{"components":{"securitySchemes":{"bearerAuth":{"bearerFormat":"JWT","scheme":"bearer","type":"http"}}},"info":{"contact":{"email":"info@limacharlie.io"},"description":"This is the REST API for LimaCharlie.io, see https://docs.limacharlie.io/7-administration/access/api-keys/ for authentication information.","license":{"name":"Apache 2.0","url":"http://www.apache.org/licenses/LICENSE-2.0.html"},"termsOfService":"https://limacharlie.io/tos","title":"LimaCharlie.io REST API","version":"1.0.0"},"openapi":"3.1.0","paths":{"/autocomplete/task":{"get":{"operationId":"autocompleteTask","tags":["Sensors"],"parameters":[{"name":"aid","description":"agent ID","schema":{"type":"string"},"in":"query"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":{"additionalProperties":false,"description":"command line command and a set of assocuated flags and positionals","properties":{"optional":{"items":{"oneOf":[{"items":false,"prefixItems":[{"description":"command line flag","title":"flag","type":"string"},{"description":"command line flag value","title":"value","type":"string"}],"type":"array"},{"description":"command line flag with no value","title":"flag","type":"string"}]},"type":"array"},"positional":{"description":"positional argument","items":{"type":"string"},"title":"argument","type":"array"}},"title":"command","type":"object"},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get autocomplete information for sensor tasking.","summary":"Autocomplete Task"}},"/cloudsec/fleet/overview":{"get":{"operationId":"getCloudSecFleetOverview","tags":["Cloud Security"],"parameters":[{"name":"oids","description":"explicit org id(s) to include; repeat the parameter for several; omit (with no 'group') to span every org the caller can see","schema":{"type":"string"},"in":"query"},{"name":"group","description":"an org-group id: include the group's member orgs (the caller must be a member or owner of the group)","schema":{"type":"string"},"in":"query"},{"name":"cursor","description":"an opaque keyset-pagination token returned as 'next_cursor' by a previous page; omit for the first page","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"the maximum number of orgs to return for this page (default 25, hard cap 100)","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"trend_days","description":"number of days of score trend window per org (default 30)","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"next_cursor":{"type":"string"},"orgs":{"items":{"type":"object"},"type":"array"},"rollups":{"type":"object"},"skipped":{"type":"object"},"total_orgs":{"type":"integer"}},"required":["orgs"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the multi-org fleet posture board in one call: one posture row per authorized org (score, severity distribution, trend direction, coverage/freshness, usage counters) plus, on the first page, the cross-tenant rollups (widely-recurring rules, fleet risk distribution, orgs with failing providers). The org set is the caller's authorized orgs — optionally narrowed by 'oids' and/or an org 'group' — intersected with the orgs where the caller holds cloudsec.get and that are subscribed to the cloud-security extension; an org failing either filter is excluded, not an error. Keyset-paginated by org via 'cursor'/'limit'.","summary":"Get Cloud Security Fleet Overview","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/attack-paths":{"get":{"operationId":"getCloudSecAttackPaths","tags":["Cloud Security"],"parameters":[{"name":"severity","description":"repeatable severity filter (CRITICAL/HIGH/MEDIUM/LOW); paths whose source finding matches any value","schema":{"type":"string"},"in":"query"},{"name":"account","description":"repeatable account/project filter","schema":{"type":"string"},"in":"query"},{"name":"status","description":"repeatable status filter; the closed set is open | resolved | accepted (resolved = mitigated or false positive; accepted = a live risk somebody signed off on carrying, NOT a fix)","schema":{"type":"string"},"in":"query"},{"name":"q","description":"free-text filter over the source findings","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"paths":{"items":{"type":"object"},"type":"array"}},"required":["paths"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the headline toxic-combination attack paths for the organization (internet-exposed workload with a KEV vulnerability that can reach a sensitive resource). Supports the findings filter selectors (severity, account, status, q) to narrow the path list.","summary":"Get Cloud Security Attack Paths","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/caasm/assets":{"get":{"operationId":"getCloudSecCAASMAssets","tags":["Cloud Security"],"parameters":[{"name":"q","description":"optional substring filter over the asset urn/name/hostname/serial/os/email","schema":{"type":"string"},"in":"query"},{"name":"kind","description":"repeatable asset-kind filter (device | user | …)","schema":{"type":"string"},"in":"query"},{"name":"source","description":"repeatable: match assets ANY of these observing tools reported (sentinelone | ms_graph | limacharlie | …)","schema":{"type":"string"},"in":"query"},{"name":"posture_encryption","description":"repeatable disk-encryption posture filter. Pass an EMPTY value to select assets no source reported this fact for — unreported is not compliant","schema":{"type":"string"},"in":"query"},{"name":"posture_screen_lock","description":"repeatable screen-lock posture filter; empty selects unreported","schema":{"type":"string"},"in":"query"},{"name":"posture_compromised","description":"repeatable compromised-state posture filter; empty selects unreported","schema":{"type":"string"},"in":"query"},{"name":"posture_managed","description":"repeatable managed-state posture filter; empty selects unreported","schema":{"type":"string"},"in":"query"},{"name":"sort","description":"page order: 'urn' (default — stable, safe for a full walk or export) or 'last_seen' for most-recently-observed first","schema":{"type":"string"},"in":"query"},{"name":"cursor","description":"an opaque keyset-pagination token returned as 'next_cursor' by a previous page; omit for the first page","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"the maximum number of assets to return for this page; omit to use the backend default","schema":{"type":"integer"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data_as_of":{"type":"string"},"next_cursor":{"type":"string"},"resources":{"items":{"type":"object"},"type":"array"},"served_from":{"type":"string"}},"required":["resources"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the organization's merged third-party asset inventory: every device/identity the org's connected tools (EDR / IdP / MDM / scanners) report, entity-resolved to one row per real asset with per-source provenance retained in props (sources, merge key, hostname/serial/MACs/email, last_seen). Supports the kind / source / device-posture selectors, the 'sort' order, and keyset pagination via the optional 'cursor' and 'limit' query parameters; the response carries a 'next_cursor' to fetch the following page.","summary":"Get CAASM Assets","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/caasm/coverage":{"get":{"operationId":"getCloudSecCAASMCoverage","tags":["Cloud Security"],"parameters":[{"name":"status","description":"filter by finding status; repeatable. The closed set is open | resolved | accepted (resolved = mitigated or false positive; accepted = a live risk somebody signed off on carrying, NOT a fix)","schema":{"type":"string"},"in":"query"},{"name":"severity","description":"filter by severity; repeatable","schema":{"type":"string"},"in":"query"},{"name":"q","description":"optional substring filter","schema":{"type":"string"},"in":"query"},{"name":"cursor","description":"an opaque keyset-pagination token returned as 'next_cursor' by a previous page; omit for the first page","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"the maximum number of findings to return for this page; omit to use the backend default","schema":{"type":"integer"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"findings":{"items":{"type":"object"},"type":"array"},"next_cursor":{"type":"string"}},"required":["findings"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the organization's coverage-gap findings: assets observed by at least one connected tool but missing a tool the org's expected-coverage policy requires (e.g. seen by the IdP, no EDR). This is the findings worklist filtered to the coverage_gap class — the same shape as /cloudsec/{oid}/findings, with the class stamped server-side. Supports the status/severity/q selectors and keyset pagination.","summary":"Get CAASM Coverage Gaps","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/caasm/ingest":{"post":{"operationId":"postCloudSecCAASMIngest","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"the source + raw records to ingest","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"policy":{"type":"object"},"record":{"type":"object"},"records":{"items":{"type":"object"},"type":"array"},"source":{"type":"string"}},"required":["source"],"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"result":{"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Ingest a batch of raw third-party asset records into the organization's merged asset inventory. 'source' must be a known CAASM source (sentinelone|crowdstrike|defender|okta|entraid|ms_graph|wiz); 'records' is an array of the raw vendor-shaped JSON objects that source's tool/adapter ships (a single object may be sent as 'record' instead). Records are normalized, entity-resolved against the existing inventory, and written as ThirdPartyAsset rows; the response carries the reconcile counters (received/normalized/skipped/assets/created/updated/deleted). Re-ingesting identical records is a no-op (idempotent). Large imports should be chunked (the request body is capped at 1 MiB); concurrent ingests for one organization may each miss the other's interleaved observations — the next ingest of the same records converges.","summary":"Ingest CAASM Asset Records","x-required-permissions":{"all_of":["cloudsec.set"]}}},"/cloudsec/{oid}/caasm/policy":{"get":{"operationId":"getCloudSecCAASMPolicy","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"next_cursor":{"type":"string"},"resources":{"items":{"type":"object"},"type":"array"}},"required":["resources"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the organization's stored expected-coverage policy. The policy is persisted as the org's single CAASMPolicy system-of-record row, so the response is the standard resource-list shape: 'resources' holds zero rows (no policy declared — coverage evaluation is then a no-op by design) or one row whose 'props' object is the policy ({expect:[...]}).","summary":"Get CAASM Coverage Policy","x-required-permissions":{"all_of":["cloudsec.get"]}},"post":{"operationId":"setCloudSecCAASMPolicy","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"the coverage policy","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"policy":{"additionalProperties":false,"properties":{"expect":{"items":{"type":"object"},"type":"array"}},"type":"object"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"ok":{"type":"boolean"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Set (upsert) the organization's expected-coverage policy: the declarative expectations the coverage engine evaluates over the merged asset inventory, e.g. {policy:{expect:[{label:\"edr-on-devices\",capability:\"edr\",kinds:[\"device\"]}]}}. The policy is validated before it is stored; an invalid policy is rejected loudly.","summary":"Set CAASM Coverage Policy","x-required-permissions":{"all_of":["cloudsec.set"]}}},"/cloudsec/{oid}/changes":{"get":{"operationId":"getCloudSecChanges","tags":["Cloud Security"],"parameters":[{"name":"limit","description":"max number of change events (default 50)","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"changes":{"items":{"type":"object"},"type":"array"}},"required":["changes"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the recent cloud-finding lifecycle changes (created/closed), newest first.","summary":"Get Cloud Security Changes","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/chokepoints":{"get":{"operationId":"getCloudSecChokepoints","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"chokepoints":{"items":{"type":"object"},"type":"array"},"total_paths":{"type":"integer"}},"required":["chokepoints"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the estate-wide chokepoints: the shared attack-path hops ranked by how many distinct paths each one breaks, plus the total attack-path count — so 'fix this one resource' can be framed as 'closes N of M paths'. Precomputed on reproject; returns an empty list when the estate has no shared hops (or hasn't been analyzed yet).","summary":"Get Cloud Security Chokepoints","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/chokepoints/dismiss":{"post":{"operationId":"dismissCloudSecChokepoint","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"the choke point urn (+ optional reason)","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"reason":{"type":"string"},"urn":{"type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"ok":{"type":"boolean"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Dismiss an estate-wide choke point (by its resource urn) so it no longer surfaces on the risk overview. Optionally records a reason.","summary":"Dismiss Cloud Security Choke Point","x-required-permissions":{"all_of":["cloudsec.set"]}}},"/cloudsec/{oid}/chokepoints/restore":{"post":{"operationId":"restoreCloudSecChokepoint","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"the choke point urn","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"urn":{"type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"ok":{"type":"boolean"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Restore (un-dismiss) a previously dismissed estate-wide choke point so it surfaces on the risk overview again.","summary":"Restore Cloud Security Choke Point","x-required-permissions":{"all_of":["cloudsec.set"]}}},"/cloudsec/{oid}/ciem/facets":{"get":{"operationId":"getCloudSecIdentityFacets","tags":["Cloud Security"],"parameters":[{"name":"provider","description":"repeatable: match identities produced by ANY of these sweeps. Alias of 'source'","schema":{"type":"string"},"in":"query"},{"name":"account","description":"repeatable: match identities observed in ANY of these accounts/projects","schema":{"type":"string"},"in":"query"},{"name":"region","description":"repeatable: match identities observed in ANY of these regions","schema":{"type":"string"},"in":"query"},{"name":"q","description":"case-insensitive substring filter over the identity's urn/email/kind","schema":{"type":"string"},"in":"query"},{"name":"source","description":"repeatable: match identities produced by ANY of these sweeps (okta | gcp | google_workspace | …). Same dimension as 'provider'; use this form to select several","schema":{"type":"string"},"in":"query"},{"name":"kind","description":"repeatable identity kind filter (user | service_account | group | ai_agent | …)","schema":{"type":"string"},"in":"query"},{"name":"criticality","description":"repeatable crown-jewel tier filter","schema":{"type":"string"},"in":"query"},{"name":"risk_band","description":"repeatable risk-band filter (critical | high | medium | low) — the band token the rail renders, not a numeric range","schema":{"type":"string"},"in":"query"},{"name":"mfa","description":"MFA state filter: on | off | unknown. 'unknown' is everyone the MFA question does not apply to (no identity-provider observation, or non-human) — it is NOT 'off'","schema":{"type":"string"},"in":"query"},{"name":"admin","description":"true/false: restrict to identities holding (or not holding) an admin role. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"external","description":"true/false: restrict to identities outside the org's own domains. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"public","description":"true/false: restrict to public principals (allUsers / allAuthenticatedUsers and their equivalents). Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"disabled","description":"true/false: restrict to disabled (or enabled) identities. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"crown_jewel","description":"true/false: restrict to identities the org's cloudsec_policy declares sensitive. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"can_escalate","description":"true/false: restrict to identities that can escalate their own privileges. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"dormant_90d","description":"true/false: restrict to identities with no observed activity in 90 days. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"with_sensitive","description":"true/false: restrict to principals holding at least one non-deny grant on a sensitive resource. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"facets":{"type":"object"}},"required":["facets"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the cross-cutting identity facet counts for the CIEM worklist (kind, MFA state, risk band, plus admin/external/public/disabled/dormant/stale-key/escalation/sensitive-access rollups and the total), so the identity view can lead with insight before the row list. The optional selectors CROSS-FILTER the rail: each dimension is counted under the other active selectors but not its own, so a value's count is exactly how many rows selecting it would list. With no selectors the response is the whole-population rollup, unchanged.","summary":"Get Cloud Security Identity Facets","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/ciem/identities":{"get":{"operationId":"getCloudSecIdentityAccessList","tags":["Cloud Security"],"parameters":[{"name":"provider","description":"repeatable: match identities produced by ANY of these sweeps. Alias of 'source'","schema":{"type":"string"},"in":"query"},{"name":"account","description":"repeatable: match identities observed in ANY of these accounts/projects","schema":{"type":"string"},"in":"query"},{"name":"region","description":"repeatable: match identities observed in ANY of these regions","schema":{"type":"string"},"in":"query"},{"name":"q","description":"case-insensitive substring filter over the identity's urn/email/kind","schema":{"type":"string"},"in":"query"},{"name":"cursor","description":"an opaque keyset-pagination token returned as 'next_cursor' by a previous page; omit for the first page","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"the maximum number of principals to return for this page; omit to use the backend default","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"source","description":"repeatable: match identities produced by ANY of these sweeps (okta | gcp | google_workspace | …). Same dimension as 'provider'; use this form to select several","schema":{"type":"string"},"in":"query"},{"name":"kind","description":"repeatable identity kind filter (user | service_account | group | ai_agent | …)","schema":{"type":"string"},"in":"query"},{"name":"criticality","description":"repeatable crown-jewel tier filter","schema":{"type":"string"},"in":"query"},{"name":"risk_band","description":"repeatable risk-band filter (critical | high | medium | low) — the band token the rail renders, not a numeric range","schema":{"type":"string"},"in":"query"},{"name":"mfa","description":"MFA state filter: on | off | unknown. 'unknown' is everyone the MFA question does not apply to (no identity-provider observation, or non-human) — it is NOT 'off'","schema":{"type":"string"},"in":"query"},{"name":"admin","description":"true/false: restrict to identities holding (or not holding) an admin role. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"external","description":"true/false: restrict to identities outside the org's own domains. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"public","description":"true/false: restrict to public principals (allUsers / allAuthenticatedUsers and their equivalents). Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"disabled","description":"true/false: restrict to disabled (or enabled) identities. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"crown_jewel","description":"true/false: restrict to identities the org's cloudsec_policy declares sensitive. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"can_escalate","description":"true/false: restrict to identities that can escalate their own privileges. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"dormant_90d","description":"true/false: restrict to identities with no observed activity in 90 days. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"with_sensitive","description":"true/false: restrict to principals holding at least one non-deny grant on a sensitive resource. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"next_cursor":{"oneOf":[{"type":"string"},{"type":"null"}]},"principals":{"items":{"type":"object"},"type":"array"}},"required":["principals"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get one keyset-paginated page of the Access screen's identity population — the same per-principal effective-access rollup rows /ciem/public-access carries on its 'principals' payload (grant / privileged / sensitive-reach counts, posture facets, risk score), but server-filtered and pageable instead of a risk-ranked top-N. Takes the same selectors as /ciem/facets, so the rail's counts and this list always describe the same population. Ranked (risk_score DESC) by default; a walk that spans a projector recompute can move a row across the cursor, so use it for browsing, not for exact exports.","summary":"Get Cloud Security Identity Access List","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/ciem/identity":{"get":{"operationId":"getCloudSecIdentity","tags":["Cloud Security"],"parameters":[{"name":"urn","required":true,"description":"the canonical lcrn of the identity to fetch","schema":{"minLength":1,"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"identity":{"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the single-identity effective-access rollup for an identity urn — the same row shape the public-access principals list carries (grant/privileged/sensitive-reach counts, posture facets, risk score), but for ANY identity, not just the risk-ranked top-N. Powers the Identity 360 view. Returns a null identity when the urn is not a known identity.","summary":"Get Cloud Security Identity","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/ciem/public-access":{"get":{"operationId":"getCloudSecPublicAccess","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"access":{"items":{"type":"object"},"type":"array"}},"required":["access"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the CIEM findings where a public or external principal holds an allow grant on a sensitive resource (workloads and data stores).","summary":"Get Cloud Security Public Access","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/code/repos":{"get":{"operationId":"getCloudSecCodeRepos","tags":["Cloud Security"],"parameters":[{"name":"q","description":"optional case-insensitive substring filter over the repository key ('\u003cowner\u003e/\u003cname\u003e') and urn","schema":{"type":"string"},"in":"query"},{"name":"has_findings","description":"true/false: restrict to repositories that do (or do not) have at least one OPEN finding. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"provider","description":"optional source-control provider filter (e.g. 'github'); omit for every provider that produces repositories","schema":{"type":"string"},"in":"query"},{"name":"cursor","description":"an opaque keyset-pagination token returned as 'next_cursor' by a previous page; omit for the first page","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"the maximum number of repositories to return for this page (default 100, max 500)","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"next_cursor":{"type":"string"},"repos":{"items":{"type":"object"},"type":"array"}},"required":["repos"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the organization's source repositories as the code lane sees them: identity (repo, urn, owner, provider), the source-control facts the connector collected (visibility, archived, branch protection), the code-scan state (scan_status, code_scanned_at, code_scan_commit, languages, packages_total, scan_limits), and the OPEN finding rollup (open_findings, findings_by_class, findings_by_severity, top_severity). 