { "type": "string" } }, { "in": "query", "name": "session_id", "schema": { "type": "string" } }, { "in": "query", "name": "new_session_id", "schema": { "type": "string" } }, { "in": "query", "name": "from_timesatmp", "schema": { "type": "string" } }, { "in": "query", "name": "to_timestamp", "schema": { "type": "string" } }, { "in": "query", "name": "skip", "schema": { "default": 0, "type": "number" } }, { "in": "query", "name": "limit", "schema": { "default": 100, "type": "number" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "results": { "type": "array", "items": {} }, "totalCount": { "type": "number" } }, "required": [ "results", "totalCount" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/network/k8s-audit-logs": { "get": { "operationId": "network-k8sAuditLogs", "summary": "Get Kubernetes Audit Logs", "description": "Retrieves detailed Kubernetes audit logs from monitored clusters, including API server events, resource access patterns, security policy violations, and administrative actions.\n\nSupports filtering by namespace, resource type, verb actions, user identities, service accounts, admission controller decisions, and cluster-specific metadata.\n\nUse this endpoint to monitor Kubernetes security posture, track privileged operations, investigate policy violations, and ensure compliance with cluster governance requirements.", "tags": [ "Network & Identity Logs" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "skip", "schema": { "default": 0, "type": "number" } }, { "in": "query", "name": "limit", "schema": { "default": 100, "type": "number" } }, { "in": "query", "name": "cluster_id", "schema": { "type": "string" } }, { "in": "query", "name": "account_id", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "verb", "schema": { "type": "string" } }, { "in": "query", "name": "principal_id", "schema": { "type": "string" } }, { "in": "query", "name": "principal_type", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "resource_type", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "namespace", "schema": { "type": "string" } }, { "in": "query", "name": "from_timesatmp", "schema": { "type": "string" } }, { "in": "query", "name": "to_timestamp", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "results": { "type": "array", "items": {} }, "totalCount": { "type": "number" } }, "required": [ "results", "totalCount" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/network/traffic-logs": { "get": { "operationId": "network-trafficLogs", "summary": "Get Network Traffic Logs", "description": "Retrieves comprehensive network traffic logs from monitored environments, including connection metadata, source and destination details, protocol information, and traffic flow data.\n\nSupports filtering by source/destination IP addresses, ports, protocols, connection states, traffic volumes, geographic regions, and time ranges.\n\nUse this endpoint to analyze network communication patterns, identify suspicious traffic flows, and investigate connectivity issues across your infrastructure.", "tags": [ "Network & Identity Logs" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "skip", "schema": { "default": 0, "type": "number" } }, { "in": "query", "name": "limit", "schema": { "default": 100, "type": "number" } }, { "in": "query", "name": "src_ip", "schema": { "type": "string" } }, { "in": "query", "name": "dst_ip", "schema": { "type": "string" } }, { "in": "query", "name": "src_resource_id", "schema": { "type": "string" } }, { "in": "query", "name": "dst_resource_id", "schema": { "type": "string" } }, { "in": "query", "name": "protocol", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "src_geo_iso", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "dst_geo_iso", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "src_port_range", "schema": { "description": "A number or a range of numbers (e.g. \"5\" or \"5-10\")", "type": "string", "pattern": "^\\d+(-\\d+)?$" } }, { "in": "query", "name": "dst_post_range", "schema": { "description": "A number or a range of numbers (e.g. \"5\" or \"5-10\")", "type": "string", "pattern": "^\\d+(-\\d+)?$" } }, { "in": "query", "name": "action", "schema": { "type": "array", "items": { "type": "string", "enum": [ "ACCEPT", "REJECT", "UNKNOWN" ] } } }, { "in": "query", "name": "account_id", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "region", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "from_timestamp", "schema": { "type": "string" } }, { "in": "query", "name": "to_timestamp", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "results": { "type": "array", "items": {} }, "totalCount": { "type": "number" } }, "required": [ "results", "totalCount" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/notifications": { "post": { "operationId": "notifications-create", "summary": "Create Notification Rule", "description": "Creates a new notification rule with the specified configuration.