{"components":{"securitySchemes":{"bearerAuth":{"bearerFormat":"JWT","scheme":"bearer","type":"http"}}},"info":{"contact":{"email":"info@limacharlie.io"},"description":"This is the REST API for LimaCharlie.io, see https://docs.limacharlie.io/7-administration/access/api-keys/ for authentication information.","license":{"name":"Apache 2.0","url":"http://www.apache.org/licenses/LICENSE-2.0.html"},"termsOfService":"https://limacharlie.io/tos","title":"LimaCharlie.io REST API","version":"1.0.0"},"openapi":"3.1.0","paths":{"/autocomplete/task":{"get":{"operationId":"autocompleteTask","tags":["Sensors"],"parameters":[{"name":"aid","description":"agent ID","schema":{"type":"string"},"in":"query"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":{"additionalProperties":false,"description":"command line command and a set of assocuated flags and positionals","properties":{"optional":{"items":{"oneOf":[{"items":false,"prefixItems":[{"description":"command line flag","title":"flag","type":"string"},{"description":"command line flag value","title":"value","type":"string"}],"type":"array"},{"description":"command line flag with no value","title":"flag","type":"string"}]},"type":"array"},"positional":{"description":"positional argument","items":{"type":"string"},"title":"argument","type":"array"}},"title":"command","type":"object"},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get autocomplete information for sensor tasking.","summary":"Autocomplete Task"}},"/domain/{domain}/auth":{"get":{"operationId":"getDomainAuthRequirements","tags":["Billing"],"parameters":[{"name":"domain","required":true,"description":"email domain","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}}},"description":"Get authentication requirements (MFA, sign-in methods) for a domain. This is a public endpoint used during login.","summary":"Get Domain Auth Requirements"}},"/errors/{oid}":{"get":{"operationId":"getErrorLog","tags":["Errors"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"errors":{"items":{"additionalProperties":false,"properties":{"component":{"type":"string"},"error":{"type":"string"},"oid":{"type":"string"},"ts":{"type":"number"}},"required":["component","error","oid","ts"],"type":"object"},"type":"array"}},"required":["errors"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the error log for the organization.","summary":"Get Error Logs"}},"/errors/{oid}/{component}":{"delete":{"operationId":"dismissError","tags":["Errors"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"component","required":true,"description":"Component name of the error to dismiss","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Dismiss a specific error for the organization.","summary":"Dismiss Error"}},"/events":{"get":{"operationId":"getAvailableEvents","tags":["General"],"parameters":[],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"events":{"items":{"type":"string"},"type":"array"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get available event names.","summary":"Get Possible Events"}},"/export/{oid}/sensors":{"post":{"operationId":"exportSensorList","tags":["Exports","Sensors"],"parameters":[{"name":"format","description":"format of the exported data, one of 'json' or 'csv'","schema":{"enum":["json","csv"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"sensors":{"oneOf":[{"items":{"additionalProperties":false,"properties":{"alive":{"description":"timestamp of last alive check","pattern":"^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$","title":"alive check","type":"string"},"arch":{"description":"architecture of host running the sensor","title":"architecture","type":"integer"},"did":{"oneOf":[{"description":"UUID of the device","format":"uuid","title":"device identifier","type":"string"},{"enum":[""]}]},"enroll":{"description":"timestamp of sensor enrollment","pattern":"^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$","title":"enrollment timestamp","type":"string"},"ext_ip":{"oneOf":[{"description":"external IP of the host running the sensor","format":"ipv4","title":"external IP","type":"string"},{"enum":["internal",""]}]},"ext_plat":{"description":"external platform of the sensor","title":"external platform","type":"integer"},"hostname":{"description":"hostname of the host running the sensor","title":"hostname","type":"string"},"installer_version":{"description":"version of the installer","title":"installer version","type":"string"},"int_ip":{"description":"internal IP of the host running the sensor","title":"internal IP","type":"string"},"is_isolated":{"description":"isolation status of the sensor","title":"isolation status","type":"boolean"},"is_kernel_available":{"description":"is kernel available to the sensor","title":"kernel availability","type":"boolean"},"is_online":{"description":"is sensor online at the moment","title":"online status","type":"boolean"},"mac_addr":{"description":"MAC address of the host running the sensor","title":"MAC address","type":"string"},"metadata":{"oneOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}]},"oid":{"description":"UUID of the organization","format":"uuid","title":"organization identifier","type":"string"},"plat":{"description":"platform type of the host running the sensor","title":"platform","type":"integer"},"sealed":{"description":"seal status of the sensor","title":"seal status","type":"boolean"},"should_isolate":{"description":"isolation intent of the sensor","title":"isolation intent","type":"boolean"},"should_seal":{"description":"seal intent of the sensor","title":"seal intent","type":"boolean"},"sid":{"description":"UUID of the sensor","format":"uuid","title":"sensor identifier","type":"string"},"tags":{"oneOf":[{"items":{"description":"sensors tag","title":"tag","type":"string"},"type":"array"},{"type":"null"}]},"version":{"description":"version of the sensor","title":"sensor version","type":"string"}},"required":["sid","alive","arch","did","enroll","ext_ip","ext_plat","hostname","int_ip","is_isolated","is_kernel_available","mac_addr","oid","plat","sealed","should_isolate","should_seal"],"type":"object"},"type":"array"},{"type":"object"}]}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Export the full sensor list (info and tags) for the Organization.","summary":"Export Sensors"}},"/extension/definition":{"get":{"operationId":"getAllExtension","tags":["Extensions"],"parameters":[],"responses":{"200":{"description":"All public and owned extension","content":{"application/json":{"schema":{"items":{"additionalProperties":false,"properties":{"cost":{"additionalProperties":false,"properties":{"minimum_sensor_count":{"type":"integer"},"per_metric":{"additionalProperties":false,"properties":{"cost":{"type":"number"},"metric_name":{"type":"string"},"unit":{"type":"number"}},"required":["metric_name","cost","unit"],"type":"object"},"per_month":{"type":"number"},"per_sensor":{"type":"number"}},"required":["per_month","per_sensor","minimum_sensor_count"],"type":"object"},"desc":{"type":"string"},"destination_url":{"type":"string"},"email":{"type":"string"},"flairs":{"type":"array"},"icon":{"type":"string"},"is_labs":{"type":"boolean"},"is_public":{"type":"boolean"},"label":{"type":"string"},"long_desc":{"type":"string"},"name":{"type":"string"},"perms":{"type":"array"},"required_extensions":{"oneOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}]},"shared_secret":{"type":"string"},"unsubscribe_warning":{"type":"string"},"website":{"type":"string"},"zero_state_desc":{"type":"string"},"zero_state_header":{"type":"string"}},"required":["name","desc","long_desc","email","website","label","zero_state_header","zero_state_desc","required_extensions","perms","flairs","cost","icon","is_public","is_labs"],"type":"object"},"type":"array"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get all public and owned extensions","summary":"Get all public and owned extensions"},"post":{"operationId":"createExtension","tags":["Extensions"],"parameters":[],"requestBody":{"description":"Extension to create","content":{"application/json":{"schema":{"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create an extension","summary":"Create an extension"},"put":{"operationId":"updateExtension","tags":["Extensions"],"parameters":[],"requestBody":{"description":"Extension fields to update all fields required as this is not a patch","content":{"application/json":{"schema":{"type":"object"}}},"required":true},"responses":{"200":{"description":"Successful update","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Update an existing Extension","summary":"Update an existing Extension"}},"/extension/definition/{extensionName}":{"delete":{"operationId":"deleteExtension","tags":["Extensions"],"parameters":[{"name":"extensionName","required":true,"description":"extension name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"Successful deletion of the extension","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete an Extension","summary":"Delete an existing Extension"},"get":{"operationId":"getExtension","tags":["Extensions"],"parameters":[{"name":"oid","description":"organization id","schema":{"format":"uuid","type":"string"},"in":"query"},{"name":"extensionName","required":true,"description":"extension name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"A extension","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"cost":{"additionalProperties":false,"properties":{"minimum_sensor_count":{"type":"integer"},"per_metric":{"additionalProperties":false,"properties":{"cost":{"type":"number"},"metric_name":{"type":"string"},"unit":{"type":"number"}},"required":["metric_name","cost","unit"],"type":"object"},"per_month":{"type":"number"},"per_sensor":{"type":"number"}},"required":["per_month","per_sensor","minimum_sensor_count"],"type":"object"},"desc":{"type":"string"},"email":{"type":"string"},"flairs":{"type":"array"},"icon":{"type":"string"},"is_labs":{"type":"boolean"},"is_public":{"type":"boolean"},"label":{"type":"string"},"long_desc":{"type":"string"},"name":{"type":"string"},"perms":{"type":"array"},"required_extensions":{"oneOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}]},"unsubscribe_warning":{"type":"string"},"website":{"type":"string"},"zero_state_desc":{"type":"string"},"zero_state_header":{"type":"string"}},"required":["name","desc","long_desc","email","website","label","zero_state_header","zero_state_desc","required_extensions","perms","flairs","cost","icon","is_public","is_labs"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get extension by extension name, extension must be public or owned by caller","summary":"Get extension by extension name, extension must be public or owned by caller"}},"/extension/public/definition":{"get":{"operationId":"getPublicExtensions","tags":["Extensions"],"parameters":[],"responses":{"200":{"description":"An array of Extensions","content":{"application/json":{"schema":{"items":{"additionalProperties":false,"properties":{"cost":{"additionalProperties":false,"properties":{"minimum_sensor_count":{"type":"integer"},"per_metric":{"additionalProperties":false,"properties":{"cost":{"type":"number"},"metric_name":{"type":"string"},"unit":{"type":"number"}},"required":["metric_name","cost","unit"],"type":"object"},"per_month":{"type":"number"},"per_sensor":{"type":"number"}},"required":["per_month","per_sensor","minimum_sensor_count"],"type":"object"},"desc":{"type":"string"},"email":{"type":"string"},"flairs":{"type":"array"},"icon":{"type":"string"},"is_labs":{"type":"boolean"},"is_public":{"type":"boolean"},"label":{"type":"string"},"long_desc":{"type":"string"},"name":{"type":"string"},"perms":{"type":"array"},"required_extensions":{"oneOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}]},"unsubscribe_warning":{"type":"string"},"website":{"type":"string"},"zero_state_desc":{"type":"string"},"zero_state_header":{"type":"string"}},"required":["name","desc","long_desc","email","website","label","zero_state_header","zero_state_desc","required_extensions","perms","flairs","cost","icon","is_public","is_labs"],"type":"object"},"type":"array"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get all public extensions - no auth required","summary":"Get all public extensions - no auth required"}},"/extension/request/{extensionName}":{"post":{"operationId":"createExtensionRequest","tags":["Extensions"],"parameters":[{"name":"data","description":"data","schema":{"type":"string"},"in":"query"},{"name":"gzdata","description":"data","schema":{"type":"string"},"in":"query"},{"name":"oid","description":"organization id","schema":{"format":"uuid","type":"string"},"in":"query"},{"name":"action","description":"action","schema":{"type":"string"},"in":"query"},{"name":"inv_id","description":"invitation id","schema":{"type":"string"},"in":"query"},{"name":"extensionName","required":true,"description":"extension name","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"JSON encoded string of the request data","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"action":{"type":"string"},"data":{"type":"string"},"gzdata":{"type":"string"},"oid":{"format":"uuid","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create extension request to extension you are subscribed to","summary":"Create extension request"}},"/extension/schema/{extensionName}":{"get":{"operationId":"getExtensionSchema","tags":["Extensions"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"type":"string"},"in":"query"},{"name":"extensionName","required":true,"description":"extension name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"A extension","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"config_schema":{"additionalProperties":false,"properties":{"fields":{"oneOf":[{"type":"null"},{"additionalProperties":{"additionalProperties":false,"properties":{"data_type":{"type":"string"},"default_value":{"oneOf":[{"type":"boolean"},{"type":"string"}]},"description":{"type":"string"},"display_index":{"type":"integer"},"filter":{"additionalProperties":false,"properties":{},"type":"object"},"filters":{"items":{"additionalProperties":false,"properties":{},"type":"object"},"type":"array"},"is_list":{"type":"boolean"},"label":{"type":"string"},"object":{"additionalProperties":false,"properties":{"element_desc":{"type":"string"},"element_name":{"type":"string"},"fields":{"additionalProperties":{"additionalProperties":false,"properties":{"data_type":{"type":"string"},"default_value":{"oneOf":[{"type":"boolean"},{"type":"string"}]},"description":{"type":"string"},"display_index":{"type":"integer"},"filter":{"additionalProperties":false,"properties":{},"type":"object"},"filters":{"items":{"type":"object"},"type":"array"},"is_list":{"type":"boolean"},"key":{"additionalProperties":false,"properties":{},"type":"object"},"label":{"type":"string"},"object":{"type":"object"},"placeholder":{"type":"string"},"requirements":{"items":{"items":{"type":"string"},"type":"array"},"type":"array"}},"type":"object"},"type":"object"},"key":{"additionalProperties":false,"properties":{"data_type":{"type":"string"},"name":{"type":"string"},"placeholder":{"type":"string"}},"type":"object"},"requirements":{"items":{"items":{"type":"string"},"type":"array"},"type":"array"},"supported_actions":{"items":{"type":"string"},"type":"array"}},"type":"object"},"placeholder":{"type":"string"},"supported_actions":{"items":{"type":"string"},"type":"array"}},"type":"object"},"type":"object"}]},"key":{"additionalProperties":false,"properties":{},"type":"object"},"requirements":{"oneOf":[{"type":"null"},{"items":{"items":{"type":"string"},"type":"array"},"type":"array"}]},"supported_actions":{"items":{"type":"string"},"type":"array"}},"type":"object"},"request_schema":{"additionalProperties":{"additionalProperties":false,"properties":{"is_impersonated":{"type":"boolean"},"is_user_facing":{"type":"boolean"},"long_description":{"type":"string"},"parameters":{"additionalProperties":{"additionalProperties":false,"properties":{"credentials":{"type":"string"},"data":{"additionalProperties":true,"type":"object"},"data_type":{"type":"string"},"default_value":{"type":"object"},"display_index":{"type":"integer"},"enum_values":{"items":{"type":"object"},"type":"array"},"is_interactive":{"type":"boolean"},"is_list":{"type":"boolean"},"name":{"type":"string"}},"type":"object"},"properties":{"fields":{"additionalProperties":true,"type":"object"}},"type":"object"},"short_description":{"type":"string"}},"type":"object"},"type":"object"},"required_events":{"items":{"type":"string"},"type":"array"},"views":{"items":{"additionalProperties":false,"properties":{"default_requests":{"items":{"type":"string"},"type":"array"},"layout_type":{"type":"string"},"name":{"type":"string"}},"type":"object"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get