'repo' is the '\u003cowner\u003e/\u003cname\u003e' key every other code route takes. scan_status is one of scanned | partial | unknown — 'partial' means the scan tripped a limit and its finding set is incomplete, and 'unknown' means this surface has no scan state for the repository and says so rather than implying it is clean (a machine-readable 'scan_status_reason' accompanies it). Supports keyset pagination via 'cursor' and 'limit'; the response carries 'next_cursor'. A page may be SHORT while 'next_cursor' is set — the cursor, not the page length, says whether the walk is done.","summary":"Get Cloud Security Code Repositories","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/code/repos/{repo+}/sbom":{"get":{"operationId":"getCloudSecCodeRepoSBOM","tags":["Cloud Security"],"parameters":[{"name":"provider","description":"the source-control provider the repository key belongs to; defaults to 'github'","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"repo","required":true,"description":"the repository key '\u003cowner\u003e/\u003cname\u003e' (as returned by /code/repos). The separator may be sent literally or percent-encoded","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"reason":{"type":"string"},"repo":{"type":"string"},"sbom":{"type":"object"},"urn":{"type":"string"}},"required":["repo"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get a short-lived, signed download link for a repository's software bill of materials (CycloneDX, gzip-compressed). The document is served directly from object storage rather than through this API, so the response carries 'sbom.url' plus 'expires_at', 'size_bytes', 'format' and 'content_encoding'; fetch the url with a plain unauthenticated GET before it expires. A repository that has no SBOM yet is a SUCCESSFUL response with 'sbom' null and a machine-readable 'reason' ('sbom_not_generated_yet' — the first scan has not completed — or 'code_lane_not_enabled_in_datacenter'); a repository this organization does not have is an error.","summary":"Get Cloud Security Repository SBOM","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/code/status":{"get":{"operationId":"getCloudSecCodeStatus","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"any_running":{"type":"boolean"},"code":{"items":{"type":"object"},"type":"array"},"totals":{"type":"object"}},"required":["code"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the code lane's run status: one entry per source-control connection ('code:\u003cprovider\u003e') carrying is_running, started_at, completed_at, last_stats and last_error, plus 'totals' — the organization's open code findings, their split by class, and how many repositories carry at least one. An empty 'code' list means the lane has never run in this organization; it does NOT mean the lane is off, which is a property of the org's code_scanning policy. This is the authoritative view of the RUN — when it disagrees with a repository's own 'scan_status', this one is current.","summary":"Get Cloud Security Code Scan Status","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/compliance":{"get":{"operationId":"getCloudSecCompliance","tags":["Cloud Security"],"parameters":[{"name":"framework","description":"the framework id to assess (e.g. cis-gcp); defaults to cis-gcp; ignored when 'assignment' is set","schema":{"type":"string"},"in":"query"},{"name":"assignment","description":"the name of a scoped compliance assignment to evaluate instead of the whole estate; its framework is assessed over its in-scope resources","schema":{"type":"string"},"in":"query"},{"name":"format","description":"set to 'csv' to stream the export as a text/csv attachment instead of JSON (walks the full filtered set server-side, capped at 100k rows)","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"report":{"type":"object"}},"required":["report"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the per-control pass/fail compliance assessment for a framework (default cis-gcp) against the org's open findings, with evidence and a summary score. Pass 'assignment' to evaluate a named scoped assignment instead (its framework over its in-scope estate); when set, 'framework' is ignored.","summary":"Get Cloud Security Compliance","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/compliance/assignments":{"get":{"operationId":"listCloudSecComplianceAssignments","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"assignments":{"items":{"type":"object"},"type":"array"}},"required":["assignments"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List the org's scoped compliance assignments (name, framework, scope, and a full scoped summary score per assignment). Empty when the org has defined no assignments — the UI then shows only the whole-estate default.","summary":"List Cloud Security Compliance Assignments","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/compliance/frameworks":{"get":{"operationId":"listCloudSecComplianceFrameworks","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"frameworks":{"items":{"type":"object"},"type":"array"}},"required":["frameworks"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List the selectable compliance frameworks (id, name, version, control count).","summary":"List Cloud Security Compliance Frameworks","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/data-security/facets":{"get":{"operationId":"getCloudSecDataStoreFacets","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"facets":{"type":"object"}},"required":["facets"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the data-security (DSPM) rollup over every data store: the total / sensitive / public / public-sensitive counts plus the store-kind, sensitivity, and exposure facets — computed server-side so the Data Security view leads with exact counts before its (separately paginated) row list.","summary":"Get Cloud Data Security Facets","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/data-security/stores":{"get":{"operationId":"getCloudSecDataStores","tags":["Cloud Security"],"parameters":[{"name":"cursor","description":"an opaque keyset-pagination token returned as 'next_cursor' by a previous page; omit for the first page","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"the maximum number of stores to return for this page; omit to use the backend default","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"next_cursor":{"type":"string"},"stores":{"items":{"type":"object"},"type":"array"}},"required":["stores"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Keyset-paginated data-store rows served from the materialized graph store under the same selectors as /data-security/facets (provider, account, region, store_kind, tier, sensitivity, exposure) — the filtered Data Security list stays exact at any estate size instead of client-filtering a capped walk.","summary":"Get Cloud Data Security Stores","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/findings":{"get":{"operationId":"getCloudSecFindings","tags":["Cloud Security"],"parameters":[{"name":"cursor","description":"an opaque keyset-pagination token returned as 'next_cursor' by a previous page; omit for the first page","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"the maximum number of findings to return for this page; omit to use the backend default","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"format","description":"set to 'csv' to stream the export as a text/csv attachment instead of JSON (walks the full filtered set server-side, capped at 100k rows)","schema":{"type":"string"},"in":"query"},{"name":"repo","description":"repeatable: restrict to findings whose subject is one of these source repositories, keyed '\u003cowner\u003e/\u003cname\u003e' as /code/repos returns them. This is the AppSec code lane's selector; cloud findings have no repository and are excluded by it","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"findings":{"items":{"type":"object"},"type":"array"}},"required":["findings"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the merged, risk-ranked cloud-security findings for the organization (CSPM misconfigurations + graph toxic-combination attack paths + CIEM access), ordered by lc_risk. Supports keyset pagination via the optional 'cursor' and 'limit' query parameters; the response carries a 'next_cursor' to fetch the following page.","summary":"Get Cloud Security Findings","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/findings/bulk/status":{"post":{"operationId":"bulkSetCloudSecFindingStatus","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"the finding ids + resolution","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"finding_ids":{"items":{"type":"string"},"type":"array"},"resolution":{"type":"object"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"updated":{"type":"integer"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Disposition many findings at once: apply one resolution to a list of finding ids.","summary":"Bulk Set Cloud Security Finding Status","x-required-permissions":{"all_of":["cloudsec.set"]}}},"/cloudsec/{oid}/findings/causes":{"get":{"operationId":"getCloudSecFindingCauses","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"causes":{"items":{"type":"object"},"type":"array"},"distinct":{"type":"integer"}},"required":["causes","distinct"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get findings grouped by their CAUSE — the mutable object (e.g. a firewall rule) whose single edit resolves all of them — under the same filter selectors as the findings list. Pass `cause` to get the exact count for one cause; omit it for the top causes by count (`limit`, default 20, max 200) plus `distinct`, the total number of causes matching the filter.","summary":"Get Cloud Security Shared-Fix Causes","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/findings/classes":{"get":{"operationId":"getCloudSecFindingClasses","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"classes":{"items":{"type":"string"},"type":"array"}},"required":["classes"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the canonical finding_class vocabulary (the valid values for finding-class filters and suppression-policy matchers), served from the backend enum so UIs never guess at the valid set.","summary":"Get Cloud Security Finding Classes","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/findings/facets":{"get":{"operationId":"getCloudSecFindingFacets","tags":["Cloud Security"],"parameters":[{"name":"owner_pin","description":"repeatable: owners to keep in the capped 'owner' facet even when they would not rank into it — pass the calling user to keep their own row reachable. NOT a filter: it selects no rows and changes no count.","schema":{"type":"string"},"in":"query"},{"name":"repo","description":"repeatable: restrict to findings whose subject is one of these source repositories, keyed '\u003cowner\u003e/\u003cname\u003e'. The response's 'repo' facet counts the code lane's repositories (capped at the top 200 by count, with any actively selected repository pinned into it; 'repo_truncated' reports whether any were dropped) and never includes the non-repository findings","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"facets":{"type":"object"}},"required":["facets"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the cross-filtered facet counts and total for the findings worklist under the same filter selectors as the findings list (severity, finding_class, status, account, owner, repo, reachable, kev, q). Each facet dimension is counted against the other active filters. The 'owner' facet is keyed by owner with the empty string holding the unassigned bucket, and is capped at the top 50 owners by count; 'owner_truncated' reports whether any were dropped. Repeat 'owner_pin' to keep specific owners in that capped facet (e.g. the calling user, so their own row stays visible on an estate with more owners than the cap) — it is NOT a filter and changes no count; the unassigned bucket is always included and outranks every pin.","summary":"Get Cloud Security Finding Facets","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/findings/{finding_id}":{"get":{"operationId":"getCloudSecFinding","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"finding_id","required":true,"description":"the finding id (fnd_...) to fetch","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"finding":{"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get a single cloud-security finding by its id, with full detail (vulnerability/CVE, evidence, remediation, status). Independent of the worklist pagination.","summary":"Get Cloud Security Finding","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/findings/{finding_id}/owner":{"post":{"operationId":"setCloudSecFindingOwner","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"finding_id","required":true,"description":"the finding id to assign","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"the owner","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"owner":{"type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"ok":{"type":"boolean"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Assign (or clear, with an empty owner) the owner of a finding.","summary":"Set Cloud Security Finding Owner","x-required-permissions":{"all_of":["cloudsec.set"]}}},"/cloudsec/{oid}/findings/{finding_id}/status":{"post":{"operationId":"setCloudSecFindingStatus","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"finding_id","required":true,"description":"the finding id to disposition","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"the resolution","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"resolution":{"additionalProperties":false,"properties":{"expires_at":{"type":"integer"},"kind":{"type":"string"},"reason":{"type":"string"}},"type":"object"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"ok":{"type":"boolean"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Disposition a finding: record an operator resolution (mitigated | accepted | false_positive) with an optional reason and (for accepted) an expires_at (unix seconds).","summary":"Set Cloud Security Finding Status","x-required-permissions":{"all_of":["cloudsec.set"]}}},"/cloudsec/{oid}/findings/{finding_id}/ticket":{"post":{"operationId":"setCloudSecFindingTicket","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"finding_id","required":true,"description":"the finding id to link","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"the ticket","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"ticket":{"type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"ok":{"type":"boolean"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Link (or clear) a ticket id/url to a finding.","summary":"Set Cloud Security Finding Ticket","x-required-permissions":{"all_of":["cloudsec.set"]}}},"/cloudsec/{oid}/free-tier":{"get":{"operationId":"getCloudSecFreeTier","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"enabled_providers":{"type":"number"},"is_free_tier":{"type":"boolean"},"max_providers":{"type":"number"},"sensor_quota":{"type":"number"}},"required":["is_free_tier","sensor_quota"],"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Report whether the organization is on the cloud-security free tier, and the limits that apply to it. Used to surface upgrade prompts before a limit is hit. Free-tier limits are enforced by the collector; this endpoint only describes them.","summary":"Get Cloud Security Free-Tier Status","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/graph/neighbors":{"get":{"operationId":"getCloudSecGraphNeighbors","tags":["Cloud Security"],"parameters":[{"name":"urn","required":true,"description":"the canonical lcrn of the resource to expand from","schema":{"minLength":1,"type":"string"},"in":"query"},{"name":"limit","description":"max neighbors to return (default 200, hard cap 500)","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"graph":{"type":"object"}},"required":["graph"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Expand a single resource's 1-hop neighborhood in the security graph: every node directly connected to the given urn (in either direction) plus the connecting edges, in the same { graph: { nodes, edges } } induced-subgraph shape as a graph query. Server-bounded, ranked (sensitive → public → data/identity), and capped; 'truncated' is true when the resource has more neighbors than the cap. Powers click-to-expand on the graph canvas.","summary":"Get Cloud Security Graph Neighbors","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/inventory":{"get":{"operationId":"getCloudSecInventory","tags":["Cloud Security"],"parameters":[{"name":"type","description":"filter to one resource_type (e.g. compute_instance | Identity | ThirdPartyAsset)","schema":{"type":"string"},"in":"query"},{"name":"provider","description":"filter by producing sweep (gcp | okta | google_workspace | …). Single-valued; with type=Identity it is repeatable, or use the 'source' alias","schema":{"type":"string"},"in":"query"},{"name":"account","description":"filter by account/project. Single-valued; repeatable with type=Identity","schema":{"type":"string"},"in":"query"},{"name":"region","description":"filter by region. Single-valued; repeatable with type=Identity","schema":{"type":"string"},"in":"query"},{"name":"q","description":"case-insensitive substring filter over the resource's identifying fields","schema":{"type":"string"},"in":"query"},{"name":"account_unscoped","description":"set true to drop the account scoping so the walk spans the whole estate","schema":{"type":"boolean"},"in":"query"},{"name":"sort","description":"page order for the merged lanes: 'urn' (default — stable, safe for a full walk or export) or 'risk' for type=Identity / 'last_seen' for type=ThirdPartyAsset. A ranked walk can move a row across the cursor when the projector recomputes mid-walk","schema":{"type":"string"},"in":"query"},{"name":"cursor","description":"an opaque keyset-pagination token returned as 'next_cursor' by a previous page; omit for the first page","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"the maximum number of resources to return for this page; omit to use the backend default","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"format","description":"set to 'csv' to stream the export as a text/csv attachment instead of JSON (walks the full filtered set server-side, capped at 100k rows)","schema":{"type":"string"},"in":"query"},{"name":"source","description":"repeatable: match identities produced by ANY of these sweeps (okta | gcp | google_workspace | …). Same dimension as 'provider'; use this form to select several","schema":{"type":"string"},"in":"query"},{"name":"kind","description":"repeatable identity kind filter (user | service_account | group | ai_agent | …)","schema":{"type":"string"},"in":"query"},{"name":"criticality","description":"repeatable crown-jewel tier filter","schema":{"type":"string"},"in":"query"},{"name":"risk_band","description":"repeatable risk-band filter (critical | high | medium | low) — the band token the rail renders, not a numeric range","schema":{"type":"string"},"in":"query"},{"name":"mfa","description":"MFA state filter: on | off | unknown. 'unknown' is everyone the MFA question does not apply to (no identity-provider observation, or non-human) — it is NOT 'off'","schema":{"type":"string"},"in":"query"},{"name":"admin","description":"true/false: restrict to identities holding (or not holding) an admin role. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"external","description":"true/false: restrict to identities outside the org's own domains. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"public","description":"true/false: restrict to public principals (allUsers / allAuthenticatedUsers and their equivalents). Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"disabled","description":"true/false: restrict to disabled (or enabled) identities. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"crown_jewel","description":"true/false: restrict to identities the org's cloudsec_policy declares sensitive. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"can_escalate","description":"true/false: restrict to identities that can escalate their own privileges. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"dormant_90d","description":"true/false: restrict to identities with no observed activity in 90 days. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"with_sensitive","description":"true/false: restrict to principals holding at least one non-deny grant on a sensitive resource. Omit for no constraint","schema":{"type":"boolean"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data_as_of":{"type":"string"},"next_cursor":{"oneOf":[{"type":"string"},{"type":"null"}]},"resources":{"items":{"type":"object"},"type":"array"},"served_from":{"type":"string"}},"required":["resources"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the organization's cloud resource inventory — every collected resource with its type, account, region, and properties. Supports keyset pagination via the optional 'cursor' and 'limit' query parameters; the response carries a 'next_cursor' to fetch the following page. With type=Identity the rows are the MERGED identity inventory (one row per real identity, unified across the sweeps that observed it), which additionally accepts the identity cross-filter selectors below and the 'sort' order.","summary":"Get Cloud Inventory","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/inventory/facets":{"get":{"operationId":"getCloudSecInventoryFacets","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"accounts":{"items":{"type":"object"},"type":"array"},"providers":{"items":{"type":"object"},"type":"array"},"regions":{"items":{"type":"object"},"type":"array"},"types":{"items":{"type":"object"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the inventory resource counts grouped by resource type, account, and region.","summary":"Get Cloud Inventory Facets","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/overview":{"get":{"operationId":"getCloudSecOverview","tags":["Cloud Security"],"parameters":[{"name":"trend_days","description":"number of days of score trend to include (default 30)","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":true,"properties":{"score":{"type":"integer"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the composed risk overview: score, severity distribution, top attack paths, account coverage, the score trend, and recent finding changes — in one round-trip.","summary":"Get Cloud Security Overview","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/policy/suggest":{"post":{"operationId":"suggestCloudSecPolicyValues","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"the suggestion query","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"dimension":{"type":"string"},"limit":{"type":"number"},"q":{"type":"string"},"target":{"type":"string"}},"required":["dimension","q"],"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"evaluated":{"type":"number"},"truncated":{"type":"boolean"},"values":{"items":{"type":"object"},"type":"array"}},"required":["values"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Suggest values for a cloudsec_policy matcher dimension from the organization's own inventory as the operator types. dimension 'name' walks the estate's policy-matchable resources (bounded, truncation-flagged) for resource names containing the typed text; dimension 'account' filters the account facet. Optional 'target' (data_store|compute|identity|any) narrows the walked resource family to the rule set being edited. Returns ranked {value,count} suggestions. Read-only: nothing is saved.","summary":"Suggest Cloud Security Policy Matcher Values","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/policy/vocabulary":{"get":{"operationId":"getCloudSecPolicyVocabulary","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"content_classes":{"items":{"type":"string"},"type":"array"},"in_use":{"type":"object"},"providers":{"items":{"type":"string"},"type":"array"},"resource_types":{"type":"object"},"suggested_classes":{"items":{"type":"string"},"type":"array"},"surfaces":{"type":"object"},"tiers":{"items":{"type":"string"},"type":"array"}},"required":["surfaces"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the classification-policy vocabulary that drives the crown-jewel/coverage/exclusion rule form: the per-surface capability table (which matcher dimensions each policy surface accepts), the closed vocabularies (resource types grouped per section, providers, criticality tiers, content classes, suggested classes), and the org's in-use histograms (accounts, regions, label keys, network tags, resource types) so the form can offer autocomplete without the operator guessing at valid tokens.","summary":"Get Cloud Security Policy Vocabulary","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/providers/manifest":{"get":{"operationId":"getCloudSecProviderManifests","tags":["Cloud Security"],"parameters":[{"name":"type","description":"the provider type to fetch the manifest for (e.g. gcp|aws|azure|okta); omit to list every provider the org has a manifest or a sweep for","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"manifest":{"type":"object"},"manifests":{"items":{"type":"object"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the per-provider coverage manifests for the organization: for each provider, the collectors (resource kinds + edge kinds) with their status, the posture checks that can fire, the activity/CIEM support level, the validation grade, the known gaps, and the org's own scan coverage/freshness. Pass 'type' to fetch a single provider's manifest (returned under 'manifest' instead of 'manifests'), including a provider the org has never swept.","summary":"Get Cloud Security Provider Manifests","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/providers/test":{"post":{"operationId":"testCloudSecProvider","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"the provider to test: {provider: \u003ccloudsec_provider record shape\u003e} with `credentials` inline (ephemeral) or a hive://secret/\u003cname\u003e reference","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"provider":{"type":"object"}},"required":["provider"],"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"report":{"additionalProperties":false,"properties":{"checks":{"items":{"additionalProperties":false,"properties":{"detail":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"ok":{"type":"boolean"},"required":{"type":"boolean"}},"type":"object"},"type":"array"},"ok":{"type":"boolean"},"provider":{"type":"string"}},"type":"object"},"supported":{"type":"boolean"}},"required":["supported"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Preflight a cloud security provider configuration: connect to the provider with the given credentials (ephemeral — never stored) and probe every permission surface collection needs. Returns a structured report: report.ok is the overall verdict over the REQUIRED checks; each check carries id/name/required/ok/detail, and a failed optional check flags a gracefully-degraded surface rather than a failure.","summary":"Test Cloud Security Provider Credentials","x-required-permissions":{"all_of":["cloudsec.set"]}}},"/cloudsec/{oid}/queries":{"get":{"operationId":"getCloudSecQueries","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"queries":{"items":{"type":"object"},"type":"array"}},"required":["queries"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List the built-in cloud-security query pack (the canonical security questions runnable by name).","summary":"List Cloud Security Queries","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/query":{"post":{"operationId":"runCloudSecQuery","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"the query to run: provide one of 'named', 'text', or 'query'","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"named":{"type":"string"},"project":{"type":"string"},"query":{"type":"object"},"text":{"type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"rows":{"items":{"type":"object"},"type":"array"}},"required":["rows"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Run a graph query against the org's security graph. Provide exactly one of: 'named' (a query-pack name), 'text' (a text query), or 'query' (a DSL object). Returns alias→urn rows.","summary":"Run Cloud Security Query","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/resolve/assets":{"get":{"operationId":"resolveCloudAssetsToSensors","tags":["Cloud Security"],"parameters":[{"name":"urn","description":"cloud asset URN(s) to resolve; repeat the parameter for a bulk request","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"resolved":{"items":{"type":"object"},"type":"array"}},"required":["resolved"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Resolve cloud asset URNs to the LimaCharlie sensor ids running on each. Pass one or more 'urn' query parameters (bulk). Unresolved URNs are returned in 'unresolved'.","summary":"Resolve Cloud Assets to Sensors","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/resolve/sensors":{"get":{"operationId":"resolveCloudSensorsToAssets","tags":["Cloud Security"],"parameters":[{"name":"sid","description":"sensor id(s) to resolve; repeat the parameter for a bulk request","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"resolved":{"items":{"type":"object"},"type":"array"}},"required":["resolved"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Resolve LimaCharlie sensor ids to the cloud asset (URN, with posture flags) each runs on. Pass one or more 'sid' query parameters (bulk). Unresolved sensors are returned in 'unresolved'.","summary":"Resolve Sensors to Cloud Assets","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/resource":{"get":{"operationId":"getCloudSecResource","tags":["Cloud Security"],"parameters":[{"name":"urn","required":true,"description":"the canonical lcrn of the resource to fetch","schema":{"minLength":1,"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"resource":{"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the single canonical record for any urn the system-of-record or security graph knows — { urn, resource_type, name, account, region, is_public, is_sensitive, props, first_seen }. Covers derived graph nodes (vulnerabilities, identities) that have no inventory row. Powers the resource drawer / urn click-through. Returns a null resource when the urn is unknown.","summary":"Get Cloud Security Resource","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/risk-trend":{"get":{"operationId":"getCloudSecRiskTrend","tags":["Cloud Security"],"parameters":[{"name":"trend_days","description":"number of days of score trend to include (default 30)","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"trend":{"items":{"type":"object"},"type":"array"}},"required":["trend"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the organization's risk-score history over time (the Overview score-trend sparkline), oldest first.","summary":"Get Cloud Security Risk Trend","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/scan-status":{"get":{"operationId":"getCloudSecScanStatus","tags":["Cloud Security"],"parameters":[{"name":"provider","description":"the cloud provider to read status for (gcp|aws|azure); defaults to gcp","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":true,"properties":{"status":{"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the cloud-collection run status for the organization — whether a sweep is in progress, when it last started/completed, the last diff stats, and any error. Optional 'provider' query parameter (default 'gcp').","summary":"Get Cloud Security Scan Status","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/simulate/findings":{"post":{"operationId":"simulateCloudSecFindingMatch","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"the suppression matcher to simulate","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"match":{"type":"object"},"sample_limit":{"type":"number"}},"required":["match"],"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"evaluated":{"type":"number"},"matched":{"type":"number"},"sample":{"items":{"type":"object"},"type":"array"},"truncated":{"type":"boolean"}},"required":["evaluated","matched"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Evaluate a suppression-policy matcher (finding_class / rule / account globs / urn_prefix / max_severity) against the organization's OPEN findings, using the exact matching semantics the suppression engine applies. Returns evaluated/matched counts, a bounded sample of the findings the rule would disposition, and truncated=true when the walk hit its size/time bound. Read-only preview: nothing is dispositioned.","summary":"Simulate Cloud Security Finding Matchers","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/simulate/resources":{"post":{"operationId":"simulateCloudSecResourceMatch","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"the matcher config to simulate","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"resource_types":{"items":{"type":"string"},"type":"array"},"rules":{"items":{"type":"object"},"type":"array"},"sample_limit":{"type":"number"},"target":{"type":"string"}},"required":["rules"],"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"evaluated":{"type":"number"},"indeterminate":{"type":"number"},"indeterminate_sample":{"items":{"type":"object"},"type":"array"},"matched":{"type":"number"},"sample":{"items":{"type":"object"},"type":"array"},"truncated":{"type":"boolean"}},"required":["evaluated","matched"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Evaluate a set of cloudsec_policy resource matcher rules (account_contains/account_glob/name_contains/name_glob/label/label_key_present/tag — the Data Classification / Coverage / Exclusions vocabulary; rules compose as OR) against the organization's stored inventory. Returns evaluated/matched/indeterminate counts, a bounded sample of matching resources, and truncated=true when the walk hit its size/time bound. 