{
  "opencollection": "1.0.0",
  "info": {
    "name": "Tanium Connect Actions Connections API",
    "version": "1.0.0"
  },
  "request": {
    "auth": {
      "type": "apikey",
      "key": "session",
      "value": "{{session}}",
      "placement": "header"
    }
  },
  "items": [
    {
      "info": {
        "name": "Connections",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "List All Connections",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{tanium_server}/plugin/products/connect/v1/connections",
            "params": [
              {
                "name": "limit",
                "value": "",
                "type": "query",
                "description": "Maximum number of connections to return"
              },
              {
                "name": "offset",
                "value": "",
                "type": "query",
                "description": "Number of connections to skip for pagination"
              }
            ]
          },
          "docs": "Retrieves a list of all configured connections. Each connection defines the link between a data source in Tanium and an external destination, along with formatting, filtering, and scheduling options."
        },
        {
          "info": {
            "name": "Create A New Connection",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{tanium_server}/plugin/products/connect/v1/connections",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Creates a new connection linking a data source to a destination with the specified format, filter, and schedule settings. The connection can be configured to deliver data as CSV, JSON, or CEF formats."
        },
        {
          "info": {
            "name": "Get A Connection By ID",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{tanium_server}/plugin/products/connect/v1/connections/:connectionId",
            "params": [
              {
                "name": "connectionId",
                "value": "",
                "type": "path",
                "description": "Unique identifier of the connection"
              }
            ]
          },
          "docs": "Retrieves the full configuration and current status of a specific connection, including its source, destination, format, filter, and schedule settings."
        },
        {
          "info": {
            "name": "Update A Connection",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://{tanium_server}/plugin/products/connect/v1/connections/:connectionId",
            "params": [
              {
                "name": "connectionId",
                "value": "",
                "type": "path",
                "description": "Unique identifier of the connection"
              }
            ],
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Updates the configuration of an existing connection. All connections that share a destination are affected when the destination settings are changed."
        },
        {
          "info": {
            "name": "Delete A Connection",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://{tanium_server}/plugin/products/connect/v1/connections/:connectionId",
            "params": [
              {
                "name": "connectionId",
                "value": "",
                "type": "path",
                "description": "Unique identifier of the connection to delete"
              }
            ]
          },
          "docs": "Permanently deletes a connection and its associated schedule. The underlying source and destination configurations are not affected."
        },
        {
          "info": {
            "name": "Run A Connection On Demand",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{tanium_server}/plugin/products/connect/v1/connections/:connectionId/run",
            "params": [
              {
                "name": "connectionId",
                "value": "",
                "type": "path",
                "description": "Unique identifier of the connection to run"
              }
            ]
          },
          "docs": "Triggers an immediate execution of a connection outside of its normal schedule. This sends the current source data to the configured destination."
        },
        {
          "info": {
            "name": "Enable A Connection",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://{tanium_server}/plugin/products/connect/v1/connections/:connectionId/enable",
            "params": [
              {
                "name": "connectionId",
                "value": "",
                "type": "path",
                "description": "Unique identifier of the connection"
              }
            ]
          },
          "docs": "Enables a previously disabled connection, allowing it to run on its configured schedule."
        },
        {
          "info": {
            "name": "Disable A Connection",
            "type": "http"
          },
          "http": {
            "method": "PUT",
            "url": "https://{tanium_server}/plugin/products/connect/v1/connections/:connectionId/disable",
            "params": [
              {
                "name": "connectionId",
                "value": "",
                "type": "path",
                "description": "Unique identifier of the connection"
              }
            ]
          },
          "docs": "Disables a connection, preventing it from running on its schedule. The connection configuration is preserved and can be re-enabled later."
        },
        {
          "info": {
            "name": "List Endpoint Connections",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{tanium_server}/plugin/products/threat-response/api/v1/conns",
            "params": [
              {
                "name": "limit",
                "value": "",
                "type": "query",
                "description": "Maximum number of connections to return"
              },
              {
                "name": "offset",
                "value": "",
                "type": "query",
                "description": "Number of connections to skip for pagination"
              },
              {
                "name": "status",
                "value": "",
                "type": "query",
                "description": "Filter by connection status"
              },
              {
                "name": "ip",
                "value": "",
                "type": "query",
                "description": "Filter by endpoint IP address"
              },
              {
                "name": "platform",
                "value": "",
                "type": "query",
                "description": "Filter by endpoint platform"
              },
              {
                "name": "hostname",
                "value": "",
                "type": "query",
                "description": "Filter by endpoint hostname"
              }
            ]
          },
          "docs": "Retrieves a paginated list of live connections to endpoints. Connections can be filtered by status, IP address, platform, and hostname."
        },
        {
          "info": {
            "name": "Create A Live Connection To An Endpoint",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{tanium_server}/plugin/products/threat-response/api/v1/conns/connect",
            "body": {
              "type": "json",
              "data": "{}"
            }
          },
          "docs": "Initiates a live connection to a specified endpoint for investigation purposes. Requires the client ID, IP, platform, and hostname of the target endpoint."
        },
        {
          "info": {
            "name": "Get A Connection By ID",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{tanium_server}/plugin/products/threat-response/api/v1/conns/:connectionId",
            "params": [
              {
                "name": "connectionId",
                "value": "",
                "type": "path",
                "description": "Unique identifier of the connection"
              }
            ]
          },
          "docs": "Retrieves the details and current status of a specific endpoint connection."
        },
        {
          "info": {
            "name": "Close A Live Connection",
            "type": "http"
          },
          "http": {
            "method": "POST",
            "url": "https://{tanium_server}/plugin/products/threat-response/api/v1/conns/close/:connectionId",
            "params": [
              {
                "name": "connectionId",
                "value": "",
                "type": "path",
                "description": "Unique identifier of the connection to close"
              }
            ]
          },
          "docs": "Closes an active live connection to an endpoint, ending the investigation session."
        },
        {
          "info": {
            "name": "Delete A Connection Record",
            "type": "http"
          },
          "http": {
            "method": "DELETE",
            "url": "https://{tanium_server}/plugin/products/threat-response/api/v1/conns/delete/:connectionId",
            "params": [
              {
                "name": "connectionId",
                "value": "",
                "type": "path",
                "description": "Unique identifier of the connection to delete"
              }
            ]
          },
          "docs": "Permanently deletes a connection record from the Threat Response database."
        }
      ]
    }
  ],
  "bundled": true
}