extension schema by extension name","summary":"Get extension schema"}},"/groups":{"get":{"operationId":"getUserOrgGroups","tags":["Organizations","Groups"],"parameters":[],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"groups":{"items":{"type":"object"},"type":"array"}},"type":"object"},"examples":{"basic":{"value":{"groups":[{"name":"test","orgs":{"test":["test@test.com"]},"owner":"test@test.com"}]}}}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get groups the current user is owner of.","summary":"Get user groups"},"post":{"operationId":"createGroup","tags":["Organizations","Groups"],"parameters":[{"name":"name","required":true,"description":"name of the new group","schema":{"type":"string"},"in":"query"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create new organization group.","summary":"Create group"}},"/groups/concurrent":{"get":{"operationId":"getUserOrgGroupsConcurrent","tags":["Groups"],"parameters":[],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"groups":{"items":{"type":"object"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Gets all group info objects a user is owner of. ","summary":"Get all owned group info"}},"/groups/{gid}":{"delete":{"operationId":"deleteGroup","tags":["Organizations","Groups"],"parameters":[{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete group.","summary":"Delete group"},"get":{"operationId":"getGroup","tags":["Groups"],"parameters":[{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get group information.","summary":"Get group info"}},"/groups/{gid}/logs":{"get":{"operationId":"getGroupLogs","tags":["Groups"],"parameters":[{"name":"limit","description":"optional number of log lines to return","schema":{"default":"1000","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"logs":{"items":{"additionalProperties":false,"properties":{"code":{"type":"string"},"email":{"type":"string"},"message":{"type":"string"},"timestamp":{"type":"integer"},"uid":{"type":"string"}},"type":"object"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get group logs.","summary":"Get group logs"}},"/groups/{gid}/orgs":{"delete":{"operationId":"removeGroupMemberOrg","tags":["Organizations","Groups"],"parameters":[{"name":"oid","required":true,"description":"oid of the org to remove","schema":{"type":"string"},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove organization from group.","summary":"Remove org from group"},"post":{"operationId":"addGroupMemberOrg","tags":["Groups"],"parameters":[{"name":"oid","description":"oid of the org to add","schema":{"type":"string"},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"request object","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"oid":{"type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Add organization to group.","summary":"Add org to group"}},"/groups/{gid}/owners":{"delete":{"operationId":"removeGroupOwnerUser","tags":["Organizations","Groups"],"parameters":[{"name":"member_email","required":true,"description":"email of the user to remove","schema":{"type":"string"},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove user from group owners.","summary":"Remove user from group owners"},"post":{"operationId":"addGroupOwnerUser","tags":["Groups"],"parameters":[{"name":"member_email","required":true,"description":"email of the user to add","schema":{"type":"string"},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Add user to group as owner.","summary":"Add user to group as owner"}},"/groups/{gid}/permissions":{"post":{"operationId":"setGroupPermissions","tags":["Groups"],"parameters":[{"name":"perm","required":true,"description":"full set of permissions for the group, repeated field","schema":{"type":"string"},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Set group permissions.","summary":"Set group permissions"}},"/groups/{gid}/users":{"delete":{"operationId":"removeGroupMemberUser","tags":["Organizations","Groups"],"parameters":[{"name":"member_email","required":true,"description":"email of the user to remove","schema":{"type":"string"},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove user from group as member.","summary":"Remove user from group as member"},"post":{"operationId":"addGroupMemberUser","tags":["Groups"],"parameters":[{"name":"member_email","required":true,"description":"email of the user to add","schema":{"type":"string"},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Add user to group as member.","summary":"Add user to group as member"}},"/hive/{hive_name}/schema":{"get":{"operationId":"getHiveSchema","tags":["Hive"],"parameters":[{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"schema":{"additionalProperties":true,"description":"JSON Schema describing the hive's record type","type":"object"}},"required":["schema"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the JSON Schema for a hive's record type.","summary":"Get Hive Schema"}},"/hive/{hive_name}/{oid}":{"get":{"operationId":"listHiveRecord","tags":["Hive"],"parameters":[{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":{"additionalProperties":false,"properties":{"data":{"oneOf":[{"additionalProperties":true,"description":"Record data, structure depends on hive type","type":"object"},{"type":"null"}]},"detection":{"type":"string"},"isDraft":{"type":"boolean"},"name":{"type":"string"},"sys_mtd":{"additionalProperties":false,"properties":{"created_at":{"type":"integer"},"created_by":{"oneOf":[{"type":"string"},{"type":"null"}]},"etag":{"type":"string"},"guid":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_author":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_error":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_error_ts":{"oneOf":[{"type":"integer"},{"type":"null"}]},"last_mod":{"type":"integer"}},"required":["created_at","last_mod"],"type":"object"},"usr_mtd":{"additionalProperties":false,"properties":{"comment":{"type":"string"},"enabled":{"type":"boolean"},"expiry":{"oneOf":[{"type":"integer"},{"type":"null"}]},"tags":{"oneOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}]},"ui_actions":{"oneOf":[{"items":{"additionalProperties":false,"properties":{"label":{"type":"string"},"location":{"type":"string"}},"required":["label","location"],"type":"object"},"type":"array"},{"type":"null"}]}},"required":["comment","enabled"],"type":"object"}},"required":["data","sys_mtd","usr_mtd"],"type":"object"},"description":"Map of record names to HiveRecord objects","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List hive records.","summary":"List Hive Records"}},"/hive/{hive_name}/{oid}/{record_name}":{"delete":{"operationId":"deleteHiveRecord","tags":["Hive"],"parameters":[{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"record_name","required":true,"description":"record name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete the hive record.","summary":"Delete Hive Record"}},"/hive/{hive_name}/{oid}/{record_name}/data":{"get":{"operationId":"getHiveRecord","tags":["Hive"],"parameters":[{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"record_name","required":true,"description":"record name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"oneOf":[{"additionalProperties":true,"description":"Record data, structure depends on hive type","type":"object"},{"type":"null"}]},"detection":{"type":"string"},"isDraft":{"type":"boolean"},"name":{"type":"string"},"sys_mtd":{"additionalProperties":false,"properties":{"created_at":{"type":"integer"},"created_by":{"oneOf":[{"type":"string"},{"type":"null"}]},"etag":{"type":"string"},"guid":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_author":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_error":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_error_ts":{"oneOf":[{"type":"integer"},{"type":"null"}]},"last_mod":{"type":"integer"}},"required":["created_at","last_mod"],"type":"object"},"usr_mtd":{"additionalProperties":false,"properties":{"comment":{"type":"string"},"enabled":{"type":"boolean"},"expiry":{"oneOf":[{"type":"integer"},{"type":"null"}]},"tags":{"oneOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}]},"ui_actions":{"oneOf":[{"items":{"additionalProperties":false,"properties":{"label":{"type":"string"},"location":{"type":"string"}},"required":["label","location"],"type":"object"},"type":"array"},{"type":"null"}]}},"required":["comment","enabled"],"type":"object"}},"required":["data","sys_mtd","usr_mtd"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the hive record data.","summary":"Get Hive Record"},"post":{"operationId":"setHiveRecord","tags":["Hive"],"parameters":[{"name":"etag","description":"the etag to use to conditionally set the record","schema":{"type":"string"},"in":"query"},{"name":"arl","description":"the ARL to use to set the record","schema":{"type":"string"},"in":"query"},{"name":"data","description":"the data to set","schema":{"type":"string"},"in":"query"},{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"record_name","required":true,"description":"record name","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"request object","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"data":{"description":"JSON encoded string of the record data","title":"data","type":"string"},"usr_mtd":{"description":"JSON encoded string of the record metadata","title":"usr_mtd","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Set the hive record data.","summary":"Set Hive Record"}},"/hive/{hive_name}/{oid}/{record_name}/mtd":{"get":{"operationId":"getHiveRecordMetadata","tags":["Hive"],"parameters":[{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"record_name","required":true,"description":"record name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"oneOf":[{"additionalProperties":true,"description":"Record data, structure depends on hive type","type":"object"},{"type":"null"}]},"detection":{"type":"string"},"isDraft":{"type":"boolean"},"name":{"type":"string"},"sys_mtd":{"additionalProperties":false,"properties":{"created_at":{"type":"integer"},"created_by":{"oneOf":[{"type":"string"},{"type":"null"}]},"etag":{"type":"string"},"guid":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_author":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_error":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_error_ts":{"oneOf":[{"type":"integer"},{"type":"null"}]},"last_mod":{"type":"integer"}},"required":["created_at","last_mod"],"type":"object"},"usr_mtd":{"additionalProperties":false,"properties":{"comment":{"type":"string"},"enabled":{"type":"boolean"},"expiry":{"oneOf":[{"type":"integer"},{"type":"null"}]},"tags":{"oneOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}]},"ui_actions":{"oneOf":[{"items":{"additionalProperties":false,"properties":{"label":{"type":"string"},"location":{"type":"string"}},"required":["label","location"],"type":"object"},"type":"array"},{"type":"null"}]}},"required":["comment","enabled"],"type":"object"}},"required":["data","sys_mtd","usr_mtd"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the hive record metadata.","summary":"Get Hive Record Metadata"},"post":{"operationId":"setHiveRecordMetadata","tags":["Hive"],"parameters":[{"name":"usr_mtd","description":"the metadata to set","schema":{"type":"string"},"in":"query"},{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"record_name","required":true,"description":"record name","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"request object","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"usr_mtd":{"description":"JSON encoded string of the record metadata","title":"usr_mtd","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Set the hive record metadata.","summary":"Set Hive Record Metadata"}},"/hive/{hive_name}/{oid}/{record_name}/rename":{"post":{"operationId":"renameHiveRecord","tags":["Hive"],"parameters":[{"name":"new_name","description":"new name of record","schema":{"type":"string"},"in":"query"},{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"record_name","required":true,"description":"record name","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"request object","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"new_name":{"description":"new name of record","title":"new_name","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Rename a hive record","summary":"Rename Hive Record"}},"/hive/{hive_name}/{oid}/{record_name}/validate":{"post":{"operationId":"validateHiveRecord","tags":["Hive"],"parameters":[{"name":"etag","description":"the etag to use to conditionally validate the record","schema":{"type":"string"},"in":"query"},{"name":"arl","description":"the ARL to use to validate the record","schema":{"type":"string"},"in":"query"},{"name":"data","description":"the data to validate","schema":{"type":"string"},"in":"query"},{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"record_name","required":true,"description":"record name","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"request object","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"data":{"description":"JSON encoded string of the record data","title":"data","type":"string"},"usr_mtd":{"description":"JSON encoded string of the record metadata","title":"usr_mtd","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Validate hive record data without storing it.","summary":"Validate Hive Record"}},"/hostnames/{oid}":{"get":{"operationId":"findSensorByHostname","tags":["Sensors"],"parameters":[{"name":"hostname","description":"hostname prefix to search for","schema":{"type":"string"},"in":"query"},{"name":"as_dict","description":"a boolean string (like 'true') indicating to return the records in a dictionary instead of the legacy list format","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"List of sensors matching the hostname","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"sid":{"oneOf":[{"items":{"items":false,"prefixItems":[{"format":"uuid","type":"string"},{"type":"string"}],"type":"array"},"type":"array"},{"items":{"additionalProperties":false,"properties":{"hostname":{"type":"string"},"sid":{"format":"uuid","type":"string"}},"type":"object"},"type":"array"}]}},"required":["sid"],"type":"object"},"examples":{"dict":{"value":{"sid":[{"hostname":"hostname1","sid":"a1b2c3d4-1234-5678-9abc-1234567890ab"},{"hostname":"hostname2","sid":"b2c3d4e5-2345-6789-abcd-234567890abc"}]}},"tuple":{"value":{"sid":[["a1b2c3d4-1234-5678-9abc-1234567890ab","hostname1"],["b2c3d4e5-2345-6789-abcd-234567890abc","hostname2"]]}}}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get sensors with hostnames matching given expression.","summary":"Get Sensors by Hostname"}},"/insight/event_count/{oid}/{sid}":{"get":{"operationId":"getEventRetainedCount","tags":["Retention"],"parameters":[{"name":"start","description":"required timestamp in seconds where to begin","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required timestamp in seconds where to stop","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"is_detailed","description":"set to 'true' to get a per-hour breakdown of the event count","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"total":{"oneOf":[{"description":"Total number of events retained (when is_detailed is not set)","type":"integer"},{"additionalProperties":false,"description":"Go sql.NullInt64 struct with Int64 and Valid fields","properties":{"Int64":{"description":"The