'indeterminate' counts resources whose stored row cannot evaluate a label constraint (their type does not persist labels). Read-only preview: nothing is saved.","summary":"Simulate Cloud Security Resource Matchers","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/cloudsec/{oid}/topology":{"get":{"operationId":"getCloudSecTopology","tags":["Cloud Security"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"available":{"type":"boolean"},"edges":{"items":{"type":"object"},"type":"array"},"generated_at":{"type":"integer"},"scopes":{"items":{"type":"object"},"type":"array"}},"required":["available","scopes","edges","generated_at"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Pre-aggregated estate topology: per-scope node counts and inter-scope relationship rollups, O(#scopes) response independent of resource count. available:false means the projector has not yet materialized this org — callers should fall back to the inventory walk.","summary":"Get Cloud Security Topology","x-required-permissions":{"all_of":["cloudsec.get"]}}},"/domain/{domain}/auth":{"get":{"operationId":"getDomainAuthRequirements","tags":["Billing"],"parameters":[{"name":"domain","required":true,"description":"email domain","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"anyOf":[{"additionalProperties":false,"description":"Empty object: the domain has no configured authentication requirements","type":"object"},{"additionalProperties":false,"properties":{"auth_ui":{"additionalProperties":false,"description":"Login-UI offering for the domain. Present only when the domain offers SSO. UI-only: enforcement is expressed via requirements.methods.","properties":{"sso_provider_id":{"type":"string"}},"required":["sso_provider_id"],"type":"object"},"is_unified_billing":{"type":"boolean"},"requirements":{"additionalProperties":false,"properties":{"max_session_seconds":{"type":"integer"},"methods":{"anyOf":[{"type":"null"},{"items":{"type":"string"},"type":"array"}]},"mfa":{"anyOf":[{"type":"null"},{"items":{"type":"string"},"type":"array"}]},"mfa_reset_email":{"type":"string"},"new_account_mfa_grace_seconds":{"type":"integer"}},"required":["methods","mfa"],"type":"object"}},"required":["requirements","is_unified_billing"],"type":"object"}]}}}}},"description":"Get authentication requirements (MFA, sign-in methods) for a domain. This is a public endpoint used during login.","summary":"Get Domain Auth Requirements"}},"/errors/{oid}":{"get":{"operationId":"getErrorLog","tags":["Errors"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"errors":{"items":{"additionalProperties":false,"properties":{"component":{"type":"string"},"error":{"type":"string"},"oid":{"type":"string"},"ts":{"type":"number"}},"required":["component","error","oid","ts"],"type":"object"},"type":"array"}},"required":["errors"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the error log for the organization.","summary":"Get Error Logs","x-required-permissions":{"all_of":["audit.get"]}}},"/errors/{oid}/{component}":{"delete":{"operationId":"dismissError","tags":["Errors"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"component","required":true,"description":"Component name of the error to dismiss","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Dismiss a specific error for the organization.","summary":"Dismiss Error","x-required-permissions":{"all_of":["audit.get"]}}},"/events":{"get":{"operationId":"getAvailableEvents","tags":["General"],"parameters":[],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"events":{"items":{"type":"string"},"type":"array"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get available event names.","summary":"Get Possible Events"}},"/export/{oid}/sensors":{"post":{"operationId":"exportSensorList","tags":["Exports","Sensors"],"parameters":[{"name":"format","description":"format of the exported data, one of 'json' or 'csv'","schema":{"enum":["json","csv"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"sensors":{"oneOf":[{"items":{"additionalProperties":false,"properties":{"alive":{"description":"timestamp of last alive check","pattern":"^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$","title":"alive check","type":"string"},"arch":{"description":"architecture of host running the sensor","title":"architecture","type":"integer"},"did":{"oneOf":[{"description":"UUID of the device","format":"uuid","title":"device identifier","type":"string"},{"enum":[""]}]},"enroll":{"description":"timestamp of sensor enrollment","pattern":"^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$","title":"enrollment timestamp","type":"string"},"ext_ip":{"oneOf":[{"description":"external IP of the host running the sensor","format":"ipv4","title":"external IP","type":"string"},{"enum":["internal",""]}]},"ext_plat":{"description":"external platform of the sensor","title":"external platform","type":"integer"},"hostname":{"description":"hostname of the host running the sensor","title":"hostname","type":"string"},"iid":{"description":"installation key identifier","title":"installation key identifier","type":"string"},"installer_version":{"description":"version of the installer","title":"installer version","type":"string"},"int_ip":{"description":"internal IP of the host running the sensor","title":"internal IP","type":"string"},"is_del":{"description":"is the sensor deleted","title":"deleted status","type":"boolean"},"is_isolated":{"description":"isolation status of the sensor","title":"isolation status","type":"boolean"},"is_kernel_available":{"description":"is kernel available to the sensor","title":"kernel availability","type":"boolean"},"is_online":{"description":"is sensor online at the moment","title":"online status","type":"boolean"},"mac_addr":{"description":"MAC address of the host running the sensor","title":"MAC address","type":"string"},"metadata":{"oneOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}]},"oid":{"description":"UUID of the organization","format":"uuid","title":"organization identifier","type":"string"},"plat":{"description":"platform type of the host running the sensor","title":"platform","type":"integer"},"sealed":{"description":"seal status of the sensor","title":"seal status","type":"boolean"},"should_isolate":{"description":"isolation intent of the sensor","title":"isolation intent","type":"boolean"},"should_seal":{"description":"seal intent of the sensor","title":"seal intent","type":"boolean"},"sid":{"description":"UUID of the sensor","format":"uuid","title":"sensor identifier","type":"string"},"tags":{"oneOf":[{"items":{"description":"sensors tag","title":"tag","type":"string"},"type":"array"},{"type":"null"}]},"version":{"description":"version of the sensor","title":"sensor version","type":"string"}},"required":["sid","alive","arch","did","enroll","ext_ip","ext_plat","hostname","int_ip","is_isolated","is_kernel_available","mac_addr","oid","plat","sealed","should_isolate","should_seal"],"type":"object"},"type":"array"},{"type":"object"},{"description":"CSV-formatted sensor list when format=csv","type":"string"}]}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Export the full sensor list (info and tags) for the Organization.","summary":"Export Sensors","x-required-permissions":{"all_of":["sensor.get","sensor.list"]}}},"/extension/definition":{"get":{"operationId":"getAllExtension","tags":["Extensions"],"parameters":[],"responses":{"200":{"description":"All public and owned extension","content":{"application/json":{"schema":{"anyOf":[{"type":"null"},{"items":{"additionalProperties":false,"properties":{"cost":{"additionalProperties":false,"properties":{"minimum_sensor_count":{"type":"integer"},"per_metric":{"additionalProperties":false,"properties":{"cost":{"type":"number"},"metric_name":{"type":"string"},"unit":{"type":"number"}},"required":["metric_name","cost","unit"],"type":"object"},"per_month":{"type":"number"},"per_sensor":{"type":"number"}},"required":["per_month","per_sensor","minimum_sensor_count"],"type":"object"},"desc":{"type":"string"},"destination_url":{"type":"string"},"email":{"type":"string"},"flairs":{"type":"array"},"icon":{"type":"string"},"is_labs":{"type":"boolean"},"is_public":{"type":"boolean"},"label":{"type":"string"},"long_desc":{"type":"string"},"name":{"type":"string"},"perms":{"type":"array"},"required_extensions":{"oneOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}]},"shared_secret":{"type":"string"},"unsubscribe_warning":{"type":"string"},"website":{"type":"string"},"zero_state_desc":{"type":"string"},"zero_state_header":{"type":"string"}},"required":["name","desc","long_desc","email","website","label","zero_state_header","zero_state_desc","required_extensions","perms","flairs","cost","icon","is_public","is_labs"],"type":"object"},"type":"array"}]}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get all public and owned extensions","summary":"Get all public and owned extensions"},"post":{"operationId":"createExtension","tags":["Extensions"],"parameters":[],"requestBody":{"description":"Extension to create","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"cost":{"additionalProperties":false,"properties":{"minimum_sensor_count":{"type":"integer"},"per_metric":{"additionalProperties":false,"properties":{"cost":{"type":"integer"},"metric_name":{"type":"string"},"unit":{"type":"integer"}},"type":"object"},"per_month":{"type":"integer"},"per_sensor":{"type":"integer"}},"type":"object"},"desc":{"type":"string"},"destination_url":{"type":"string"},"flairs":{"items":{"type":"string"},"type":"array"},"icon":{"type":"string"},"is_labs":{"description":"Ignored: user-created extensions are never labs extensions","type":"boolean"},"is_public":{"description":"Ignored: user-created extensions are always private","type":"boolean"},"key_name":{"description":"Managed server-side","type":"string"},"label":{"type":"string"},"long_desc":{"type":"string"},"name":{"type":"string"},"owner":{"description":"Managed server-side","type":"string"},"perms":{"items":{"description":"Permission name, e.g. sensor.get","type":"string"},"type":"array"},"required_extensions":{"items":{"type":"string"},"type":"array"},"shared_secret":{"type":"string"},"stripe_plan":{"type":"string"},"unsubscribe_warning":{"type":"string"},"website":{"type":"string"},"zero_state_desc":{"type":"string"},"zero_state_header":{"type":"string"}},"required":["name","destination_url","shared_secret","desc","perms"],"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create an extension","summary":"Create an extension"},"put":{"operationId":"updateExtension","tags":["Extensions"],"parameters":[],"requestBody":{"description":"Extension fields to update all fields required as this is not a patch","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"cost":{"additionalProperties":false,"properties":{"minimum_sensor_count":{"type":"integer"},"per_metric":{"additionalProperties":false,"properties":{"cost":{"type":"integer"},"metric_name":{"type":"string"},"unit":{"type":"integer"}},"type":"object"},"per_month":{"type":"integer"},"per_sensor":{"type":"integer"}},"type":"object"},"desc":{"type":"string"},"destination_url":{"type":"string"},"flairs":{"items":{"type":"string"},"type":"array"},"icon":{"type":"string"},"is_labs":{"description":"Ignored: user-created extensions are never labs extensions","type":"boolean"},"is_public":{"description":"Ignored: user-created extensions are always private","type":"boolean"},"key_name":{"description":"Managed server-side","type":"string"},"label":{"type":"string"},"long_desc":{"type":"string"},"name":{"type":"string"},"owner":{"description":"Managed server-side","type":"string"},"perms":{"items":{"description":"Permission name, e.g. sensor.get","type":"string"},"type":"array"},"required_extensions":{"items":{"type":"string"},"type":"array"},"shared_secret":{"type":"string"},"stripe_plan":{"type":"string"},"unsubscribe_warning":{"type":"string"},"website":{"type":"string"},"zero_state_desc":{"type":"string"},"zero_state_header":{"type":"string"}},"required":["name","destination_url","shared_secret","desc","perms"],"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Update an existing Extension","summary":"Update an existing Extension"}},"/extension/definition/{extensionName}":{"delete":{"operationId":"deleteExtension","tags":["Extensions"],"parameters":[{"name":"extensionName","required":true,"description":"extension name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete an Extension","summary":"Delete an existing Extension"},"get":{"operationId":"getExtension","tags":["Extensions"],"parameters":[{"name":"oid","description":"organization id","schema":{"format":"uuid","type":"string"},"in":"query"},{"name":"extensionName","required":true,"description":"extension name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"A extension","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"cost":{"additionalProperties":false,"properties":{"minimum_sensor_count":{"type":"integer"},"per_metric":{"additionalProperties":false,"properties":{"cost":{"type":"number"},"metric_name":{"type":"string"},"unit":{"type":"number"}},"required":["metric_name","cost","unit"],"type":"object"},"per_month":{"type":"number"},"per_sensor":{"type":"number"}},"required":["per_month","per_sensor","minimum_sensor_count"],"type":"object"},"desc":{"type":"string"},"email":{"type":"string"},"flairs":{"type":"array"},"icon":{"type":"string"},"is_labs":{"type":"boolean"},"is_public":{"type":"boolean"},"label":{"type":"string"},"long_desc":{"type":"string"},"name":{"type":"string"},"perms":{"type":"array"},"required_extensions":{"oneOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}]},"unsubscribe_warning":{"type":"string"},"website":{"type":"string"},"zero_state_desc":{"type":"string"},"zero_state_header":{"type":"string"}},"required":["name","desc","long_desc","email","website","label","zero_state_header","zero_state_desc","required_extensions","perms","flairs","cost","icon","is_public","is_labs"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get extension by extension name, extension must be public or owned by caller","summary":"Get extension by extension name, extension must be public or owned by caller","x-required-permissions":{"any_of":["ext.request","ext.conf.get"]}}},"/extension/public/definition":{"get":{"operationId":"getPublicExtensions","tags":["Extensions"],"parameters":[],"responses":{"200":{"description":"An array of Extensions","content":{"application/json":{"schema":{"items":{"additionalProperties":false,"properties":{"cost":{"additionalProperties":false,"properties":{"minimum_sensor_count":{"type":"integer"},"per_metric":{"additionalProperties":false,"properties":{"cost":{"type":"number"},"metric_name":{"type":"string"},"unit":{"type":"number"}},"required":["metric_name","cost","unit"],"type":"object"},"per_month":{"type":"number"},"per_sensor":{"type":"number"}},"required":["per_month","per_sensor","minimum_sensor_count"],"type":"object"},"desc":{"type":"string"},"email":{"type":"string"},"flairs":{"type":"array"},"icon":{"type":"string"},"is_labs":{"type":"boolean"},"is_public":{"type":"boolean"},"label":{"type":"string"},"long_desc":{"type":"string"},"name":{"type":"string"},"perms":{"type":"array"},"required_extensions":{"oneOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}]},"unsubscribe_warning":{"type":"string"},"website":{"type":"string"},"zero_state_desc":{"type":"string"},"zero_state_header":{"type":"string"}},"required":["name","desc","long_desc","email","website","label","zero_state_header","zero_state_desc","required_extensions","perms","flairs","cost","icon","is_public","is_labs"],"type":"object"},"type":"array"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get all public extensions - no auth required","summary":"Get all public extensions - no auth required"}},"/extension/request/{extensionName}":{"post":{"operationId":"createExtensionRequest","tags":["Extensions"],"parameters":[{"name":"data","description":"data","schema":{"type":"string"},"in":"query"},{"name":"gzdata","description":"data","schema":{"type":"string"},"in":"query"},{"name":"oid","description":"organization id","schema":{"format":"uuid","type":"string"},"in":"query"},{"name":"action","description":"action","schema":{"type":"string"},"in":"query"},{"name":"inv_id","description":"invitation id","schema":{"type":"string"},"in":"query"},{"name":"extensionName","required":true,"description":"extension name","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"JSON encoded string of the request data","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"action":{"type":"string"},"data":{"type":"string"},"gzdata":{"description":"base64(gzip(JSON)) alternative to data for payloads larger than the 10MB form limit","type":"string"},"impersonator_jwt":{"description":"optional JWT of an impersonating identity; the request is attributed to that identity instead of the caller","type":"string"},"inv_id":{"description":"optional investigation id to attribute the request to","type":"string"},"oid":{"format":"uuid","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"anyOf":[{"type":"null"},{"additionalProperties":true,"description":"Response payload produced by the extension; the shape is defined by the extension's response schema (see /extension/schema/{extensionName}) and is not under LimaCharlie's control","type":"object"}]},"error":{"description":"Only present when the extension reported an error","type":"string"}},"required":["data"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create extension request to extension you are subscribed to","summary":"Create extension request","x-required-permissions":{"all_of":["ext.request"]}}},"/extension/schema/{extensionName}":{"get":{"operationId":"getExtensionSchema","tags":["Extensions"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"type":"string"},"in":"query"},{"name":"extensionName","required":true,"description":"extension name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"A extension","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"config_schema":{"additionalProperties":false,"properties":{"fields":{"oneOf":[{"type":"null"},{"additionalProperties":{"additionalProperties":false,"properties":{"data_type":{"type":"string"},"default_value":{"oneOf":[{"type":"boolean"},{"type":"string"}]},"description":{"type":"string"},"display_index":{"type":"integer"},"filter":{"additionalProperties":false,"properties":{},"type":"object"},"filters":{"items":{"additionalProperties":false,"properties":{},"type":"object"},"type":"array"},"is_list":{"type":"boolean"},"label":{"type":"string"},"object":{"additionalProperties":false,"properties":{"element_desc":{"type":"string"},"element_name":{"type":"string"},"fields":{"additionalProperties":{"additionalProperties":false,"properties":{"data_type":{"type":"string"},"default_value":{"oneOf":[{"type":"boolean"},{"type":"string"}]},"description":{"type":"string"},"display_index":{"type":"integer"},"enum_values":{"items":{"type":"object"},"type":"array"},"filter":{"additionalProperties":false,"properties":{},"type":"object"},"filters":{"items":{"type":"object"},"type":"array"},"is_list":{"type":"boolean"},"key":{"additionalProperties":false,"properties":{},"type":"object"},"label":{"type":"string"},"object":{"type":"object"},"placeholder":{"type":"string"},"requirements":{"items":{"items":{"type":"string"},"type":"array"},"type":"array"}},"type":"object"},"type":"object"},"key":{"additionalProperties":false,"properties":{"data_type":{"type":"string"},"name":{"type":"string"},"placeholder":{"type":"string"}},"type":"object"},"requirements":{"items":{"items":{"type":"string"},"type":"array"},"type":"array"},"supported_actions":{"items":{"type":"string"},"type":"array"}},"type":"object"},"placeholder":{"type":"string"},"supported_actions":{"items":{"type":"string"},"type":"array"}},"type":"object"},"type":"object"}]},"key":{"additionalProperties":false,"properties":{},"type":"object"},"requirements":{"oneOf":[{"type":"null"},{"items":{"items":{"type":"string"},"type":"array"},"type":"array"}]},"supported_actions":{"items":{"type":"string"},"type":"array"}},"type":"object"},"request_schema":{"additionalProperties":{"additionalProperties":false,"properties":{"is_default":{"type":"boolean"},"is_impersonated":{"type":"boolean"},"is_user_facing":{"type":"boolean"},"label":{"type":"string"},"long_description":{"type":"string"},"messages":{"additionalProperties":true,"type":"object"},"parameters":{"additionalProperties":{"additionalProperties":false,"properties":{"credentials":{"type":"string"},"data":{"additionalProperties":true,"type":"object"},"data_type":{"type":"string"},"default_value":{"type":"object"},"display_index":{"type":"integer"},"enum_values":{"items":{"type":"object"},"type":"array"},"is_interactive":{"type":"boolean"},"is_list":{"type":"boolean"},"name":{"type":"string"}},"type":"object"},"properties":{"fields":{"anyOf":[{"type":"null"},{"additionalProperties":true,"type":"object"}]},"requirements":{"anyOf":[{"type":"null"},{"items":{"items":{"type":"string"},"type":"array"},"type":"array"},{"additionalProperties":true,"type":"object"}]}},"type":"object"},"response":{"anyOf":[{"type":"null"},{"additionalProperties":true,"type":"object"}]},"short_description":{"type":"string"}},"type":"object"},"type":"object"},"required_events":{"items":{"type":"string"},"type":"array"},"views":{"items":{"additionalProperties":false,"properties":{"default_requests":{"items":{"type":"string"},"type":"array"},"layout_type":{"type":"string"},"name":{"type":"string"}},"type":"object"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get extension schema by extension name","summary":"Get extension schema","x-required-permissions":{"all_of":["ext.request","ext.conf.set"]}}},"/feedback":{"post":{"operationId":"submitFeedback","parameters":[],"requestBody":{"description":"feedback payload","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"category":{"type":"string"},"details":{"type":"string"},"oid":{"type":"string"},"source":{"type":"string"},"summary":{"type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"success":{"type":"boolean"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Receive a generic JSON feedback object from a user and relay it to the LimaCharlie customer-feedback Slack channel.","summary":"Submit user feedback"}},"/groups":{"get":{"operationId":"getUserOrgGroups","tags":["Organizations","Groups"],"parameters":[],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"groups":{"items":{"type":"object"},"type":"array"}},"type":"object"},"examples":{"basic":{"value":{"groups":[{"name":"test","orgs":{"test":["test@test.com"]},"owner":"test@test.com"}]}}}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get groups the current user is owner of.","summary":"Get user groups"},"post":{"operationId":"createGroup","tags":["Organizations","Groups"],"parameters":[{"name":"name","required":true,"description":"name of the new group","schema":{"type":"string"},"in":"query"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"additionalProperties":false,"properties":{"gid":{"description":"ID of the newly created group","format":"uuid","type":"string"}},"required":["gid"],"type":"object"},"success":{"type":"boolean"}},"required":["data","success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create new organization group.","summary":"Create group"}},"/groups/concurrent":{"get":{"operationId":"getUserOrgGroupsConcurrent","tags":["Groups"],"parameters":[],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"groups":{"items":{"type":"object"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Gets all group info objects a user is owner of. ","summary":"Get all owned group info"}},"/groups/{gid}":{"delete":{"operationId":"deleteGroup","tags":["Organizations","Groups"],"parameters":[{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"additionalProperties":false,"properties":{"success":{"type":"boolean"}},"required":["success"],"type":"object"},"success":{"type":"boolean"}},"required":["data","success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete group.","summary":"Delete group"},"get":{"operationId":"getGroup","tags":["Groups"],"parameters":[{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"group":{"additionalProperties":false,"properties":{"group_id":{"type":"string"},"members":{"items":{"description":"Member user email","type":"string"},"type":"array"},"name":{"type":"string"},"orgs":{"items":{"additionalProperties":false,"properties":{"org_id":{"format":"uuid","type":"string"},"org_name":{"type":"string"}},"required":["org_id","org_name"],"type":"object"},"type":"array"},"owners":{"items":{"description":"Owner user email","type":"string"},"type":"array"},"perms":{"items":{"description":"Permission name, e.g. org.get","type":"string"},"type":"array"}},"required":["group_id","name","owners","members","orgs","perms"],"type":"object"}},"required":["group"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get group information.","summary":"Get group info"}},"/groups/{gid}/logs":{"get":{"operationId":"getGroupLogs","tags":["Groups"],"parameters":[{"name":"limit","description":"optional number of log lines to return","schema":{"default":"1000","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"logs":{"items":{"additionalProperties":false,"properties":{"code":{"type":"string"},"email":{"type":"string"},"message":{"type":"string"},"timestamp":{"type":"integer"},"uid":{"type":"string"}},"type":"object"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get group logs.","summary":"Get group logs"}},"/groups/{gid}/orgs":{"delete":{"operationId":"removeGroupMemberOrg","tags":["Organizations","Groups"],"parameters":[{"name":"oid","required":true,"description":"oid of the org to remove","schema":{"type":"string"},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"additionalProperties":false,"properties":{"success":{"type":"boolean"}},"required":["success"],"type":"object"},"success":{"type":"boolean"}},"required":["data","success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove organization from group.","summary":"Remove org from group"},"post":{"operationId":"addGroupMemberOrg","tags":["Groups"],"parameters":[{"name":"oid","description":"oid of the org to add","schema":{"type":"string"},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"request object","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"oid":{"type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"additionalProperties":false,"properties":{"success":{"type":"boolean"}},"required":["success"],"type":"object"},"success":{"type":"boolean"}},"required":["data","success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Add organization to group.","summary":"Add org to