\n\nThe rule will trigger alerts to configured destinations when matching events occur.", "tags": [ "Notifications" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 100 }, "description": { "type": "string", "maxLength": 250 }, "enabled": { "default": true, "type": "boolean" }, "event_type": { "type": "string", "enum": [ "cloud_event", "detection", "simulation_event" ] }, "channels": { "type": "array", "items": { "type": "object", "properties": { "type": { "anyOf": [ { "type": "string", "enum": [ "webhook", "splunk", "pagerduty", "microsoftteams", "opsgenie", "logzio", "googlecards", "paloaltocortexxsiam", "torq" ] }, { "type": "string", "const": "slack" } ] }, "subtype": { "anyOf": [ { "type": "string", "enum": [ "webhook", "splunk", "pagerduty", "microsoftteams", "opsgenie", "logzio", "googlecards", "paloaltocortexxsiam", "torq" ] }, { "type": "string", "const": "slack" } ] }, "id": { "type": "string" } }, "required": [ "type", "id" ] } }, "condition": { "type": "object", "properties": { "main_filter": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } } }, "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } } } } } } } } } }, "required": [ "operand" ] } } } }, "required": [ "name", "event_type" ] } } } }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "enabled": { "type": "boolean" }, "event_type": { "type": "string", "enum": [ "cloud_event", "detection", "simulation_event" ] }, "channels": { "anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "anyOf": [ { "type": "string", "enum": [ "webhook", "splunk", "pagerduty", "microsoftteams", "opsgenie", "logzio", "googlecards", "paloaltocortexxsiam", "torq" ] }, { "type": "string", "const": "slack" } ] }, "subtype": { "anyOf": [ { "type": "string", "enum": [ "webhook", "splunk", "pagerduty", "microsoftteams", "opsgenie", "logzio", "googlecards", "paloaltocortexxsiam", "torq" ] }, { "type": "string", "const": "slack" } ] }, "id": { "type": "string" } }, "required": [ "type", "id" ], "additionalProperties": false } }, { "type": "null" } ] }, "condition": { "anyOf": [ { "type": "object", "properties": { "main_filter": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } }, "additionalProperties": false }, "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } }, "additionalProperties": false } }, "additionalProperties": false } } }, "additionalProperties": false } } }, "required": [ "operand" ], "additionalProperties": false } }, "additionalProperties": false }, { "type": "null" } ] }, "created_by": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "created_at": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "modified_at": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "id", "name", "enabled", "event_type" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } }, "get": { "operationId": "notifications-list", "summary": "List Notification Rules", "description": "Retrieves notification rules with optional filtering and pagination.\n\nNotification rules define when and how users are notified about security events.\n\nResults are returned in descending order by creation date.", "tags": [ "Notifications" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "event_types", "schema": { "type": "array", "items": { "type": "string", "enum": [ "cloud_event", "detection", "simulation_event" ] } } }, { "in": "query", "name": "statuses", "schema": { "type": "array", "items": { "type": "string", "enum": [ "active", "inactive" ] } } }, { "in": "query", "name": "destinations", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "severities", "schema": { "type": "array", "items": { "type": "string", "enum": [ "low", "medium", "high", "critical" ] } } }, { "in": "query", "name": "search", "schema": { "type": "string" } }, { "in": "query", "name": "limit", "schema": { "default": 10, "type": "number", "minimum": 1, "maximum": 100 } }, { "in": "query", "name": "cursor", "schema": { "type": "number", "minimum": 0 } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "items": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "enabled": { "type": "boolean" }, "event_type": { "type": "string", "enum": [ "cloud_event", "detection", "simulation_event" ] }, "channels": { "anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "anyOf": [ { "type": "string", "enum": [ "webhook", "splunk", "pagerduty", "microsoftteams", "opsgenie", "logzio", "googlecards", "paloaltocortexxsiam", "torq" ] }, { "type": "string", "const": "slack" } ] }, "subtype": { "anyOf": [ { "type": "string", "enum": [ "webhook", "splunk", "pagerduty", "microsoftteams", "opsgenie", "logzio", "googlecards", "paloaltocortexxsiam", "torq" ] }, { "type": "string", "const": "slack" } ] }, "id": { "type": "string" } }, "required": [ "type", "id" ], "additionalProperties": false } }, { "type": "null" } ] }, "condition": { "anyOf": [ { "type": "object", "properties": { "main_filter": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } }, "additionalProperties": false }, "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } }, "additionalProperties": false } }, "additionalProperties": false } } }, "additionalProperties": false } } }, "required": [ "operand" ], "additionalProperties": false } }, "additionalProperties": false }, { "type": "null" } ] }, "created_by": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "created_at": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "modified_at": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "customer_id": { "type": "string" } }, "required": [ "id", "name", "enabled", "event_type" ], "additionalProperties": false } }, "total": { "type": "number" }, "totalUnfiltered": { "type": "number" } }, "required": [ "items", "total", "totalUnfiltered" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/notifications/{id}": { "delete": { "operationId": "notifications-delete", "summary": "Delete Notification Rule", "description": "Permanently deletes a notification rule.\n\nThis action cannot be undone.", "tags": [ "Notifications" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean" } }, "required": [ "success" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } }, "get": { "operationId": "notifications-get", "summary": "Get Notification Rule", "description": "Retrieves a single notification rule by ID.\n\nReturns the complete notification configuration including channels, conditions, and settings.", "tags": [ "Notifications" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "enabled": { "type": "boolean" }, "event_type": { "type": "string", "enum": [ "cloud_event", "detection", "simulation_event" ] }, "channels": { "anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "anyOf": [ { "type": "string", "enum": [ "webhook", "splunk", "pagerduty", "microsoftteams", "opsgenie", "logzio", "googlecards", "paloaltocortexxsiam", "torq" ] }, { "type": "string", "const": "slack" } ] }, "subtype": { "anyOf": [ { "type": "string", "enum": [ "webhook", "splunk", "pagerduty", "microsoftteams", "opsgenie", "logzio", "googlecards", "paloaltocortexxsiam", "torq" ] }, { "type": "string", "const": "slack" } ] }, "id": { "type": "string" } }, "required": [ "type", "id" ], "additionalProperties": false } }, { "type": "null" } ] }, "condition": { "anyOf": [ { "type": "object", "properties": { "main_filter": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } }, "additionalProperties": false }, "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } }, "additionalProperties": false } }, "additionalProperties": false } } }, "additionalProperties": false } } }, "required": [ "operand" ], "additionalProperties": false } }, "additionalProperties": false }, { "type": "null" } ] }, "created_by": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "created_at": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "modified_at": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "customer_id": { "type": "string" } }, "required": [ "id", "name", "enabled", "event_type" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } }, "patch": { "operationId": "notifications-update", "summary": "Update Notification Rule", "description": "Updates an existing notification rule.\n\nSupports partial updates - only provided fields will be modified.", "tags": [ "Notifications" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 100 }, "description": { "type": "string", "maxLength": 250 }, "enabled": { "type": "boolean" }, "event_type": { "type": "string", "enum": [ "cloud_event", "detection", "simulation_event" ] }, "channels": { "type": "array", "items": { "type": "object", "properties": { "type": { "anyOf": [ { "type": "string", "enum": [ "webhook", "splunk", "pagerduty", "microsoftteams", "opsgenie", "logzio", "googlecards", "paloaltocortexxsiam", "torq" ] }, { "type": "string", "const": "slack" } ] }, "subtype": { "anyOf": [ { "type": "string", "enum": [ "webhook", "splunk", "pagerduty", "microsoftteams", "opsgenie", "logzio", "googlecards", "paloaltocortexxsiam", "torq" ] }, { "type": "string", "const": "slack" } ] }, "id": { "type": "string" } }, "required": [ "type", "id" ] } }, "condition": { "type": "object", "properties": { "main_filter": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } } }, "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } } } } } } } } } }, "required": [ "operand" ] } } } } } } } }, "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "description": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "enabled": { "type": "boolean" }, "event_type": { "type": "string", "enum": [ "cloud_event", "detection", "simulation_event" ] }, "channels": { "anyOf": [ { "type": "array", "items": { "type": "object", "properties": { "type": { "anyOf": [ { "type": "string", "enum": [ "webhook", "splunk", "pagerduty", "microsoftteams", "opsgenie", "logzio", "googlecards", "paloaltocortexxsiam", "torq" ] }, { "type": "string", "const": "slack" } ] }, "subtype": { "anyOf": [ { "type": "string", "enum": [ "webhook", "splunk", "pagerduty", "microsoftteams", "opsgenie", "logzio", "googlecards", "paloaltocortexxsiam", "torq" ] }, { "type": "string", "const": "slack" } ] }, "id": { "type": "string" } }, "required": [ "type", "id" ], "additionalProperties": false } }, { "type": "null" } ] }, "condition": { "anyOf": [ { "type": "object", "properties": { "main_filter": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } }, "additionalProperties": false }, "operand": { "type": "string", "enum": [ "and", "or" ] }, "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "regex", "gte", "lte", "exists", "not_exists", "empty", "not_empty" ] }, "value": {}, "tag": { "type": "object", "properties": { "key": { "type": "string" }, "match_type": { "type": "string", "enum": [ "is", "is_not", "contains", "not_contains", "empty", "not_empty", "regex" ] }, "value": { "type": "string" } }, "additionalProperties": false } }, "additionalProperties": false } } }, "additionalProperties": false } } }, "required": [ "operand" ], "additionalProperties": false } }, "additionalProperties": false }, { "type": "null" } ] }, "created_by": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "created_at": { "anyOf": [ { "type": "string" }, { "type": "null" } ] }, "modified_at": { "anyOf": [ { "type": "string" }, { "type": "null" } ] } }, "required": [ "id", "name", "enabled", "event_type" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/rules": { "get": { "operationId": "rules-list", "summary": "Get Posture Rules", "description": "Retrieves posture rules that define security, compliance, or configuration requirements for monitored environments. Each rule includes metadata such as name, description, severity, category, compliance mappings, status, state, finding type, remediation guidance, and associated labels.\n\nUse this endpoint to review and manage the set of posture rules applied across your environment, identify active requirements, and assess compliance coverage.", "tags": [ "Posture Security" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "query", "name": "_id", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "account_ids", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "severity", "schema": { "type": "array", "items": { "type": "number", "minimum": 1, "maximum": 4 } } }, { "in": "query", "name": "rule_type", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "finding_type", "schema": { "type": "array", "items": { "type": "string", "enum": [ "misconfiguration", "internet_exposed", "insecure_identity", "vulnerability", "high_privileges", "privilege_escalation", "data_access", "crown_jewel_access", "admin_privileges", "external_access", "segmentation_breach" ] } } }, { "in": "query", "name": "category", "schema": { "type": "array", "items": { "type": "string", "enum": [ "Security", "Cost", "Availability", "Sustainability", "Other" ] } } }, { "in": "query", "name": "labels", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "status", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "state", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "created_by", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "compliance_controls_ids", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "compliance", "schema": { "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "include_violations_count", "schema": { "type": "boolean" } }, { "in": "query", "name": "violations_resource_ids", "schema": { "minItems": 1, "type": "array", "items": { "type": "string" } } }, { "in": "query", "name": "phrase", "schema": { "type": "string" } }, { "in": "query", "name": "skip", "schema": { "type": "number", "minimum": 0 } }, { "in": "query", "name": "limit", "schema": { "type": "number", "minimum": 1 } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "results": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "violations_count": { "type": "number" }, "name": { "type": "string" }, "status": { "type": "string", "enum": [ "pending", "pending_fullscan", "processing", "active", "invalid", "inactive", "error", "disabled", "archived", "draft" ] }, "exclusions_count": { "type": "number" }, "state": { "type": "string", "enum": [ "enabled", "disabled", "draft", "archived" ] }, "category": { "type": "string", "enum": [ "Security", "Cost", "Availability", "Sustainability", "Other" ] }, "severity": { "type": "number", "minimum": 1, "maximum": 4 }, "description": { "type": "string" }, "remediation": { "type": "string" }, "labels": { "type": "array", "items": { "type": "string" } }, "compliance": { "type": "array", "items": { "type": "string" } }, "rule_type": { "type": "string", "enum": [ "resource", "path" ] }, "finding_type": { "type": "string", "enum": [ "misconfiguration", "internet_exposed", "insecure_identity", "vulnerability", "high_privileges", "privilege_escalation", "data_access", "crown_jewel_access", "admin_privileges", "external_access", "segmentation_breach" ] }, "subject": { "type": "string", "enum": [ "source", "intermediate", "destination" ] }, "path_source_predicates": { "type": "array", "items": { "type": "object", "properties": { "resource_type": { "type": "string" }, "resource_id": { "type": "string" }, "attributes": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "OR", "AND" ] }, "attributes_list": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "array", "items": {} }, "match_type": { "type": "string", "enum": [ "equals", "not_equals", "contains", "not_contains", "is_null", "is_not_null", "greater_than", "greater_equal", "less_than", "less_equal" ] } }, "additionalProperties": false } } }, "required": [ "operand", "attributes_list" ], "additionalProperties": false }, "tags": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "OR", "AND" ] }, "attributes_list": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "array", "items": {} }, "match_type": { "type": "string", "enum": [ "equals", "not_equals", "contains", "not_contains", "is_null", "is_not_null", "greater_than", "greater_equal", "less_than", "less_equal" ] } }, "additionalProperties": false } } }, "required": [ "operand", "attributes_list" ], "additionalProperties": false }, "locations": { "type": "array", "items": { "type": "object", "properties": { "location_type": { "type": "string", "enum": [ "Account", "Subscription", "GCPProjectAccount", "Region", "vpc" ] }, "location_value": { "type": "string" } }, "required": [ "location_type", "location_value" ], "additionalProperties": false } } }, "additionalProperties": false } }, "path_source_predicate_operand": { "type": "string", "enum": [ "OR", "AND" ] }, "path_intermediate_predicates": { "type": "array", "items": { "type": "object", "properties": { "resource_type": { "type": "string" }, "resource_id": { "type": "string" }, "attributes": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "OR", "AND" ] }, "attributes_list": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "array", "items": {} }, "match_type": { "type": "string", "enum": [ "equals", "not_equals", "contains", "not_contains", "is_null", "is_not_null", "greater_than", "greater_equal", "less_than", "less_equal" ] } }, "additionalProperties": false } } }, "required": [ "operand", "attributes_list" ], "additionalProperties": false }, "tags": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "OR", "AND" ] }, "attributes_list": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "array", "items": {} }, "match_type": { "type": "string", "enum": [ "equals", "not_equals", "contains", "not_contains", "is_null", "is_not_null", "greater_than", "greater_equal", "less_than", "less_equal" ] } }, "additionalProperties": false } } }, "required": [ "operand", "attributes_list" ], "additionalProperties": false }, "locations": { "type": "array", "items": { "type": "object", "properties": { "location_type": { "type": "string", "enum": [ "Account", "Subscription", "GCPProjectAccount", "Region", "vpc" ] }, "location_value": { "type": "string" } }, "required": [ "location_type", "location_value" ], "additionalProperties": false } } }, "additionalProperties": false } }, "path_intermediate_predicate_operand": { "type": "string", "enum": [ "OR", "AND" ] }, "path_destination_predicates": { "type": "array", "items": { "type": "object", "properties": { "resource_type": { "type": "string" }, "resource_id": { "type": "string" }, "attributes": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "OR", "AND" ] }, "attributes_list": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "array", "items": {} }, "match_type": { "type": "string", "enum": [ "equals", "not_equals", "contains", "not_contains", "is_null", "is_not_null", "greater_than", "greater_equal", "less_than", "less_equal" ] } }, "additionalProperties": false } } }, "required": [ "operand", "attributes_list" ], "additionalProperties": false }, "tags": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "OR", "AND" ] }, "attributes_list": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "array", "items": {} }, "match_type": { "type": "string", "enum": [ "equals", "not_equals", "contains", "not_contains", "is_null", "is_not_null", "greater_than", "greater_equal", "less_than", "less_equal" ] } }, "additionalProperties": false } } }, "required": [ "operand", "attributes_list" ], "additionalProperties": false }, "locations": { "type": "array", "items": { "type": "object", "properties": { "location_type": { "type": "string", "enum": [ "Account", "Subscription", "GCPProjectAccount", "Region", "vpc" ] }, "location_value": { "type": "string" } }, "required": [ "location_type", "location_value" ], "additionalProperties": false } } }, "additionalProperties": false } }, "path_destination_predicate_operand": { "type": "string", "enum": [ "OR", "AND" ] }, "path_source_predicate_equals_match": { "type": "boolean" }, "path_intermediate_predicate_equals_match": { "type": "boolean" }, "path_destination_predicate_equals_match": { "type": "boolean" }, "exclusion_predicates": { "type": "array", "items": { "type": "object", "properties": { "resource_type": { "type": "string" }, "resource_id": { "type": "string" }, "attributes": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "OR", "AND" ] }, "attributes_list": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "array", "items": {} }, "match_type": { "type": "string", "enum": [ "equals", "not_equals", "contains", "not_contains", "is_null", "is_not_null", "greater_than", "greater_equal", "less_than", "less_equal" ] } }, "additionalProperties": false } } }, "required": [ "operand", "attributes_list" ], "additionalProperties": false }, "tags": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "OR", "AND" ] }, "attributes_list": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "array", "items": {} }, "match_type": { "type": "string", "enum": [ "equals", "not_equals", "contains", "not_contains", "is_null", "is_not_null", "greater_than", "greater_equal", "less_than", "less_equal" ] } }, "additionalProperties": false } } }, "required": [ "operand", "attributes_list" ], "additionalProperties": false }, "locations": { "type": "array", "items": { "type": "object", "properties": { "location_type": { "type": "string", "enum": [ "Account", "Subscription", "GCPProjectAccount", "Region", "vpc" ] }, "location_value": { "type": "string" } }, "required": [ "location_type", "location_value" ], "additionalProperties": false } } }, "additionalProperties": false } }, "resource_predicates": { "type": "array", "items": { "type": "object", "properties": { "resource_type": { "type": "string" }, "resource_id": { "type": "string" }, "attributes": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "OR", "AND" ] }, "attributes_list": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "array", "items": {} }, "match_type": { "type": "string", "enum": [ "equals", "not_equals", "contains", "not_contains", "is_null", "is_not_null", "greater_than", "greater_equal", "less_than", "less_equal" ] } }, "additionalProperties": false } } }, "required": [ "operand", "attributes_list" ], "additionalProperties": false }, "tags": { "type": "object", "properties": { "operand": { "type": "string", "enum": [ "OR", "AND" ] }, "attributes_list": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "array", "items": {} }, "match_type": { "type": "string", "enum": [ "equals", "not_equals", "contains", "not_contains", "is_null", "is_not_null", "greater_than", "greater_equal", "less_than", "less_equal" ] } }, "additionalProperties": false } } }, "required": [ "operand", "attributes_list" ], "additionalProperties": false }, "locations": { "type": "array", "items": { "type": "object", "properties": { "location_type": { "type": "string", "enum": [ "Account", "Subscription", "GCPProjectAccount", "Region", "vpc" ] }, "location_value": { "type": "string" } }, "required": [ "location_type", "location_value" ], "additionalProperties": false } } }, "additionalProperties": false } }, "ports": { "type": "array", "items": {} }, "allowed_actions": {}, "fail_simulation": { "type": "boolean" }, "action": { "type": "string", "enum": [ "create", "modify", "delete" ] }, "creation_date": { "type": "string" }, "created_by": { "type": "string" }, "relevant_attributes": { "type": "array", "items": { "type": "string" } } }, "required": [ "id", "name", "status", "state", "category", "severity" ], "additionalProperties": false } }, "total_count": { "type": "number" } }, "required": [ "results", "total_count" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/rules/resource/{resource_id}/violations": { "get": { "operationId": "rules-resourceViolations", "summary": "Get Resource Violations", "description": "Retrieves all policy violations and security findings associated with a specific resource.