integer value","type":"integer"},"Valid":{"description":"Whether the value is valid","type":"boolean"}},"required":["Int64","Valid"],"type":"object"},{"additionalProperties":{"type":"integer"},"description":"Per-hour breakdown of event counts (when is_detailed is 'true')","type":"object"}]}},"required":["total"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve historical data from the sensor using Insight.","summary":"Get Historical Events"}},"/insight/{oid}":{"get":{"operationId":"getInsightStatus","tags":["Retention"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"insight_bucket":{"type":"string"},"insight_dataset":{"type":"string"}},"required":["insight_bucket","insight_dataset"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Check if the organization is configured with Insight.","summary":"Get Retention Status"}},"/insight/{oid}/artifacts":{"get":{"operationId":"getArtifactList","tags":["Retention","Artifacts"],"parameters":[{"name":"start","description":"required timestamp in seconds where to begin","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required timestamp in seconds where to stop","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"cursor","description":"optional cursor for paginated access, set to '-' for first query","schema":{"type":"string"},"in":"query"},{"name":"hint","description":"optional hint for the type of artifact to query for","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"logs":{"items":{"additionalProperties":false,"properties":{"error":{"type":"string"},"expires":{"type":"integer"},"is_indexed":{"type":"boolean"},"path":{"type":"string"},"payload_id":{"type":"string"},"size":{"type":"integer"},"source":{"format":"uuid","type":"string"},"ts":{"type":"integer"},"type":{"type":"string"}},"type":"object"},"type":"array"},"next_cursor":{"oneOf":[{"type":"string"},{"type":"null"}]}},"required":["logs","next_cursor"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the list of artifacts available during a time frame.","summary":"Get Artifact List"}},"/insight/{oid}/artifacts/originals/{artifact_id}":{"get":{"operationId":"getOriginalArtifact","tags":["Retention","Artifacts"],"parameters":[{"name":"is_compressed","description":"set to 'true' to enable compression, data returned 'events' is base64(gzip(data))","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"dest_bucket","description":"destination bucket for the artifact","schema":{"type":"string"},"in":"query"},{"name":"svc_creds","description":"service credentials for the destination bucket","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"artifact_id","required":true,"description":"artifact id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"expires":{"type":"integer"},"export":{"type":"string"},"export_id":{"type":"string"},"id":{"type":"string"},"oid":{"format":"uuid","type":"string"},"path":{"type":"string"},"payload":{"type":"string"},"records":{"additionalProperties":{"type":"string"},"type":"object"},"region":{"type":"string"},"size":{"type":"integer"},"source":{"format":"uuid","type":"string"},"ts":{"type":"integer"},"type":{"type":"string"},"was_billed":{"type":"boolean"}},"required":["expires","export","export_id","id","oid","path","region","size","source","ts","type","was_billed"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve the original version of a specific artifact.","summary":"Get Original Artifact"}},"/insight/{oid}/artifacts/payloads/{payload_id}":{"get":{"operationId":"getReadableArtifact","tags":["Retention","Artifacts"],"parameters":[{"name":"records","description":"the record IDs to retrieve specifically, repeated field","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"is_compressed","description":"set to 'true' to enable compression, data returned 'logs' is base64(gzip(data))","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"payload_id","required":true,"description":"payload/log id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"logs":{"oneOf":[{"description":"Parsed log data. When is_compressed is 'true', this is base64(gzip(data))","type":"string"},{"additionalProperties":{"additionalProperties":false,"properties":{"export":{"type":"string"},"export_id":{"type":"string"},"id":{"type":"string"},"oid":{"format":"uuid","type":"string"},"path":{"type":"string"},"records":{"additionalProperties":{"type":"string"},"type":"object"},"requested_by":{"type":"string"},"size":{"type":"integer"},"source":{"format":"uuid","type":"string"},"ts":{"type":"integer"},"type":{"type":"string"}},"required":["id","oid","path","size","source","ts","type"],"type":"object"},"description":"Parsed log data as an object with record IDs as keys","type":"object"}]}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve the parsed/readable version of a specific artifact.","summary":"Get Readable Artifact"}},"/insight/{oid}/audit":{"get":{"operationId":"getAuditEvents","tags":["Retention"],"parameters":[{"name":"start","description":"required timestamp in seconds where to begin","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required timestamp in seconds where to stop","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"limit","description":"maximum number of audit events to return","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"event_type","description":"specific audit event type to fetch","schema":{"type":"string"},"in":"query"},{"name":"is_compressed","description":"set to 'true' to enable compression, data returned 'events' is base64(gzip(data))","schema":{"type":"string"},"in":"query"},{"name":"cursor","description":"optional cursor for paginated access, set to '-' for first query","schema":{"type":"string"},"in":"query"},{"name":"is_forward","description":"direction of paginated query results, defaults to 'true' (ascending).","schema":{"type":"string"},"in":"query"},{"name":"output_name","description":"send data to a named output instead","schema":{"type":"string"},"in":"query"},{"name":"sid","description":"only return events relating to a specific sensor id","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"events":{"oneOf":[{"description":"Compressed events data (base64(gzip(data))) when is_compressed is 'true'","type":"string"},{"description":"Uncompressed events array when is_compressed is not set or 'false'","items":{"additionalProperties":false,"properties":{"entity":{"additionalProperties":false,"properties":{"hive_name":{"type":"string"},"hive_partititon":{"type":"string"},"hive_record_name":{"type":"string"},"output_name":{"type":"string"},"sid":{"type":"string"},"stream":{"type":"string"}},"type":"object"},"etype":{"type":"string"},"ident":{"type":"string"},"msg":{"type":"string"},"mtd":{"additionalProperties":false,"properties":{"module":{"type":"string"},"n_billed":{"type":"integer"},"n_free":{"type":"integer"},"stream":{"type":"string"},"task":{"type":"string"}},"type":"object"},"oid":{"format":"uuid","type":"string"},"origin":{"type":"string"},"time":{"type":"integer"},"ts":{"type":"string"}},"required":["etype","msg","oid","origin","time","ts"],"type":"object"},"type":"array"}]},"next_cursor":{"type":"string"}},"required":["events"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve retained LimaCharlie audit logs using Insight.","summary":"Get Audit Events"}},"/insight/{oid}/detections":{"get":{"operationId":"getDetections","tags":["Retention"],"parameters":[{"name":"start","description":"required timestamp in seconds where to begin","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required timestamp in seconds where to stop","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"limit","description":"maximum number of detections to return","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"cat","description":"specific detection category to fetch","schema":{"type":"string"},"in":"query"},{"name":"is_compressed","description":"set to 'true' to enable compression, data returned 'detects' is base64(gzip(data))","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"cursor","description":"optional cursor for paginated access, set to '-' for first query","schema":{"type":"string"},"in":"query"},{"name":"is_forward","description":"direction of paginated query results, defaults to 'true' (ascending).","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"sid","description":"only return detections relating to a specific sensor id","schema":{"type":"string"},"in":"query"},{"name":"output_name","description":"send data to a named output instead","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"detects":{"oneOf":[{"description":"Compressed detections data (base64(gzip(data))) when is_compressed is 'true'","type":"string"},{"description":"Uncompressed detections array when is_compressed is not set or 'false'","items":{"additionalProperties":false,"properties":{"author":{"type":"string"},"cat":{"type":"string"},"detect":{"additionalProperties":false,"description":"SensorEvent object containing the detection event","properties":{"Event":{"additionalProperties":true,"description":"Alternative event data format","type":"object"},"event":{"additionalProperties":true,"description":"Event data, structure varies by event type","type":"object"},"routing":{"additionalProperties":false,"description":"Routing information for the event","properties":{"arch":{"oneOf":[{"type":"string"},{"type":"number"}]},"did":{"type":"string"},"event_id":{"type":"string"},"event_time":{"type":"integer"},"event_type":{"type":"string"},"ext_ip":{"type":"string"},"hostname":{"type":"string"},"iid":{"type":"string"},"int_ip":{"type":"string"},"investigation_id":{"type":"string"},"latency":{"type":"integer"},"link":{"type":"string"},"log_id":{"type":"string"},"log_type":{"type":"string"},"moduleid":{"type":"integer"},"oid":{"format":"uuid","type":"string"},"parent":{"type":"string"},"plat":{"oneOf":[{"type":"string"},{"type":"number"}]},"sid":{"format":"uuid","type":"string"},"tags":{"items":{"type":"string"},"type":"array"},"target":{"type":"string"},"this":{"type":"string"}},"required":["event_time","event_type","oid"],"type":"object"}},"required":["routing"],"type":"object"},"detect_id":{"type":"string"},"detect_mtd":{"additionalProperties":true,"type":"object"},"gen_time":{"type":"integer"},"link":{"type":"string"},"namespace":{"type":"string"},"routing":{"additionalProperties":false,"description":"Routing information (duplicate of detect.routing)","properties":{"arch":{"oneOf":[{"type":"string"},{"type":"number"}]},"did":{"type":"string"},"event_id":{"type":"string"},"event_time":{"type":"integer"},"event_type":{"type":"string"},"ext_ip":{"type":"string"},"hostname":{"type":"string"},"iid":{"type":"string"},"int_ip":{"type":"string"},"investigation_id":{"type":"string"},"latency":{"type":"integer"},"link":{"type":"string"},"log_id":{"type":"string"},"log_type":{"type":"string"},"moduleid":{"type":"integer"},"oid":{"format":"uuid","type":"string"},"parent":{"type":"string"},"plat":{"oneOf":[{"type":"string"},{"type":"number"}]},"sid":{"format":"uuid","type":"string"},"tags":{"items":{"type":"string"},"type":"array"},"target":{"type":"string"},"this":{"type":"string"}},"required":["event_time","event_type","oid"],"type":"object"},"rule_tags":{"items":{"type":"string"},"type":"array"},"source":{"type":"string"},"source_rule":{"type":"string"},"ts":{"type":"integer"}},"required":["author","cat","detect","detect_id","namespace","source","source_rule","ts"],"type":"object"},"type":"array"}]},"from_cache":{"type":"boolean"},"next_cursor":{"type":"string"},"prev_cursor":{"type":"string"}},"required":["detects"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve historical detections using Insight.","summary":"Get Detections"}},"/insight/{oid}/detections/breakdown":{"get":{"operationId":"getDetectionBreakdown","tags":["Retention"],"parameters":[{"name":"start","description":"required timestamp in seconds where to begin","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required timestamp in seconds where to stop","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"breakdown":{"additionalProperties":{"type":"integer"},"description":"Map of detection categories to counts","type":"object"}},"required":["breakdown"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve detection type information using Insight.","summary":"Get Detections Breakdown"}},"/insight/{oid}/detections/stats":{"get":{"operationId":"getDetectionStats","tags":["Retention"],"parameters":[{"name":"start","description":"required timestamp in seconds where to begin","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required timestamp in seconds where to stop","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"per","description":"optional time period to group by, one of: hour, day, week, month","schema":{"type":"string"},"in":"query"},{"name":"sid","description":"optional sensor ID to filter by","schema":{"format":"uuid","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"totals":{"anyOf":[{"additionalProperties":{"type":"integer"},"description":"Flat stats: map of timestamps to detection counts","type":"object"},{"additionalProperties":{"additionalProperties":{"type":"integer"},"type":"object"},"description":"Categorized stats: map of category names to timestamp-based stats","type":"object"}]}},"required":["totals"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve detection stats information using Insight.","summary":"Get Detection Stats"}},"/insight/{oid}/detections/{atom}":{"get":{"operationId":"getDetectByDetectID","tags":["Retention"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"atom","required":true,"description":"event atom id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"event":{"additionalProperties":false,"description":"Detection event object","properties":{"author":{"type":"string"},"cat":{"type":"string"},"detect":{"additionalProperties":false,"description":"SensorEvent object containing the detection event","properties":{"Event":{"additionalProperties":true,"description":"Alternative event data format","type":"object"},"event":{"additionalProperties":true,"description":"Event data, structure varies by event type","type":"object"},"routing":{"additionalProperties":false,"description":"Routing information for the event","properties":{"arch":{"oneOf":[{"type":"string"},{"type":"number"}]},"did":{"type":"string"},"event_id":{"type":"string"},"event_time":{"type":"integer"},"event_type":{"type":"string"},"ext_ip":{"type":"string"},"hostname":{"type":"string"},"iid":{"type":"string"},"int_ip":{"type":"string"},"investigation_id":{"type":"string"},"latency":{"type":"integer"},"link":{"type":"string"},"log_id":{"type":"string"},"log_type":{"type":"string"},"moduleid":{"type":"integer"},"oid":{"format":"uuid","type":"string"},"parent":{"type":"string"},"plat":{"oneOf":[{"type":"string"},{"type":"number"}]},"sid":{"format":"uuid","type":"string"},"tags":{"items":{"type":"string"},"type":"array"},"target":{"type":"string"},"this":{"type":"string"}},"required":["event_time","event_type","oid","sid","this"],"type":"object"}},"required":["routing"],"type":"object"},"detect_id":{"type":"string"},"gen_time":{"type":"integer"},"namespace":{"type":"string"},"routing":{"additionalProperties":false,"description":"Routing information (duplicate of detect.routing)","properties":{"arch":{"oneOf":[{"type":"string"},{"type":"number"}]},"did":{"type":"string"},"event_id":{"type":"string"},"event_time":{"type":"integer"},"event_type":{"type":"string"},"ext_ip":{"type":"string"},"hostname":{"type":"string"},"iid":{"type":"string"},"int_ip":{"type":"string"},"investigation_id":{"type":"string"},"latency":{"type":"integer"},"link":{"type":"string"},"log_id":{"type":"string"},"log_type":{"type":"string"},"moduleid":{"type":"integer"},"oid":{"format":"uuid","type":"string"},"parent":{"type":"string"},"plat":{"oneOf":[{"type":"string"},{"type":"number"}]},"sid":{"format":"uuid","type":"string"},"tags":{"items":{"type":"string"},"type":"array"},"target":{"type":"string"},"this":{"type":"string"}},"required":["event_time","event_type","oid"],"type":"object"},"source":{"type":"string"},"source_rule":{"type":"string"},"ts":{"type":"integer"}},"required":["author","cat","detect","detect_id","namespace","source","source_rule","ts"],"type":"object"}},"required":["event"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve a specific detection by detect_id from Insight.","summary":"Get Detect by DetectID"}},"/insight/{oid}/ingestion_keys":{"delete":{"operationId":"removeIngestionKey","tags":["Retention"],"parameters":[{"name":"name","description":"name of the ingestion key to remove","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"request for the removal of ingestion key","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"name":{"description":"name of the ingestion key to remove","title":"name","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove an ingestion key.","summary":"Remove Ingestion Key"},"get":{"operationId":"getIngestionKeys","tags":["Retention"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"keys":{"additionalProperties":{"type":"string"},"type":"object"}},"required":["keys"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the ingestion keys.","summary":"Get Ingestion Keys"},"post":{"operationId":"addIngestionKey","tags":["Retention"],"parameters":[{"name":"name","description":"name of the ingestion key to create","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"request for the new ingestion key","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"name":{"description":"name of the ingestion key to create","title":"name","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create a new ingestion key.","summary":"Add Ingestion Key"}},"/insight/{oid}/metrics":{"post":{"operationId":"getEntityMetrics","tags":["Retention"],"parameters":[{"name":"start","description":"optional timestamp in seconds where to begin","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"optional timestamp in seconds where to stop","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"entity_type","description":"the type of entity to query for","schema":{"type":"string"},"in":"query"},{"name":"entity_id","description":"the unique ID of the entity to query","schema":{"type":"string"},"in":"query"},{"name":"metric_name","description":"the name of the metric to query","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve a history of metrics for entities.","summary":"Get Entity Metrics"}},"/insight/{oid}/object_usage/{objType}":{"get":{"operationId":"getObjectSummary","tags":["Retention"],"parameters":[{"name":"name","required":true,"description":"name of the object to look for","schema":{"type":"string"},"in":"query"},{"name":"case_sensitive","description":"set to 'false' to disable case sensitivity","schema":{"type":"string"},"in":"query"},{"name":"is_compressed","description":"set to 'true' to enable compression, data returned 'events' is base64(gzip(data))","schema":{"type":"string"},"in":"query"},{"name":"start","description":"required timestamp in seconds where to begin","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required timestamp in seconds where to stop","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"objType","required":true,"description":"type of object, one of: user, domain, ip, file_hash, file_path, file_name, service_name, package_name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve summarized usage for a specific object / indicator using Insight.","summary":"Get Object Summary"}},"/insight/{oid}/objects":{"post":{"operationId":"getSpecificObjects","tags":["Retention"],"parameters":[{"name":"objects","description":"a JSON dictionary like: {objType: [objName1, objName2, ...]}","schema":{"type":"string"},"in":"query"},{"name":"case_sensitive","description":"set to 'false' to disable case sensitivity","schema":{"type":"string"},"in":"query"},{"name":"info","description":"the type of information to receive, one of: summary, locations (default: summary)","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"per-indicator location cap when info=locations (default 100, max 1000)","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"with_wildcards","description":"set to 'true' to treat each object name as a BigQuery LIKE pattern (e.g. '10.10.%'). Only valid when info=locations.","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve historical information about specific objects / indicators using Insight.","summary":"Get Specific Objects"}},"/insight/{oid}/objects-details":{"get":{"operationId":"getSpecificObjectsFmtOutput","tags":["Retention"],"parameters":[{"name":"types","required":true,"description":"type of object, one of: user, domain, ip, file_hash, file_path, file_name, service_name, package_name","schema":{"type":"string"},"in":"query"},{"name":"name","required":true,"description":"name of the object to look for","schema":{"type":"string"},"in":"query"},{"name":"time_range","description":"a comma seperated list of ranges to search through, list must have 4 elements EX: 1,7,30,90","schema":{"type":"string"},"in":"query"},{"name":"info","required":true,"description":"the type of information to receive, one of: summary, locations","schema":{"type":"string"},"in":"query"},{"name":"with_wildcards","description":"set to 'true' to be able to use '%' wildcards in the object name","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"case_sensitive","description":"set to 'false' to disable case sensitivity","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"per_object","description":"set to 'true' to get results per object","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve historical information about specific objects / indicators using Insight.","summary":"Get Objects summarized by list of types"}},"/insight/{oid}/objects/{objType}":{"get":{"operationId":"getObjectInformation","tags":["Retention"],"parameters":[{"name":"name","required":true,"description":"name of the object to look for","schema":{"type":"string"},"in":"query"},{"name":"info","required":true,"description":"the type of information to receive, one of: summary, locations","schema":{"type":"string"},"in":"query"},{"name":"case_sensitive","description":"set to 'false' to disable case sensitivity","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"with_wildcards","description":"set to 'true' to be able to use '%' wildcards in the object name","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"per_object","description":"set to 'true' to return one entry per object","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"limit","description":"maximum number of results to return","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"objType","required":true,"description":"type of object, one of: user, domain, ip, file_hash, file_path, file_name, service_name, package_name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve historical information about specific objects / indicators using Insight.","summary":"Get Object Information"}},"/insight/{oid}/online/stats":{"get":{"operationId":"getOnlineStats","tags":["Retention"],"parameters":[{"name":"start","description":"required timestamp in seconds where to begin","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required timestamp in seconds where to stop","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"totals":{"oneOf":[{"additionalProperties":{"type":"integer"},"description":"Flat stats: map of timestamps to online sensor counts","type":"object"},{"additionalProperties":{"additionalProperties":{"type":"integer"},"type":"object"},"description":"Categorized stats: map of category names to timestamp-based stats","type":"object"}]}},"required":["totals"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve stats on sensors online using Insight.","summary":"Get Online Stats"}},"/insight/{oid}/traffic/breakdown":{"get":{"operationId":"getTrafficBreakdown","tags":["Retention"],"parameters":[{"name":"start","description":"required timestamp in seconds where to begin","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required timestamp in seconds where to stop","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"breakdown":{"additionalProperties":{"type":"integer"},"description":"Map of traffic categories to counts","type":"object"}},"required":["breakdown"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve traffic type information using Insight.","summary":"Get Traffic Breakdown"}},"/insight/{oid}/traffic/stats":{"get":{"operationId":"getTrafficStats","tags":["Retention"],"parameters":[{"name":"start","description":"required timestamp in seconds where to begin","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required timestamp in seconds where to stop","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"sid","description":"only return events relating to a specific sensor id","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"totals":{"oneOf":[{"additionalProperties":{"type":"integer"},"description":"Flat stats: map of timestamps to traffic counts","type":"object"},{"additionalProperties":{"additionalProperties":{"type":"integer"},"type":"object"},"description":"Categorized stats: map of category names to timestamp-based stats","type":"object"}]}},"required":["totals"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve traffic stats information using Insight.","summary":"Get Traffic Stats"}},"/insight/{oid}/{sid}":{"get":{"operationId":"getHistoricEvents","tags":["Retention"],"parameters":[{"name":"start","description":"required timestamp in seconds where to begin","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required timestamp in seconds where to stop","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"limit","description":"maximum number of events to return","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"event_type","description":"specific event type to fetch","schema":{"type":"string"},"in":"query"},{"name":"is_compressed","description":"set to 'true' to enable compression, data returned 'events' is base64(gzip(data))","schema":{"type":"string"},"in":"query"},{"name":"cursor","description":"optional cursor for paginated access, set to '-' for first query","schema":{"type":"string"},"in":"query"},{"name":"is_forward","description":"direction of paginated query results, defaults to 'true' (ascending).","schema":{"type":"string"},"in":"query"},{"name":"output_name","description":"send data to a named output instead","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"events":{"oneOf":[{"items":{"additionalProperties":true,"description":"Event data, structure varies by event type","type":"object"},"type":"array"},{"description":"Compressed events data (base64(gzip(data))) when is_compressed is 'true'","type":"string"}]},"from_cache":{"type":"boolean"},"next_cursor":{"description":"cursor for the next page","title":"cursor","type":"string"}},"required":["events","next_cursor"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve historical data from the sensor using Insight.","summary":"Get Historical Events"}},"/insight/{oid}/{sid}/overview":{"get":{"operationId":"getHistoricEventOverview","tags":["Retention"],"parameters":[{"name":"start","description":"required timestamp in seconds where to begin","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required timestamp in seconds where to stop","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"from_cache":{"type":"boolean"},"overview":{"items":{"type":"number"},"type":"array"}},"required":["overview"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve overview data of the historical data from the sensor using Insight.","summary":"Get Historical Overview"}},"/insight/{oid}/{sid}/{atom}":{"get":{"operationId":"getEventByAtom","tags":["Retention"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"atom","required":true,"description":"event atom id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"event":{"additionalProperties":true,"description":"Event data, structure varies by event type","type":"object"},"from_cache":{"type":"boolean"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve a specific event by atom from Insight.","summary":"Get Event by Atom"}},"/insight/{oid}/{sid}/{atom}/children":{"get":{"operationId":"getChildrenOfAtom","tags":["Retention"],"parameters":[{"name":"is_compressed","description":"set to 'true' to enable compression, data returned 'events' is base64(gzip(data))","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"atom","required":true,"description":"event atom id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"events":{"oneOf":[{"description":"Compressed events data (base64(gzip(data))) when is_compressed is 'true'","type":"string"},{"description":"Uncompressed events array when is_compressed is not set or 'false'","items":{"type":"object"},"type":"array"}]},"from_cache":{"type":"boolean"},"stopped_all_terminated":{"type":"boolean"},"stopped_deadline":{"type":"boolean"},"stopped_rebooted":{"type":"boolean"},"too_many_events":{"type":"boolean"}},"required":["events"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve all children of atom from Insight.","summary":"Get Children Of Atom"}},"/installationkeys/{oid}":{"delete":{"operationId":"removeInstallationKey","tags":["Installation Keys"],"parameters":[{"name":"iid","description":"installer id to delete","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete an installation key for the organization.","summary":"Remove Installation Key"},"get":{"operationId":"getInstallationKeys","tags":["Installation Keys"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":{"additionalProperties":{"additionalProperties":false,"properties":{"created":{"type":"string"},"desc":{"type":"string"},"iid":{"type":"string"},"json_key":{"type":"string"},"key":{"type":"string"},"oid":{"type":"string"},"quota_remaining":{"type":"integer"},"quota_total":{"type":"integer"},"tags":{"type":"string"},"use_public_root_ca":{"type":"boolean"}},"required":["oid","iid","key","json_key","created","desc","tags","use_public_root_ca"],"type":"object"},"type":"object"},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the installation keys for the organization.","summary":"Get Installation Keys"},"post":{"operationId":"addInstallationKey","tags":["Installation Keys"],"parameters":[{"name":"tags","description":"tags to associate with sensors","schema":{"type":"string"},"in":"query"},{"name":"desc","description":"description of key","schema":{"type":"string"},"in":"query"},{"name":"use_public_root_ca","description":"whether to use the public root CA","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"quota","description":"quota for the installation key","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"iid","description":"installation id key, required for update.","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create a new installation key for the organization.","summary":"Add Installation Key"}},"/installationkeys/{oid}/{iid}":{"get":{"operationId":"getInstallationKey","tags":["Installation Keys"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"iid","required":true,"description":"installation key id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get a specific installation key from the organization.","summary":"Get Installation Key"}},"/invite/user":{"post":{"operationId":"inviteUserToLC","tags":["Groups"],"parameters":[],"requestBody":{"description":"invite user request","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"user_email":{"allOf":[{"type":"string"},{"format":"email","type":"string"},{"pattern":"^[^@]+@[^@]+$","type":"string"}]}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Invite user to limacharlie.io.","summary":"Invite user to limacharlie.io"}},"/job/{oid}":{"get":{"operationId":"getJobs","tags":["Jobs"],"parameters":[{"name":"start","description":"required timestamp in seconds where to begin fetching jobs","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required timestamp in seconds where to stop fetching jobs","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"limit","description":"maximum