{ "openapi": "3.1.1", "info": { "title": "ContraForce API", "description": "ContraForce platform API for security operations management.", "version": "2.0" }, "paths": { "/api/v2/workspaces/{workspaceId}/incidents/{source}/{incidentId}": { "get": { "tags": [ "Incidents" ], "summary": "Get incident by id", "operationId": "v2-get-incident-by-id", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "source", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/IncidentSource" } }, { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfContraForceIncident" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/incidents/{source}/{incidentId}/evidence": { "get": { "tags": [ "Incidents" ], "summary": "Get incident evidence", "operationId": "v2-get-incident-evidence", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "source", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/IncidentSource" } }, { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfGeneralTableDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/incidents/{source}/{incidentId}/last-gamebook": { "get": { "tags": [ "Incidents" ], "summary": "Get incident last gamebook", "operationId": "v2-get-incident-last-gamebook", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "source", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/IncidentSource" } }, { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfGamebookDto" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/incidents/{source}/by-entity": { "get": { "tags": [ "Incidents" ], "summary": "Get incidents by entity", "operationId": "v2-get-incidents-by-entity", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "source", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/IncidentSource" } }, { "name": "IncidentId", "in": "query", "schema": { "type": "string" } }, { "name": "EntityKind", "in": "query", "schema": { "type": "string" } }, { "name": "EntityFilter", "in": "query", "schema": { "type": "string" } }, { "name": "TimeFilteringType", "in": "query", "schema": { "$ref": "#/components/schemas/TimeFilteringType" } }, { "name": "StartDate", "in": "query", "schema": { "type": "string", "format": "date-time" } }, { "name": "EndDate", "in": "query", "schema": { "type": "string", "format": "date-time" } }, { "name": "EntityName", "in": "query", "schema": { "type": "string" } }, { "name": "EntityType", "in": "query", "schema": { "$ref": "#/components/schemas/EntityType" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIncidentsByEntityResultDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/incidents/{source}/{incidentId}/status": { "put": { "tags": [ "Incidents" ], "summary": "Update incident status", "operationId": "v2-update-incident-status", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "source", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/IncidentSource" } }, { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateIncidentStatusRequest" } } } }, "responses": { "204": { "description": "No Content" }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/incidents/{source}/{incidentId}/assignee": { "put": { "tags": [ "Incidents" ], "summary": "Assign incident", "operationId": "v2-assign-incident", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "source", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/IncidentSource" } }, { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AssignIncidentRequest" } } } }, "responses": { "204": { "description": "No Content" }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/incidents/{source}/{incidentId}/comments": { "get": { "tags": [ "Incidents" ], "summary": "Get incident comments", "operationId": "v2-get-incident-comments", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "source", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/IncidentSource" } }, { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIEnumerableOfIncidentCommentDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } }, "post": { "tags": [ "Incidents" ], "summary": "Create incident comment", "operationId": "v2-create-incident-comment", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "source", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/IncidentSource" } }, { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateIncidentCommentRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIncidentCommentDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/incidents/{source}/{incidentId}/comments/{commentId}": { "put": { "tags": [ "Incidents" ], "summary": "Update incident comment", "operationId": "v2-update-incident-comment", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "source", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/IncidentSource" } }, { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "commentId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateIncidentCommentRequest" } } } }, "responses": { "204": { "description": "No Content" }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } }, "delete": { "tags": [ "Incidents" ], "summary": "Delete incident comment", "operationId": "v2-delete-incident-comment", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "source", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/IncidentSource" } }, { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "commentId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "extensionId", "in": "query", "schema": { "type": "string" } } ], "responses": { "204": { "description": "No Content" }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/gamebooks/rules/{incidentTitle}": { "get": { "tags": [ "Gamebooks" ], "summary": "Get playbooks by incident title", "operationId": "v2-get-playbooks-by-incident-title", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "incidentTitle", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIEnumerableOfPlaybookMetadataDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/gamebooks/history": { "get": { "tags": [ "Gamebooks" ], "summary": "List gamebooks history", "operationId": "v2-list-gamebooks-history", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "query", "in": "query", "schema": { "type": "string" } }, { "name": "pageToken", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfListGamebooksResultDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/gamebooks/history/{gamebookId}/playbooks": { "get": { "tags": [ "Gamebooks" ], "summary": "Get playbooks by gamebook id", "operationId": "v2-get-playbooks-by-gamebook-id", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "gamebookId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "year", "in": "query", "required": true, "schema": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" } }, { "name": "tenantId", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIEnumerableOfPlaybookGameplanDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/gamebooks/by-incident/{incidentId}": { "get": { "tags": [ "Gamebooks" ], "summary": "List incident gamebooks", "operationId": "v2-list-incident-gamebooks", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "withUserDetails", "in": "query", "required": true, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIEnumerableOfGamebookDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/datasources": { "get": { "tags": [ "Data sources" ], "summary": "Get connected datasources", "operationId": "v2-get-connected-datasources", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIEnumerableOfDataSource" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/tickets/search": { "get": { "tags": [ "Service tickets" ], "summary": "Search tickets", "operationId": "v2-search-tickets", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "groupingId", "in": "query", "schema": { "type": "string" } }, { "name": "ticketNumber", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIEnumerableOfServiceTicketDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/tickets/link": { "post": { "tags": [ "Service tickets" ], "summary": "Link ticket", "operationId": "v2-link-ticket", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LinkServiceTicketRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfServiceTicketDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/tickets/unlink": { "post": { "tags": [ "Service tickets" ], "summary": "Unlink ticket", "operationId": "v2-unlink-ticket", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UnlinkServiceTicketRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfboolean" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/tickets/priority": { "put": { "tags": [ "Service tickets" ], "summary": "Update ticket priority", "operationId": "v2-update-ticket-priority", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServiceTicketUpdatePriorityRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfboolean" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/investigation/users/signin-logs": { "get": { "tags": [ "Investigation" ], "summary": "List signin logs", "operationId": "v2-list-signin-logs", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "UserId", "in": "query", "schema": { "type": "string" } }, { "name": "TimeFilteringType", "in": "query", "required": true, "schema": { "$ref": "#/components/schemas/TimeFilteringType" } }, { "name": "StartDate", "in": "query", "schema": { "type": "string", "format": "date-time" } }, { "name": "EndDate", "in": "query", "schema": { "type": "string", "format": "date-time" } }, { "name": "NextPageLink", "in": "query", "schema": { "type": "string" } }, { "name": "EntityName", "in": "query", "schema": { "type": "string" } }, { "name": "ResourceId", "in": "query", "schema": { "type": "string" } }, { "name": "ResourceName", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfSignInLogsResultDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/investigation/users/directory-logs": { "get": { "tags": [ "Investigation" ], "summary": "List directory logs", "operationId": "v2-list-directory-logs", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "UserId", "in": "query", "schema": { "type": "string" } }, { "name": "TimeFilteringType", "in": "query", "required": true, "schema": { "$ref": "#/components/schemas/TimeFilteringType" } }, { "name": "StartDate", "in": "query", "schema": { "type": "string", "format": "date-time" } }, { "name": "EndDate", "in": "query", "schema": { "type": "string", "format": "date-time" } }, { "name": "NextPageLink", "in": "query", "schema": { "type": "string" } }, { "name": "EntityName", "in": "query", "schema": { "type": "string" } }, { "name": "ResourceId", "in": "query", "schema": { "type": "string" } }, { "name": "ResourceName", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfAuditLogsResultDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks": { "post": { "tags": [ "agent-tools" ], "summary": "Agent tool submit gamebook", "operationId": "v2-agent-tool-submit-gamebook", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "source", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/IncidentSource" } }, { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentToolGamebookSubmissionRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfAgentToolGamebookSubmissionResult" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/investigation": { "post": { "tags": [ "agent-tools" ], "summary": "Agent tool submit investigation", "operationId": "v2-agent-tool-submit-investigation", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "source", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/IncidentSource" } }, { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentToolInvestigationSubmissionRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfAgentToolInvestigationSubmissionResult" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/agent/tools/users/{userId}": { "get": { "tags": [ "agent-tools" ], "summary": "Agent tool get user details", "operationId": "v2-agent-tool-get-user-details", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfAgentToolUserDetailsResult" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/agent/tools/kql/tables": { "get": { "tags": [ "agent-tools" ], "summary": "Agent tool list kql tables", "operationId": "v2-agent-tool-list-kql-tables", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfAgentToolKqlTablesResult" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/agent/tools/kql/tables/columns": { "post": { "tags": [ "agent-tools" ], "summary": "Agent tool get kql table columns", "operationId": "v2-agent-tool-get-kql-table-columns", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentToolKqlTableColumnsRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfAgentToolKqlTableColumnsResult" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/agent/tools/kql/query": { "post": { "tags": [ "agent-tools" ], "summary": "Agent tool execute kql", "operationId": "v2-agent-tool-execute-kql", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AgentToolKqlQueryRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfAgentToolKqlQueryResult" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/agent/tools/users/{userId}/signin-logs": { "get": { "tags": [ "agent-tools" ], "summary": "Agent tool list signin logs", "operationId": "v2-agent-tool-list-signin-logs", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "TimeFilteringType", "in": "query", "description": "Time window for the lookup. Allowed values: ThreeHours, SixHours, TwelveHours, TwentyFourHours, FourtyEightHours, Custom. Prefer the smallest window that resolves your specific uncertainty — sign-in volume can be high. Default: TwentyFourHours.", "required": true, "schema": { "$ref": "#/components/schemas/TimeFilteringType" } }, { "name": "StartDate", "in": "query", "description": "UTC start instant for Custom windows. Required when TimeFilteringType is Custom; ignored otherwise.", "schema": { "type": "string", "format": "date-time" } }, { "name": "EndDate", "in": "query", "description": "UTC end instant for Custom windows. Required when TimeFilteringType is Custom; ignored otherwise.", "schema": { "type": "string", "format": "date-time" } }, { "name": "NextPageLink", "in": "query", "description": "Pagination cursor returned by a previous call's response. Pass to fetch the next page of results; omit for the first page.", "schema": { "type": "string" } }, { "name": "EntityName", "in": "query", "description": "Display name of the user entity being investigated. Surfaced in the audit trail; not used for matching.", "schema": { "type": "string" } }, { "name": "ResourceId", "in": "query", "description": "Audit-trail anchor — the ID of the resource the lookup is attributed to. Typically the incident ID.", "schema": { "type": "string" } }, { "name": "ResourceName", "in": "query", "description": "Audit-trail anchor — the display name of the resource the lookup is attributed to. Typically the incident title.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfAgentToolTabularResult" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/agent/tools/users/{userId}/directory-logs": { "get": { "tags": [ "agent-tools" ], "summary": "Agent tool list directory logs", "operationId": "v2-agent-tool-list-directory-logs", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "TimeFilteringType", "in": "query", "description": "Time window for the lookup. Allowed values: ThreeHours, SixHours, TwelveHours, TwentyFourHours, FourtyEightHours, Custom. Prefer the smallest window that resolves your specific uncertainty — directory audit volume can be high. Default: TwentyFourHours.", "required": true, "schema": { "$ref": "#/components/schemas/TimeFilteringType" } }, { "name": "StartDate", "in": "query", "description": "UTC start instant for Custom windows. Required when TimeFilteringType is Custom; ignored otherwise.", "schema": { "type": "string", "format": "date-time" } }, { "name": "EndDate", "in": "query", "description": "UTC end instant for Custom windows. Required when TimeFilteringType is Custom; ignored otherwise.", "schema": { "type": "string", "format": "date-time" } }, { "name": "NextPageLink", "in": "query", "description": "Pagination cursor returned by a previous call's response. Pass to fetch the next page of results; omit for the first page.", "schema": { "type": "string" } }, { "name": "EntityName", "in": "query", "description": "Display name of the user entity being investigated. Surfaced in the audit trail; not used for matching.", "schema": { "type": "string" } }, { "name": "ResourceId", "in": "query", "description": "Audit-trail anchor — the ID of the resource the lookup is attributed to. Typically the incident ID.", "schema": { "type": "string" } }, { "name": "ResourceName", "in": "query", "description": "Audit-trail anchor — the display name of the resource the lookup is attributed to. Typically the incident title.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfAgentToolTabularResult" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/agent/tools/devices/{deviceId}/timeline": { "get": { "tags": [ "agent-tools" ], "summary": "Agent tool get device timeline", "operationId": "v2-agent-tool-get-device-timeline", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "deviceId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "alertTime", "in": "query", "required": true, "schema": { "type": "string", "format": "date-time" } }, { "name": "entityName", "in": "query", "schema": { "type": "string" } }, { "name": "resourceId", "in": "query", "schema": { "type": "string" } }, { "name": "resourceName", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfAgentToolTabularResult" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/related-by-entity": { "get": { "tags": [ "agent-tools" ], "summary": "Agent tool related incidents", "operationId": "v2-agent-tool-related-incidents", "parameters": [ { "name": "workspaceId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "source", "in": "path", "required": true, "schema": { "$ref": "#/components/schemas/IncidentSource" } }, { "name": "incidentId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "EntityKind", "in": "query", "description": "The entity's `kind` property as it appears on the incident (e.g. 'Account', 'Host', 'File', 'FileHash', 'Ip', 'Mailbox').", "schema": { "type": "string" } }, { "name": "EntityFilter", "in": "query", "description": "Main matching property of the entity — the hash for File/FileHash, device name or ID for Host, UPN/email/object ID for Account, IP string for Ip. Wrong choices return zero matches; refer to the entity's primary identifier on the incident.", "schema": { "type": "string" } }, { "name": "TimeFilteringType", "in": "query", "description": "Time window for related-incident search. Allowed values: ThreeHours, SixHours, TwelveHours, TwentyFourHours, FourtyEightHours, Custom. Default: TwentyFourHours.", "required": true, "schema": { "$ref": "#/components/schemas/TimeFilteringType" } }, { "name": "StartDate", "in": "query", "description": "UTC start instant for Custom windows. Required when TimeFilteringType is Custom; ignored otherwise.", "schema": { "type": "string", "format": "date-time" } }, { "name": "EndDate", "in": "query", "description": "UTC end instant for Custom windows. Required when TimeFilteringType is Custom; ignored otherwise.", "schema": { "type": "string", "format": "date-time" } }, { "name": "EntityName", "in": "query", "description": "Display name of the entity being investigated. Surfaced in the audit trail and the result's human-readable summary.", "schema": { "type": "string" } }, { "name": "EntityType", "in": "query", "description": "Internal entity type enum — more granular than EntityKind (e.g. EntityType.Account vs