\n\nA violation represents a misconfiguration, excessive permission, or risky exposure detected on the asset, including:\n\n* Security misconfigurations (e.g., public access, weak authentication, missing encryption)\n\n* Resources that can be accessed from this asset \u2014 such as databases, storage buckets, crown-jewel systems, AI models, or accounts with administrative or high-level privileges\n\n* Privilege escalation risks and excessive permissions\n\nEach result includes the violation\u2019s category, severity, rule name, finding type, and the discovery timestamp (when the issue was first detected).", "tags": [ "Posture Security" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "path", "name": "resource_id", "schema": { "type": "string" }, "required": true }, { "in": "query", "name": "skip", "schema": { "default": 0, "type": "number", "minimum": 0 } }, { "in": "query", "name": "limit", "schema": { "default": 50, "type": "number", "minimum": 1 } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "rule_id": { "type": "string" }, "first_seen_timestamp": { "type": "string" } }, "required": [ "rule_id" ], "additionalProperties": false } } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/rules/rule/{rule_id}/violations": { "get": { "operationId": "rules-ruleViolations", "summary": "Get Rule Violations", "description": "Retrieves all violations triggered by a specific detection or compliance rule.\n\nEach violation represents a resource that has failed the rule\u2019s evaluation, indicating a misconfiguration, security risk, or policy non-compliance.", "tags": [ "Posture Security" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" }, { "in": "path", "name": "rule_id", "schema": { "type": "string" }, "required": true }, { "in": "query", "name": "skip", "schema": { "type": "number", "minimum": 0 } }, { "in": "query", "name": "limit", "schema": { "type": "number", "minimum": 1 } } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "object", "properties": { "results": { "type": "array", "items": { "type": "object", "properties": { "subject_id": { "type": "string" }, "first_seen_timestamp": { "type": "string" } }, "required": [ "subject_id" ], "additionalProperties": false } } }, "required": [ "results" ], "additionalProperties": false } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } }, "/workspaces": { "get": { "operationId": "workspaces-list", "summary": "Get workspaces", "tags": [ "Workspaces" ], "security": [ { "BearerAuth": [] } ], "parameters": [ { "in": "header", "name": "workspace", "schema": { "description": "Workspace ID", "type": "string" }, "description": "Workspace ID" } ], "responses": { "200": { "description": "Successful response", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "required": [ "id" ], "additionalProperties": false } } } } }, "400": { "description": "Invalid input data", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.BAD_REQUEST" } } } }, "401": { "description": "Authorization not provided", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.UNAUTHORIZED" } } } }, "403": { "description": "Insufficient access", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.FORBIDDEN" } } } }, "404": { "description": "Not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.NOT_FOUND" } } } }, "500": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR" } } } } } } } }, "components": { "schemas": { "error.BAD_REQUEST": { "title": "Invalid input data error (400)", "description": "The error information", "example": { "code": "BAD_REQUEST", "message": "Invalid input data", "issues": [] }, "type": "object", "properties": { "message": { "description": "The error message", "example": "Invalid input data", "type": "string" }, "code": { "description": "The error code", "example": "BAD_REQUEST", "type": "string" }, "issues": { "description": "An array of issues that were responsible for the error", "example": [], "type": "array", "items": { "type": "object", "properties": { "message": { "type": "string" } }, "required": [ "message" ], "additionalProperties": false } } }, "required": [ "message", "code" ], "additionalProperties": false }, "error.UNAUTHORIZED": { "title": "Authorization not provided error (401)", "description": "The error information", "example": { "code": "UNAUTHORIZED", "message": "Authorization not