number of jobs to return","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"sid","description":"optionally only fetch jobs relating to a Sensor ID","schema":{"type":"string"},"in":"query"},{"name":"is_compressed","description":"set to 'true' to enable compression, data returned is base64(gzip(data))","schema":{"type":"string"},"in":"query"},{"name":"with_data","description":"optionally include full job data, 'true' or 'false'","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"jobs":{"additionalProperties":false,"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve jobs for an organization.","summary":"Get Jobs"}},"/job/{oid}/{job_id}":{"delete":{"operationId":"removeJob","tags":["Jobs"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"job_id","required":true,"description":"job id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete a specific job.","summary":"Remove Job"},"get":{"operationId":"getJobInfo","tags":["Jobs"],"parameters":[{"name":"is_compressed","description":"set to 'true' to enable compression, data returned is base64(gzip(data))","schema":{"type":"string"},"in":"query"},{"name":"with_data","description":"optionally include full job data, 'true' or 'false'","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"job_id","required":true,"description":"job id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Fetch a specific job.","summary":"Get Job"}},"/mitre/{oid}":{"get":{"operationId":"getOrgMITREReport","tags":["Rules"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"description":{"type":"string"},"domain":{"type":"string"},"name":{"type":"string"},"sorting":{"type":"integer"},"techniques":{"items":{"additionalProperties":false,"properties":{"color":{"type":"string"},"enabled":{"type":"boolean"},"techniqueID":{"type":"string"}},"required":["color","enabled","techniqueID"],"type":"object"},"type":"array"},"versions":{"additionalProperties":false,"properties":{"layer":{"type":"string"},"navigator":{"type":"string"}},"required":["layer","navigator"],"type":"object"}},"required":["description","domain","name","sorting","techniques","versions"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Generate a JSON MITRE report for a specific organization with its current detection rules.","summary":"Get MITRE report"}},"/models/{oid}/batch":{"post":{"operationId":"batchModelRequests","tags":["Model Request"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"Batch model request data","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"is_stop_on_failure":{"type":"boolean"},"requests":{"items":{"additionalProperties":false,"properties":{"delete_record":{"additionalProperties":false,"properties":{"model_name":{"type":"string"},"oid":{"type":"string"},"primary_key":{"type":"string"}},"type":"object"},"write_model_record":{"additionalProperties":false,"properties":{"expiry":{"type":"integer"},"fields":{"type":"object"},"model_name":{"type":"string"},"oid":{"type":"string"},"primary_key":{"type":"string"}},"type":"object"}},"type":"object"},"type":"array"}},"required":["requests"],"type":"object"}}},"required":true},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Execute multiple model operations in a single batch","summary":"Batch model requests"}},"/models/{oid}/model/{model_name}/aggregate_view":{"post":{"operationId":"queryAggregateView","tags":["Model Request"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"Aggregate view query request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"aggregate_by":{"type":"string"},"aggregate_value":{"type":"string"},"ascending":{"type":"boolean"},"cursor":{"type":"string"},"filters":{"type":"object"},"include_tags":{"type":"boolean"},"limit":{"type":"integer"},"search":{"additionalProperties":false,"properties":{"field":{"type":"string"},"op":{"type":"string"},"value":{"type":"string"}},"type":"object"},"sort_by":{"type":"string"}},"required":["aggregate_by"],"type":"object"}}},"required":true},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Query aggregated data from model records with aggregate views","summary":"Query aggregate view"}},"/models/{oid}/model/{model_name}/index_records":{"get":{"operationId":"listIndexRecords","tags":["Model Request"],"parameters":[{"name":"index_key_name","required":true,"description":"name of the index key","schema":{"type":"string"},"in":"query"},{"name":"index_key_value","required":true,"description":"value of the index key","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"maximum number of records to return","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"cursor","description":"pagination cursor","schema":{"type":"string"},"in":"query"},{"name":"no_limit","description":"return all records without limit","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"show_expiry","description":"include record expiry information","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List records from a model index","summary":"List index records"}},"/models/{oid}/model/{model_name}/index_records_by_key_prefix":{"get":{"operationId":"listIndexRecordsByKeyPrefix","tags":["Model Request"],"parameters":[{"name":"index_key_name","required":true,"description":"name of the index key","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"maximum number of records to return","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"cursor","description":"pagination cursor","schema":{"type":"string"},"in":"query"},{"name":"no_limit","description":"return all records without limit","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"show_expiry","description":"include record expiry information","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List records from a model index using key prefix matching","summary":"List index records by key prefix"}},"/models/{oid}/model/{model_name}/index_value_counts":{"get":{"operationId":"getIndexValueCounts","tags":["Model Request"],"parameters":[{"name":"index_name","required":true,"description":"name of the index to count values for","schema":{"type":"string"},"in":"query"},{"name":"sort_desc","description":"sort by count descending (default: false)","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get unique counts a specific index in a model","summary":"Get unique index counts"}},"/models/{oid}/model/{model_name}/record":{"delete":{"operationId":"deleteModelRecord","tags":["Model Request"],"parameters":[{"name":"primary_key","required":true,"description":"primary key of the record","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete a record in a model","summary":"Delete model record"},"get":{"operationId":"getModelRecord","tags":["Model Request"],"parameters":[{"name":"primary_key","required":true,"description":"primary key of the record","schema":{"type":"string"},"in":"query"},{"name":"metadata","description":"return metadata","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get a record from a model","summary":"Get model record"},"post":{"operationId":"createModelRecord","tags":["Model Request"],"parameters":[{"name":"primary_key","required":true,"description":"primary key of the record","schema":{"type":"string"},"in":"query"},{"name":"fields","required":true,"description":"fields of the record","schema":{"type":"string"},"in":"query"},{"name":"expiry","description":"expiration of the record","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create a record in a model","summary":"Create model record"}},"/models/{oid}/model/{model_name}/records":{"get":{"operationId":"getModelRecords","tags":["Model Request"],"parameters":[{"name":"starting_model_name","required":true,"description":"starting model name","schema":{"type":"string"},"in":"query"},{"name":"starting_key_name","required":true,"description":"starting key name","schema":{"type":"string"},"in":"query"},{"name":"starting_key_value","required":true,"description":"starting key value","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get multiple records from a model","summary":"Get model records"},"post":{"operationId":"listModelRecords","tags":["Model Request"],"parameters":[{"name":"model_name","required":true,"description":"model name","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"maximum number of records per cursor","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"cusror","description":"cursor of the last set of records fetched","schema":{"type":"string"},"in":"query"},{"name":"show_expiry","description":"include record expiry information","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List all records from a model","summary":"List model records"}},"/models/{oid}/model/{model_name}/search":{"get":{"operationId":"substringSearchModels","tags":["Model Request"],"parameters":[{"name":"index_key_name","required":true,"description":"which index key to search for substring","schema":{"type":"string"},"in":"query"},{"name":"substring","required":true,"description":"substring to search","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"model substring search","summary":"search substring for searchable indexes"}},"/models/{oid}/query":{"get":{"operationId":"queryModels","tags":["Model Request"],"parameters":[{"name":"starting_model_name","required":true,"description":"starting model name","schema":{"type":"string"},"in":"query"},{"name":"starting_key_name","required":true,"description":"starting key name","schema":{"type":"string"},"in":"query"},{"name":"starting_key_value","required":true,"description":"starting key value","schema":{"type":"string"},"in":"query"},{"name":"plan","required":true,"description":"list of query step json records","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"A extension","content":{"application/json":{"schema":{"additionalProperties":{"config_schema":{"additionalProperties":false,"properties":{"fields":{"additionalProperties":{"additionalProperties":false,"properties":{"data_type":{"type":"string"},"description":{"type":"string"},"display_index":{"type":"integer"},"is_list":{"type":"boolean"},"label":{"type":"string"},"object":{"type":"object"},"supported_actions":{"items":{"type":"string"},"type":"array"}},"type":"object"},"type":"object"},"requirements":{"items":{"type":"string"},"type":"array"}},"type":"object"},"request_schema":{"additionalProperties":{"is_impersonated":{"type":"boolean"},"is_user_facing":{"type":"boolean"},"long_description":{"type":"string"},"parameters":{"additionalProperties":{"data_type":{"type":"string"},"default_value":{"type":"object"},"display_index":{"type":"integer"},"enum_values":{"items":{"type":"object"},"type":"array"},"is_list":{"type":"boolean"}},"type":"object"},"short_description":{"type":"string"}},"type":"object"},"required_events":{"items":{"type":"string"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Traverse different models","summary":"Query/traverse different models"}},"/modules/{oid}":{"post":{"operationId":"upgradeOrg","tags":["Modules"],"parameters":[{"name":"is_fallback","description":"if set to true downgrade to the previous version of the sensor, 'true' or 'false'","schema":{"type":"string"},"in":"query"},{"name":"is_sleep","description":"if set to true moves sensors to dormant mode, 'true' or 'false'","schema":{"type":"string"},"in":"query"},{"name":"specific_version","description":"if set, will upgrade sensors to the specific version string specified","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Update the sensor version for the organization.","summary":"Update Sensors"}},"/online/{oid}":{"get":{"operationId":"getOnlineSensors","tags":["Sensors"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"count":{"type":"integer"},"online":{"type":"integer"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the number of sensors online belonging to the organization.","summary":"Get Online Count"},"post":{"operationId":"getOnlineSensorsInList","tags":["Sensors"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"List of sensor ids to check online status for.","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"sids":{"items":{"format":"uuid","type":"string"},"type":"array"}},"type":"object"},"examples":{"basic":{"summary":"List of sensor ids","description":"List of sensor ids to check online status for.","value":{"sids":["f47ac10b-58cc-4372-a567-0e02b2c3d479","f47ac10b-58cc-4372-a567-0e02b2c3d480"]}}}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the online status of multiple sensors.","summary":"Get Online Statuses"}},"/ontology":{"get":{"operationId":"getOntology","tags":["General"],"parameters":[],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"architectures":{"additionalProperties":{"type":"integer"},"type":"object"},"native_edr_events":{"items":{"type":"string"},"type":"array"},"permissions":{"items":{"type":"string"},"type":"array"},"platforms":{"additionalProperties":{"type":"integer"},"type":"object"}},"required":["platforms","architectures","native_edr_events","permissions"],"type":"object"}}}}},"description":"Get the ontology of various components of LimaCharlie.","summary":"Get Ontology"}},"/orgs/new":{"get":{"operationId":"requestCheckOrgName","tags":["Organizations"],"parameters":[{"name":"name","required":true,"description":"organization name","schema":{"type":"string"},"in":"query"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"is_available":{"type":"boolean"}},"required":["is_available"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Check the availability of an organization mame.","summary":"Check organization name availability."},"post":{"operationId":"requestCreateOrg","tags":["Organizations"],"parameters":[{"name":"name","description":"organization name","schema":{"type":"string"},"in":"query"},{"name":"loc","description":"location where org is created","schema":{"type":"string"},"in":"query"},{"name":"template","description":"an infrastructure as code template to use to populate the org","schema":{"type":"string"},"in":"query"},{"name":"description","description":"organization description","schema":{"type":"string"},"in":"query"}],"requestBody":{"description":"organization creation request","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"loc":{"type":"string"},"name":{"type":"string"},"template":{"type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"additionalProperties":false,"properties":{"code":{"type":"string"},"loc":{"type":"string"},"oid":{"type":"string"}},"required":["oid","code","loc"],"type":"object"},"success":{"type":"boolean"}},"required":["success","data"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Request the creation of a new organization.","summary":"Request organization creation."