EntityType.User). Use the value present on the entity in the incident.", "required": true, "schema": { "$ref": "#/components/schemas/EntityType" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfAgentToolTabularResult" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/incidents/across-workspaces": { "post": { "tags": [ "Cross-workspace incidents" ], "summary": "List incidents across workspaces", "operationId": "v2-list-incidents-across-workspaces", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListIncidentsAcrossWorkspacesRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfListIncidentsForWorkspacesResultDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/incidents/across-workspaces/bulk-update": { "post": { "tags": [ "Cross-workspace incidents" ], "summary": "Bulk update incidents across workspaces", "operationId": "v2-bulk-update-incidents-across-workspaces", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BulkUpdateIncidentsRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfBulkUpdateIncidentResultDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/gamebooks/across-workspaces/history": { "get": { "tags": [ "Cross-workspace gamebooks" ], "summary": "List gamebooks history across workspaces", "operationId": "v2-list-gamebooks-history-across-workspaces", "parameters": [ { "name": "workspaces", "in": "query", "schema": { "type": "string" } }, { "name": "statuses", "in": "query", "schema": { "type": "string" } }, { "name": "currentPage", "in": "query", "required": true, "schema": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" } }, { "name": "query", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfPageListOfGamebookDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/datasources/across-workspaces/anomalies": { "post": { "tags": [ "Cross-workspace data sources" ], "summary": "List datasource anomalies across workspaces", "operationId": "v2-list-datasource-anomalies-across-workspaces", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListMultipleWorkspacesGeneralRequestDto" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfDataConnectorAnomaliesDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/datasources/across-workspaces": { "get": { "tags": [ "Cross-workspace data sources" ], "summary": "Get datasource workspaces across workspaces", "operationId": "v2-get-datasource-workspaces-across-workspaces", "parameters": [ { "name": "workspaceIds", "in": "query", "schema": { "type": "array", "items": { "type": "string" } } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfDataConnectorWorkspacesDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/webhooks": { "get": { "tags": [ "Webhooks" ], "summary": "List webhooks", "operationId": "v2-list-webhooks", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIEnumerableOfWebhookConfigurationDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } }, "post": { "tags": [ "Webhooks" ], "summary": "Create webhook", "operationId": "v2-create-webhook", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateWebhookConfigurationRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfWebhookConfigurationCreatedDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/webhooks/{id}": { "get": { "tags": [ "Webhooks" ], "summary": "Get webhook", "operationId": "v2-get-webhook", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfWebhookConfigurationDto" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } }, "put": { "tags": [ "Webhooks" ], "summary": "Update webhook", "operationId": "v2-update-webhook", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateWebhookConfigurationRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfWebhookConfigurationDto" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } }, "delete": { "tags": [ "Webhooks" ], "summary": "Delete webhook", "operationId": "v2-delete-webhook", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfboolean" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/webhooks/{id}/delivery-logs": { "get": { "tags": [ "Webhooks" ], "summary": "List webhook delivery logs", "operationId": "v2-list-webhook-delivery-logs", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "from", "in": "query", "schema": { "type": "string", "format": "date-time" } }, { "name": "to", "in": "query", "schema": { "type": "string", "format": "date-time" } }, { "name": "pageSize", "in": "query", "required": true, "schema": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" } }, { "name": "continuationToken", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfPagedResultOfWebhookDeliveryLogDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/webhooks/{id}/delivery-logs/{logId}": { "get": { "tags": [ "Webhooks" ], "summary": "Get webhook delivery log", "operationId": "v2-get-webhook-delivery-log", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "logId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "createdAt", "in": "query", "required": true, "schema": { "type": "string", "format": "date-time" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfWebhookDeliveryLogDto" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/webhooks/{id}/pause": { "post": { "tags": [ "Webhooks" ], "summary": "Pause webhook", "operationId": "v2-pause-webhook", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfWebhookConfigurationDto" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/webhooks/{id}/resume": { "post": { "tags": [ "Webhooks" ], "summary": "Resume webhook", "operationId": "v2-resume-webhook", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfWebhookConfigurationDto" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/webhooks/{id}/enable": { "post": { "tags": [ "Webhooks" ], "summary": "Enable webhook", "operationId": "v2-enable-webhook", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfWebhookConfigurationDto" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/webhooks/{id}/credentials": { "post": { "tags": [ "Webhooks" ], "summary": "Update webhook credentials", "operationId": "v2-update-webhook-credentials", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateWebhookCredentialsRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfWebhookCredentialsUpdatedDto" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/webhooks/{id}/test": { "post": { "tags": [ "Webhooks" ], "summary": "Test webhook", "operationId": "v2-test-webhook", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfSendTestWebhookResult" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/webhooks/{id}/delivery-logs/{logId}/redeliver": { "post": { "tags": [ "Webhooks" ], "summary": "Redeliver webhook", "operationId": "v2-redeliver-webhook", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "logId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "createdAt", "in": "query", "required": true, "schema": { "type": "string", "format": "date-time" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfRedeliverWebhookCommandResult" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/service-accounts": { "get": { "tags": [ "Service accounts" ], "summary": "List service accounts", "operationId": "v2-list-service-accounts", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfListOfServiceAccountDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } }, "post": { "tags": [ "Service accounts" ], "summary": "Create service account", "operationId": "v2-create-service-account", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateServiceAccountRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfServiceAccountCreatedDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/service-accounts/{id}": { "get": { "tags": [ "Service accounts" ], "summary": "Get service account", "operationId": "v2-get-service-account", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfServiceAccountDto" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } }, "put": { "tags": [ "Service accounts" ], "summary": "Update service account", "operationId": "v2-update-service-account", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateServiceAccountRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfServiceAccountDto" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } }, "delete": { "tags": [ "Service accounts" ], "summary": "Delete service account", "operationId": "v2-delete-service-account", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfboolean" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/service-accounts/{id}/disable": { "post": { "tags": [ "Service accounts" ], "summary": "Disable service account", "operationId": "v2-disable-service-account", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfServiceAccountDto" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/service-accounts/{id}/enable": { "post": { "tags": [ "Service accounts" ], "summary": "Enable service account", "operationId": "v2-enable-service-account", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfServiceAccountDto" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/service-accounts/{id}/credentials": { "post": { "tags": [ "Service accounts" ], "summary": "Create service account credential", "operationId": "v2-create-service-account-credential", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateServiceAccountCredentialRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfServiceAccountCredentialCreatedDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/service-accounts/{id}/credentials/{credentialId}/revoke": { "post": { "tags": [ "Service accounts" ], "summary": "Revoke service account credential", "operationId": "v2-revoke-service-account-credential", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "credentialId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfServiceAccountCredentialDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/users": { "get": { "tags": [ "Users" ], "summary": "List