provided", "issues": [] }, "type": "object", "properties": { "message": { "description": "The error message", "example": "Authorization not provided", "type": "string" }, "code": { "description": "The error code", "example": "UNAUTHORIZED", "type": "string" }, "issues": { "description": "An array of issues that were responsible for the error", "example": [], "type": "array", "items": { "type": "object", "properties": { "message": { "type": "string" } }, "required": [ "message" ], "additionalProperties": false } } }, "required": [ "message", "code" ], "additionalProperties": false }, "error.FORBIDDEN": { "title": "Insufficient access error (403)", "description": "The error information", "example": { "code": "FORBIDDEN", "message": "Insufficient access", "issues": [] }, "type": "object", "properties": { "message": { "description": "The error message", "example": "Insufficient access", "type": "string" }, "code": { "description": "The error code", "example": "FORBIDDEN", "type": "string" }, "issues": { "description": "An array of issues that were responsible for the error", "example": [], "type": "array", "items": { "type": "object", "properties": { "message": { "type": "string" } }, "required": [ "message" ], "additionalProperties": false } } }, "required": [ "message", "code" ], "additionalProperties": false }, "error.NOT_FOUND": { "title": "Not found error (404)", "description": "The error information", "example": { "code": "NOT_FOUND", "message": "Not found", "issues": [] }, "type": "object", "properties": { "message": { "description": "The error message", "example": "Not found", "type": "string" }, "code": { "description": "The error code", "example": "NOT_FOUND", "type": "string" }, "issues": { "description": "An array of issues that were responsible for the error", "example": [], "type": "array", "items": { "type": "object", "properties": { "message": { "type": "string" } }, "required": [ "message" ], "additionalProperties": false } } }, "required": [ "message", "code" ], "additionalProperties": false }, "error.INTERNAL_SERVER_ERROR": { "title": "Internal server error error (500)", "description": "The error information", "example": { "code": "INTERNAL_SERVER_ERROR", "message": "Internal server error", "issues": [] }, "type": "object", "properties": { "message": { "description": "The error message", "example": "Internal server error", "type": "string" }, "code": { "description": "The error code", "example": "INTERNAL_SERVER_ERROR", "type": "string" }, "issues": { "description": "An array of issues that were responsible for the error", "example": [], "type": "array", "items": { "type": "object", "properties": { "message": { "type": "string" } }, "required": [ "message" ], "additionalProperties": false } } }, "required": [ "message", "code" ], "additionalProperties": false } }, "securitySchemes": { "BearerAuth": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT" } } }, "tags": [ { "name": "Attack Paths" }, { "name": "Canaries" }, { "name": "Config Changes" }, { "name": "Detection Rules" }, { "name": "Integrations" }, { "name": "Inventory" }, { "name": "Network & Identity Logs" }, { "name": "Notifications" }, { "name": "Posture Security" }, { "name": "Threat Detection" }, { "name": "Vulnerabilities" }, { "name": "Workspaces" } ], "x-apis-io-provenance": { "assembled": true, "date": "2026-08-29", "method": "searched", "note": "NOT a single verbatim download. Stream.Security publishes its OpenAPI as PER-OPERATION fragments embedded in its ReadMe-hosted reference pages: each https://docs.streamsec.io/reference/.md carries a '# OpenAPI definition' block containing a complete OpenAPI 3.1.0 document for that one operation. 44 reference pages were fetched (all HTTP 200) on 2026-08-29; 34 contained an OpenAPI fragment and were merged on paths and components. Every path, operation, parameter, schema and response below is the provider's own published text, unmodified. Only the union is ours. The consolidated spec is not downloadable from ReadMe as one file - /openapi.json, /openapi.yaml and the /branches/1.0/apis/*.json paths return 404 or 429.", "sources": [ "https://docs.streamsec.io/reference/", "https://docs.streamsec.io/llms.txt" ], "fragments_merged": 34, "ownership_check": "Confirmed. info.title 'Stream Security API'; servers[] https://{app}.streamsec.io/openapi. streamsec.io is Stream.Security's own operational domain - app.streamsec.io is the product console named as 'YOUR STREAM SECURITY DOMAIN URL' in the provider's MCP setup docs, and docs.streamsec.io is the documentation host. The streamsec.io domain, rather than stream.security, is the pre-rename Lightlytics-era infrastructure the company still runs its product on." } }