}},"/orgs/{oid}":{"get":{"operationId":"getOrgInfo","tags":["Organizations"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"code":{"type":"string"},"desc":{"type":"string"},"is_ready":{"type":"boolean"},"latest_versions":{"additionalProperties":false,"properties":{"experimental":{"type":"string"},"fallback":{"type":"string"},"latest":{"type":"string"}},"required":["experimental","fallback","latest"],"type":"object"},"n_installation_keys":{"type":"number"},"n_outputs":{"type":"number"},"n_rules":{"type":"number"},"name":{"type":"string"},"oid":{"type":"string"},"sensor_quota":{"type":"number"},"sensor_version":{"type":"string"},"site_name":{"type":"string"},"status":{"type":"string"}},"required":["latest_versions","n_installation_keys","n_outputs","n_rules","name","oid","sensor_quota","sensor_version","site_name","code","status","is_ready"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get information about the organization.","summary":"Get Org Info"}},"/orgs/{oid}/addons":{"get":{"operationId":"getOrgAddons","tags":["Resources"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"addons":{"additionalProperties":{"additionalProperties":{"additionalProperties":false,"properties":{"cost":{"oneOf":[{"type":"number"},{"type":"string"}]},"desc":{"type":"string"}},"type":"object"},"type":"object"},"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List all addons subscribed to by an organization with details including cost and description.","summary":"Get Org Addons"}},"/orgs/{oid}/billing/details":{"get":{"operationId":"getOrgBillingDetails","tags":["Billing"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get comprehensive billing details for an organization including Stripe customer, subscription status, and upcoming invoice.","summary":"Get Org Billing Details"}},"/orgs/{oid}/billing/invoice/{year}/{month}":{"get":{"operationId":"getOrgInvoiceForMonth","tags":["Billing"],"parameters":[{"name":"format","description":"output format: json, simple_json, simple_csv, or empty for URL only","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"year","required":true,"description":"invoice year (YYYY)","schema":{"type":"string"},"in":"path"},{"name":"month","required":true,"description":"invoice month (MM)","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the invoice URL or data for a specific month.","summary":"Get Org Invoice For Month"}},"/orgs/{oid}/billing/quota":{"post":{"operationId":"requestOrgBillingQuota","tags":["Billing"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"Quota change request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"quota":{"type":"integer"}},"required":["quota"],"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"is_success":{"type":"boolean"}},"required":["is_success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Request a quota (sensor count) change for an organization.","summary":"Request Org Billing Quota"}},"/orgs/{oid}/billing/sku":{"get":{"operationId":"getOrgSkuDefinitions","tags":["Billing"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"skus":{"items":{"type":"object"},"type":"array"}},"required":["skus"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get metered SKU definitions with metadata and current Stripe pricing for an organization.","summary":"Get Org SKU Definitions"}},"/orgs/{oid}/billing/status":{"get":{"operationId":"getOrgBillingStatus","tags":["Billing"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"is_past_due":{"type":"boolean"},"org_name":{"type":"string"}},"required":["is_past_due","org_name"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the billing status (past due or not) for an organization.","summary":"Get Org Billing Status"}},"/orgs/{oid}/delete":{"delete":{"operationId":"completeOrgDelete","tags":["Organizations"],"parameters":[{"name":"confirmation","required":true,"description":"confirmation token obtained during initialization","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Complete the deletion process for an organization.","summary":"Complete Org Delete"},"get":{"operationId":"initOrgDelete","tags":["Organizations"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"confirmation":{"description":"confirmation token","title":"confirmation","type":"string"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Initiate the deletion process for an organization.","summary":"Start Delete Org"}},"/orgs/{oid}/keys":{"delete":{"operationId":"removeOrgApiKey","tags":["Api Keys"],"parameters":[{"name":"key_hash","description":"hash of the key to remove","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove an API key from an organization.","summary":"Remove API Key"},"get":{"operationId":"getOrgApiKeys","tags":["Api Keys"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"api_keys":{"additionalProperties":{"additionalProperties":false,"properties":{"allowed_ip_range":{"type":"string"},"by":{"type":"string"},"last_used":{"type":"integer"},"name":{"type":"string"},"priv":{"items":{"type":"string"},"type":"array"}},"required":["name","last_used"],"type":"object"},"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List API keys in organization.","summary":"Get API Keys"},"post":{"operationId":"addOrgApiKey","tags":["Api Keys"],"parameters":[{"name":"key_name","description":"name of the key to add","schema":{"type":"string"},"in":"query"},{"name":"perms","description":"comma separated values of the permissions of the key to add","schema":{"type":"string"},"in":"query"},{"name":"allowed_ip_range","description":"optional CIDR of the allowed IP ranges of the key to add","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"api_key":{"type":"string"},"key_hash":{"type":"string"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Add a new user to the organization.","summary":"Add API Key"}},"/orgs/{oid}/name":{"post":{"operationId":"renameOrg","tags":["Organizations"],"parameters":[{"name":"name","description":"new name for the organization","schema":{"type":"string"},"in":"query"},{"name":"description","description":"new description for the organization","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"new_name":{"type":"string"},"oid":{"type":"string"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Rename an organization.","summary":"Org Rename"}},"/orgs/{oid}/org_create_status":{"get":{"operationId":"getOrgCreateStatus","tags":["Api Keys"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"org_create_steps":{"oneOf":[{"additionalProperties":false,"properties":{"step1_starting_org_creation":{"type":"integer"},"step2_max_org_check_passed":{"type":"integer"},"step3_org_record_created":{"type":"integer"},"step4_stripe_customer_created":{"type":"integer"},"step5_stripe_subscription_created":{"type":"integer"},"step6_org_creation_succeeded":{"type":"integer"}},"type":"object"},{"type":"null"}]}},"required":["org_create_steps"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get org creation status steps","summary":"Get org create status"}},"/orgs/{oid}/quota":{"post":{"operationId":"setOrgQuota","tags":["Billing"],"parameters":[{"name":"quota","description":"new sensor quota to request for organization","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Request a new sensor quota for an organization.","summary":"Set Org Quota"}},"/orgs/{oid}/resources":{"delete":{"operationId":"unregisterOrgFromResource","tags":["Resources"],"parameters":[{"name":"res_cat","description":"resource category of the resource to unsubscribe from, like 'lookup'","schema":{"type":"string"},"in":"query"},{"name":"res_name","description":"resource name of the resource to unsubscribe from","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Unsubscribe an organization from a resource.","summary":"Unsubscribe Org to Resource"},"get":{"operationId":"getOrgResources","tags":["Resources"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"resources":{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List all resources subscribed to by an organization.","summary":"Get Org Resources"},"post":{"operationId":"registerOrgToResource","tags":["Resources"],"parameters":[{"name":"res_cat","description":"resource category of the resource to subscribe to, like 'lookup'","schema":{"type":"string"},"in":"query"},{"name":"res_name","description":"resource name of the resource to subscribe to","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Subscribe the organization to a resource.","summary":"Subscribe Org to Resource"}},"/orgs/{oid}/schema":{"delete":{"operationId":"resetOrgSchemas","tags":["Schema"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Reset all schemas in organization.","summary":"Reset Org Schemas"},"get":{"operationId":"getOrgSchemas","tags":["Schema"],"parameters":[{"name":"platform","description":"Optional platform name to filter the event types by.","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"event_types":{"items":{"type":"string"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List all the available event schemas in organization.","summary":"Get Org Schemas"}},"/orgs/{oid}/schema/{schema_name+}":{"get":{"operationId":"getOrgSchema","tags":["Schema"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"schema_name","required":true,"description":"schema name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the detailed schema of a specific event.","summary":"Get Schema Details"}},"/orgs/{oid}/status":{"get":{"operationId":"getOrgStatus","tags":["Organizations"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"code":{"type":"string"},"is_ready":{"type":"boolean"},"name":{"type":"string"},"oid":{"type":"string"},"status":{"type":"string"}},"required":["oid","code","name","status","is_ready"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get organization initialization status for polling during creation.","summary":"Get Org Status"}},"/orgs/{oid}/subscription/extension/{extensionName}":{"delete":{"operationId":"deleteExtensionSubscription","tags":["Extensions"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"extensionName","required":true,"description":"extension name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete extension subscription","summary":"Delete extension subscription"},"patch":{"operationId":"reKeyExtensionSubscription","tags":["Extensions"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"extensionName","required":true,"description":"extension name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Re-key extension subscription","summary":"Re-key extension subscription"},"post":{"operationId":"createExtensionSubscription","tags":["Extensions"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"extensionName","required":true,"description":"extension name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create extension subscription","summary":"Create extension subscription"}},"/orgs/{oid}/subscriptions":{"get":{"operationId":"getOrgSubscriptions","tags":["Extensions","Extensions"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"An array of Extension Subscriptions","content":{"application/json":{"schema":{"additionalProperties":{"additionalProperties":false,"properties":{"extension_name":{"type":"string"},"is_labs":{"type":"boolean"},"is_public":{"type":"boolean"},"key_name":{"type":"string"},"label":{"type":"string"},"oid":{"type":"string"},"org_name":{"type":"string"}},"required":["extension_name","org_name","oid","key_name","is_public","is_labs","label"],"type":"object"},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get all org extension subscriptions","summary":"Get all org extension subscriptions"}},"/orgs/{oid}/ui_actions":{"get":{"operationId":"getUIActions","tags":["Hive"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"actions":{"items":{"additionalProperties":false,"properties":{"label":{"type":"string"},"location":{"type":"string"},"record_name":{"type":"string"},"source_hive":{"type":"string"}},"type":"object"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get all UI actions defined in the organization's hive records. This is a synchronous call that returns immediately.","summary":"Get UI Actions"}},"/orgs/{oid}/ui_actions/execute":{"post":{"operationId":"executeUIAction","tags":["Hive"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"request object. context_data is a JSON-serialized string passed as playbook parameters or appended to the AI agent prompt.","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"context_data":{"type":"string"},"record_name":{"type":"string"},"source_hive":{"type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Execute a UI action from a hive record. This is an asynchronous call that returns immediately. For playbook actions (source_hive=playbook), the playbook execution is dispatched in the background. For AI agent actions (source_hive=ai_agent), an AI session is created and the session metadata is returned; the actual AI execution continues in the background.","summary":"Execute UI Action"}},"/orgs/{oid}/url":{"get":{"operationId":"getOrgURLs","tags":["Organizations"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"certs":{"additionalProperties":{"type":"string"},"type":"object"},"site_name":{"type":"string"},"url":{"additionalProperties":false,"properties":{"artifacts":{"type":"string"},"cases":{"type":"string"},"edr":{"type":"string"},"hooks":{"type":"string"},"lc":{"type":"string"},"lc_wss":{"type":"string"},"live":{"type":"string"},"logs":{"type":"string"},"private_endpoints":{"additionalProperties":{"type":"boolean"},"type":"object"},"region_code":{"type":"string"},"replay":{"type":"string"},"search":{"type":"string"}},"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the various access URLs used by resources related to the organization.","summary":"Get Org URLs"}},"/orgs/{oid}/users":{"delete":{"operationId":"removeOrgUser","tags":["Users"],"parameters":[{"name":"email","description":"email of the user to remove","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove a user from an organization.","summary":"Remove Org User"},"get":{"operationId":"getOrgUsers","tags":["Users"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"users":{"items":{"type":"string"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List all users in organization.","summary":"Get Org Users"},"post":{"operationId":"addOrgUser","tags":["Users"],"parameters":[{"name":"email","description":"email of the user to add","schema":{"type":"string"},"in":"query"},{"name":"invite_missing","description":"if the user does not exist, send an invite","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"role","description":"role to assign to the user (Owner, Administrator, Operator, Viewer, Basic). If not provided, defaults to Basic.","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation - returns {success: boolean, role: string}","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Add a new user to the organization.","summary":"Add Org User"}},"/orgs/{oid}/users/permissions":{"delete":{"operationId":"removeUserPermission","tags":["Users"],"parameters":[{"name":"email","description":"email of the user to remove the permission from","schema":{"type":"string"},"in":"query"},{"name":"perm","description":"permission to remove","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove a user permission.","summary":"Remove User Permission"},"get":{"operationId":"getUsersAndPermissions","tags":["Users"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"direct_users":{"items":{"additionalProperties":false,"properties":{"MFA_enabled":{"type":"boolean"},"MFA_types":{"items":{"type":"string"},"type":"array"},"email":{"type":"string"},"perms":{"items":{"type":"string"},"type":"array"},"uid":{"type":"string"}},"required":["email","uid","perms"],"type":"object"},"type":"array"},"from_groups":{"additionalProperties":{"additionalProperties":false,"properties":{"MFA_enabled":{"type":"boolean"},"MFA_types":{"items":{"type":"string"},"type":"array"},"email":{"type":"string"},"groups":{"additionalProperties":{"type":"boolean"},"type":"object"},"hasDirectAccess":{"type":"boolean"},"is_admin":{"type":"boolean"}},"required":["email","groups"],"type":"object"},"type":"object"},"group_info":{"additionalProperties":{"additionalProperties":false,"properties":{"name":{"type":"string"},"owners":{"items":{"type":"string"},"type":"array"},"perms":{"items":{"type":"string"},"type":"array"}},"type":"object"},"type":"object"},"user_permissions":{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List all users and permissions in organization.","summary":"Get User Permissions"},"post":{"operationId":"addUserPermission","tags":["Users"],"parameters":[{"name":"email","description":"email of the user to add a permission to","schema":{"type":"string"},"in":"query"},{"name":"perm","description":"permission to give","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Add a new user to the organization.","summary":"Add User Permission"}},"/outputs/{oid}":{"delete":{"operationId":"removeOutput","tags":["Outputs"],"parameters":[{"name":"name","description":"output module name to disable","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"JSON encoded string of the request data","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"name":{"description":"output module name to disable","title":"name","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Disable a specific output module for an organization.","summary":"Remove