users", "operationId": "v2-list-users", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIEnumerableOfUser" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } }, "post": { "tags": [ "Users" ], "summary": "Add user", "operationId": "v2-add-user", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubmitAddUsersRequest" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfboolean" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } }, "put": { "tags": [ "Users" ], "summary": "Update user", "operationId": "v2-update-user", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubmitUserManagementRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfboolean" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/users/{userId}": { "get": { "tags": [ "Users" ], "summary": "Get user", "operationId": "v2-get-user", "parameters": [ { "name": "userId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfUser" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/users/profile": { "get": { "tags": [ "Users" ], "summary": "Get user profile", "operationId": "v2-get-user-profile", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfUserProfileDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } }, "put": { "tags": [ "Users" ], "summary": "Update user profile", "operationId": "v2-update-user-profile", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SubmitUserManagementRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfboolean" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/users/workspace/users": { "post": { "tags": [ "Users" ], "summary": "Get workspace users", "operationId": "v2-get-workspace-users", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetWorkspaceUsersRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIEnumerableOfWorkspaceUserDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/users/{id}": { "delete": { "tags": [ "Users" ], "summary": "Remove user", "operationId": "v2-remove-user", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfboolean" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/users/workspace": { "post": { "tags": [ "Users" ], "summary": "Add workspace users", "operationId": "v2-add-workspace-users", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfboolean" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/users/organization/role": { "put": { "tags": [ "Users" ], "summary": "Update org role", "operationId": "v2-update-org-role", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateUserOrganizationalRoleRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfboolean" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/azure-resources/subscriptions": { "get": { "tags": [ "Azure resources" ], "summary": "List azure subscriptions", "operationId": "v2-list-azure-subscriptions", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIEnumerableOfAzureSubscriptionDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/azure-resources/subscriptions/{subscriptionId}/network-security-groups": { "get": { "tags": [ "Azure resources" ], "summary": "List azure nsgs", "operationId": "v2-list-azure-nsgs", "parameters": [ { "name": "subscriptionId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIEnumerableOfNetworkSecurityGroupDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/azure-resources/subscriptions/is-owner": { "get": { "tags": [ "Azure resources" ], "summary": "Check azure subscription owner", "operationId": "v2-check-azure-subscription-owner", "parameters": [ { "name": "subscriptionId", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfboolean" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/azure-resources/subscriptions/{subscriptionId}/resource-groups": { "get": { "tags": [ "Azure resources" ], "summary": "List azure resource groups", "operationId": "v2-list-azure-resource-groups", "parameters": [ { "name": "subscriptionId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIEnumerableOfAzureResourceDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/azure-resources/subscriptions/{subscriptionId}/resource-groups/{resourceGroup}/workspaces": { "get": { "tags": [ "Azure resources" ], "summary": "List azure workspaces", "operationId": "v2-list-azure-workspaces", "parameters": [ { "name": "subscriptionId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "resourceGroup", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIEnumerableOfAzureResourceDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/azure-resources/subscriptions/{subscriptionId}/resource-groups/{resourceGroup}/sentinels": { "get": { "tags": [ "Azure resources" ], "summary": "List azure sentinels", "operationId": "v2-list-azure-sentinels", "parameters": [ { "name": "subscriptionId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "resourceGroup", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfIEnumerableOfAzureResourceDto" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/azure-resources/subscriptions/{subscriptionId}/resource-groups/{resourceGroup}/workspaces/{workspaceName}/validate": { "get": { "tags": [ "Azure resources" ], "summary": "Validate azure workspace", "operationId": "v2-validate-azure-workspace", "parameters": [ { "name": "subscriptionId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "resourceGroup", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "workspaceName", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfboolean" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } }, "/api/v2/azure-resources/analytical-rules/{ruleId}": { "put": { "tags": [ "Azure resources" ], "summary": "Update analytical rule", "operationId": "v2-update-analytical-rule", "parameters": [ { "name": "ruleId", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "enabled", "in": "query", "required": true, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiResponseOfboolean" } } } }, "400": { "description": "Bad request — validation or parameter binding failed.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "401": { "description": "Unauthorized — missing or invalid Bearer token.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "403": { "description": "Forbidden — insufficient scope or workspace access.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "404": { "description": "Not found — workspace or resource is missing.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } }, "500": { "description": "Internal server error.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" } } } } } } } }, "components": { "schemas": { "AgentToolCallKql": { "type": "object", "properties": { "query": { "type": [ "null", "string" ], "description": "Exact KQL query that was executed. Shown verbatim in the comment activity header so an analyst can replay or audit the query." }, "row_count": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "description": "Number of rows the query returned before any client-side truncation. Use the row_count from the execute-kql tool result.", "format": "int32" } }, "description": "Per-call detail emitted alongside an `execute-kql` tool call so the comment\nheader can render the query and result size without a re-execution." }, "AgentToolCallRecord": { "type": "object", "properties": { "name": { "type": [ "null", "string" ], "description": "Tool name as the agent invoked it (e.g. 'execute-kql', 'get-user-details', 'list-signin-logs'). Use the MCP tool name verbatim so the activity header maps to the right icon/label." }, "time": { "type": "string", "description": "UTC instant the tool call started. ISO 8601 / RFC 3339 format.", "format": "date-time" }, "duration_ms": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "description": "Wall-clock duration of the call in milliseconds, including network time. Used to surface slow tool calls in the activity header.", "format": "int64" }, "target_entity": { "type": [ "null", "string" ], "description": "Entity the tool call targeted — UPN for users, device ID for hosts, table name for KQL, etc. Null for tools that do not address a specific entity (e.g. list-kql-tables)." }, "kql": { "description": "KQL-specific detail. Populate ONLY for execute-kql tool calls — the renderer shows the query and row count inline in the activity header. Null for every other tool.", "$ref": "#/components/schemas/AgentToolCallKql" } }, "description": "One entry in the agent's tool-call timeline." }, "AgentToolGamebookSubmissionRequest": { "type": "object", "properties": { "incident_number": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "description": "Sequential incident number from the source platform. Used in human-readable summaries and gamebook tracking.", "format": "int32" }, "incident_title": { "type": [ "null", "string" ], "description": "Human-readable incident title from the source platform. Used in summaries and audit logs." }, "trigger_type": { "description": "How the agent run was triggered. OnQueue (background): subject to per-severity Gamebooks capability gating — submissions are rejected for severities where Gamebooks is not enabled. ManualInvestigateAndRespond (operator-requested): always allowed to submit gamebooks regardless of capability settings.", "$ref": "#/components/schemas/AgentTriggerType" }, "playbooks": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/AgentToolPlaybook" }, "description": "Ordered playbook actions to run as part of this gamebook. Each entry binds a playbook from the registered catalog to its target entity. Must contain at least one entry — empty arrays are rejected." } }, "description": "Request DTO for the agent's submit-gamebook tool. Allows the agent to queue one or more\nremediation gamebooks against an incident as it investigates." }, "AgentToolGamebookSubmissionResult": { "type": "object", "properties": { "success": { "type": "boolean", "description": "True when the gamebook was queued. False for application-level failures (severity gating, unknown playbook, missing entity properties, upstream errors) — the failure reason is in `summary`." }, "summary": { "type": [ "null", "string" ], "description": "Compact human-readable digest the agent can quote directly. On success: 'Gamebook GB-XXXXXX queued for {severity} severity incident. N playbook(s) scheduled: …'. On failure: a one-line failure reason." }, "gamebook_id": { "type": [ "null", "string" ], "description": "ID of the queued gamebook. Pass this back in `submit-investigation`'s gamebook_ids so the investigation record references the gamebooks the agent triggered." }, "status": { "type": [ "null", "string" ], "description": "Gamebook lifecycle status at the moment of queueing (e.g. 