group","x-required-permissions":{"all_of":["user.ctrl"]}}},"/groups/{gid}/owners":{"delete":{"operationId":"removeGroupOwnerUser","tags":["Organizations","Groups"],"parameters":[{"name":"member_email","required":true,"description":"email of the user to remove","schema":{"type":"string"},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"additionalProperties":false,"properties":{"success":{"type":"boolean"}},"required":["success"],"type":"object"},"success":{"type":"boolean"}},"required":["data","success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove user from group owners.","summary":"Remove user from group owners"},"post":{"operationId":"addGroupOwnerUser","tags":["Groups"],"parameters":[{"name":"member_email","required":true,"description":"email of the user to add","schema":{"type":"string"},"in":"query"},{"name":"invite_missing","description":"if set to 'true' and the user does not exist, send them an invite email instead of failing","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"additionalProperties":false,"properties":{"invite_sent":{"description":"Only present when the user did not exist and invite_missing was set: an invite email was sent instead of adding the user","type":"boolean"},"success":{"description":"Present when the user was added as owner","type":"boolean"}},"type":"object"},"success":{"type":"boolean"}},"required":["data","success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Add user to group as owner.","summary":"Add user to group as owner"}},"/groups/{gid}/permissions":{"post":{"operationId":"setGroupPermissions","tags":["Groups"],"parameters":[{"name":"perm","required":true,"description":"full set of permissions for the group, repeated field","schema":{"type":"string"},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"additionalProperties":false,"properties":{"success":{"type":"boolean"}},"required":["success"],"type":"object"},"success":{"type":"boolean"}},"required":["data","success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Set group permissions.","summary":"Set group permissions"}},"/groups/{gid}/users":{"delete":{"operationId":"removeGroupMemberUser","tags":["Organizations","Groups"],"parameters":[{"name":"member_email","required":true,"description":"email of the user to remove","schema":{"type":"string"},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"additionalProperties":false,"properties":{"success":{"type":"boolean"}},"required":["success"],"type":"object"},"success":{"type":"boolean"}},"required":["data","success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove user from group as member.","summary":"Remove user from group as member"},"post":{"operationId":"addGroupMemberUser","tags":["Groups"],"parameters":[{"name":"member_email","required":true,"description":"email of the user to add","schema":{"type":"string"},"in":"query"},{"name":"invite_missing","description":"if set to 'true' and the user does not exist, send them an invite email instead of failing","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"gid","required":true,"description":"group id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"additionalProperties":false,"properties":{"invite_sent":{"description":"Only present when the user did not exist and invite_missing was set: an invite email was sent instead of adding the user","type":"boolean"}},"type":"object"},"success":{"type":"boolean"}},"required":["data","success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Add user to group as member.","summary":"Add user to group as member"}},"/hive/{hive_name}/schema":{"get":{"operationId":"getHiveSchema","tags":["Hive"],"parameters":[{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"schema":{"additionalProperties":true,"description":"JSON Schema describing the hive's record type","type":"object"}},"required":["schema"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the JSON Schema for a hive's record type.","summary":"Get Hive Schema"}},"/hive/{hive_name}/{oid}":{"get":{"operationId":"listHiveRecord","tags":["Hive"],"parameters":[{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":{"additionalProperties":false,"properties":{"data":{"oneOf":[{"additionalProperties":true,"description":"Record data, structure depends on hive type","type":"object"},{"type":"null"}]},"detection":{"type":"string"},"isDraft":{"type":"boolean"},"name":{"type":"string"},"sys_mtd":{"additionalProperties":false,"properties":{"created_at":{"type":"integer"},"created_by":{"oneOf":[{"type":"string"},{"type":"null"}]},"etag":{"type":"string"},"guid":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_author":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_error":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_error_ts":{"oneOf":[{"type":"integer"},{"type":"null"}]},"last_mod":{"type":"integer"}},"required":["created_at","last_mod"],"type":"object"},"usr_mtd":{"additionalProperties":false,"properties":{"comment":{"type":"string"},"enabled":{"type":"boolean"},"expiry":{"oneOf":[{"type":"integer"},{"type":"null"}]},"tags":{"oneOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}]},"ui_actions":{"oneOf":[{"items":{"additionalProperties":false,"properties":{"label":{"type":"string"},"location":{"type":"string"}},"required":["label","location"],"type":"object"},"type":"array"},{"type":"null"}]}},"required":["comment","enabled"],"type":"object"}},"required":["data","sys_mtd","usr_mtd"],"type":"object"},"description":"Map of record names to HiveRecord objects","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List hive records.","summary":"List Hive Records"}},"/hive/{hive_name}/{oid}/{record_name}":{"delete":{"operationId":"deleteHiveRecord","tags":["Hive"],"parameters":[{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"record_name","required":true,"description":"record name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete the hive record.","summary":"Delete Hive Record"}},"/hive/{hive_name}/{oid}/{record_name}/data":{"get":{"operationId":"getHiveRecord","tags":["Hive"],"parameters":[{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"record_name","required":true,"description":"record name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"oneOf":[{"additionalProperties":true,"description":"Record data, structure depends on hive type","type":"object"},{"type":"null"}]},"detection":{"type":"string"},"isDraft":{"type":"boolean"},"name":{"type":"string"},"sys_mtd":{"additionalProperties":false,"properties":{"created_at":{"type":"integer"},"created_by":{"oneOf":[{"type":"string"},{"type":"null"}]},"etag":{"type":"string"},"guid":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_author":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_error":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_error_ts":{"oneOf":[{"type":"integer"},{"type":"null"}]},"last_mod":{"type":"integer"}},"required":["created_at","last_mod"],"type":"object"},"usr_mtd":{"additionalProperties":false,"properties":{"comment":{"type":"string"},"enabled":{"type":"boolean"},"expiry":{"oneOf":[{"type":"integer"},{"type":"null"}]},"tags":{"oneOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}]},"ui_actions":{"oneOf":[{"items":{"additionalProperties":false,"properties":{"label":{"type":"string"},"location":{"type":"string"}},"required":["label","location"],"type":"object"},"type":"array"},{"type":"null"}]}},"required":["comment","enabled"],"type":"object"}},"required":["data","sys_mtd","usr_mtd"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the hive record data.","summary":"Get Hive Record"},"post":{"operationId":"setHiveRecord","tags":["Hive"],"parameters":[{"name":"etag","description":"the etag to use to conditionally set the record","schema":{"type":"string"},"in":"query"},{"name":"arl","description":"the ARL to use to set the record","schema":{"type":"string"},"in":"query"},{"name":"data","description":"the data to set","schema":{"type":"string"},"in":"query"},{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"record_name","required":true,"description":"record name","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"request object","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"data":{"description":"JSON encoded string of the record data","title":"data","type":"string"},"gzdata":{"description":"base64(gzip(JSON)) alternative to data for payloads larger than the 10MB form limit","title":"gzdata","type":"string"},"usr_mtd":{"description":"JSON encoded string of the record metadata","title":"usr_mtd","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"guid":{"description":"Globally unique ID of the record","type":"string"},"hive":{"additionalProperties":false,"properties":{"name":{"type":"string"},"partition":{"type":"string"}},"required":["name","partition"],"type":"object"},"name":{"type":"string"}},"required":["hive","name","guid"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Set the hive record data.","summary":"Set Hive Record"}},"/hive/{hive_name}/{oid}/{record_name}/mtd":{"get":{"operationId":"getHiveRecordMetadata","tags":["Hive"],"parameters":[{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"record_name","required":true,"description":"record name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"oneOf":[{"additionalProperties":true,"description":"Record data, structure depends on hive type","type":"object"},{"type":"null"}]},"detection":{"type":"string"},"isDraft":{"type":"boolean"},"name":{"type":"string"},"sys_mtd":{"additionalProperties":false,"properties":{"created_at":{"type":"integer"},"created_by":{"oneOf":[{"type":"string"},{"type":"null"}]},"etag":{"type":"string"},"guid":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_author":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_error":{"oneOf":[{"type":"string"},{"type":"null"}]},"last_error_ts":{"oneOf":[{"type":"integer"},{"type":"null"}]},"last_mod":{"type":"integer"}},"required":["created_at","last_mod"],"type":"object"},"usr_mtd":{"additionalProperties":false,"properties":{"comment":{"type":"string"},"enabled":{"type":"boolean"},"expiry":{"oneOf":[{"type":"integer"},{"type":"null"}]},"tags":{"oneOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}]},"ui_actions":{"oneOf":[{"items":{"additionalProperties":false,"properties":{"label":{"type":"string"},"location":{"type":"string"}},"required":["label","location"],"type":"object"},"type":"array"},{"type":"null"}]}},"required":["comment","enabled"],"type":"object"}},"required":["data","sys_mtd","usr_mtd"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the hive record metadata.","summary":"Get Hive Record Metadata"},"post":{"operationId":"setHiveRecordMetadata","tags":["Hive"],"parameters":[{"name":"usr_mtd","description":"the metadata to set","schema":{"type":"string"},"in":"query"},{"name":"etag","description":"the etag to use to conditionally set the metadata","schema":{"type":"string"},"in":"query"},{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"record_name","required":true,"description":"record name","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"request object","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"usr_mtd":{"description":"JSON encoded string of the record metadata","title":"usr_mtd","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"guid":{"description":"Globally unique ID of the record","type":"string"},"hive":{"additionalProperties":false,"properties":{"name":{"type":"string"},"partition":{"type":"string"}},"required":["name","partition"],"type":"object"},"name":{"type":"string"}},"required":["hive","name","guid"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Set the hive record metadata.","summary":"Set Hive Record Metadata"}},"/hive/{hive_name}/{oid}/{record_name}/rename":{"post":{"operationId":"renameHiveRecord","tags":["Hive"],"parameters":[{"name":"new_name","description":"new name of record","schema":{"type":"string"},"in":"query"},{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"record_name","required":true,"description":"record name","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"request object","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"new_name":{"description":"new name of record","title":"new_name","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"guid":{"description":"Globally unique ID of the record","type":"string"},"hive":{"additionalProperties":false,"properties":{"name":{"type":"string"},"partition":{"type":"string"}},"required":["name","partition"],"type":"object"},"name":{"type":"string"}},"required":["hive","name","guid"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Rename a hive record","summary":"Rename Hive Record"}},"/hive/{hive_name}/{oid}/{record_name}/validate":{"post":{"operationId":"validateHiveRecord","tags":["Hive"],"parameters":[{"name":"etag","description":"the etag to use to conditionally validate the record","schema":{"type":"string"},"in":"query"},{"name":"arl","description":"the ARL to use to validate the record","schema":{"type":"string"},"in":"query"},{"name":"data","description":"the data to validate","schema":{"type":"string"},"in":"query"},{"name":"hive_name","required":true,"description":"type of hive record","schema":{"type":"string"},"in":"path"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"record_name","required":true,"description":"record name","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"request object","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"data":{"description":"JSON encoded string of the record data","title":"data","type":"string"},"gzdata":{"description":"base64(gzip(JSON)) alternative to data for payloads larger than the 10MB form limit","title":"gzdata","type":"string"},"usr_mtd":{"description":"JSON encoded string of the record metadata","title":"usr_mtd","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Validate hive record data without storing it.","summary":"Validate Hive Record"}},"/hostnames/{oid}":{"get":{"operationId":"findSensorByHostname","tags":["Sensors"],"parameters":[{"name":"hostname","description":"hostname prefix to search for","schema":{"type":"string"},"in":"query"},{"name":"as_dict","description":"a boolean string (like 'true') indicating to return the records in a dictionary instead of the legacy list format","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"List of sensors matching the hostname","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"sid":{"anyOf":[{"items":{"items":false,"prefixItems":[{"format":"uuid","type":"string"},{"type":"string"}],"type":"array"},"type":"array"},{"items":{"additionalProperties":false,"properties":{"hostname":{"type":"string"},"sid":{"format":"uuid","type":"string"}},"type":"object"},"type":"array"}]}},"required":["sid"],"type":"object"},"examples":{"dict":{"value":{"sid":[{"hostname":"hostname1","sid":"a1b2c3d4-1234-5678-9abc-1234567890ab"},{"hostname":"hostname2","sid":"b2c3d4e5-2345-6789-abcd-234567890abc"}]}},"tuple":{"value":{"sid":[["a1b2c3d4-1234-5678-9abc-1234567890ab","hostname1"],["b2c3d4e5-2345-6789-abcd-234567890abc","hostname2"]]}}}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get sensors with hostnames matching given expression.","summary":"Get Sensors by Hostname","x-required-permissions":{"all_of":["sensor.list"]}}},"/insight/event_count/{oid}/{sid}":{"get":{"operationId":"getEventRetainedCount","tags":["Retention"],"parameters":[{"name":"start","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to begin, e.g. 1735689600. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to stop, e.g. 1735693200. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"is_detailed","description":"set to 'true' to get a per-hour breakdown of the event count","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"from_cache":{"type":"boolean"},"records":{"items":{"additionalProperties":false,"properties":{"Date":{"description":"Hour bucket timestamp (YYYY-MM-DD HH:00:00, UTC)","type":"string"},"Total":{"anyOf":[{"description":"Event count for the hour bucket","type":"integer"},{"type":"null"}]}},"type":"object"},"type":"array"},"total":{"anyOf":[{"description":"Total number of events retained over the window","type":"integer"},{"type":"null"}]}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve historical data from the sensor using Insight.","summary":"Get Historical Events","x-required-permissions":{"all_of":["insight.stat"]}}},"/insight/{oid}":{"get":{"operationId":"getInsightStatus","tags":["Retention"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"insight_bucket":{"type":"string"},"insight_dataset":{"type":"string"}},"required":["insight_bucket","insight_dataset"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Check if the organization is configured with Insight.","summary":"Get Retention Status","x-required-permissions":{"all_of":["insight.list"]}}},"/insight/{oid}/artifacts":{"get":{"operationId":"getArtifactList","tags":["Retention","Artifacts"],"parameters":[{"name":"start","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to begin, e.g. 1735689600. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to stop, e.g. 1735693200. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"cursor","description":"optional cursor for paginated access, set to '-' for first query","schema":{"type":"string"},"in":"query"},{"name":"hint","description":"optional hint for the type of artifact to query for","schema":{"type":"string"},"in":"query"},{"name":"source","description":"optional source (sensor or adapter ID) to filter the artifacts by","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"logs":{"items":{"additionalProperties":false,"properties":{"error":{"type":"string"},"expires":{"type":"integer"},"is_indexed":{"type":"boolean"},"path":{"type":"string"},"payload_id":{"type":"string"},"size":{"type":"integer"},"source":{"type":"string"},"ts":{"type":"integer"},"type":{"type":"string"}},"type":"object"},"type":"array"},"next_cursor":{"oneOf":[{"type":"string"},{"type":"null"}]}},"required":["logs"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the list of artifacts available during a time frame.","summary":"Get Artifact List","x-required-permissions":{"any_of":["insight.evt.get","insight.evt.get.simple"]}}},"/insight/{oid}/artifacts/originals/{artifact_id}":{"get":{"operationId":"getOriginalArtifact","tags":["Retention","Artifacts"],"parameters":[{"name":"is_compressed","description":"set to 'true' to enable compression, data returned 'events' is base64(gzip(data))","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"dest_bucket","description":"destination bucket for the artifact","schema":{"type":"string"},"in":"query"},{"name":"svc_creds","description":"service credentials for the destination bucket","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"artifact_id","required":true,"description":"artifact id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"expires":{"type":"integer"},"export":{"type":"string"},"export_id":{"type":"string"},"id":{"type":"string"},"oid":{"format":"uuid","type":"string"},"path":{"type":"string"},"payload":{"type":"string"},"records":{"additionalProperties":{"type":"string"},"type":"object"},"region":{"type":"string"},"size":{"type":"integer"},"source":{"type":"string"},"ts":{"type":"integer"},"type":{"type":"string"},"was_billed":{"type":"boolean"}},"required":["expires","export","export_id","id","oid","path","region","size","source","ts","type","was_billed"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve the original version of a specific artifact.","summary":"Get Original Artifact","x-required-permissions":{"any_of":["insight.evt.get","insight.evt.get.simple"]}}},"/insight/{oid}/artifacts/payloads/{payload_id}":{"get":{"operationId":"getReadableArtifact","tags":["Retention","Artifacts"],"parameters":[{"name":"records","description":"the record IDs to retrieve specifically, repeated field","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"is_compressed","description":"set to 'true' to enable compression, data returned 'logs' is base64(gzip(data))","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"with_raw","description":"set to 'true' to include raw data in the response","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"payload_id","required":true,"description":"payload/log id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"logs":{"oneOf":[{"description":"Parsed log data. When is_compressed is 'true', this is base64(gzip(data))","type":"string"},{"additionalProperties":{"additionalProperties":false,"properties":{"export":{"type":"string"},"export_id":{"type":"string"},"id":{"type":"string"},"oid":{"format":"uuid","type":"string"},"path":{"type":"string"},"records":{"additionalProperties":{"type":"string"},"type":"object"},"requested_by":{"type":"string"},"size":{"type":"integer"},"source":{"type":"string"},"ts":{"type":"integer"},"type":{"type":"string"}},"required":["id","oid","path","size","source","ts","type"],"type":"object"},"description":"Parsed log data as an object with record IDs as keys","type":"object"}]}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve the parsed/readable version of a specific artifact.","summary":"Get Readable Artifact","x-required-permissions":{"all_of":["insight.list"]}}},"/insight/{oid}/audit":{"get":{"operationId":"getAuditEvents","tags":["Retention"],"parameters":[{"name":"start","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to begin, e.g. 1735689600. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to stop, e.g. 1735693200. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"limit","description":"maximum number of audit events to return","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"event_type","description":"specific audit event type to fetch","schema":{"type":"string"},"in":"query"},{"name":"is_compressed","description":"set to 'true' to enable compression, data returned 'events' is base64(gzip(data))","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"cursor","description":"optional cursor for paginated access, set to '-' for first query","schema":{"type":"string"},"in":"query"},{"name":"is_forward","description":"direction of paginated query results, defaults to 'true' (ascending).","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"output_name","description":"send data to a named output instead","schema":{"type":"string"},"in":"query"},{"name":"sid","description":"only return events relating to a specific sensor id","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"events":{"oneOf":[{"description":"Compressed events data (base64(gzip(data))) when is_compressed is 'true'","type":"string"},{"description":"Uncompressed events array when is_compressed is not set or 'false'","items":{"additionalProperties":false,"properties":{"entity":{"additionalProperties":false,"properties":{"hive_name":{"type":"string"},"hive_partititon":{"type":"string"},"hive_record_name":{"type":"string"},"output_name":{"type":"string"},"sid":{"type":"string"},"stream":{"type":"string"}},"type":"object"},"etype":{"type":"string"},"ident":{"type":"string"},"msg":{"type":"string"},"mtd":{"additionalProperties":false,"properties":{"module":{"type":"string"},"n_billed":{"type":"integer"},"n_free":{"type":"integer"},"stream":{"type":"string"},"task":{"type":"string"}},"type":"object"},"oid":{"format":"uuid","type":"string"},"origin":{"type":"string"},"time":{"type":"integer"},"ts":{"type":"string"}},"required":["etype","msg","oid","origin","time","ts"],"type":"object"},"type":"array"}]},"next_cursor":{"type":"string"}},"required":["events"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve retained LimaCharlie audit logs using Insight.","summary":"Get Audit Events","x-required-permissions":{"all_of":["audit.get"]}}},"/insight/{oid}/detections":{"get":{"operationId":"getDetections","tags":["Retention"],"parameters":[{"name":"start","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to begin, e.g. 1735689600. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to stop, e.g. 1735693200. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"limit","description":"maximum number of detections to return","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"cat","description":"specific detection category to fetch","schema":{"type":"string"},"in":"query"},{"name":"is_compressed","description":"set to 'true' to enable compression, data returned 'detects' is base64(gzip(data))","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"cursor","description":"optional cursor for paginated access, set to '-' for first query","schema":{"type":"string"},"in":"query"},{"name":"is_forward","description":"direction of paginated query results, defaults to 'true' (ascending).","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"sid","description":"only return detections relating to a specific sensor id","schema":{"type":"string"},"in":"query"},{"name":"output_name","description":"send data to a named output instead","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"detects":{"oneOf":[{"description":"Compressed detections data (base64(gzip(data))) when is_compressed is 'true'","type":"string"},{"description":"Uncompressed detections array when is_compressed is not set or 'false'","items":{"additionalProperties":false,"properties":{"author":{"type":"string"},"cat":{"type":"string"},"detect":{"additionalProperties":false,"description":"SensorEvent or wrapped detection containing the event","properties":{"Event":{"additionalProperties":true,"description":"Alternative event data format","type":"object"},"author":{"type":"string"},"cat":{"type":"string"},"detect":{"additionalProperties":true,"description":"Nested SensorEvent in wrapped detection format","type":"object"},"detect_data":{"additionalProperties":true,"type":"object"},"detect_id":{"type":"string"},"detect_mtd":{"additionalProperties":true,"type":"object"},"event":{"additionalProperties":true,"description":"Event data, structure varies by event type","type":"object"},"gen_time":{"type":"integer"},"link":{"type":"string"},"mtd":{"additionalProperties":true,"type":"object"},"priority":{"type":"integer"},"routing":{"additionalProperties":false,"description":"Routing information for the event","properties":{"arch":{"oneOf":[{"type":"string"},{"type":"number"}]},"did":{"type":"string"},"event_id":{"type":"string"},"event_time":{"type":"integer"},"event_type":{"type":"string"},"ext_ip":{"type":"string"},"hostname":{"type":"string"},"iid":{"type":"string"},"int_ip":{"type":"string"},"investigation_id":{"type":"string"},"latency":{"type":"integer"},"link":{"type":"string"},"log_id":{"type":"string"},"log_type":{"type":"string"},"moduleid":{"type":"integer"},"oid":{"format":"uuid","type":"string"},"parent":{"type":"string"},"plat":{"oneOf":[{"type":"string"},{"type":"number"}]},"sid":{"format":"uuid","type":"string"},"tags":{"items":{"type":"string"},"type":"array"},"target":{"type":"string"},"this":{"type":"string"}},"required":["event_time","event_type","oid"],"type":"object"},"rule_tags":{"items":{"type":"string"},"type":"array"},"source":{"type":"string"},"source_rule":{"type":"string"}},"type":"object"},"detect_data":{"additionalProperties":true,"type":"object"},"detect_id":{"type":"string"},"detect_mtd":{"additionalProperties":true,"type":"object"},"gen_time":{"type":"integer"},"link":{"type":"string"},"mtd":{"additionalProperties":true,"type":"object"},"namespace":{"type":"string"},"priority":{"type":"integer"},"routing":{"additionalProperties":false,"description":"Routing information (duplicate of detect.routing)","properties":{"arch":{"oneOf":[{"type":"string"},{"type":"number"}]},"did":{"type":"string"},"event_id":{"type":"string"},"event_time":{"type":"integer"},"event_type":{"type":"string"},"ext_ip":{"type":"string"},"hostname":{"type":"string"},"iid":{"type":"string"},"int_ip":{"type":"string"},"investigation_id":{"type":"string"},"latency":{"type":"integer"},"link":{"type":"string"},"log_id":{"type":"string"},"log_type":{"type":"string"},"moduleid":{"type":"integer"},"oid":{"format":"uuid","type":"string"},"parent":{"type":"string"},"plat":{"oneOf":[{"type":"string"},{"type":"number"}]},"sid":{"format":"uuid","type":"string"},"tags":{"items":{"type":"string"},"type":"array"},"target":{"type":"string"},"this":{"type":"string"}},"required":["event_time","event_type","oid"],"type":"object"},"rule_tags":{"items":{"type":"string"},"type":"array"},"source":{"type":"string"},"source_rule":{"type":"string"},"ts":{"type":"integer"}},"type":"object"},"type":"array"}]},"from_cache":{"type":"boolean"},"next_cursor":{"type":"string"},"prev_cursor":{"type":"string"}},"required":["detects"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve historical detections using Insight.","summary":"Get Detections","x-required-permissions":{"all_of":["insight.det.get"]}}},"/insight/{oid}/detections/breakdown":{"get":{"operationId":"getDetectionBreakdown","tags":["Retention"],"parameters":[{"name":"start","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to begin, e.g. 1735689600. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to stop, e.g. 1735693200. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"breakdown":{"additionalProperties":{"type":"integer"},"description":"Map of detection categories to counts","type":"object"}},"required":["breakdown"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve detection type information using Insight.","summary":"Get Detections Breakdown","x-required-permissions":{"all_of":["insight.stat"]}}},"/insight/{oid}/detections/stats":{"get":{"operationId":"getDetectionStats","tags":["Retention"],"parameters":[{"name":"start","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to begin, e.g. 1735689600. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to stop, e.g. 1735693200. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"per","description":"optional time period to group by, one of: hour, day, week, month","schema":{"type":"string"},"in":"query"},{"name":"sid","description":"optional sensor ID to filter by","schema":{"format":"uuid","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"totals":{"anyOf":[{"additionalProperties":{"type":"integer"},"description":"Flat stats: map of timestamps to detection counts","type":"object"},{"additionalProperties":{"additionalProperties":{"type":"integer"},"type":"object"},"description":"Categorized stats: map of category names to timestamp-based stats","type":"object"}]}},"required":["totals"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve detection stats information using Insight.","summary":"Get Detection Stats","x-required-permissions":{"all_of":["insight.stat"]}}},"/insight/{oid}/detections/{atom}":{"get":{"operationId":"getDetectByDetectID","tags":["Retention"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"atom","required":true,"description":"event atom id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"event":{"additionalProperties":false,"description":"Detection event object","properties":{"author":{"type":"string"},"cat":{"type":"string"},"detect":{"additionalProperties":false,"description":"SensorEvent or wrapped detection containing the event","properties":{"Event":{"additionalProperties":true,"description":"Alternative event data format","type":"object"},"author":{"type":"string"},"cat":{"type":"string"},"detect":{"additionalProperties":true,"description":"Nested SensorEvent in wrapped detection format","type":"object"},"detect_data":{"additionalProperties":true,"type":"object"},"detect_id":{"type":"string"},"detect_mtd":{"additionalProperties":true,"type":"object"},"event":{"additionalProperties":true,"description":"Event data, structure varies by event type","type":"object"},"gen_time":{"type":"integer"},"link":{"type":"string"},"mtd":{"additionalProperties":true,"type":"object"},"priority":{"type":"integer"},"routing":{"additionalProperties":false,"description":"Routing information for the event","properties":{"arch":{"oneOf":[{"type":"string"},{"type":"number"}]},"did":{"type":"string"},"event_id":{"type":"string"},"event_time":{"type":"integer"},"event_type":{"type":"string"},"ext_ip":{"type":"string"},"hostname":{"type":"string"},"iid":{"type":"string"},"int_ip":{"type":"string"},"investigation_id":{"type":"string"},"latency":{"type":"integer"},"link":{"type":"string"},"log_id":{"type":"string"},"log_type":{"type":"string"},"moduleid":{"type":"integer"},"oid":{"format":"uuid","type":"string"},"parent":{"type":"string"},"plat":{"oneOf":[{"type":"string"},{"type":"number"}]},"sid":{"format":"uuid","type":"string"},"tags":{"items":{"type":"string"},"type":"array"},"target":{"type":"string"},"this":{"type":"string"}},"required":["event_time","event_type","oid","sid","this"],"type":"object"},"rule_tags":{"items":{"type":"string"},"type":"array"},"source":{"type":"string"},"source_rule":{"type":"string"}},"type":"object"},"detect_data":{"additionalProperties":true,"type":"object"},"detect_id":{"type":"string"},"detect_mtd":{"additionalProperties":true,"type":"object"},"gen_time":{"type":"integer"},"link":{"type":"string"},"mtd":{"additionalProperties":true,"type":"object"},"namespace":{"type":"string"},"priority":{"type":"integer"},"routing":{"additionalProperties":false,"description":"Routing information (duplicate of detect.routing)","properties":{"arch":{"oneOf":[{"type":"string"},{"type":"number"}]},"did":{"type":"string"},"event_id":{"type":"string"},"event_time":{"type":"integer"},"event_type":{"type":"string"},"ext_ip":{"type":"string"},"hostname":{"type":"string"},"iid":{"type":"string"},"int_ip":{"type":"string"},"investigation_id":{"type":"string"},"latency":{"type":"integer"},"link":{"type":"string"},"log_id":{"type":"string"},"log_type":{"type":"string"},"moduleid":{"type":"integer"},"oid":{"format":"uuid","type":"string"},"parent":{"type":"string"},"plat":{"oneOf":[{"type":"string"},{"type":"number"}]},"sid":{"format":"uuid","type":"string"},"tags":{"items":{"type":"string"},"type":"array"},"target":{"type":"string"},"this":{"type":"string"}},"required":["event_time","event_type","oid"],"type":"object"},"rule_tags":{"items":{"type":"string"},"type":"array"},"source":{"type":"string"},"source_rule":{"type":"string"},"ts":{"type":"integer"}},"required":["author","cat","detect","detect_id","namespace","source","source_rule","ts"],"type":"object"}},"required":["event"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve a specific detection by detect_id from Insight.","summary":"Get Detect by DetectID","x-required-permissions":{"all_of":["insight.det.get"]}}},"/insight/{oid}/ingestion_keys":{"delete":{"operationId":"removeIngestionKey","tags":["Retention"],"parameters":[{"name":"name","description":"name of the ingestion key to remove","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"request for the removal of ingestion key","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"name":{"description":"name of the ingestion key to remove","title":"name","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove an ingestion key.","summary":"Remove Ingestion Key","x-required-permissions":{"all_of":["ingestkey.ctrl"]}},"get":{"operationId":"getIngestionKeys","tags":["Retention"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"keys":{"additionalProperties":{"type":"string"},"type":"object"}},"required":["keys"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the ingestion keys.","summary":"Get Ingestion Keys","x-required-permissions":{"all_of":["ingestkey.ctrl"]}},"post":{"operationId":"addIngestionKey","tags":["Retention"],"parameters":[{"name":"name","description":"name of the ingestion key to create","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"request for the new ingestion key","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"name":{"description":"name of the ingestion key to create","title":"name","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"key":{"description":"The server-generated ingestion key value","type":"string"},"name":{"type":"string"}},"required":["name","key"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create a new ingestion key.","summary":"Add Ingestion Key","x-required-permissions":{"all_of":["ingestkey.ctrl"]}}},"/insight/{oid}/metrics":{"post":{"operationId":"getEntityMetrics","tags":["Retention"],"parameters":[{"name":"start","description":"optional Unix epoch timestamp in SECONDS (not milliseconds) where to begin, e.g. 1735689600. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"optional Unix epoch timestamp in SECONDS (not milliseconds) where to stop, e.g. 1735693200. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"entity_type","description":"the type of entity to query for","schema":{"type":"string"},"in":"query"},{"name":"entity_id","description":"the unique ID of the entity to query","schema":{"type":"string"},"in":"query"},{"name":"metric_name","description":"the name of the metric to query","schema":{"type":"string"},"in":"query"},{"name":"bucket_seconds","description":"optional bucket size in seconds to aggregate the metric values by","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"entities":{"items":{"additionalProperties":false,"properties":{"entity":{"additionalProperties":false,"properties":{"entity_id":{"type":"string"},"entity_type":{"type":"string"},"metric_name":{"type":"string"},"oid":{"format":"uuid","type":"string"}},"required":["oid","entity_type","entity_id","metric_name"],"type":"object"},"metrics":{"items":{"additionalProperties":false,"properties":{"metric":{"type":"integer"},"ts":{"description":"Bucket-aligned unix timestamp in seconds","type":"integer"}},"required":["ts","metric"],"type":"object"},"type":"array"}},"required":["entity","metrics"],"type":"object"},"type":"array"}},"required":["entities"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve a history of metrics for entities.","summary":"Get Entity Metrics","x-required-permissions":{"all_of":["insight.stat"]}}},"/insight/{oid}/object_usage/{objType}":{"get":{"operationId":"getObjectSummary","tags":["Retention"],"parameters":[{"name":"name","required":true,"description":"name of the object to look for","schema":{"type":"string"},"in":"query"},{"name":"case_sensitive","description":"set to 'false' to disable case sensitivity","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"is_compressed","description":"set to 'true' to enable compression, data returned 'events' is base64(gzip(data))","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"start","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to begin, e.g. 1735689600. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to stop, e.g. 1735693200. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"objType","required":true,"description":"type of object, one of: user, domain, ip, file_hash, file_path, file_name, service_name, package_name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"from_cache":{"type":"boolean"},"logs":{"anyOf":[{"additionalProperties":{"type":"integer"},"description":"Map of external log ID to unix timestamp (seconds) of first sighting","type":"object"},{"description":"base64(gzip(JSON)) of the map when is_compressed=true","type":"string"}]},"usage":{"anyOf":[{"additionalProperties":{"type":"integer"},"description":"Map of sensor ID to unix timestamp (seconds) of first sighting","type":"object"},{"description":"base64(gzip(JSON)) of the map when is_compressed=true","type":"string"}]}},"required":["usage","logs"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve summarized usage for a specific object / indicator using Insight.","summary":"Get Object Summary","x-required-permissions":{"any_of":["insight.evt.get","insight.evt.get.simple"]}}},"/insight/{oid}/objects":{"post":{"operationId":"getSpecificObjects","tags":["Retention"],"parameters":[{"name":"objects","description":"a JSON dictionary like: {objType: [objName1, objName2, ...]}","schema":{"type":"string"},"in":"query"},{"name":"case_sensitive","description":"set to 'false' to disable case sensitivity","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"info","description":"the type of information to receive, one of: summary, locations (default: summary)","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"per-indicator location cap when info=locations (default 100, max 1000)","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"with_wildcards","description":"set to 'true' to treat each object name as a BigQuery LIKE pattern (e.g. '10.10.%'). Only valid when info=locations.","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"anyOf":[{"additionalProperties":false,"description":"Batch summary response (info=summary)","patternProperties":{"^last_[0-9]+_days$":{"additionalProperties":{"additionalProperties":{"description":"Number of hits for the object name in the time bucket","type":"integer"},"description":"Map of object name to hit count","type":"object"},"description":"Map of object type to per-name hit counts","type":"object"}},"properties":{"from_cache":{"type":"boolean"}},"type":"object"},{"additionalProperties":{"additionalProperties":{"additionalProperties":false,"properties":{"locations":{"items":{"additionalProperties":false,"properties":{"first_ts":{"type":"integer"},"hostname":{"type":"string"},"last_ts":{"type":"integer"},"sid":{"format":"uuid","type":"string"}},"required":["sid","hostname","first_ts","last_ts"],"type":"object"},"type":"array"},"summary":{"additionalProperties":false,"properties":{"last_1_days":{"type":"integer"},"last_30_days":{"type":"integer"},"last_365_days":{"type":"integer"},"last_7_days":{"type":"integer"}},"required":["last_1_days","last_7_days","last_30_days","last_365_days"],"type":"object"}},"required":["summary","locations"],"type":"object"},"description":"Map of indicator (as supplied by the caller) to its summary and locations","type":"object"},"description":"Batch locations response (info=locations): map of object type to indicators","properties":{"errors":{"additionalProperties":{"type":"string"},"description":"Only present when some object types failed: map of object type to error message","type":"object"}},"type":"object"}]}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve historical information about specific objects / indicators using Insight.","summary":"Get Specific Objects","x-required-permissions":{"any_of":["insight.evt.get","insight.evt.get.simple"]}}},"/insight/{oid}/objects-details":{"get":{"operationId":"getSpecificObjectsFmtOutput","tags":["Retention"],"parameters":[{"name":"types","required":true,"description":"type of object, one of: user, domain, ip, file_hash, file_path, file_name, service_name, package_name","schema":{"type":"string"},"in":"query"},{"name":"name","required":true,"description":"name of the object to look for","schema":{"type":"string"},"in":"query"},{"name":"time_range","description":"a comma seperated list of ranges to search through, list must have 4 elements EX: 1,7,30,90","schema":{"type":"string"},"in":"query"},{"name":"info","description":"ignored: this endpoint always returns the summary form; kept for backwards compatibility","schema":{"type":"string"},"in":"query"},{"name":"with_wildcards","description":"set to 'true' to be able to use '%' wildcards in the object name","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"case_sensitive","description":"set to 'false' to disable case sensitivity","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"per_object","description":"set to 'true' to get results per object","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":{"additionalProperties":false,"description":"Hit counts per time bucket for the object type","patternProperties":{"^last_[0-9]+_days$":{"anyOf":[{"description":"Number of hits in the time bucket","type":"integer"},{"additionalProperties":{"type":"integer"},"description":"Number of hits per object value (when per_object=true)","type":"object"}]}},"type":"object"},"properties":{"from_cache":{"type":"boolean"},"name":{"type":"string"}},"required":["name"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve historical information about specific objects / indicators using Insight.","summary":"Get Objects summarized by list of types","x-required-permissions":{"any_of":["insight.evt.get","insight.evt.get.simple"]}}},"/insight/{oid}/objects/{objType}":{"get":{"operationId":"getObjectInformation","tags":["Retention"],"parameters":[{"name":"name","required":true,"description":"name of the object to look for","schema":{"type":"string"},"in":"query"},{"name":"info","required":true,"description":"the type of information to receive, one of: summary, locations","schema":{"type":"string"},"in":"query"},{"name":"case_sensitive","description":"set to 'false' to disable case sensitivity","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"with_wildcards","description":"set to 'true' to be able to use '%' wildcards in the object name","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"per_object","description":"set to 'true' to return one entry per object","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"limit","description":"maximum number of results to return","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"objType","required":true,"description":"type of object, one of: user, domain, ip, file_hash, file_path, file_name, service_name, package_name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"anyOf":[{"additionalProperties":false,"description":"Summary response (info=summary)","properties":{"from_cache":{"type":"boolean"},"last_1_days":{"anyOf":[{"description":"Number of hits in the time bucket","type":"integer"},{"additionalProperties":{"type":"integer"},"description":"Number of hits per object value (when per_object=true)","type":"object"}]},"last_30_days":{"anyOf":[{"description":"Number of hits in the time bucket","type":"integer"},{"additionalProperties":{"type":"integer"},"description":"Number of hits per object value (when per_object=true)","type":"object"}]},"last_365_days":{"anyOf":[{"description":"Number of hits in the time bucket","type":"integer"},{"additionalProperties":{"type":"integer"},"description":"Number of hits per object value (when per_object=true)","type":"object"}]},"last_7_days":{"anyOf":[{"description":"Number of hits in the time bucket","type":"integer"},{"additionalProperties":{"type":"integer"},"description":"Number of hits per object value (when per_object=true)","type":"object"}]},"name":{"type":"string"},"type":{"type":"string"}},"required":["type","name","last_1_days","last_7_days","last_30_days","last_365_days"],"type":"object"},{"additionalProperties":{"anyOf":[{"additionalProperties":false,"description":"Sensor-origin location","properties":{"first_ts":{"type":"integer"},"hostname":{"anyOf":[{"type":"string"},{"type":"null"}]},"last_ts":{"type":"integer"},"obj":{"description":"Only present when per_object=true","type":"string"},"sid":{"format":"uuid","type":"string"}},"required":["sid","first_ts","last_ts"],"type":"object"},{"additionalProperties":false,"description":"External-log-origin location","properties":{"first":{"type":"integer"},"id":{"type":"string"},"last":{"type":"integer"},"obj":{"description":"Only present when per_object=true","type":"string"},"records":{"items":{"type":"integer"},"type":"array"},"source":{"type":"string"},"type":{"type":"string"}},"required":["source","type","id","records","first","last"],"type":"object"}]},"description":"Locations response (info=locations): map of location key to location entry; empty object when nothing matched","properties":{"from_cache":{"type":"boolean"},"name":{"description":"Only present when at least one location matched","type":"string"},"type":{"description":"Only present when at least one location matched","type":"string"}},"type":"object"}]}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve historical information about specific objects / indicators using Insight.","summary":"Get Object Information","x-required-permissions":{"any_of":["insight.evt.get","insight.evt.get.simple"]}}},"/insight/{oid}/online/stats":{"get":{"operationId":"getOnlineStats","tags":["Retention"],"parameters":[{"name":"start","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to begin, e.g. 1735689600. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to stop, e.g. 1735693200. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"totals":{"anyOf":[{"additionalProperties":{"type":"integer"},"description":"Flat stats: map of timestamps to online sensor counts","type":"object"},{"additionalProperties":{"additionalProperties":{"type":"integer"},"type":"object"},"description":"Categorized stats: map of category names to timestamp-based stats","type":"object"}]}},"required":["totals"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve stats on sensors online using Insight.","summary":"Get Online Stats","x-required-permissions":{"all_of":["insight.stat"]}}},"/insight/{oid}/traffic/breakdown":{"get":{"operationId":"getTrafficBreakdown","tags":["Retention"],"parameters":[{"name":"start","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to begin, e.g. 1735689600. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to stop, e.g. 1735693200. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"breakdown":{"additionalProperties":{"type":"integer"},"description":"Map of traffic categories to counts","type":"object"}},"required":["breakdown"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve traffic type information using Insight.","summary":"Get Traffic Breakdown","x-required-permissions":{"all_of":["insight.stat"]}}},"/insight/{oid}/traffic/stats":{"get":{"operationId":"getTrafficStats","tags":["Retention"],"parameters":[{"name":"start","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to begin, e.g. 1735689600. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to stop, e.g. 1735693200. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"sid","description":"only return events relating to a specific sensor id","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"totals":{"anyOf":[{"additionalProperties":{"type":"integer"},"description":"Flat stats: map of timestamps to traffic counts","type":"object"},{"additionalProperties":{"additionalProperties":{"type":"integer"},"type":"object"},"description":"Categorized stats: map of category names to timestamp-based stats","type":"object"}]}},"required":["totals"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve traffic stats information using Insight.","summary":"Get Traffic Stats","x-required-permissions":{"all_of":["insight.stat"]}}},"/insight/{oid}/{sid}":{"get":{"operationId":"getHistoricEvents","tags":["Retention"],"parameters":[{"name":"start","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to begin, e.g. 1735689600. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to stop, e.g. 1735693200. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"limit","description":"maximum number of events to return","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"event_type","description":"specific event type to fetch","schema":{"type":"string"},"in":"query"},{"name":"is_compressed","description":"set to 'true' to enable compression, data returned 'events' is base64(gzip(data))","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"cursor","description":"optional cursor for paginated access, set to '-' for first query","schema":{"type":"string"},"in":"query"},{"name":"is_forward","description":"direction of paginated query results, defaults to 'true' (ascending).","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"output_name","description":"send data to a named output instead","schema":{"type":"string"},"in":"query"},{"name":"epcon","description":"internal: when present, routes the query through the get_historical_events RPC (epcon testing)","schema":{"type":"string"},"in":"query"},{"name":"stream","description":"internal: stream name override, only used together with epcon","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"events":{"oneOf":[{"items":{"additionalProperties":true,"description":"Event data, structure varies by event type","type":"object"},"type":"array"},{"description":"Compressed events data (base64(gzip(data))) when is_compressed is 'true'","type":"string"}]},"from_cache":{"type":"boolean"},"next_cursor":{"description":"cursor for the next page","title":"cursor","type":"string"}},"required":["events","next_cursor"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve historical data from the sensor using Insight.","summary":"Get Historical Events","x-required-permissions":{"any_of":["insight.evt.get","insight.evt.get.simple"]}}},"/insight/{oid}/{sid}/overview":{"get":{"operationId":"getHistoricEventOverview","tags":["Retention"],"parameters":[{"name":"start","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to begin, e.g. 1735689600. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required Unix epoch timestamp in SECONDS (not milliseconds) where to stop, e.g. 1735693200. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"from_cache":{"type":"boolean"},"overview":{"items":{"type":"number"},"type":"array"}},"required":["overview"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve overview data of the historical data from the sensor using Insight.","summary":"Get Historical Overview","x-required-permissions":{"any_of":["insight.evt.get","insight.evt.get.simple"]}}},"/insight/{oid}/{sid}/{atom}":{"get":{"operationId":"getEventByAtom","tags":["Retention"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"atom","required":true,"description":"event atom id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"event":{"additionalProperties":true,"description":"Event data, structure varies by event type","type":"object"},"from_cache":{"type":"boolean"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve a specific event by atom from Insight.","summary":"Get Event by Atom","x-required-permissions":{"any_of":["insight.evt.get","insight.evt.get.simple"]}}},"/insight/{oid}/{sid}/{atom}/children":{"get":{"operationId":"getChildrenOfAtom","tags":["Retention"],"parameters":[{"name":"is_compressed","description":"set to 'true' to enable compression, data returned 'events' is base64(gzip(data))","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"atom","required":true,"description":"event atom id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"events":{"oneOf":[{"description":"Compressed events data (base64(gzip(data))) when is_compressed is 'true'","type":"string"},{"description":"Uncompressed events array when is_compressed is not set or 'false'","items":{"type":"object"},"type":"array"}]},"from_cache":{"type":"boolean"},"stopped_all_terminated":{"type":"boolean"},"stopped_deadline":{"type":"boolean"},"stopped_rebooted":{"type":"boolean"},"too_many_events":{"type":"boolean"}},"required":["events"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve all children of atom from Insight.","summary":"Get Children Of Atom","x-required-permissions":{"any_of":["insight.evt.get","insight.evt.get.simple"]}}},"/installationkeys/{oid}":{"delete":{"operationId":"removeInstallationKey","tags":["Installation Keys"],"parameters":[{"name":"iid","description":"installer id to delete","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete an installation key for the organization.","summary":"Remove Installation Key","x-required-permissions":{"all_of":["ikey.del"]}},"get":{"operationId":"getInstallationKeys","tags":["Installation Keys"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":{"additionalProperties":{"additionalProperties":false,"properties":{"created":{"anyOf":[{"type":"string"},{"type":"number"}]},"desc":{"type":"string"},"iid":{"type":"string"},"json_key":{"description":"JSON enrollment key used by browser extensions and adapters","type":"string"},"key":{"description":"Base64-encoded sensor bootstrap key","type":"string"},"oid":{"type":"string"},"quota_remaining":{"type":"integer"},"quota_total":{"type":"integer"},"tags":{"description":"Comma-separated list of tags applied to enrolling sensors","type":"string"},"use_public_root_ca":{"type":"boolean"}},"required":["oid","iid","key","json_key","created","desc","tags","use_public_root_ca"],"type":"object"},"type":"object"},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the installation keys for the organization.","summary":"Get Installation Keys","x-required-permissions":{"all_of":["ikey.list"]}},"post":{"operationId":"addInstallationKey","tags":["Installation Keys"],"parameters":[{"name":"tags","description":"tags to associate with sensors","schema":{"type":"string"},"in":"query"},{"name":"desc","description":"description of key","schema":{"type":"string"},"in":"query"},{"name":"use_public_root_ca","description":"whether to use the public root CA","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"quota","description":"quota for the installation key","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"iid","description":"installation id key, required for update.","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"iid":{"description":"ID of the created or updated installation key","format":"uuid","type":"string"},"oid":{"format":"uuid","type":"string"}},"required":["oid","iid"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create a new installation key for the organization.","summary":"Add Installation