Output"},"get":{"operationId":"getOutputs","tags":["Outputs"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":{"additionalProperties":true,"properties":{"by":{"description":"who created the output","title":"by","type":"string"},"for":{"description":"data type for output","title":"for","type":"string"},"is_built_in":{"description":"if the output is built in","title":"is built in","type":"boolean"},"module":{"description":"output module name to enable","title":"module","type":"string"},"name":{"description":"what to name this output","title":"name","type":"string"},"oid":{"description":"organization id","title":"oid","type":"string"}},"type":"object"},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the various outputs for an organization.","summary":"Get Outputs"},"post":{"operationId":"setOutput","tags":["Outputs"],"parameters":[{"name":"module","description":"output module name to enable","schema":{"type":"string"},"in":"query"},{"name":"type","description":"data type for output","schema":{"type":"string"},"in":"query"},{"name":"name","description":"what to name this output","schema":{"type":"string"},"in":"query"},{"name":"inv_id","description":"if specified, only events part of this investigation id will be sent to this output","schema":{"type":"string"},"in":"query"},{"name":"tag","description":"if specified, only events coming from sensors with the specific tag will be sent to this output","schema":{"type":"string"},"in":"query"},{"name":"cat","description":"if specified, only detections in this category will be sent to this output","schema":{"type":"string"},"in":"query"},{"name":"is_flat","description":"if the json should be flattened (true, false)","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"is_compression","description":"if data should be sent compressed (true, false)","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"dir","description":"directory for output","schema":{"type":"string"},"in":"query"},{"name":"max_bytes","description":"max size in bytes before rotation","schema":{"type":"string"},"in":"query"},{"name":"backup_count","description":"maximum number of output in rotation","schema":{"type":"string"},"in":"query"},{"name":"bucket","description":"name of the bucket for output","schema":{"type":"string"},"in":"query"},{"name":"key_id","description":"public key id for auth","schema":{"type":"string"},"in":"query"},{"name":"sec_per_file","description":"seconds per output files","schema":{"type":"string"},"in":"query"},{"name":"dest_host","description":"destination host for output","schema":{"type":"string"},"in":"query"},{"name":"username","description":"username for auth","schema":{"type":"string"},"in":"query"},{"name":"slack_channel","description":"slack channel to output to","schema":{"type":"string"},"in":"query"},{"name":"is_tls","description":"whether connection should be secured over tls (true, false)","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"is_no_header","description":"whether protocol header should be sent before the data (true, false)","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"is_delete_on_failure","description":"if enabled, the output will be deleted as soon as a connection error occurs (true, false)","schema":{"type":"string"},"in":"query"},{"name":"event_white_list","description":"whitelist of event types to allow","schema":{"type":"string"},"in":"query"},{"name":"event_black_list","description":"blacklist of event types to disallow","schema":{"type":"string"},"in":"query"},{"name":"cat_black_list","description":"blacklist of categories to disallow","schema":{"type":"string"},"in":"query"},{"name":"routing_topic","description":"topic to publish on from the routing of then event","schema":{"type":"string"},"in":"query"},{"name":"literal_topic","description":"literal topic to publish on","schema":{"type":"string"},"in":"query"},{"name":"is_no_routing","description":"if true, do not include event routing, acts as an event pass-through","schema":{"type":"string"},"in":"query"},{"name":"sample_rate","description":"sample events out as 1/sample_rate","schema":{"type":"string"},"in":"query"},{"name":"is_payload_as_string","description":"include the event as a JSON string instead of a JSON object","schema":{"type":"string"},"in":"query"},{"name":"is_prefix_data","description":"encapsulate the data inside a JSON object with a key equal to the event type","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"JSON encoded string of the request data","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"custom_transform":{"description":"custom transform expression","title":"custom transform","type":"string"},"module":{"description":"output module name to enable","title":"module","type":"string"},"name":{"description":"what to name this output","title":"name","type":"string"},"password":{"description":"password for auth","title":"password","type":"string"},"secret_key":{"description":"secret key for auth","title":"secret key","type":"string"},"slack_api_token":{"description":"slack api token","title":"slack api token","type":"string"},"structured_data":{"description":"structured data expression","title":"structured data","type":"string"},"type":{"description":"data type for output","title":"type","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":true,"properties":{"by":{"description":"who created the output","title":"by","type":"string"},"for":{"description":"data type for output","title":"for","type":"string"},"is_built_in":{"description":"if the output is built in","title":"is built in","type":"boolean"},"module":{"description":"output module name to enable","title":"module","type":"string"},"name":{"description":"what to name this output","title":"name","type":"string"},"oid":{"description":"organization id","title":"oid","type":"string"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Enable a specific output module for an organization.","summary":"Set Output"}},"/outputs/{oid}/samples":{"get":{"operationId":"getOutputSamples","tags":["Outputs"],"parameters":[{"name":"name","required":true,"description":"output module name to get samples from","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"items":{"additionalProperties":false,"properties":{"sample":{"items":{"oneOf":[{"type":"null"},{"type":"string"}]},"type":"array"}},"required":["sample"],"type":"object"},"type":"array"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get sample data from an Output.","summary":"Get Output Samples"}},"/payload/{oid}":{"get":{"operationId":"listPayloads","tags":["Payload"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"payloads":{"additionalProperties":{"additionalProperties":false,"properties":{"by":{"type":"string"},"created":{"type":"integer"},"name":{"type":"string"},"oid":{"type":"string"},"size":{"type":"integer"}},"required":["name","oid","by","created","size"],"type":"object"},"type":"object"},"replicants":{"items":{"type":"string"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the list of existing payloads.","summary":"List Payloads"}},"/payload/{oid}/{payloadName}":{"delete":{"operationId":"removePayload","tags":["Payload"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"payloadName","required":true,"description":"payload name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove an existing payload.","summary":"Remove Payload"},"get":{"operationId":"getPayload","tags":["Payload"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"payloadName","required":true,"description":"payload name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"get_url":{"type":"string"}},"required":["get_url"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the content of a payload.","summary":"Get Payload"},"post":{"operationId":"addPayload","tags":["Payload"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"payloadName","required":true,"description":"payload name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create a new payload.","summary":"Add Payload"}},"/plans":{"get":{"operationId":"getAvailablePlans","tags":["Users"],"parameters":[],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"plans":{"items":{"additionalProperties":false,"properties":{"id":{"type":"string"},"name":{"type":"string"},"region":{"type":"string"}},"required":["id","name","region"],"type":"object"},"type":"array"}},"required":["plans"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the list of plans available for the authenticated user based on their email domain.","summary":"Get Available Plans"}},"/runtime_mtd/{oid}":{"get":{"operationId":"getRuntimeMtd","tags":["General"],"parameters":[{"name":"entity_type","description":"optionally return only entities of a specific type","schema":{"type":"string"},"in":"query"},{"name":"entity_name","description":"optionally return only the entity with the given name","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"entities":{"description":"Array of entity metadata objects","items":{"additionalProperties":true,"type":"object"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the runtime metadata of various entities running in an org.","summary":"Get Runtime Metadata"}},"/sensors/{oid}":{"get":{"operationId":"getSensorList","tags":["Sensors"],"parameters":[{"name":"continuation_token","description":"optional token provided as a previous response to fetch the next page of data","schema":{"type":"string"},"in":"query"},{"name":"selector","description":"optional sensor selector to filter the list with","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"optional maximum number of sensors to return in a page of data","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"is_compressed","description":"optional boolean indicating if the response should be compressed","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"with_ip","description":"optional internal or external IP of sensors to list","schema":{"type":"string"},"in":"query"},{"name":"with_hostname_prefix","description":"optional hostname prefix of sensors to list","schema":{"type":"string"},"in":"query"},{"name":"with_tags","description":"optionally include sensor tags in response","schema":{"type":"string"},"in":"query"},{"name":"is_online_only","description":"optional boolean indicating if the response should include only the online sensors","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"List of sensors","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"continuation_token":{"type":"string"},"from_cache":{"type":"boolean"},"sensors":{"oneOf":[{"description":"base64 encoded gzip compressed list of sensors","title":"compressed list of sensors","type":"string"},{"items":{"additionalProperties":false,"properties":{"alive":{"description":"timestamp of last alive check","pattern":"^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$","title":"alive check","type":"string"},"arch":{"description":"architecture of host running the sensor","title":"architecture","type":"integer"},"did":{"oneOf":[{"description":"UUID of the device","format":"uuid","title":"device identifier","type":"string"},{"enum":[""]}]},"enroll":{"description":"timestamp of sensor enrollment","pattern":"^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$","title":"enrollment timestamp","type":"string"},"ext_ip":{"oneOf":[{"description":"external IP of the host running the sensor","format":"ipv4","title":"external IP","type":"string"},{"enum":["internal",""]}]},"ext_plat":{"description":"external platform of the sensor","title":"external platform","type":"integer"},"hostname":{"description":"hostname of the host running the sensor","title":"hostname","type":"string"},"installer_version":{"description":"version of the installer","title":"installer version","type":"string"},"int_ip":{"description":"internal IP of the host running the sensor","title":"internal IP","type":"string"},"is_isolated":{"description":"isolation status of the sensor","title":"isolation status","type":"boolean"},"is_kernel_available":{"description":"is kernel available to the sensor","title":"kernel availability","type":"boolean"},"is_online":{"description":"is sensor online at the moment","title":"online status","type":"boolean"},"mac_addr":{"description":"MAC address of the host running the sensor","title":"MAC address","type":"string"},"metadata":{"oneOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}]},"oid":{"description":"UUID of the organization","format":"uuid","title":"organization identifier","type":"string"},"plat":{"description":"platform type of the host running the sensor","title":"platform","type":"integer"},"sealed":{"description":"seal status of the sensor","title":"seal status","type":"boolean"},"should_isolate":{"description":"isolation intent of the sensor","title":"isolation intent","type":"boolean"},"should_seal":{"description":"seal intent of the sensor","title":"seal intent","type":"boolean"},"sid":{"description":"UUID of the sensor","format":"uuid","title":"sensor identifier","type":"string"},"tags":{"oneOf":[{"items":{"description":"sensors tag","title":"tag","type":"string"},"type":"array"},{"type":"null"}]},"version":{"description":"version of the sensor","title":"sensor version","type":"string"}},"required":["sid","alive","arch","did","enroll","ext_ip","ext_plat","hostname","int_ip","is_isolated","is_kernel_available","mac_addr","oid","plat","sealed","should_isolate","should_seal"],"type":"object"},"type":"array"}]}},"required":["sensors"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the list of sensors belonging to the organization.","summary":"Get Sensor List"}},"/service/{oid}":{"get":{"operationId":"getAvailableServices","tags":["Service"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"replicants":{"items":{"type":"string"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the list of Services enabled on this organization.","summary":"Get Available Services"}},"/service/{oid}/{service_name}":{"post":{"operationId":"makeServiceRequest","tags":["Service"],"parameters":[{"name":"is_async","description":"if set to 'true', this REST call will not wait for the Service to finish handling the request","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"service_name","required":true,"description":"Service name to send the request to","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"request object","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"jwt":{"description":"optional JWT token to use for authentication to the Service","title":"jwt","type":"string"},"request_data":{"description":"JSON data to send to the Service","title":"request_data","type":"string"}},"required":["request_data"],"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Send a request to a Service.","summary":"Make Service Request"}},"/service/{service_name}/usage":{"get":{"operationId":"getServiceUsage","tags":["Service"],"parameters":[{"name":"service_name","required":true,"description":"Service name to send the request to","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"params":{"additionalProperties":true,"description":"Service usage parameters","type":"object"}},"required":["params"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the usage parameters for requests to the service.","summary":"Get Service Usage"}},"/tags/{oid}":{"get":{"operationId":"listOrgTags","tags":["Sensors","Tags"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"tags":{"oneOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}]}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List all the tags in use by sensors belonging to the organization.","summary":"List All Sensor Tags"}},"/tags/{oid}/{tag}":{"get":{"operationId":"findSensorsWithTag","tags":["Sensors","Tags"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"tag","required":true,"description":"tag to search for","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Search for sensors with given tags.","summary":"Find Sensors by Tag"}},"/test_template":{"post":{"operationId":"testTemplate","tags":["Rules"],"parameters":[],"requestBody":{"description":"JSON encoded string of the request