'Queued', 'Running'). Not authoritative for completion — gamebooks run asynchronously after this call returns." }, "is_queued_for_approval": { "type": "boolean", "description": "True when the gamebook was recorded but not started — it is sitting in the analyst's queue waiting for approval. Happens when the trigger type or severity capability doesn't give the agent run-authority (OnQueue without the Gamebooks capability for the incident's severity, or ManualInvestigateOnly). False when the gamebook was run directly." } }, "description": "Result of an agent submit-gamebook tool call. Designed for LLM consumption — the\nstring AgentToolGamebookSubmissionResult.Summary field is a compact human-readable digest the agent can emit\ndirectly into chat or chain into follow-up reasoning." }, "AgentToolInvestigationSubmissionRequest": { "type": "object", "properties": { "comment": { "type": [ "null", "string" ], "description": "Final investigation summary. Posted on the incident as the agent's comment as-is — no server-side wrapping or section headers are applied. Write as a detailed security analyst would: cover initial hypothesis, indicators matched, tools called and why, evidence found, classification rationale, response actions, and recommended next steps. This is what a human analyst will read to learn from the agent's analysis." }, "classification_reason_comment": { "type": [ "null", "string" ], "description": "Short rationale (1–2 sentences) shown on the incident's closure record when the status transition closes the incident. Surfaces in the closure dialog and audit log alongside the classification reason." }, "malicious_score": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "description": "Agent's maliciousness confidence on a 0–100 scale. 0 = clearly benign, 100 = clearly malicious. Values outside this range cause the call to fail with success:false.", "format": "int32" }, "classification": { "oneOf": [ { "type": "null" }, { "description": "Final incident classification. Allowed values: TruePositive (confirmed malicious), FalsePositive (alert was wrong), BenignPositive (real activity but not malicious), Undetermined (insufficient evidence), Suspicious (SentinelOne incidents only — suspicious but not confirmable). Status transition follows from this via the per-severity agent settings.", "$ref": "#/components/schemas/Classification" } ] }, "classification_reason": { "oneOf": [ { "type": "null" }, { "description": "Reason corresponding to the classification. TruePositive → Malware | Phishing | Other. FalsePositive → InaccurateData | IncorrectAlertLogic | Other. BenignPositive/Undetermined → Other. Not set for Suspicious. Wrong pairings are normalised server-side and may result in an unexpected applied reason.", "$ref": "#/components/schemas/ClassificationReason" } ] }, "classification_sop": { "description": "The single classification SOP whose decision tree drove the classification. Null when no SOP applied to this incident type.", "$ref": "#/components/schemas/AgentToolSopReference" }, "response_sops": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/AgentToolSopReference" }, "description": "SOPs whose response steps the agent executed during the investigation. Empty when the agent decided no response action was warranted." }, "gamebook_ids": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "IDs of gamebooks the agent queued earlier via submit-gamebook during this investigation. Use the `gamebook_id` returned by each submit-gamebook call. Receive-only here — submit-investigation does NOT queue additional gamebooks." }, "tool_calls": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/AgentToolCallRecord" }, "description": "Per-tool-call timeline the agent recorded during the investigation. Used to render the activity header on the comment so an analyst can see exactly which tools the agent invoked, on what target, in what order, and how long each took." } }, "description": "Request DTO for the agent's submit-investigation tool — the closeout call the agent\nmakes after it has finished investigating an incident." }, "AgentToolInvestigationSubmissionResult": { "type": "object", "properties": { "success": { "type": "boolean", "description": "True when both the comment was posted and the status transition (if any) succeeded. False if either failed — see `comment_posted` and `status_updated` for which leg failed." }, "summary": { "type": [ "null", "string" ], "description": "Compact human-readable digest of what happened: comment posted? status changed from X to Y? failure reason if any." }, "previous_status": { "type": [ "null", "string" ], "description": "Status the incident was in before this call." }, "new_status": { "type": [ "null", "string" ], "description": "Status the incident is in after this call. Equals previous_status when no transition was applied (either because the status already matched the target or because the update failed)." }, "applied_classification": { "type": [ "null", "string" ], "description": "Classification actually applied after server-side normalisation (e.g. provider-specific value normalisation). May differ from what was sent." }, "applied_classification_reason": { "type": [ "null", "string" ], "description": "Classification reason actually applied after server-side normalisation. May differ from what was sent." }, "comment_posted": { "type": "boolean", "description": "True when the agent's comment was successfully posted on the incident." }, "status_updated": { "type": "boolean", "description": "True when the incident's status was successfully transitioned. False when the status was already at the target value (no update needed) or when the update failed." } }, "description": "Result of an agent submit-investigation tool call." }, "AgentToolKqlColumn": { "type": "object", "properties": { "name": { "type": [ "null", "string" ], "description": "Column name. Use verbatim in KQL queries — column names are case-sensitive in Kusto." }, "type": { "type": [ "null", "string" ], "description": "Column data type as Kusto names it (e.g. 'string', 'datetime', 'long', 'real', 'bool', 'dynamic', 'guid'). Use to decide on appropriate operators and casts in your KQL." } } }, "AgentToolKqlQueryRequest": { "type": "object", "properties": { "query": { "type": [ "null", "string" ], "description": "KQL query to execute against the workspace's Log Analytics workspace. Ground the query in the real schema first by calling list-kql-tables and get-kql-table-columns — queries against non-existent tables or columns return a clear error. Prefer narrowly-scoped queries (specific table, time range, project clause) over broad scans to keep results inside the row cap." }, "max_rows": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "null", "integer", "string" ], "description": "Optional row cap. Defaults to 50 server-side; values above the hard maximum (200) are clamped silently. Set explicitly only when the default is too narrow for the investigation — the cap protects the LLM context window from runaway queries.", "format": "int32" } }, "description": "Request DTO for the agent's KQL execution tool. Trimmed for LLM consumption — the\nagent supplies a query string the schema-aware sub-agent has already generated, and we\nrun it under the workspace's Log Analytics context." }, "AgentToolKqlQueryResult": { "type": "object", "properties": { "success": { "type": "boolean", "description": "True when the query ran. False for KQL syntax errors, schema mismatches, upstream Log Analytics failures, or XDR-only workspaces — the failure reason is in `summary`." }, "summary": { "type": [ "null", "string" ], "description": "Compact human-readable digest: 'Query returned N rows.' or 'Query returned X rows; showing first N (truncated).' or a one-line failure reason." }, "row_count": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "description": "Number of rows actually returned (after server-side truncation). When `truncated` is true, this is less than the total rows the query matched.", "format": "int32" }, "truncated": { "type": "boolean", "description": "True when the query produced more rows than were returned (hit the row cap). The agent should narrow the query (tighter time range, more selective filters, project fewer columns) rather than attempt pagination — these tools have no pagination contract. Omitted when false." }, "columns": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "Column names in order. Index into each row in `rows` using the position of the column name here. Columns whose values were null/empty across every projected row are auto-pruned." }, "rows": { "type": [ "null", "array" ], "items": { "type": "array", "items": { "type": "string" } }, "description": "Result rows as parallel arrays aligned to `columns`. Position-aligned: rows[r][c] is the value of columns[c] for row r. Values are stringified — booleans become 'true'/'false', objects/arrays become compact JSON, oversized cells are truncated with a `…(N more)` suffix." } }, "description": "Result of an agent KQL execution tool call. Returns true-columnar