Key","x-required-permissions":{"all_of":["ikey.set"]}}},"/installationkeys/{oid}/{iid}":{"get":{"operationId":"getInstallationKey","tags":["Installation Keys"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"iid","required":true,"description":"installation key id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"created":{"anyOf":[{"type":"string"},{"type":"number"}]},"desc":{"type":"string"},"iid":{"type":"string"},"json_key":{"description":"JSON enrollment key used by browser extensions and adapters","type":"string"},"key":{"description":"Base64-encoded sensor bootstrap key","type":"string"},"oid":{"type":"string"},"quota_remaining":{"type":"integer"},"quota_total":{"type":"integer"},"tags":{"description":"Comma-separated list of tags applied to enrolling sensors","type":"string"},"use_public_root_ca":{"type":"boolean"}},"required":["oid","iid","key","json_key","created","desc","tags","use_public_root_ca"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get a specific installation key from the organization.","summary":"Get Installation Key","x-required-permissions":{"all_of":["ikey.list"]}}},"/invite/user":{"post":{"operationId":"inviteUserToLC","tags":["Groups"],"parameters":[],"requestBody":{"description":"invite user request","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"user_email":{"allOf":[{"type":"string"},{"format":"email","type":"string"},{"pattern":"^[^@]+@[^@]+$","type":"string"}]}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"exists":{"description":"Only present when the user already had an account; no invite email is sent in that case","type":"boolean"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Invite user to limacharlie.io.","summary":"Invite user to limacharlie.io"}},"/job/{oid}":{"get":{"operationId":"getJobs","tags":["Jobs"],"parameters":[{"name":"start","description":"required timestamp in seconds where to begin fetching jobs","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"required timestamp in seconds where to stop fetching jobs","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"limit","description":"maximum number of jobs to return","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"sid","description":"optionally only fetch jobs relating to a Sensor ID","schema":{"type":"string"},"in":"query"},{"name":"is_compressed","description":"set to 'true' to enable compression, data returned is base64(gzip(data))","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"with_data","description":"optionally include full job data, 'true' or 'false'","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"jobs":{"oneOf":[{"additionalProperties":false,"type":"object"},{"description":"Compressed jobs data (base64(gzip(data))) when is_compressed is 'true'","type":"string"}]}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Retrieve jobs for an organization.","summary":"Get Jobs","x-required-permissions":{"all_of":["job.get"]}}},"/job/{oid}/{job_id}":{"delete":{"operationId":"removeJob","tags":["Jobs"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"job_id","required":true,"description":"job id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete a specific job.","summary":"Remove Job","x-required-permissions":{"all_of":["job.set"]}},"get":{"operationId":"getJobInfo","tags":["Jobs"],"parameters":[{"name":"is_compressed","description":"set to 'true' to enable compression, data returned is base64(gzip(data))","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"with_data","description":"optionally include full job data, 'true' or 'false'","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"job_id","required":true,"description":"job id","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"job":{"anyOf":[{"additionalProperties":false,"properties":{"cause":{"type":"string"},"created":{"type":"integer"},"job_id":{"type":"string"},"last_change":{"type":"integer"},"last_narration":{"type":"string"},"oid":{"type":"string"},"record":{"additionalProperties":true,"description":"Full job data, only present when with_data=true; the shape is defined by the Service that owns the job","type":"object"},"replicant":{"type":"string"},"sids":{"items":{"type":"string"},"type":"array"},"stopped":{"type":"integer"}},"type":"object"},{"description":"base64(gzip(JSON)) of the job when is_compressed=true","type":"string"}]}},"required":["job"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Fetch a specific job.","summary":"Get Job","x-required-permissions":{"all_of":["job.get"]}}},"/mitre/{oid}":{"get":{"operationId":"getOrgMITREReport","tags":["Rules"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"description":{"type":"string"},"domain":{"type":"string"},"name":{"type":"string"},"sorting":{"type":"integer"},"techniques":{"items":{"additionalProperties":false,"properties":{"color":{"type":"string"},"enabled":{"type":"boolean"},"techniqueID":{"type":"string"}},"required":["color","enabled","techniqueID"],"type":"object"},"type":"array"},"versions":{"additionalProperties":false,"properties":{"layer":{"type":"string"},"navigator":{"type":"string"}},"required":["layer","navigator"],"type":"object"}},"required":["description","domain","name","sorting","techniques","versions"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Generate a JSON MITRE report for a specific organization with its current detection rules.","summary":"Get MITRE report","x-required-permissions":{"all_of":["dr.list"]}}},"/models/{oid}/batch":{"post":{"operationId":"batchModelRequests","tags":["Model Request"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"Batch model request data","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"is_stop_on_failure":{"type":"boolean"},"requests":{"items":{"additionalProperties":false,"properties":{"delete_record":{"additionalProperties":false,"properties":{"model_name":{"type":"string"},"oid":{"type":"string"},"primary_key":{"type":"string"}},"type":"object"},"write_model_record":{"additionalProperties":false,"properties":{"expiry":{"type":"integer"},"fields":{"type":"object"},"model_name":{"type":"string"},"oid":{"type":"string"},"primary_key":{"type":"string"}},"type":"object"}},"type":"object"},"type":"array"}},"required":["requests"],"type":"object"}}},"required":true},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"responses":{"items":{"additionalProperties":false,"properties":{"Data":{"anyOf":[{"type":"null"},{"additionalProperties":true,"description":"For write operations, the written mutation echoed back; null for delete operations","type":"object"}]},"Error":{"anyOf":[{"type":"null"},{"additionalProperties":true,"description":"Null when the operation succeeded; error details are not serialized, so a failed operation surfaces as an empty object","type":"object"}]}},"required":["Data","Error"],"type":"object"},"type":"array"}},"required":["responses"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Execute multiple model operations in a single batch","summary":"Batch model requests","x-required-permissions":{"all_of":["model.set","model.del"]}}},"/models/{oid}/model/{model_name}/aggregate_view":{"post":{"operationId":"queryAggregateView","tags":["Model Request"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"Aggregate view query request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"aggregate_by":{"type":"string"},"aggregate_value":{"type":"string"},"ascending":{"type":"boolean"},"cursor":{"type":"string"},"filters":{"type":"object"},"include_tags":{"type":"boolean"},"limit":{"type":"integer"},"search":{"additionalProperties":false,"properties":{"field":{"type":"string"},"op":{"type":"string"},"value":{"type":"string"}},"type":"object"},"sort_by":{"type":"string"}},"required":["aggregate_by"],"type":"object"}}},"required":true},"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"next_cursor":{"description":"Pagination cursor for the next page; empty when there are no more rows","type":"string"},"results":{"items":{"additionalProperties":true,"description":"Aggregated row; columns depend on the model's aggregate view definition","type":"object"},"type":"array"}},"required":["results","next_cursor"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Query aggregated data from model records with aggregate views","summary":"Query aggregate view","x-required-permissions":{"all_of":["model.get"]}}},"/models/{oid}/model/{model_name}/index_records":{"get":{"operationId":"listIndexRecords","tags":["Model Request"],"parameters":[{"name":"index_key_name","required":true,"description":"name of the index key","schema":{"type":"string"},"in":"query"},{"name":"index_key_value","required":true,"description":"value of the index key","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"maximum number of records to return","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"cursor","description":"pagination cursor","schema":{"type":"string"},"in":"query"},{"name":"no_limit","description":"return all records without limit","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"show_expiry","description":"include record expiry information","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"cursor":{"description":"Pagination cursor for the next page; empty when there are no more records","type":"string"},"records":{"additionalProperties":{"additionalProperties":true,"description":"Model record. Fields are defined by the org's model definition and are not statically known.","type":"object"},"description":"Map of record primary key to record","type":"object"}},"required":["records","cursor"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List records from a model index","summary":"List index records","x-required-permissions":{"all_of":["model.get"]}}},"/models/{oid}/model/{model_name}/index_records_by_key_prefix":{"get":{"operationId":"listIndexRecordsByKeyPrefix","tags":["Model Request"],"parameters":[{"name":"index_key_name","required":true,"description":"name of the index key","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"maximum number of records to return","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"cursor","description":"pagination cursor","schema":{"type":"string"},"in":"query"},{"name":"no_limit","description":"return all records without limit","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"show_expiry","description":"include record expiry information","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"cursor":{"description":"Pagination cursor for the next page; empty when there are no more records","type":"string"},"records":{"additionalProperties":{"additionalProperties":true,"description":"Model record. Fields are defined by the org's model definition and are not statically known.","type":"object"},"description":"Map of record primary key to record","type":"object"}},"required":["records","cursor"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List records from a model index using key prefix matching","summary":"List index records by key prefix","x-required-permissions":{"all_of":["model.get"]}}},"/models/{oid}/model/{model_name}/index_value_counts":{"get":{"operationId":"getIndexValueCounts","tags":["Model Request"],"parameters":[{"name":"index_name","required":true,"description":"name of the index to count values for","schema":{"type":"string"},"in":"query"},{"name":"sort_desc","description":"sort by count descending (default: false)","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"total_count":{"description":"Total number of unique values for the index","type":"integer"},"values":{"items":{"additionalProperties":false,"properties":{"count":{"type":"integer"},"value":{"type":"string"}},"required":["value","count"],"type":"object"},"type":"array"}},"required":["values","total_count"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get unique counts a specific index in a model","summary":"Get unique index counts","x-required-permissions":{"all_of":["model.get"]}}},"/models/{oid}/model/{model_name}/record":{"delete":{"operationId":"deleteModelRecord","tags":["Model Request"],"parameters":[{"name":"primary_key","required":true,"description":"primary key of the record","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete a record in a model","summary":"Delete model record","x-required-permissions":{"all_of":["model.del"]}},"get":{"operationId":"getModelRecord","tags":["Model Request"],"parameters":[{"name":"primary_key","required":true,"description":"primary key of the record","schema":{"type":"string"},"in":"query"},{"name":"metadata","description":"return metadata","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"additionalProperties":true,"description":"Model record. Fields are defined by the org's model definition and are not statically known.","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get a record from a model","summary":"Get model record","x-required-permissions":{"all_of":["model.get"]}},"post":{"operationId":"createModelRecord","tags":["Model Request"],"parameters":[{"name":"primary_key","required":true,"description":"primary key of the record","schema":{"type":"string"},"in":"query"},{"name":"fields","required":true,"description":"fields of the record","schema":{"type":"string"},"in":"query"},{"name":"expiry","description":"expiration of the record","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"fields":{"additionalProperties":true,"description":"The record fields as written; defined by the org's model definition","type":"object"},"model_name":{"type":"string"},"oid":{"format":"uuid","type":"string"},"opt_expiry":{"anyOf":[{"type":"null"},{"type":"integer"}]},"primary_key":{"type":"string"}},"required":["oid","model_name","primary_key","fields","opt_expiry"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create a record in a model","summary":"Create model record","x-required-permissions":{"all_of":["model.set"]}}},"/models/{oid}/model/{model_name}/records":{"get":{"operationId":"getModelRecords","tags":["Model Request"],"parameters":[{"name":"index_key_name","required":true,"description":"name of the index key to look records up by","schema":{"type":"string"},"in":"query"},{"name":"index_key_value","required":true,"description":"value of the index key to look records up by","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"maximum number of records to return","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"cursor":{"description":"Pagination cursor for the next page; empty when there are no more records","type":"string"},"records":{"additionalProperties":{"additionalProperties":true,"description":"Model record. Fields are defined by the org's model definition and are not statically known.","type":"object"},"description":"Map of record primary key to record","type":"object"}},"required":["records","cursor"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get multiple records from a model","summary":"Get model records","x-required-permissions":{"all_of":["model.get"]}},"post":{"operationId":"listModelRecords","tags":["Model Request"],"parameters":[{"name":"limit","description":"maximum number of records per cursor","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"cursor","description":"cursor of the last set of records fetched","schema":{"type":"string"},"in":"query"},{"name":"show_expiry","description":"include record expiry information","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"cursor":{"description":"Pagination cursor for the next page; empty when there are no more records","type":"string"},"records":{"additionalProperties":{"additionalProperties":true,"description":"Model record. Fields are defined by the org's model definition and are not statically known.","type":"object"},"description":"Map of record primary key to record","type":"object"}},"required":["records","cursor"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List all records from a model","summary":"List model records","x-required-permissions":{"all_of":["model.get"]}}},"/models/{oid}/model/{model_name}/search":{"get":{"operationId":"substringSearchModels","tags":["Model Request"],"parameters":[{"name":"index_key_name","required":true,"description":"which index key to search for substring","schema":{"type":"string"},"in":"query"},{"name":"substring","required":true,"description":"substring to search","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"model_name","required":true,"description":"name of the model","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"additionalProperties":{"additionalProperties":true,"description":"Model record. Fields are defined by the org's model definition and are not statically known.","type":"object"},"description":"Map of record primary key to matching record","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"model substring search","summary":"search substring for searchable indexes","x-required-permissions":{"all_of":["model.get"]}}},"/models/{oid}/query":{"get":{"operationId":"queryModels","tags":["Model Request"],"parameters":[{"name":"starting_model_name","required":true,"description":"starting model name","schema":{"type":"string"},"in":"query"},{"name":"starting_key_name","required":true,"description":"starting key name","schema":{"type":"string"},"in":"query"},{"name":"starting_key_value","required":true,"description":"starting key value","schema":{"type":"string"},"in":"query"},{"name":"plan","required":true,"description":"list of query step json records","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"success","content":{"application/json":{"schema":{"additionalProperties":{"additionalProperties":true,"description":"Model record reached by the traversal; fields depend on the model's definition","type":"object"},"description":"Map of record key to the records reached by the final traversal step","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Traverse different models","summary":"Query/traverse different models","x-required-permissions":{"all_of":["model.get"]}}},"/modules/{oid}":{"post":{"operationId":"upgradeOrg","tags":["Modules"],"parameters":[{"name":"is_fallback","description":"if set to true downgrade to the previous version of the sensor, 'true' or 'false'","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"is_sleep","description":"if set to true moves sensors to dormant mode, 'true' or 'false'","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"specific_version","description":"if set, will upgrade sensors to the specific version string specified","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Update the sensor version for the organization.","summary":"Update Sensors","x-required-permissions":{"all_of":["module.update"]}}},"/online/{oid}":{"get":{"operationId":"getOnlineSensors","tags":["Sensors"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"count":{"type":"integer"},"online":{"type":"integer"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the number of sensors online belonging to the organization.","summary":"Get Online Count","x-required-permissions":{"all_of":["sensor.list"]}},"post":{"operationId":"getOnlineSensorsInList","tags":["Sensors"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"List of sensor ids to check online status for.","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"sids":{"items":{"format":"uuid","type":"string"},"type":"array"}},"type":"object"},"examples":{"basic":{"summary":"List of sensor ids","description":"List of sensor ids to check online status for.","value":{"sids":["f47ac10b-58cc-4372-a567-0e02b2c3d479","f47ac10b-58cc-4372-a567-0e02b2c3d480"]}}}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":{"type":"boolean"},"description":"Map of sensor ID to its online status","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the online status of multiple sensors.","summary":"Get Online Statuses","x-required-permissions":{"all_of":["sensor.list"]}}},"/ontology":{"get":{"operationId":"getOntology","tags":["General"],"parameters":[],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"architectures":{"additionalProperties":{"type":"integer"},"type":"object"},"native_edr_events":{"items":{"type":"string"},"type":"array"},"permissions":{"items":{"type":"string"},"type":"array"},"platforms":{"additionalProperties":{"type":"integer"},"type":"object"}},"required":["platforms","architectures","native_edr_events","permissions"],"type":"object"}}}}},"description":"Get the ontology of various components of LimaCharlie.","summary":"Get Ontology"}},"/orgs/new":{"get":{"operationId":"requestCheckOrgName","tags":["Organizations"],"parameters":[{"name":"name","required":true,"description":"organization name","schema":{"type":"string"},"in":"query"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"is_available":{"type":"boolean"}},"required":["is_available"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Check the availability of an organization mame.","summary":"Check organization name availability."},"post":{"operationId":"requestCreateOrg","tags":["Organizations"],"parameters":[{"name":"name","description":"organization name","schema":{"type":"string"},"in":"query"},{"name":"loc","description":"location where org is created","schema":{"type":"string"},"in":"query"},{"name":"template","description":"an infrastructure as code template to use to populate the org","schema":{"type":"string"},"in":"query"},{"name":"description","description":"organization description","schema":{"type":"string"},"in":"query"}],"requestBody":{"description":"organization creation request","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"loc":{"type":"string"},"name":{"type":"string"},"template":{"type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"additionalProperties":false,"properties":{"code":{"type":"string"},"loc":{"type":"string"},"oid":{"type":"string"}},"required":["oid","code","loc"],"type":"object"},"success":{"type":"boolean"}},"required":["success","data"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Request the creation of a new organization.","summary":"Request organization creation."}},"/orgs/{oid}":{"get":{"operationId":"getOrgInfo","tags":["Organizations"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"code":{"type":"string"},"desc":{"type":"string"},"is_ready":{"type":"boolean"},"latest_versions":{"additionalProperties":false,"properties":{"experimental":{"type":"string"},"fallback":{"type":"string"},"latest":{"type":"string"}},"required":["experimental","fallback","latest"],"type":"object"},"n_installation_keys":{"type":"number"},"n_outputs":{"type":"number"},"n_rules":{"type":"number"},"name":{"type":"string"},"oid":{"type":"string"},"sensor_quota":{"type":"number"},"sensor_version":{"type":"string"},"site_name":{"type":"string"},"status":{"type":"string"}},"required":["latest_versions","n_installation_keys","n_outputs","n_rules","name","oid","sensor_quota","sensor_version","site_name","code","status","is_ready"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get information about the organization.","summary":"Get Org Info","x-required-permissions":{"all_of":["org.get"]}}},"/orgs/{oid}/addons":{"get":{"operationId":"getOrgAddons","tags":["Resources"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"addons":{"additionalProperties":{"additionalProperties":{"additionalProperties":false,"properties":{"cost":{"oneOf":[{"type":"number"},{"type":"string"}]},"desc":{"type":"string"}},"type":"object"},"type":"object"},"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List all addons subscribed to by an organization with details including cost and description.","summary":"Get Org Addons"}},"/orgs/{oid}/billing/details":{"get":{"operationId":"getOrgBillingDetails","tags":["Billing"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"customer":{"additionalProperties":true,"description":"Stripe Customer object with sources, subscriptions and invoice_settings.default_payment_method expanded; the shape is defined by the Stripe API and is not under LimaCharlie's control","type":"object"},"status":{"additionalProperties":false,"properties":{"is_past_due":{"type":"boolean"}},"required":["is_past_due"],"type":"object"},"unified":{"additionalProperties":false,"description":"Only present when the customer's email domain is part of a unified-billing arrangement","properties":{"customer":{"additionalProperties":true,"description":"Stripe Customer object of the unified-billing parent; the shape is defined by the Stripe API and is not under LimaCharlie's control","type":"object"},"invoice_date":{"description":"Day of the month the unified invoice is issued","type":"integer"}},"required":["customer","invoice_date"],"type":"object"},"upcoming_invoice":{"anyOf":[{"type":"null"},{"additionalProperties":true,"description":"Stripe Invoice object with up to 100 upcoming lines (plan products expanded); the shape is defined by the Stripe API and is not under LimaCharlie's control","type":"object"}]}},"required":["customer","status","upcoming_invoice"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get comprehensive billing details for an organization including Stripe customer, subscription status, and upcoming invoice.","summary":"Get Org Billing Details","x-required-permissions":{"all_of":["org.get","billing.ctrl"]}}},"/orgs/{oid}/billing/invoice/{year}/{month}":{"get":{"operationId":"getOrgInvoiceForMonth","tags":["Billing"],"parameters":[{"name":"format","description":"output format: json, simple_json, simple_csv, or empty for URL only","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"year","required":true,"description":"invoice year (YYYY)","schema":{"type":"string"},"in":"path"},{"name":"month","required":true,"description":"invoice month (MM)","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"anyOf":[{"additionalProperties":false,"description":"Default response (no format specified)","properties":{"url":{"description":"Stripe hosted invoice URL","type":"string"}},"required":["url"],"type":"object"},{"additionalProperties":false,"description":"format=json response","properties":{"invoice":{"additionalProperties":true,"description":"Stripe Invoice object with all lines (plan products expanded); the shape is defined by the Stripe API and is not under LimaCharlie's control","type":"object"}},"required":["invoice"],"type":"object"},{"additionalProperties":false,"description":"format=simple_json response","properties":{"lines":{"items":{"additionalProperties":false,"properties":{"amount":{"type":"integer"},"description":{"type":"string"},"product":{"type":"string"},"quantity":{"type":"integer"},"scheme":{"type":"string"},"unit_amount":{"type":"integer"}},"required":["product","amount","unit_amount","scheme","quantity","description"],"type":"object"},"type":"array"}},"required":["lines"],"type":"object"},{"additionalProperties":false,"description":"format=simple_csv response","properties":{"csv":{"description":"CSV rendering of the simplified invoice lines","type":"string"}},"required":["csv"],"type":"object"}]}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the invoice URL or data for a specific month.","summary":"Get Org Invoice For Month","x-required-permissions":{"all_of":["org.get","billing.ctrl"]}}},"/orgs/{oid}/billing/quota":{"post":{"operationId":"requestOrgBillingQuota","tags":["Billing"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"Quota change request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"quota":{"type":"integer"}},"required":["quota"],"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"additionalProperties":false,"properties":{"success":{"type":"boolean"}},"type":"object"},"is_success":{"type":"boolean"}},"required":["is_success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Request a quota (sensor count) change for an organization.","summary":"Request Org Billing Quota","x-required-permissions":{"all_of":["billing.ctrl"]}}},"/orgs/{oid}/billing/sku":{"get":{"operationId":"getOrgSkuDefinitions","tags":["Billing"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"skus":{"items":{"type":"object"},"type":"array"}},"required":["skus"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get metered SKU definitions with metadata and current Stripe pricing for an organization.","summary":"Get Org SKU Definitions","x-required-permissions":{"all_of":["org.get"]}}},"/orgs/{oid}/billing/status":{"get":{"operationId":"getOrgBillingStatus","tags":["Billing"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"is_past_due":{"type":"boolean"},"org_name":{"type":"string"}},"required":["is_past_due","org_name"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the billing status (past due or not) for an organization.","summary":"Get