openapi: 3.0.3
info:
  title: Wallarm Applications Attacks API
  description: The Wallarm API provides programmatic access to the Wallarm API Security Platform. It enables management of attacks, incidents, vulnerabilities, security rules, IP lists, filter nodes, users, integrations, and triggers. The API is available on both US Cloud and EU Cloud endpoints and uses API token authentication.
  version: 4.0.0
  termsOfService: https://www.wallarm.com/terms-of-service
  contact:
    name: Wallarm Support
    url: https://docs.wallarm.com/
    email: support@wallarm.com
  license:
    name: Proprietary
    url: https://www.wallarm.com/terms-of-service
servers:
- url: https://us1.api.wallarm.com
  description: Wallarm US Cloud API
- url: https://api.wallarm.com
  description: Wallarm EU Cloud API
security:
- ApiTokenAuth: []
tags:
- name: Attacks
  description: Attack and incident data management
paths:
  /v1/objects/attack:
    post:
      operationId: listAttacks
      summary: List Attacks
      description: Retrieve a list of attacks detected by Wallarm. Supports filtering by time range, client ID, attack type, and other criteria.
      tags:
      - Attacks
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ObjectQueryRequest'
      responses:
        '200':
          description: List of attacks returned successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttackListResponse'
        '401':
          description: Unauthorized
  /v2/objects/attack:
    post:
      operationId: listAttacksPaginated
      summary: List Attacks (Paginated)
      description: Retrieve attacks with cursor-based pagination, returning up to 100 records per page. Use the returned cursor to fetch subsequent pages.
      tags:
      - Attacks
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PaginatedQueryRequest'
      responses:
        '200':
          description: Paginated list of attacks
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedAttackResponse'
        '401':
          description: Unauthorized
components:
  schemas:
    PaginatedQueryRequest:
      type: object
      properties:
        clientid:
          type: integer
          description: Client ID
        filter:
          type: object
          description: Filter criteria
        limit:
          type: integer
          default: 100
          description: Maximum number of results per page
        paging:
          type: boolean
          default: true
          description: Enable cursor-based pagination
        cursor:
          type: string
          description: Cursor for fetching next page of results
    AttackListResponse:
      type: object
      properties:
        status:
          type: integer
        body:
          type: array
          items:
            $ref: '#/components/schemas/Attack'
    Attack:
      type: object
      properties:
        id:
          type: string
          description: Unique attack identifier
        type:
          type: string
          description: Attack type (sqli, xss, rce, etc.)
        time:
          type: integer
          description: Unix timestamp of attack
        domain:
          type: string
          description: Target domain
        path:
          type: string
          description: Target URL path
        method:
          type: string
          description: HTTP method
        parameter:
          type: string
          description: Attacked parameter
        status:
          type: integer
          description: HTTP response status code
        hits:
          type: integer
          description: Number of hit requests in this attack
    PaginatedAttackResponse:
      type: object
      properties:
        status:
          type: integer
        body:
          type: object
          properties:
            data:
              type: array
              items:
                $ref: '#/components/schemas/Attack'
            cursor:
              type: string
              description: Cursor for fetching the next page
    ObjectQueryRequest:
      type: object
      properties:
        clientid:
          type: integer
          description: Client ID
        filter:
          type: object
          description: Filter criteria
        limit:
          type: integer
          default: 50
          description: Maximum number of results to return
        offset:
          type: integer
          default: 0
          description: Pagination offset
        order_by:
          type: string
          description: Field to sort results by
        order_desc:
          type: boolean
          default: true
          description: Sort in descending order
  securitySchemes:
    ApiTokenAuth:
      type: apiKey
      in: header
      name: X-WallarmApi-Token
      description: API token obtained from Wallarm Console under Settings → API Tokens.