rows (parallel arrays\nindexed against the List<string> AgentToolKqlQueryResult.Columns header) — far more token-efficient than a\nper-row dictionary because column names are written exactly once." }, "AgentToolKqlTable": { "type": "object", "properties": { "name": { "type": [ "null", "string" ], "description": "Table name as it appears in Log Analytics. Use this verbatim in KQL queries." }, "columns": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/AgentToolKqlColumn" }, "description": "Columns defined on this table. Order follows the table's schema definition." } } }, "AgentToolKqlTableColumnsRequest": { "type": "object", "properties": { "table_names": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "Table names to fetch column metadata for. Names from list-kql-tables work as-is. Unknown names are echoed back in `unknown_table_names` rather than silently dropped, so the agent can recover. Must contain at least one entry." } }, "description": "Request DTO for the agent's get-KQL-table-columns tool. Pass the table names the\nagent wants column metadata for — the response includes per-table column lists and\nechoes back any names that didn't resolve to a real table." }, "AgentToolKqlTableColumnsResult": { "type": "object", "properties": { "success": { "type": "boolean", "description": "True when at least one requested table matched the schema. False when none matched, on XDR-only workspaces, or on upstream schema-fetch failures — reason in `summary`." }, "summary": { "type": [ "null", "string" ], "description": "Compact human-readable digest: 'Resolved N table(s) with M column(s) total.' plus a list of unknown names when any failed to resolve." }, "tables": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/AgentToolKqlTable" }, "description": "Per-table column metadata for the names that resolved. Order follows the request input." }, "unknown_table_names": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "Names from the request that did not resolve to a real table. Empty when every requested name was found. Use this to retry with corrected names or to back off and call list-kql-tables again." } }, "description": "Result of the agent's get-KQL-table-columns tool." }, "AgentToolKqlTablesResult": { "type": "object", "properties": { "success": { "type": "boolean", "description": "True when the schema fetch succeeded. False on XDR-only onboarded workspaces (Log Analytics not available) or upstream failures — reason in `summary`." }, "summary": { "type": [ "null", "string" ], "description": "Compact human-readable digest: 'Workspace exposes N table(s). Call get-table-columns with the names you intend to query.' or a one-line failure reason." }, "tables": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "Table names available in the workspace, sorted alphabetically. Use verbatim in subsequent get-kql-table-columns and execute-kql calls." } }, "description": "Result of the agent's list-KQL-tables tool. Returns table names only — column data\nis intentionally excluded so the agent can broaden discovery cheaply and then call\nthe get-table-columns tool with a narrowed set of names." }, "AgentToolPlaybook": { "type": "object", "properties": { "playbook_id": { "type": [ "null", "string" ], "description": "ID of a playbook from the registered playbook catalog. Unknown IDs cause the entire submission to fail — there is no partial-success mode." }, "entity_id": { "type": [ "null", "string" ], "description": "Stable identifier of the target entity. MUST be the entity object's `id` property — NEVER `aadUserId`, `DeviceId`, `FileHash`, or any other entity-specific property. Using the wrong identifier here will cause the playbook to act on the wrong target or fail." }, "affected_entity": { "type": [ "null", "string" ], "description": "Display name of the target entity (e.g. UPN for a user, hostname for a device). Shown in human-readable summaries and audit logs." }, "sequence": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "description": "Run order within the gamebook, starting at 1. Lower numbers execute first. Use this to express dependencies — e.g., scan endpoint (sequence 1) before isolate endpoint (sequence 2) on the same device. Sequence is independent per entity: playbooks targeting different entities run in parallel groups.", "format": "int32" } } }, "AgentToolSopReference": { "type": "object", "properties": { "id": { "type": [ "null", "string" ], "description": "Internal SOP identifier (UUID or slug). Used to link back to the SOP record in the knowledge base." }, "name": { "type": [ "null", "string" ], "description": "Display name of the SOP. Shown in the comment header so the analyst sees which SOP drove the decision without a follow-up lookup." } }, "description": "A reference to a Standard Operating Procedure used by the agent — both the SOP's\ninternal id and its display name are sent so the metadata is self-describing\nwithout a follow-up lookup." }, "AgentToolTabularResult": { "type": "object", "properties": { "success": { "type": "boolean", "description": "True when the underlying lookup completed and the rows reflect real data. False for upstream failures, prerequisite-missing errors (e.g. module disabled, no aadUserId), or empty-with-reason responses — see `summary` for the cause." }, "summary": { "type": [ "null", "string" ], "description": "Compact human-readable digest: row count + truncation hint, or a one-line failure reason. Omitted when there is nothing meaningful to say beyond the rows themselves." }, "row_count": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "description": "Number of rows actually returned in `rows`. Zero when the lookup ran successfully but produced no matches.", "format": "int32" }, "truncated": { "type": "boolean", "description": "True when the upstream produced more rows than were returned (row cap hit). Narrow the query / time window rather than attempting pagination — these tools have no pagination contract unless `next_page_link` is present." }, "columns": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "Column names in order. Index into each row in `rows` using the position of the column name here. Columns whose values were null/empty across every projected row are auto-pruned so the agent isn't asked to reason about noise." }, "rows": { "type": [ "null", "array" ], "items": { "type": "array", "items": { "type": "string" } }, "description": "Result rows as parallel arrays aligned to `columns`. Position-aligned: rows[r][c] is the value of columns[c] for row r. Values are stringified — booleans become 'true'/'false', timestamps are ISO-8601 UTC, oversized cells are truncated with a `…(N more)` suffix." }, "constants": { "type": [ "null", "object" ], "additionalProperties": { "type": "string" }, "description": "Columns whose value was identical across every projected row, promoted out of `rows` and emitted once here. Saves tokens when (e.g.) every sign-in event has the same userPrincipalName." }, "next_page_link": { "type": [ "null", "string" ], "description": "Opaque pagination cursor returned by the upstream provider. Pass back as `next_page_link` on the next call to continue paging; omit for the first page. Absent when the upstream does not support pagination or there are no more pages." } }, "description": "Token-efficient envelope for agent-tool list responses. Rows are stored as parallel\narrays aligned to a single shared List<string> AgentToolTabularResult.Columns header so column names are\nwritten exactly once rather than once per row." }, "AgentToolUserDetailsResult": { "type": "object", "properties": { "success": { "type": "boolean", "description": "True when the user was found in Microsoft Graph. False when the user does not exist, when the Gamebooks-for-Identity module is disabled for the workspace, or when Graph returned an error — reason in `summary`." }, "summary": { "type": [ "null", "string" ], "description": "Compact one-line human-readable digest: '{DisplayName}, {JobTitle} in {Department} ({OfficeLocation}). UPN: {UPN}.' — fields omitted when null." }, "user_id": { "type": [ "null", "string" ], "description": "Azure AD object ID of the resolved user. Echoes the request input — useful for chained calls." }, "display_name": { "type": [ "null", "string" ], "description": "Display name (first + last) of the user." }, "user_principal_name": { "type": [ "null", "string" ], "description": "User Principal Name (UPN), typically the user's email-like sign-in name (e.g. alice@contoso.com)." }, "mail": { "type": [ "null", "string" ], "description": "Primary SMTP email address. May differ from the UPN." }, "job_title": { "type": [ "null", "string" ], "description": "Job title from the user's directory profile. Useful for assessing whether the account is privileged (e.g. 