data","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"template":{"description":"template expression","title":"template","type":"string"},"test_data":{"description":"test data to apply the template from","title":"test data","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the resulting data from applying a template.","summary":"Simulate a template being apply to data"}},"/test_transform":{"post":{"operationId":"testTransform","tags":["Outputs"],"parameters":[],"requestBody":{"description":"JSON encoded string of the request data","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"test_data":{"description":"test data to apply the transform to","title":"test data","type":"string"},"transform":{"description":"transform expression","title":"transform","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the resulting data from applying a transform.","summary":"Simulate a transform being apply to data"}},"/usage/{oid}":{"get":{"operationId":"getOrgUsageStats","tags":["Organizations"],"parameters":[{"name":"days","description":"number of days to look back for usage stats","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"start","description":"optional timestamp in seconds where to begin","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"optional timestamp in seconds where to stop","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"from_cache":{"type":"boolean"},"usage":{"additionalProperties":{"additionalProperties":{"type":"integer"},"properties":{"date":{"type":"string"}},"required":["date"],"type":"object"},"type":"object"}},"required":["usage"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get various organization usage stats. Supports either a days lookback or explicit start/end epoch timestamps. If start and end are provided, they take precedence over days.","summary":"Get Usage Stats"}},"/user/orgs":{"get":{"operationId":"getUserOrgs","tags":["Organizations"],"parameters":[{"name":"offset","description":"number of organizations to skip from the start","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"limit","description":"maximum number of organizations to return (default 10)","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"filter","description":"case-insensitive substring filter on name, description, or oid","schema":{"type":"string"},"in":"query"},{"name":"sort_by","description":"field to sort by: 'name' or 'description' (default: 'name')","schema":{"type":"string"},"in":"query"},{"name":"sort_order","description":"sort order: 'asc' or 'desc' (default: 'asc')","schema":{"type":"string"},"in":"query"},{"name":"fields","description":"comma-separated list of fields to return (e.g. 'oid,name,description'). Supported fields: code, oid, name, description, status, sensor_online, sensor_quota, billing_quantity, sensor_version, permissions, errors, site_name. If not specified, all fields are returned.","schema":{"type":"string"},"in":"query"},{"name":"membership","description":"filter by membership type: 'direct' (only orgs the user is a direct admin of) or 'group' (only orgs accessed via group membership). If not specified, all orgs are returned.","schema":{"type":"string"},"in":"query"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"orgs":{"items":{"additionalProperties":false,"properties":{"billing_quantity":{"oneOf":[{"type":"integer"},{"type":"null"}]},"code":{"type":"string"},"description":{"type":"string"},"errors":{"oneOf":[{"type":"null"},{"items":{"additionalProperties":false,"properties":{"component":{"type":"string"},"error":{"type":"string"},"oid":{"type":"string"},"ts":{"type":"number"}},"type":"object"},"type":"array"}]},"name":{"type":"string"},"oid":{"type":"string"},"permissions":{"items":{"type":"string"},"type":"array"},"sensor_online":{"oneOf":[{"type":"integer"},{"type":"null"}]},"sensor_quota":{"oneOf":[{"type":"integer"},{"type":"null"}]},"sensor_version":{"oneOf":[{"type":"string"},{"type":"null"}]},"site_name":{"oneOf":[{"type":"string"},{"type":"null"}]},"status":{"type":"string"}},"type":"object"},"type":"array"},"total":{"type":"integer"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get all organizations the current token has access to, including oid, name and description.","summary":"Get Accessible Orgs"}},"/user/self/auth":{"get":{"operationId":"getUserAuthRequirements","tags":["Billing"],"parameters":[],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get authentication requirements (MFA, sign-in methods) for the authenticated user's email domain.","summary":"Get User Auth Requirements"}},"/usp/validate/{oid}":{"post":{"operationId":"validateUSPMapping","tags":["USP"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"USP mapping validation request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"hostname":{"description":"Default hostname for sensors. If not specified, defaults to 'validation-test'.","title":"Default Hostname","type":"string"},"indexing":{"description":"Optional list of indexing rules to apply to parsed events. Structure validated by backend.","items":{"type":"object"},"title":"Indexing Rules","type":"array"},"json_input":{"description":"Pre-parsed JSON input as an array of objects. Mutually exclusive with text_input.","items":{"type":"object"},"title":"JSON Input","type":"array"},"mapping":{"description":"A single mapping descriptor to validate. Structure validated by backend.","title":"Single Mapping","type":"object"},"mappings":{"description":"List of mapping descriptors for multi-mapping selection. Structure validated by backend.","items":{"type":"object"},"title":"Multiple Mappings","type":"array"},"platform":{"description":"The parser platform type to use (e.g., 'text', 'json', 'cef', 'gcp', 'aws').","title":"Platform","type":"string"},"text_input":{"description":"Newline-separated text input to parse. Mutually exclusive with json_input.","title":"Text Input","type":"string"}},"required":["platform"],"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"errors":{"description":"List of errors encountered during validation.","items":{"type":"string"},"title":"Errors","type":"array"},"results":{"description":"List of successfully parsed events.","items":{"type":"object"},"title":"Parsed Results","type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Validate USP adapter mapping configurations by testing them against sample input without affecting production systems. This allows you to verify that your parsing rules, mappings, and indexing configurations work as expected before deploying them. The request body is passed through to the backend validation service.","summary":"Validate USP Mapping"}},"/{sid}":{"delete":{"operationId":"deleteSensor","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete a sensor.","summary":"Delete Sensor"},"get":{"operationId":"getSensorInfo","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"info":{"additionalProperties":false,"properties":{"alive":{"description":"timestamp of last alive check","pattern":"^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$","title":"alive check","type":"string"},"arch":{"description":"architecture of host running the sensor","title":"architecture","type":"integer"},"cursor":{"description":"cursor for the next page","type":"string"},"did":{"oneOf":[{"description":"UUID of the device","format":"uuid","title":"device identifier","type":"string"},{"enum":[""]}]},"enroll":{"description":"timestamp of sensor enrollment","pattern":"^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$","title":"enrollment timestamp","type":"string"},"error":{"oneOf":[{"type":"string"},{"type":"null"}]},"ext_ip":{"oneOf":[{"description":"external IP of the host running the sensor","format":"ipv4","title":"external IP","type":"string"},{"enum":["internal",""]}]},"ext_plat":{"description":"external platform of the sensor","title":"external platform","type":"integer"},"hostname":{"description":"hostname of the host running the sensor","title":"hostname","type":"string"},"iid":{"description":"installation key identifier","title":"installation key identifier","type":"string"},"installer_version":{"description":"version of the installer","title":"installer version","type":"string"},"int_ip":{"description":"internal IP of the host running the sensor","title":"internal IP","type":"string"},"is_del":{"description":"is the sensor deleted","title":"deleted status","type":"boolean"},"is_isolated":{"description":"isolation status of the sensor","title":"isolation status","type":"boolean"},"is_kernel_available":{"description":"is kernel available to the sensor","title":"kernel availability","type":"boolean"},"is_online":{"description":"is sensor online at the moment","title":"online status","type":"boolean"},"mac_addr":{"description":"MAC address of the host running the sensor","title":"MAC address","type":"string"},"metadata":{"oneOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}]},"oid":{"description":"UUID of the organization","format":"uuid","title":"organization identifier","type":"string"},"plat":{"description":"platform type of the host running the sensor","title":"platform","type":"integer"},"sealed":{"description":"seal status of the sensor","title":"seal status","type":"boolean"},"should_isolate":{"description":"isolation intent of the sensor","title":"isolation intent","type":"boolean"},"should_seal":{"description":"seal intent of the sensor","title":"seal intent","type":"boolean"},"sid":{"description":"UUID of the sensor","format":"uuid","title":"sensor identifier","type":"string"},"tags":{"items":{"description":"sensors tag","title":"tag","type":"string"},"type":"array"},"version":{"description":"version of the sensor","title":"sensor version","type":"string"}},"required":["sid","alive","arch","did","enroll","ext_ip","ext_plat","hostname","int_ip","is_isolated","is_kernel_available","mac_addr","oid","plat","sealed","should_isolate","should_seal"],"type":"object"},"online":{"additionalProperties":false,"properties":{"error":{"type":"string"},"is_online":{"type":"boolean"}},"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the sensor information and online status.","summary":"Get Sensor Info"},"patch":{"operationId":"undeleteSensor","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Undelete a sensor.","summary":"Undelete Sensor"},"post":{"operationId":"taskSensor","tags":["Sensors"],"parameters":[{"name":"tasks","description":"list of tasks to send","schema":{"type":"string"},"in":"query"},{"name":"investigation_id","description":"tag included in data returned from sensor resulting from the tasks","schema":{"type":"string"},"in":"query"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"specification for the tasks to be performed","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"investigation_id":{"description":"a tag included in data returned from sensor resulting from the tasks","title":"investigation id","type":"string"},"tasks":{"description":"list of tasks to send","items":{"type":"string"},"title":"tasks","type":"array"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Send a task to a sensor.","summary":"Task Sensor"}},"/{sid}/isolation":{"delete":{"operationId":"rejoinSensor","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove the sensor from network isolation.","summary":"Rejoin Sensor"},"get":{"operationId":"getSensorIsolation","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"is_isolated":{"type":"boolean"},"should_isolate":{"type":"boolean"}},"required":["is_isolated","should_isolate"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the sensor isolation status.","summary":"Get Isolation Status"},"post":{"operationId":"isolateSensor","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Set the sensor in network isolation.","summary":"Isolate Sensor"}},"/{sid}/seal":{"delete":{"operationId":"unsealSensor","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove the sensor seal.","summary":"Unseal Sensor"},"get":{"operationId":"getSensorSeal","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"is_sealed":{"type":"boolean"},"should_seal":{"type":"boolean"}},"required":["is_sealed","should_seal"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the sensor seal status.","summary":"Get Seal Status"},"post":{"operationId":"sealSensor","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Set the sensor seal status.","summary":"Seal Sensor"}},"/{sid}/tags":{"delete":{"operationId":"removeSensorTag","tags":["Sensors","Tags"],"parameters":[{"name":"tag","description":"tag to delete","schema":{"type":"string"},"in":"query"},{"name":"tags","description":"tags to delete, as a comma separated list","schema":{"type":"string"},"in":"query"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove a tag from the sensor.","summary":"Untag Sensor"},"get":{"operationId":"getSensorTags","tags":["Sensors","Tags"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"tags":{"additionalProperties":{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"},"type":"object"}},"required":["tags"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the sensor tags.","summary":"Get Sensor Tags"},"post":{"operationId":"addSensorTag","tags":["Sensors","Tags"],"parameters":[{"name":"tags","description":"list of tags to add","schema":{"type":"string"},"in":"query"},{"name":"ttl","description":"number of seconds the tag is valid for","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"is_did","description":"if set, indicates that the sid provided is really a DeviceID (did) and all its sensors should betagged","schema":{"type":"string"},"in":"query"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Add tags to the sensor.","summary":"Tag Sensor"}}},"security":[{"bearerAuth":[]}],"servers":[{"url":"https://api.limacharlie.io/v1"}],"tags":[{"name":"Api Keys","description":"Operations related to the management of API Keys."},{"name":"Artifacts","description":"Operations related to the management of Artifacts."},{"name":"Billing","description":"Operations related to the management of Billing."},{"name":"Errors","description":"Operations related to the Error logs."},{"name":"Exports","description":"Operations related to the exporting of data."},{"name":"Extensions","description":"Operations related to the management of Extensions."},{"name":"General","description":"Misc. Operations."},{"name":"Groups","description":"Operations related to the management of Groups."},{"name":"Hive","description":"Operations related to the configuration hive."},{"name":"Installation Keys","description":"Operations related to the management of Installation Keys."},{"name":"Jobs","description":"Operations related to the management of Jobs."},{"name":"Model Request","description":"Operations related to the management of Models."},{"name":"Modules","description":"Operations related to the management of sensor versions deployed."},{"name":"Organizations","description":"Operations related to the management of Organizations."},{"name":"Outputs","description":"Operations related to the forwarding of data."},{"name":"Payload","description":"Operations related to the management of Payloads."},{"name":"Resources","description":"Operations related to subscription and updating of Resources."},{"name":"Retention","description":"Operations related to data retention, visualization and searching."},{"name":"Rules","description":"Operations related to the Detection \u0026 Response rules."},{"name":"Schema","description":"Operations related to the interaction with Schemas."},{"name":"Sensors","description":"Operations related to the interaction with Sensors."},{"name":"Service","description":"Operations related to interaction with LimaCharlie Services."},{"name":"Tags","description":"Operations related to the tagging of sensors."},{"name":"USP","description":"Operations related to Universal Sensor Protocol adapters."},{"name":"Users","description":"Operations related to user and permissions management."}],"x-explorer-enabled":true,"x-samples-enabled":true,"x-samples-languages":["curl","node","ruby","javascript","python","go"]}