Org Billing Status","x-required-permissions":{"all_of":["org.get"]}}},"/orgs/{oid}/delete":{"delete":{"operationId":"completeOrgDelete","tags":["Organizations"],"parameters":[{"name":"confirmation","required":true,"description":"confirmation token obtained during initialization","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"data":{"additionalProperties":false,"properties":{"success":{"type":"boolean"}},"required":["success"],"type":"object"},"success":{"type":"boolean"}},"required":["data","success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Complete the deletion process for an organization.","summary":"Complete Org Delete","x-required-permissions":{"all_of":["billing.ctrl","user.ctrl"]}},"get":{"operationId":"initOrgDelete","tags":["Organizations"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"confirmation":{"description":"confirmation token","title":"confirmation","type":"string"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Initiate the deletion process for an organization.","summary":"Start Delete Org","x-required-permissions":{"all_of":["billing.ctrl","user.ctrl"]}}},"/orgs/{oid}/keys":{"delete":{"operationId":"removeOrgApiKey","tags":["Api Keys"],"parameters":[{"name":"key_hash","description":"hash of the key to remove","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove an API key from an organization.","summary":"Remove API Key","x-required-permissions":{"all_of":["apikey.ctrl"]}},"get":{"operationId":"getOrgApiKeys","tags":["Api Keys"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"api_keys":{"additionalProperties":{"additionalProperties":false,"properties":{"allowed_ip_range":{"type":"string"},"by":{"type":"string"},"last_used":{"type":"integer"},"name":{"type":"string"},"priv":{"items":{"type":"string"},"type":"array"}},"required":["name","last_used"],"type":"object"},"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List API keys in organization.","summary":"Get API Keys","x-required-permissions":{"all_of":["apikey.ctrl"]}},"post":{"operationId":"addOrgApiKey","tags":["Api Keys"],"parameters":[{"name":"key_name","description":"name of the key to add","schema":{"type":"string"},"in":"query"},{"name":"perms","description":"comma separated values of the permissions of the key to add","schema":{"type":"string"},"in":"query"},{"name":"allowed_ip_range","description":"optional CIDR of the allowed IP ranges of the key to add","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"allowed_ip_range":{"type":"string"},"api_key":{"type":"string"},"key_hash":{"type":"string"},"key_name":{"type":"string"},"perms":{"items":{"type":"string"},"type":"array"},"success":{"type":"boolean"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Add a new user to the organization.","summary":"Add API Key","x-required-permissions":{"all_of":["apikey.ctrl"]}}},"/orgs/{oid}/name":{"post":{"operationId":"renameOrg","tags":["Organizations"],"parameters":[{"name":"name","description":"new name for the organization","schema":{"type":"string"},"in":"query"},{"name":"description","description":"new description for the organization","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"new_name":{"type":"string"},"oid":{"type":"string"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Rename an organization.","summary":"Org Rename","x-required-permissions":{"all_of":["billing.ctrl"]}}},"/orgs/{oid}/org_create_status":{"get":{"operationId":"getOrgCreateStatus","tags":["Api Keys"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"org_create_steps":{"oneOf":[{"additionalProperties":false,"properties":{"step1_starting_org_creation":{"type":"integer"},"step2_max_org_check_passed":{"type":"integer"},"step3_org_record_created":{"type":"integer"},"step4_stripe_customer_created":{"type":"integer"},"step5_stripe_subscription_created":{"type":"integer"},"step6_org_creation_succeeded":{"type":"integer"}},"type":"object"},{"type":"null"}]}},"required":["org_create_steps"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get org creation status steps","summary":"Get org create status","x-required-permissions":{"all_of":["org.get"]}}},"/orgs/{oid}/quota":{"post":{"operationId":"setOrgQuota","tags":["Billing"],"parameters":[{"name":"quota","description":"new sensor quota to request for organization","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"success":{"type":"boolean"}},"required":["success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Request a new sensor quota for an organization.","summary":"Set Org Quota","x-required-permissions":{"all_of":["billing.ctrl"]}}},"/orgs/{oid}/resources":{"delete":{"operationId":"unregisterOrgFromResource","tags":["Resources"],"parameters":[{"name":"res_cat","description":"resource category of the resource to unsubscribe from, like 'lookup'","schema":{"type":"string"},"in":"query"},{"name":"res_name","description":"resource name of the resource to unsubscribe from","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Unsubscribe an organization from a resource.","summary":"Unsubscribe Org to Resource","x-required-permissions":{"all_of":["billing.ctrl"]}},"get":{"operationId":"getOrgResources","tags":["Resources"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"resources":{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List all resources subscribed to by an organization.","summary":"Get Org Resources"},"post":{"operationId":"registerOrgToResource","tags":["Resources"],"parameters":[{"name":"res_cat","description":"resource category of the resource to subscribe to, like 'lookup'","schema":{"type":"string"},"in":"query"},{"name":"res_name","description":"resource name of the resource to subscribe to","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Subscribe the organization to a resource.","summary":"Subscribe Org to Resource","x-required-permissions":{"all_of":["billing.ctrl"]}}},"/orgs/{oid}/schema":{"delete":{"operationId":"resetOrgSchemas","tags":["Schema"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Reset all schemas in organization.","summary":"Reset Org Schemas","x-required-permissions":{"all_of":["org.get"]}},"get":{"operationId":"getOrgSchemas","tags":["Schema"],"parameters":[{"name":"platform","description":"Optional platform name to filter the event types by.","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"event_types":{"items":{"type":"string"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List all the available event schemas in organization.","summary":"Get Org Schemas","x-required-permissions":{"all_of":["org.get"]}}},"/orgs/{oid}/schema/{schema_name+}":{"get":{"operationId":"getOrgSchema","tags":["Schema"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"schema_name","required":true,"description":"schema name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"anyOf":[{"additionalProperties":false,"properties":{"schema":{"additionalProperties":false,"properties":{"elements":{"items":{"description":"Schema element key, prefixed with a 1-letter data type (s = string, i = integer, b = boolean)","type":"string"},"type":"array"},"event_type":{"type":"string"}},"required":["event_type","elements"],"type":"object"}},"required":["schema"],"type":"object"},{"additionalProperties":false,"properties":{"schemas":{"additionalProperties":{"items":{"description":"Schema element key, prefixed with a 1-letter data type (s = string, i = integer, b = boolean)","type":"string"},"type":"array"},"description":"Map of event type to its schema elements","type":"object"}},"required":["schemas"],"type":"object"}]}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the detailed schema of a specific event.","summary":"Get Schema Details","x-required-permissions":{"all_of":["org.get"]}}},"/orgs/{oid}/status":{"get":{"operationId":"getOrgStatus","tags":["Organizations"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"code":{"type":"string"},"is_ready":{"type":"boolean"},"name":{"type":"string"},"oid":{"type":"string"},"status":{"type":"string"}},"required":["oid","code","name","status","is_ready"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get organization initialization status for polling during creation.","summary":"Get Org Status"}},"/orgs/{oid}/stories":{"get":{"operationId":"listStories","tags":["Organizations"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"stories":{"items":{"type":"string"},"type":"array"}},"required":["stories"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List the names of all lc:story:* stories defined in the org. A story exists wherever at least one component carries a tag matching lc:story:NAME[:...].","summary":"List Stories"}},"/orgs/{oid}/stories/{name}":{"get":{"operationId":"getStory","tags":["Organizations"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"name","required":true,"description":"story name (slug, ^[a-z0-9][a-z0-9_-]{0,63}$)","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"edges":{"items":{"additionalProperties":false,"properties":{"from":{"type":"string"},"label":{"type":"string"},"origin":{"enum":["derived","declared"]},"to":{"type":"string"}},"required":["from","to","origin"],"type":"object"},"type":"array"},"name":{"type":"string"},"nodes":{"items":{"additionalProperties":false,"properties":{"id":{"type":"string"},"label":{"type":"string"},"name":{"type":"string"},"type":{"type":"string"}},"required":["id","type","name"],"type":"object"},"type":"array"}},"required":["name","nodes","edges"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the assembled graph for one lc:story:NAME story: the set of components carrying lc:story:NAME[:...] tags plus the directed edges between them. Edges are derived from the member records' own configuration (origin: derived) or declared with links: tags (origin: declared).","summary":"Get Story"}},"/orgs/{oid}/subscription/extension/{extensionName}":{"delete":{"operationId":"deleteExtensionSubscription","tags":["Extensions"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"extensionName","required":true,"description":"extension name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete extension subscription","summary":"Delete extension subscription","x-required-permissions":{"all_of":["billing.ctrl"]}},"patch":{"operationId":"reKeyExtensionSubscription","tags":["Extensions"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"extensionName","required":true,"description":"extension name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Re-key extension subscription","summary":"Re-key extension subscription","x-required-permissions":{"all_of":["billing.ctrl","user.ctrl"]}},"post":{"operationId":"createExtensionSubscription","tags":["Extensions"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"extensionName","required":true,"description":"extension name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create extension subscription","summary":"Create extension subscription","x-required-permissions":{"all_of":["billing.ctrl","user.ctrl"]}}},"/orgs/{oid}/subscriptions":{"get":{"operationId":"getOrgSubscriptions","tags":["Extensions","Extensions"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"An array of Extension Subscriptions","content":{"application/json":{"schema":{"additionalProperties":{"additionalProperties":false,"properties":{"extension_name":{"type":"string"},"is_labs":{"type":"boolean"},"is_public":{"type":"boolean"},"key_name":{"type":"string"},"label":{"type":"string"},"oid":{"type":"string"},"org_name":{"type":"string"}},"required":["extension_name","org_name","oid","key_name","is_public","is_labs","label"],"type":"object"},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get all org extension subscriptions","summary":"Get all org extension subscriptions","x-required-permissions":{"any_of":["billing.ctrl","ext.request","ext.conf.set","ext.conf.del","ext.conf.get","ext.conf.set.mtd","ext.conf.get.mtd"]}}},"/orgs/{oid}/ui_actions":{"get":{"operationId":"getUIActions","tags":["Hive"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"actions":{"items":{"additionalProperties":false,"properties":{"label":{"type":"string"},"location":{"type":"string"},"record_name":{"type":"string"},"source_hive":{"type":"string"}},"type":"object"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get all UI actions defined in the organization's hive records. This is a synchronous call that returns immediately.","summary":"Get UI Actions","x-required-permissions":{"all_of":["org.get"]}}},"/orgs/{oid}/ui_actions/execute":{"post":{"operationId":"executeUIAction","tags":["Hive"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"request object. context_data is a JSON-serialized string passed as playbook parameters or appended to the AI agent prompt.","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"context_data":{"type":"string"},"record_name":{"type":"string"},"source_hive":{"type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":true,"description":"For source_hive=playbook: the extension-manager dispatch acknowledgement. For source_hive=ai_agent: session metadata from the AI Sessions service. Both shapes are defined by the downstream service.","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Execute a UI action from a hive record. This is an asynchronous call that returns immediately. For playbook actions (source_hive=playbook), the playbook execution is dispatched in the background. For AI agent actions (source_hive=ai_agent), an AI session is created and the session metadata is returned; the actual AI execution continues in the background.","summary":"Execute UI Action","x-required-permissions":{"any_of":["ext.request","ai_agent.exec"]}}},"/orgs/{oid}/url":{"get":{"operationId":"getOrgURLs","tags":["Organizations"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"certs":{"anyOf":[{"type":"null"},{"additionalProperties":{"type":"string"},"type":"object"}]},"site_name":{"type":"string"},"url":{"additionalProperties":false,"properties":{"ai":{"type":"string"},"artifacts":{"type":"string"},"cases":{"type":"string"},"edr":{"type":"string"},"hooks":{"type":"string"},"lc":{"type":"string"},"lc_wss":{"type":"string"},"live":{"type":"string"},"logs":{"type":"string"},"private_endpoints":{"additionalProperties":{"type":"boolean"},"type":"object"},"region_code":{"type":"string"},"replay":{"type":"string"},"search":{"type":"string"}},"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the various access URLs used by resources related to the organization.","summary":"Get Org URLs"}},"/orgs/{oid}/users":{"delete":{"operationId":"removeOrgUser","tags":["Users"],"parameters":[{"name":"email","description":"email of the user to remove","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"success":{"type":"boolean"}},"required":["success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove a user from an organization.","summary":"Remove Org User","x-required-permissions":{"all_of":["user.ctrl"]}},"get":{"operationId":"getOrgUsers","tags":["Users"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"users":{"items":{"type":"string"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List all users in organization.","summary":"Get Org Users","x-required-permissions":{"all_of":["user.ctrl"]}},"post":{"operationId":"addOrgUser","tags":["Users"],"parameters":[{"name":"email","description":"email of the user to add","schema":{"type":"string"},"in":"query"},{"name":"invite_missing","description":"if the user does not exist, send an invite","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"role","description":"role to assign to the user (Owner, Administrator, Operator, Viewer, Basic). If not provided, defaults to Basic.","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"invite_sent":{"description":"Only present when the user did not exist and invite_missing was set: an invite email was sent instead of adding the user","type":"boolean"},"role":{"description":"Role assigned to the user; only present when the user was newly added","type":"string"},"success":{"description":"Present when the user was added to the organization (or already was a member)","type":"boolean"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Add a new user to the organization.","summary":"Add Org User","x-required-permissions":{"all_of":["user.ctrl"]}}},"/orgs/{oid}/users/permissions":{"delete":{"operationId":"removeUserPermission","tags":["Users"],"parameters":[{"name":"email","description":"email of the user to remove the permission from","schema":{"type":"string"},"in":"query"},{"name":"perm","description":"permission to remove","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"success":{"type":"boolean"}},"required":["success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove a user permission.","summary":"Remove User Permission","x-required-permissions":{"all_of":["user.ctrl"]}},"get":{"operationId":"getUsersAndPermissions","tags":["Users"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"direct_users":{"items":{"additionalProperties":false,"properties":{"MFA_enabled":{"type":"boolean"},"MFA_types":{"items":{"type":"string"},"type":"array"},"auth_providers":{"items":{"type":"string"},"type":"array"},"email":{"type":"string"},"perms":{"items":{"type":"string"},"type":"array"},"uid":{"type":"string"}},"required":["email","uid","perms"],"type":"object"},"type":"array"},"from_groups":{"additionalProperties":{"additionalProperties":false,"properties":{"MFA_enabled":{"type":"boolean"},"MFA_types":{"items":{"type":"string"},"type":"array"},"auth_providers":{"items":{"type":"string"},"type":"array"},"email":{"type":"string"},"groups":{"additionalProperties":{"type":"boolean"},"type":"object"},"hasDirectAccess":{"type":"boolean"},"is_admin":{"type":"boolean"}},"required":["email","groups"],"type":"object"},"type":"object"},"group_info":{"additionalProperties":{"additionalProperties":false,"properties":{"name":{"type":"string"},"owners":{"items":{"type":"string"},"type":"array"},"perms":{"items":{"type":"string"},"type":"array"}},"type":"object"},"type":"object"},"user_permissions":{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List all users and permissions in organization.","summary":"Get User Permissions","x-required-permissions":{"all_of":["user.ctrl"]}},"post":{"operationId":"addUserPermission","tags":["Users"],"parameters":[{"name":"email","description":"email of the user to add a permission to","schema":{"type":"string"},"in":"query"},{"name":"perm","description":"permission to give","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"success":{"type":"boolean"}},"required":["success"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Add a new user to the organization.","summary":"Add User Permission","x-required-permissions":{"all_of":["user.ctrl"]}}},"/outputs/{oid}":{"delete":{"operationId":"removeOutput","tags":["Outputs"],"parameters":[{"name":"name","description":"output module name to disable","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"JSON encoded string of the request data","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"name":{"description":"output module name to disable","title":"name","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Disable a specific output module for an organization.","summary":"Remove Output","x-required-permissions":{"any_of":["output.del","live_stream.ctrl"]}},"get":{"operationId":"getOutputs","tags":["Outputs"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":{"additionalProperties":true,"properties":{"by":{"description":"who created the output","title":"by","type":"string"},"for":{"description":"data type for output","title":"for","type":"string"},"is_built_in":{"description":"if the output is built in","title":"is built in","type":"boolean"},"module":{"description":"output module name to enable","title":"module","type":"string"},"name":{"description":"what to name this output","title":"name","type":"string"},"oid":{"description":"organization id","title":"oid","type":"string"}},"type":"object"},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the various outputs for an organization.","summary":"Get Outputs","x-required-permissions":{"all_of":["output.list"]}},"post":{"operationId":"setOutput","tags":["Outputs"],"parameters":[{"name":"module","description":"output module name to enable","schema":{"type":"string"},"in":"query"},{"name":"type","description":"data type for output","schema":{"type":"string"},"in":"query"},{"name":"name","description":"what to name this output","schema":{"type":"string"},"in":"query"},{"name":"inv_id","description":"if specified, only events part of this investigation id will be sent to this output","schema":{"type":"string"},"in":"query"},{"name":"tag","description":"if specified, only events coming from sensors with the specific tag will be sent to this output","schema":{"type":"string"},"in":"query"},{"name":"cat","description":"if specified, only detections in this category will be sent to this output","schema":{"type":"string"},"in":"query"},{"name":"is_flat","description":"if the json should be flattened (true, false)","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"is_compression","description":"if data should be sent compressed (true, false)","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"dir","description":"directory for output","schema":{"type":"string"},"in":"query"},{"name":"max_bytes","description":"max size in bytes before rotation","schema":{"type":"string"},"in":"query"},{"name":"backup_count","description":"maximum number of output in rotation","schema":{"type":"string"},"in":"query"},{"name":"bucket","description":"name of the bucket for output","schema":{"type":"string"},"in":"query"},{"name":"key_id","description":"public key id for auth","schema":{"type":"string"},"in":"query"},{"name":"sec_per_file","description":"seconds per output files","schema":{"type":"string"},"in":"query"},{"name":"dest_host","description":"destination host for output","schema":{"type":"string"},"in":"query"},{"name":"username","description":"username for auth","schema":{"type":"string"},"in":"query"},{"name":"slack_channel","description":"slack channel to output to","schema":{"type":"string"},"in":"query"},{"name":"is_tls","description":"whether connection should be secured over tls (true, false)","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"is_no_header","description":"whether protocol header should be sent before the data (true, false)","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"is_delete_on_failure","description":"if enabled, the output will be deleted as soon as a connection error occurs (true, false)","schema":{"type":"string"},"in":"query"},{"name":"event_white_list","description":"whitelist of event types to allow","schema":{"type":"string"},"in":"query"},{"name":"event_black_list","description":"blacklist of event types to disallow","schema":{"type":"string"},"in":"query"},{"name":"cat_black_list","description":"blacklist of categories to disallow","schema":{"type":"string"},"in":"query"},{"name":"routing_topic","description":"topic to publish on from the routing of then event","schema":{"type":"string"},"in":"query"},{"name":"literal_topic","description":"literal topic to publish on","schema":{"type":"string"},"in":"query"},{"name":"is_no_routing","description":"if true, do not include event routing, acts as an event pass-through","schema":{"type":"string"},"in":"query"},{"name":"sample_rate","description":"sample events out as 1/sample_rate","schema":{"type":"string"},"in":"query"},{"name":"is_payload_as_string","description":"include the event as a JSON string instead of a JSON object","schema":{"type":"string"},"in":"query"},{"name":"is_prefix_data","description":"encapsulate the data inside a JSON object with a key equal to the event type","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"JSON encoded string of the request data","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"custom_transform":{"description":"custom transform expression","title":"custom transform","type":"string"},"module":{"description":"output module name to enable","title":"module","type":"string"},"name":{"description":"what to name this output","title":"name","type":"string"},"password":{"description":"password for auth","title":"password","type":"string"},"secret_key":{"description":"secret key for auth","title":"secret key","type":"string"},"slack_api_token":{"description":"slack api token","title":"slack api token","type":"string"},"structured_data":{"description":"structured data expression","title":"structured data","type":"string"},"type":{"description":"data type for output","title":"type","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":true,"properties":{"by":{"description":"who created the output","title":"by","type":"string"},"for":{"description":"data type for output","title":"for","type":"string"},"is_built_in":{"description":"if the output is built in","title":"is built in","type":"boolean"},"module":{"description":"output module name to enable","title":"module","type":"string"},"name":{"description":"what to name this output","title":"name","type":"string"},"oid":{"description":"organization id","title":"oid","type":"string"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Enable a specific output module for an organization.","summary":"Set Output","x-required-permissions":{"any_of":["output.set","live_stream.ctrl"]}}},"/outputs/{oid}/samples":{"get":{"operationId":"getOutputSamples","tags":["Outputs"],"parameters":[{"name":"name","required":true,"description":"output module name to get samples from","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"items":{"additionalProperties":false,"properties":{"sample":{"items":{"oneOf":[{"type":"null"},{"type":"string"}]},"type":"array"}},"required":["sample"],"type":"object"},"type":"array"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get sample data from an Output.","summary":"Get Output Samples","x-required-permissions":{"all_of":["output.list"]}}},"/payload/{oid}":{"get":{"operationId":"listPayloads","tags":["Payload"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"payloads":{"additionalProperties":{"additionalProperties":false,"properties":{"by":{"type":"string"},"created":{"type":"integer"},"name":{"type":"string"},"oid":{"type":"string"},"put_url":{"type":"string"},"size":{"type":"integer"}},"required":["name","oid","by","created","size"],"type":"object"},"type":"object"},"replicants":{"items":{"type":"string"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the list of existing payloads.","summary":"List Payloads","x-required-permissions":{"all_of":["payload.ctrl"]}}},"/payload/{oid}/{payloadName}":{"delete":{"operationId":"removePayload","tags":["Payload"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"payloadName","required":true,"description":"payload name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"description":"Empty acknowledgement object","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove an existing payload.","summary":"Remove Payload","x-required-permissions":{"all_of":["payload.ctrl"]}},"get":{"operationId":"getPayload","tags":["Payload"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"payloadName","required":true,"description":"payload name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"get_url":{"type":"string"}},"required":["get_url"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the content of a payload.","summary":"Get Payload","x-required-permissions":{"all_of":["payload.ctrl"]}},"post":{"operationId":"addPayload","tags":["Payload"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"payloadName","required":true,"description":"payload name","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"put_url":{"description":"Signed URL to HTTP PUT the payload content to","type":"string"}},"required":["put_url"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Create a new payload.","summary":"Add Payload","x-required-permissions":{"all_of":["payload.ctrl"]}}},"/plans":{"get":{"operationId":"getAvailablePlans","tags":["Users"],"parameters":[],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"plans":{"items":{"additionalProperties":false,"properties":{"id":{"type":"string"},"name":{"type":"string"},"region":{"type":"string"}},"required":["id","name","region"],"type":"object"},"type":"array"}},"required":["plans"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the list of plans available for the authenticated user based on their email domain.","summary":"Get Available