'Domain Admin', 'CFO')." }, "department": { "type": [ "null", "string" ], "description": "Department from the user's directory profile." }, "office_location": { "type": [ "null", "string" ], "description": "Office location from the user's directory profile. Useful when correlating sign-in geolocation against expected location." }, "mobile_phone": { "type": [ "null", "string" ], "description": "Mobile phone number from the user's directory profile." } }, "description": "Result of an agent user-lookup tool call. Returns a token-efficient view of a Microsoft\nGraph user with only the fields that have proven useful in incident analysis — full\nGraph payloads include large arrays of identities, business phones, and password change\nmetadata that bloat LLM context without changing decisions." }, "AgentTriggerType": { "enum": [ "OnQueue", "ManualInvestigateOnly", "ManualInvestigateAndRespond" ], "description": "Define the type of the agent trigger that identifies the behaviour of the agent" }, "ApiProblemDetails": { "type": "object", "properties": { "type": { "type": [ "null", "string" ] }, "title": { "type": [ "null", "string" ] }, "status": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "null", "integer", "string" ], "format": "int32" }, "detail": { "type": [ "null", "string" ] }, "instance": { "type": [ "null", "string" ] }, "code": { "type": [ "null", "string" ] }, "requestId": { "type": [ "null", "string" ] }, "timestamp": { "type": [ "null", "string" ] }, "target": { "type": [ "null", "string" ] }, "errors": { "type": [ "null", "object" ], "additionalProperties": { "type": "array", "items": { "type": "string" } } } }, "description": "API extension of ProblemDetails that surfaces the stable error code,\ntrace identifier, timestamp, optional target, and optional field-keyed validation\nerror map alongside the RFC 7807 members." }, "ApiResponseOfAgentToolGamebookSubmissionResult": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/AgentToolGamebookSubmissionResult" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfAgentToolInvestigationSubmissionResult": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/AgentToolInvestigationSubmissionResult" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfAgentToolKqlQueryResult": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/AgentToolKqlQueryResult" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfAgentToolKqlTableColumnsResult": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/AgentToolKqlTableColumnsResult" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfAgentToolKqlTablesResult": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/AgentToolKqlTablesResult" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfAgentToolTabularResult": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/AgentToolTabularResult" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfAgentToolUserDetailsResult": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/AgentToolUserDetailsResult" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfAuditLogsResultDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/AuditLogsResultDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfboolean": { "type": "object", "properties": { "data": { "type": "boolean" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfBulkUpdateIncidentResultDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/BulkUpdateIncidentResultDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfContraForceIncident": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/ContraForceIncident" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfDataConnectorAnomaliesDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/DataConnectorAnomaliesDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfDataConnectorWorkspacesDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/DataConnectorWorkspacesDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfGamebookDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/GamebookDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfGeneralTableDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/GeneralTableDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfIEnumerableOfAzureResourceDto": { "type": "object", "properties": { "data": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/AzureResourceDto" } }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfIEnumerableOfAzureSubscriptionDto": { "type": "object", "properties": { "data": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/AzureSubscriptionDto" } }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfIEnumerableOfDataSource": { "type": "object", "properties": { "data": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/DataSource" } }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfIEnumerableOfGamebookDto": { "type": "object", "properties": { "data": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/GamebookDto" } }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfIEnumerableOfIncidentCommentDto": { "type": "object", "properties": { "data": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/IncidentCommentDto" } }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfIEnumerableOfNetworkSecurityGroupDto": { "type": "object", "properties": { "data": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/NetworkSecurityGroupDto" } }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfIEnumerableOfPlaybookGameplanDto": { "type": "object", "properties": { "data": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/PlaybookGameplanDto" } }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfIEnumerableOfPlaybookMetadataDto": { "type": "object", "properties": { "data": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/PlaybookMetadataDto" } }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfIEnumerableOfServiceTicketDto": { "type": "object", "properties": { "data": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/ServiceTicketDto" } }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfIEnumerableOfUser": { "type": "object", "properties": { "data": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/User" } }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfIEnumerableOfWebhookConfigurationDto": { "type": "object", "properties": { "data": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/WebhookConfigurationDto" } }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfIEnumerableOfWorkspaceUserDto": { "type": "object", "properties": { "data": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/WorkspaceUserDto" } }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfIncidentCommentDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/IncidentCommentDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfIncidentsByEntityResultDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/IncidentsByEntityResultDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfListGamebooksResultDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/ListGamebooksResultDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfListIncidentsForWorkspacesResultDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/ListIncidentsForWorkspacesResultDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfListOfServiceAccountDto": { "type": "object", "properties": { "data": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/ServiceAccountDto" } }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfPagedResultOfWebhookDeliveryLogDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/PagedResultOfWebhookDeliveryLogDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfPageListOfGamebookDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/PageListOfGamebookDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfRedeliverWebhookCommandResult": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/RedeliverWebhookCommandResult" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfSendTestWebhookResult": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/SendTestWebhookResult" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfServiceAccountCreatedDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/ServiceAccountCreatedDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfServiceAccountCredentialCreatedDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/ServiceAccountCredentialCreatedDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfServiceAccountCredentialDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/ServiceAccountCredentialDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfServiceAccountDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/ServiceAccountDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfServiceTicketDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/ServiceTicketDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfSignInLogsResultDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/SignInLogsResultDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfUser": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/User" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfUserProfileDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/UserProfileDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfWebhookConfigurationCreatedDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WebhookConfigurationCreatedDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfWebhookConfigurationDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WebhookConfigurationDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfWebhookCredentialsUpdatedDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WebhookCredentialsUpdatedDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "ApiResponseOfWebhookDeliveryLogDto": { "type": "object", "properties": { "data": { "$ref": "#/components/schemas/WebhookDeliveryLogDto" }, "meta": { "$ref": "#/components/schemas/ResponseMeta" } }, "description": "Standard v2 API response envelope for single-item responses." }, "AppRole": { "enum": [ "DefaultAccess", "Admin", "User", "Billing", "IncidentAnalyst", "IncidentResponder", "DataSourceAdmin" ] }, "AssignIncidentRequest": { "type": "object", "properties": { "userId": { "type": [ "null", "string" ], "description": "ContraForce user id of the assignee." }, "email": { "type": [ "null", "string" ], "description": "Email of the assignee, used when string AssignIncidentRequest.UserId is not known to the caller." } }, "description": "v2 request body for assigning an incident to a user." }, "AuditedResourceType": { "enum": [ "None", "Incident", "Account" ], "description": "Specifies the types of resources that can be audited within the system." }, "AuditLogItemDto": { "type": "object", "properties": { "date": { "type": "string", "format": "date-time" }, "service": { "type": [ "null", "string" ] }, "activity": { "type": [ "null", "string" ] }, "category": { "type": [ "null", "string" ] }, "status": { "type": [ "null", "string" ] }, "statusReason": { "type": [ "null", "string" ] }, "targetResources": { "type": [ "null", "array" ], "items": { "type": "string" } }, "targets": { "type": [ "null", "string" ] }, "actor": { "type": [ "null", "string" ] } } }, "AuditLogsResultDto": { "type": "object", "properties": { "items": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/AuditLogItemDto" }, "description": "The user audit log items." }, "nextPageLink": { "type": [ "null", "string" ], "description": "The link to load the next page of user audit logs." }, "message": { "type": [ "null", "string" ], "description": "A consumer-neutral message describing why data could not be retrieved.