Plans"}},"/quota_usage/{oid}":{"get":{"operationId":"getOrgQuotaUsage","tags":["Sensors"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"breakdown":{"type":"object"},"quota":{"type":"integer"},"usage":{"type":"integer"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the enforced sensor quota usage for the organization. This is the weighted virtual-sensor count the platform actually uses to decide whether a sensor may come online, so it is the value to size sensor_quota against. It can read higher than the /online count, which weights EPP/response-mode sensors at 0.","summary":"Get Sensor Quota Usage","x-required-permissions":{"all_of":["sensor.list"]}}},"/runtime_mtd/{oid}":{"get":{"operationId":"getRuntimeMtd","tags":["General"],"parameters":[{"name":"entity_type","description":"optionally return only entities of a specific type","schema":{"type":"string"},"in":"query"},{"name":"entity_name","description":"optionally return only the entity with the given name","schema":{"type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"entities":{"description":"Array of entity metadata objects","items":{"additionalProperties":true,"type":"object"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the runtime metadata of various entities running in an org.","summary":"Get Runtime Metadata","x-required-permissions":{"any_of":["sensor.list","cloudsensor.get"]}}},"/sensors/{oid}":{"get":{"operationId":"getSensorList","tags":["Sensors"],"parameters":[{"name":"continuation_token","description":"optional token provided as a previous response to fetch the next page of data","schema":{"type":"string"},"in":"query"},{"name":"selector","description":"optional sensor selector to filter the list with","schema":{"type":"string"},"in":"query"},{"name":"limit","description":"optional maximum number of sensors to return in a page of data","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"is_compressed","description":"optional boolean indicating if the response should be compressed","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"with_ip","description":"optional internal or external IP of sensors to list","schema":{"type":"string"},"in":"query"},{"name":"with_hostname_prefix","description":"optional hostname prefix of sensors to list","schema":{"type":"string"},"in":"query"},{"name":"with_tags","description":"optionally include sensor tags in response","schema":{"type":"string"},"in":"query"},{"name":"is_online_only","description":"optional boolean indicating if the response should include only the online sensors","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"List of sensors","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"continuation_token":{"type":"string"},"from_cache":{"type":"boolean"},"matched_count":{"description":"total number of sensors matching the selector","title":"matched count","type":"integer"},"sensors":{"oneOf":[{"description":"base64 encoded gzip compressed list of sensors","title":"compressed list of sensors","type":"string"},{"items":{"additionalProperties":false,"properties":{"alive":{"description":"timestamp of last alive check","pattern":"^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$","title":"alive check","type":"string"},"arch":{"description":"architecture of host running the sensor","title":"architecture","type":"integer"},"did":{"oneOf":[{"description":"UUID of the device","format":"uuid","title":"device identifier","type":"string"},{"enum":[""]}]},"enroll":{"description":"timestamp of sensor enrollment","pattern":"^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$","title":"enrollment timestamp","type":"string"},"ext_ip":{"oneOf":[{"description":"external IP of the host running the sensor","format":"ipv4","title":"external IP","type":"string"},{"enum":["internal",""]}]},"ext_plat":{"description":"external platform of the sensor","title":"external platform","type":"integer"},"hostname":{"description":"hostname of the host running the sensor","title":"hostname","type":"string"},"iid":{"description":"installation key identifier","title":"installation key identifier","type":"string"},"installer_version":{"description":"version of the installer","title":"installer version","type":"string"},"int_ip":{"description":"internal IP of the host running the sensor","title":"internal IP","type":"string"},"is_del":{"description":"is the sensor deleted","title":"deleted status","type":"boolean"},"is_isolated":{"description":"isolation status of the sensor","title":"isolation status","type":"boolean"},"is_kernel_available":{"description":"is kernel available to the sensor","title":"kernel availability","type":"boolean"},"is_online":{"description":"is sensor online at the moment","title":"online status","type":"boolean"},"mac_addr":{"description":"MAC address of the host running the sensor","title":"MAC address","type":"string"},"metadata":{"oneOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}]},"oid":{"description":"UUID of the organization","format":"uuid","title":"organization identifier","type":"string"},"plat":{"description":"platform type of the host running the sensor","title":"platform","type":"integer"},"sealed":{"description":"seal status of the sensor","title":"seal status","type":"boolean"},"should_isolate":{"description":"isolation intent of the sensor","title":"isolation intent","type":"boolean"},"should_seal":{"description":"seal intent of the sensor","title":"seal intent","type":"boolean"},"sid":{"description":"UUID of the sensor","format":"uuid","title":"sensor identifier","type":"string"},"tags":{"oneOf":[{"items":{"description":"sensors tag","title":"tag","type":"string"},"type":"array"},{"type":"null"}]},"version":{"description":"version of the sensor","title":"sensor version","type":"string"}},"required":["sid","alive","arch","did","enroll","ext_ip","ext_plat","hostname","int_ip","is_isolated","is_kernel_available","mac_addr","oid","plat","sealed","should_isolate","should_seal"],"type":"object"},"type":"array"}]},"warning":{"description":"warning emitted when the result set was truncated by safety limits","title":"warning","type":"string"}},"required":["sensors"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the list of sensors belonging to the organization.","summary":"Get Sensor List","x-required-permissions":{"all_of":["sensor.list"]}}},"/service/{oid}":{"get":{"operationId":"getAvailableServices","tags":["Service"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"replicants":{"items":{"type":"string"},"type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the list of Services enabled on this organization.","summary":"Get Available Services","x-required-permissions":{"all_of":["replicant.get"]}}},"/service/{oid}/{service_name}":{"post":{"operationId":"makeServiceRequest","tags":["Service"],"parameters":[{"name":"is_async","description":"if set to 'true', this REST call will not wait for the Service to finish handling the request","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"service_name","required":true,"description":"Service name to send the request to","schema":{"type":"string"},"in":"path"}],"requestBody":{"description":"request object","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"jwt":{"description":"optional JWT token to use for authentication to the Service","title":"jwt","type":"string"},"request_data":{"description":"JSON data to send to the Service","title":"request_data","type":"string"}},"required":["request_data"],"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":true,"description":"Response payload produced by the Service handling the request; the shape is defined by each Service and is not under LimaCharlie's control. Requests with is_async=true (the default) return an empty object.","type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Send a request to a Service.","summary":"Make Service Request","x-required-permissions":{"all_of":["replicant.task"]}}},"/service/{service_name}/usage":{"get":{"operationId":"getServiceUsage","tags":["Service"],"parameters":[{"name":"service_name","required":true,"description":"Service name to send the request to","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"params":{"additionalProperties":true,"description":"Service usage parameters","type":"object"}},"required":["params"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the usage parameters for requests to the service.","summary":"Get Service Usage","x-required-permissions":{"all_of":["replicant.task"]}}},"/tags/{oid}":{"get":{"operationId":"listOrgTags","tags":["Sensors","Tags"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"tags":{"oneOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}]}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"List all the tags in use by sensors belonging to the organization.","summary":"List All Sensor Tags","x-required-permissions":{"all_of":["sensor.list"]}}},"/tags/{oid}/{tag}":{"get":{"operationId":"findSensorsWithTag","tags":["Sensors","Tags"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"},{"name":"tag","required":true,"description":"tag to search for","schema":{"type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Search for sensors with given tags.","summary":"Find Sensors by Tag","x-required-permissions":{"all_of":["sensor.list"]}}},"/test_template":{"post":{"operationId":"testTemplate","tags":["Rules"],"parameters":[],"requestBody":{"description":"JSON encoded string of the request data","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"template":{"description":"template expression","title":"template","type":"string"},"test_data":{"description":"test data to apply the template from","title":"test data","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the resulting data from applying a template.","summary":"Simulate a template being apply to data"}},"/test_transform":{"post":{"operationId":"testTransform","tags":["Outputs"],"parameters":[],"requestBody":{"description":"JSON encoded string of the request data","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"test_data":{"description":"test data to apply the transform to","title":"test data","type":"string"},"transform":{"description":"transform expression","title":"transform","type":"string"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the resulting data from applying a transform.","summary":"Simulate a transform being apply to data"}},"/usage/{oid}":{"get":{"operationId":"getOrgUsageStats","tags":["Organizations"],"parameters":[{"name":"days","description":"number of days to look back for usage stats","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"start","description":"optional Unix epoch timestamp in SECONDS (not milliseconds) where to begin, e.g. 1735689600. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"end","description":"optional Unix epoch timestamp in SECONDS (not milliseconds) where to stop, e.g. 1735693200. Millisecond values are rejected.","schema":{"description":"Unix epoch timestamp in SECONDS (10 digits), not milliseconds.","pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"from_cache":{"type":"boolean"},"note":{"type":"string"},"usage":{"additionalProperties":{"additionalProperties":{"type":"integer"},"properties":{"date":{"type":"string"}},"required":["date"],"type":"object"},"type":"object"}},"required":["usage"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get various organization usage stats. Supports either a days lookback or explicit start/end epoch timestamps. If start and end are provided, they take precedence over days.","summary":"Get Usage Stats","x-required-permissions":{"all_of":["org.get"]}}},"/user/orgs":{"get":{"operationId":"getUserOrgs","tags":["Organizations"],"parameters":[{"name":"offset","description":"number of organizations to skip from the start","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"limit","description":"maximum number of organizations to return (default 10)","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"filter","description":"case-insensitive substring filter on name, description, or oid","schema":{"type":"string"},"in":"query"},{"name":"sort_by","description":"field to sort by: 'name' or 'description' (default: 'name')","schema":{"type":"string"},"in":"query"},{"name":"sort_order","description":"sort order: 'asc' or 'desc' (default: 'asc')","schema":{"type":"string"},"in":"query"},{"name":"fields","description":"comma-separated list of fields to return (e.g. 'oid,name,description'). Supported fields: code, oid, name, description, status, sensor_online, sensor_quota, billing_quantity, sensor_version, permissions, errors, site_name, latest_versions. If not specified, all fields are returned.","schema":{"type":"string"},"in":"query"},{"name":"membership","description":"filter by membership type: 'direct' (only orgs the user is a direct admin of) or 'group' (only orgs accessed via group membership). If not specified, all orgs are returned.","schema":{"type":"string"},"in":"query"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"orgs":{"items":{"additionalProperties":false,"properties":{"billing_quantity":{"oneOf":[{"type":"integer"},{"type":"null"}]},"code":{"type":"string"},"description":{"type":"string"},"errors":{"oneOf":[{"type":"null"},{"items":{"additionalProperties":false,"properties":{"component":{"type":"string"},"error":{"type":"string"},"oid":{"type":"string"},"ts":{"type":"number"}},"type":"object"},"type":"array"}]},"latest_versions":{"oneOf":[{"type":"null"},{"additionalProperties":false,"properties":{"experimental":{"type":"string"},"fallback":{"type":"string"},"latest":{"type":"string"}},"type":"object"}]},"name":{"type":"string"},"oid":{"type":"string"},"permissions":{"items":{"type":"string"},"type":"array"},"sensor_online":{"oneOf":[{"type":"integer"},{"type":"null"}]},"sensor_quota":{"oneOf":[{"type":"integer"},{"type":"null"}]},"sensor_version":{"oneOf":[{"type":"string"},{"type":"null"}]},"site_name":{"oneOf":[{"type":"string"},{"type":"null"}]},"status":{"type":"string"}},"type":"object"},"type":"array"},"total":{"type":"integer"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get all organizations the current token has access to, including oid, name and description.","summary":"Get Accessible Orgs"}},"/user/self/auth":{"get":{"operationId":"getUserAuthRequirements","tags":["Billing"],"parameters":[],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"anyOf":[{"additionalProperties":false,"description":"Empty object: the domain has no configured authentication requirements","type":"object"},{"additionalProperties":false,"properties":{"auth_ui":{"additionalProperties":false,"description":"Login-UI offering for the domain. Present only when the domain offers SSO. UI-only: enforcement is expressed via requirements.methods.","properties":{"sso_provider_id":{"type":"string"}},"required":["sso_provider_id"],"type":"object"},"is_unified_billing":{"type":"boolean"},"requirements":{"additionalProperties":false,"properties":{"max_session_seconds":{"type":"integer"},"methods":{"anyOf":[{"type":"null"},{"items":{"type":"string"},"type":"array"}]},"mfa":{"anyOf":[{"type":"null"},{"items":{"type":"string"},"type":"array"}]},"mfa_reset_email":{"type":"string"},"new_account_mfa_grace_seconds":{"type":"integer"}},"required":["methods","mfa"],"type":"object"}},"required":["requirements","is_unified_billing"],"type":"object"}]}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get authentication requirements (MFA, sign-in methods) for the authenticated user's email domain.","summary":"Get User Auth Requirements"}},"/usp/validate/{oid}":{"post":{"operationId":"validateUSPMapping","tags":["USP"],"parameters":[{"name":"oid","required":true,"description":"organization id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"USP mapping validation request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"hostname":{"description":"Default hostname for sensors. If not specified, defaults to 'validation-test'.","title":"Default Hostname","type":"string"},"indexing":{"description":"Optional list of indexing rules to apply to parsed events. Structure validated by backend.","items":{"type":"object"},"title":"Indexing Rules","type":"array"},"json_input":{"description":"Pre-parsed JSON input as an array of objects. Mutually exclusive with text_input.","items":{"type":"object"},"title":"JSON Input","type":"array"},"mapping":{"description":"A single mapping descriptor to validate. Structure validated by backend.","title":"Single Mapping","type":"object"},"mappings":{"description":"List of mapping descriptors for multi-mapping selection. Structure validated by backend.","items":{"type":"object"},"title":"Multiple Mappings","type":"array"},"platform":{"description":"The parser platform type to use (e.g., 'text', 'json', 'cef', 'gcp', 'aws').","title":"Platform","type":"string"},"text_input":{"description":"Newline-separated text input to parse. Mutually exclusive with json_input.","title":"Text Input","type":"string"}},"required":["platform"],"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"errors":{"description":"List of errors encountered during validation.","items":{"type":"string"},"title":"Errors","type":"array"},"results":{"description":"List of successfully parsed events.","items":{"type":"object"},"title":"Parsed Results","type":"array"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Validate USP adapter mapping configurations by testing them against sample input without affecting production systems. This allows you to verify that your parsing rules, mappings, and indexing configurations work as expected before deploying them. The request body is passed through to the backend validation service.","summary":"Validate USP Mapping"}},"/{sid}":{"delete":{"operationId":"deleteSensor","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Delete a sensor.","summary":"Delete Sensor","x-required-permissions":{"all_of":["sensor.del"]}},"get":{"operationId":"getSensorInfo","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"info":{"additionalProperties":false,"properties":{"alive":{"description":"timestamp of last alive check","pattern":"^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$","title":"alive check","type":"string"},"arch":{"description":"architecture of host running the sensor","title":"architecture","type":"integer"},"cursor":{"description":"cursor for the next page","type":"string"},"did":{"oneOf":[{"description":"UUID of the device","format":"uuid","title":"device identifier","type":"string"},{"enum":[""]}]},"enroll":{"description":"timestamp of sensor enrollment","pattern":"^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$","title":"enrollment timestamp","type":"string"},"error":{"oneOf":[{"type":"string"},{"type":"null"}]},"ext_ip":{"oneOf":[{"description":"external IP of the host running the sensor","format":"ipv4","title":"external IP","type":"string"},{"enum":["internal",""]}]},"ext_plat":{"description":"external platform of the sensor","title":"external platform","type":"integer"},"hostname":{"description":"hostname of the host running the sensor","title":"hostname","type":"string"},"iid":{"description":"installation key identifier","title":"installation key identifier","type":"string"},"installer_version":{"description":"version of the installer","title":"installer version","type":"string"},"int_ip":{"description":"internal IP of the host running the sensor","title":"internal IP","type":"string"},"is_del":{"description":"is the sensor deleted","title":"deleted status","type":"boolean"},"is_isolated":{"description":"isolation status of the sensor","title":"isolation status","type":"boolean"},"is_kernel_available":{"description":"is kernel available to the sensor","title":"kernel availability","type":"boolean"},"is_online":{"description":"is sensor online at the moment","title":"online status","type":"boolean"},"mac_addr":{"description":"MAC address of the host running the sensor","title":"MAC address","type":"string"},"metadata":{"oneOf":[{"additionalProperties":true,"type":"object"},{"type":"null"}]},"oid":{"description":"UUID of the organization","format":"uuid","title":"organization identifier","type":"string"},"plat":{"description":"platform type of the host running the sensor","title":"platform","type":"integer"},"sealed":{"description":"seal status of the sensor","title":"seal status","type":"boolean"},"should_isolate":{"description":"isolation intent of the sensor","title":"isolation intent","type":"boolean"},"should_seal":{"description":"seal intent of the sensor","title":"seal intent","type":"boolean"},"sid":{"description":"UUID of the sensor","format":"uuid","title":"sensor identifier","type":"string"},"tags":{"items":{"description":"sensors tag","title":"tag","type":"string"},"type":"array"},"version":{"description":"version of the sensor","title":"sensor version","type":"string"}},"required":["sid","alive","arch","did","enroll","ext_ip","ext_plat","hostname","int_ip","is_isolated","is_kernel_available","mac_addr","oid","plat","sealed","should_isolate","should_seal"],"type":"object"},"online":{"additionalProperties":false,"properties":{"error":{"type":"string"},"is_online":{"type":"boolean"}},"type":"object"}},"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the sensor information and online status.","summary":"Get Sensor Info","x-required-permissions":{"all_of":["sensor.get"]}},"patch":{"operationId":"undeleteSensor","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Undelete a sensor.","summary":"Undelete Sensor","x-required-permissions":{"all_of":["sensor.del"]}},"post":{"operationId":"taskSensor","tags":["Sensors"],"parameters":[{"name":"tasks","description":"list of tasks to send","schema":{"type":"string"},"in":"query"},{"name":"investigation_id","description":"tag included in data returned from sensor resulting from the tasks","schema":{"type":"string"},"in":"query"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"requestBody":{"description":"specification for the tasks to be performed","content":{"application/x-www-form-urlencoded":{"schema":{"additionalProperties":false,"properties":{"investigation_id":{"description":"a tag included in data returned from sensor resulting from the tasks","title":"investigation id","type":"string"},"tasks":{"description":"list of tasks to send","items":{"type":"string"},"title":"tasks","type":"array"}},"type":"object"}}},"required":true},"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Send a task to a sensor.","summary":"Task Sensor","x-required-permissions":{"all_of":["sensor.task"]}}},"/{sid}/isolation":{"delete":{"operationId":"rejoinSensor","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove the sensor from network isolation.","summary":"Rejoin Sensor","x-required-permissions":{"all_of":["sensor.task"]}},"get":{"operationId":"getSensorIsolation","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"is_isolated":{"type":"boolean"},"should_isolate":{"type":"boolean"}},"required":["is_isolated","should_isolate"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the sensor isolation status.","summary":"Get Isolation Status","x-required-permissions":{"all_of":["sensor.get"]}},"post":{"operationId":"isolateSensor","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Set the sensor in network isolation.","summary":"Isolate Sensor","x-required-permissions":{"all_of":["sensor.task"]}}},"/{sid}/seal":{"delete":{"operationId":"unsealSensor","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove the sensor seal.","summary":"Unseal Sensor","x-required-permissions":{"all_of":["sensor.task"]}},"get":{"operationId":"getSensorSeal","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"is_sealed":{"type":"boolean"},"should_seal":{"type":"boolean"}},"required":["is_sealed","should_seal"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the sensor seal status.","summary":"Get Seal Status","x-required-permissions":{"all_of":["sensor.get"]}},"post":{"operationId":"sealSensor","tags":["Sensors"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Set the sensor seal status.","summary":"Seal Sensor","x-required-permissions":{"all_of":["sensor.task"]}}},"/{sid}/tags":{"delete":{"operationId":"removeSensorTag","tags":["Sensors","Tags"],"parameters":[{"name":"tag","description":"tag to delete","schema":{"type":"string"},"in":"query"},{"name":"tags","description":"tags to delete, as a comma separated list","schema":{"type":"string"},"in":"query"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Remove a tag from the sensor.","summary":"Untag Sensor","x-required-permissions":{"all_of":["sensor.tag"]}},"get":{"operationId":"getSensorTags","tags":["Sensors","Tags"],"parameters":[{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"tags":{"additionalProperties":{"additionalProperties":{"items":{"type":"string"},"type":"array"},"type":"object"},"type":"object"}},"required":["tags"],"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Get the sensor tags.","summary":"Get Sensor Tags","x-required-permissions":{"all_of":["sensor.get"]}},"post":{"operationId":"addSensorTag","tags":["Sensors","Tags"],"parameters":[{"name":"tags","description":"list of tags to add","schema":{"type":"string"},"in":"query"},{"name":"ttl","description":"number of seconds the tag is valid for","schema":{"pattern":"^[0-9]+$","type":"string"},"in":"query"},{"name":"is_did","description":"if set, indicates that the sid provided is really a DeviceID (did) and all its sensors should betagged","schema":{"enum":["1","t","T","true","TRUE","True","0","f","F","false","FALSE","False"]},"in":"query"},{"name":"sid","required":true,"description":"sensor id","schema":{"format":"uuid","type":"string"},"in":"path"}],"responses":{"200":{"description":"successful operation","content":{"application/json":{"schema":{"additionalProperties":false,"type":"object"}}}},"400":{"description":"Malformed request","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}},"401":{"description":"Access token is missing or invalid","content":{"application/json":{"schema":{"additionalProperties":false,"properties":{"error":{"type":"string"}},"type":"object"}}}}},"description":"Add tags to the sensor.","summary":"Tag Sensor","x-required-permissions":{"all_of":["sensor.tag"]}}}},"security":[{"bearerAuth":[]}],"servers":[{"url":"https://api.limacharlie.io/v1"}],"tags":[{"name":"Api Keys","description":"Operations related to the management of API Keys."},{"name":"Artifacts","description":"Operations related to the management of Artifacts."},{"name":"Billing","description":"Operations related to the management of Billing."},{"name":"Cloud Security","description":"Operations related to the CNAPP cloud-security posture, findings, and security graph."},{"name":"Errors","description":"Operations related to the Error logs."},{"name":"Exports","description":"Operations related to the exporting of data."},{"name":"Extensions","description":"Operations related to the management of Extensions."},{"name":"General","description":"Misc. Operations."},{"name":"Groups","description":"Operations related to the management of Groups."},{"name":"Hive","description":"Operations related to the configuration hive."},{"name":"Installation Keys","description":"Operations related to the management of Installation Keys."},{"name":"Jobs","description":"Operations related to the management of Jobs."},{"name":"Model Request","description":"Operations related to the management of Models."},{"name":"Modules","description":"Operations related to the management of sensor versions deployed."},{"name":"Organizations","description":"Operations related to the management of Organizations."},{"name":"Outputs","description":"Operations related to the forwarding of data."},{"name":"Payload","description":"Operations related to the management of Payloads."},{"name":"Resources","description":"Operations related to subscription and updating of Resources."},{"name":"Retention","description":"Operations related to data retention, visualization and searching."},{"name":"Rules","description":"Operations related to the Detection \u0026 Response rules."},{"name":"Schema","description":"Operations related to the interaction with Schemas."},{"name":"Sensors","description":"Operations related to the interaction with Sensors."},{"name":"Service","description":"Operations related to interaction with LimaCharlie Services."},{"name":"Tags","description":"Operations related to the tagging of sensors."},{"name":"USP","description":"Operations related to Universal Sensor Protocol adapters."},{"name":"Users","description":"Operations related to user and permissions management."}],"x-explorer-enabled":true,"x-samples-enabled":true,"x-samples-languages":["curl","node","ruby","javascript","python","go"]}