\nPresent when bool AuditLogsResultDto.CanRetrieveData is `false`." }, "canRetrieveData": { "type": "boolean", "description": "Indicates whether the handler was able to retrieve the requested data.\nWhen `false`, callers should check string AuditLogsResultDto.Message for the reason\nand avoid retrying the same request without addressing the underlying cause." } } }, "AutotaskTicketDto": { "type": "object", "properties": { "id": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "companyId": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "projectId": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "null", "integer", "string" ], "format": "int32" }, "assignedResourceId": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "null", "integer", "string" ], "format": "int64" }, "assignedResourceRoleId": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "null", "integer", "string" ], "format": "int64" }, "billingCodeId": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "null", "integer", "string" ], "format": "int32" }, "categoryId": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "number": { "type": [ "null", "string" ] }, "type": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "title": { "type": [ "null", "string" ] }, "description": { "type": [ "null", "string" ] }, "priority": { "$ref": "#/components/schemas/AutotaskTicketPriority" }, "status": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "queueId": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "dueDateTime": { "type": "string", "format": "date-time" }, "notes": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/AutotaskTicketNoteDto" } } } }, "AutotaskTicketNoteDto": { "type": "object", "properties": { "id": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "description": { "type": [ "null", "string" ] }, "ticketId": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "title": { "type": [ "null", "string" ] } } }, "AutotaskTicketPriority": { "enum": [ "High", "Medium", "Low", "Critical" ] }, "AutotaskTicketPriorityUpdateRequest": { "type": "object", "properties": { "id": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "priority": { "$ref": "#/components/schemas/AutotaskTicketPriority" } } }, "AzureResourceDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "name": { "type": [ "null", "string" ] }, "azureId": { "type": [ "null", "string" ] }, "location": { "type": [ "null", "string" ] } } }, "AzureSubscriptionDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "displayName": { "type": [ "null", "string" ] } } }, "BulkUpdateIncidentResultDto": { "type": "object", "properties": { "accepted": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "Incident IDs the caller is authorized to update. These are scheduled for async processing." }, "forbidden": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/ForbiddenBulkUpdateIncidentDto" }, "description": "Incidents the caller is not authorized to update, grouped with the reason." } }, "description": "Outcome of a bulk incident update request after per-incident authorization." }, "BulkUpdateIncidentsRequest": { "type": "object", "properties": { "items": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/UpdateIncidentRequest" } } }, "description": "v2 request body for the cross-workspace bulk incident update endpoint." }, "Classification": { "enum": [ "BenignPositive", "FalsePositive", "TruePositive", "Undetermined", "InformationalExpectedActivity", "Unknown", "NonIssue", "PolicyViolation", "QradarFalsePositive", "Undefined", "Suspicious", null ] }, "ClassificationReason": { "enum": [ "InaccurateData", "IncorrectAlertLogic", "SuspiciousActivity", "SuspiciousButExpected", "Unknown", "Apt", "Malware", "SecurityPersonnel", "SecurityTesting", "UnwantedSoftware", "Other", "MultistagedAttack", "CompromisedUser", "Phishing", "MaliciousUserActivity", "NotMalicious", "NoEnoughDataToValidate", "ConfirmedUserActivity", "LineOfBusinessApplication", null ] }, "ConnectorParameterHelper": { "type": "object", "properties": { "propertyName": { "type": [ "null", "string" ] }, "propertyValue": { "type": [ "null", "string" ] } } }, "ConnectorType": { "enum": [ "MicrosoftOffice", "AzureADIdentityProtection", "MicrosoftDefenderForEndpoint", "MicrosoftDefenderForCloudApps", "MicrosoftDefenderForCloud", "MicrosoftDefenderForIdentity", "AWSCloudTrail" ] }, "ContraForceIncident": { "type": "object", "properties": { "source": { "description": "Property to retrieve the source of the incident (DefenderXDR, Sentinel, etc)", "$ref": "#/components/schemas/IncidentSource" }, "incident": { "description": "Object to retrieve the base information of the incident", "$ref": "#/components/schemas/Incident" }, "investigationDetails": { "description": "Object to retrieve the entities and alerts related to the incident", "$ref": "#/components/schemas/IncidentInvestigationDetailsDto" }, "evidence": { "description": "Object to retrieve the evidence related to the incident", "$ref": "#/components/schemas/GeneralTableDto" }, "gamebookCatalog": { "description": "(Nullable) Represents the recommended gamebook by ContraForce or the last run gamebook for the incident", "$ref": "#/components/schemas/IncidentGamebooksCatalogDto" } }, "description": "Object that represents all the data from an incident that could come from any source" }, "CreateIncidentCommentRequest": { "required": [ "content", "extensionId" ], "type": "object", "properties": { "content": { "type": [ "null", "string" ], "description": "Body of the comment." }, "extensionId": { "type": [ "null", "string" ], "description": "Id of the extension associated with the incident; required to route the\nwrite back to the originating system (e.g. Sentinel, Defender XDR)." } }, "description": "v2 request body for creating a comment on an incident." }, "CreateServiceAccountCredentialRequest": { "type": "object", "properties": { "expirationDate": { "type": [ "null", "string" ], "format": "date-time" }, "scopes": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "The API scopes to grant to this credential." } }, "description": "Request to create an additional credential for an existing service account." }, "CreateServiceAccountRequest": { "type": "object", "properties": { "name": { "type": [ "null", "string" ] }, "description": { "type": [ "null", "string" ] }, "organizationalRole": { "$ref": "#/components/schemas/OrganizationalRole" }, "workspaceAssignments": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/WorkspaceRoleAssignment" } }, "expirationDate": { "type": [ "null", "string" ], "format": "date-time" }, "scopes": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "The granular API scopes granted to the initial credential." } } }, "CreateWebhookConfigurationRequest": { "type": "object", "properties": { "workspaceId": { "type": [ "null", "string" ], "format": "uuid" }, "name": { "type": [ "null", "string" ] }, "url": { "type": [ "null", "string" ] }, "eventTypes": { "type": [ "null", "array" ], "items": { "type": "string" } }, "monitoredAccountIds": { "type": [ "null", "array" ], "items": { "type": "string", "format": "uuid" } }, "authenticationType": { "$ref": "#/components/schemas/WebhookAuthenticationType" }, "token": { "type": [ "null", "string" ] }, "signingToken": { "type": [ "null", "string" ] }, "username": { "type": [ "null", "string" ] }, "password": { "type": [ "null", "string" ] } } }, "DataConnectorAnomaliesDto": { "type": "object", "properties": { "items": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/DataConnectorAnomalyItemDto" } } } }, "DataConnectorAnomalyItemDto": { "type": "object", "properties": { "workspaceName": { "type": [ "null", "string" ] }, "dataConnector": { "$ref": "#/components/schemas/DataConnectorDto" }, "status": { "$ref": "#/components/schemas/DataConnectorAnomalyStatus" } } }, "DataConnectorAnomalyStatus": { "enum": [ "Active", "Resolved", "Investigating", "Failed" ] }, "DataConnectorDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "name": { "type": [ "null", "string" ] }, "description": { "type": [ "null", "string" ] }, "icon": { "type": [ "null", "string" ] }, "link": { "type": [ "null", "string" ] }, "category": { "type": [ "null", "string" ] }, "provider": { "type": [ "null", "string" ] }, "isConnected": { "type": "boolean" }, "isWaitingActivation": { "type": "boolean" }, "directApiConnectionAvailable": { "type": "boolean", "description": "Indicates if the data connector has an API to connect/disconnect it" }, "metadata": { "type": [ "null", "string" ], "description": "Defines a JSON / String that contains the configuration for a specific data source (ARN for AWS CloudTrail)" }, "isConfigurable": { "type": "boolean", "description": "Data Connector requires configuration before it can be used (Form of data is needed)" }, "plan": { "type": [ "null", "string" ] }, "isSupported": { "type": "boolean" }, "isPrivate": { "type": "boolean" }, "isSubscribedToDeployments": { "type": "boolean" }, "deployedVersionDto": { "$ref": "#/components/schemas/VersionDto" }, "cfCurrentVersionDto": { "$ref": "#/components/schemas/VersionDto" }, "status": { "$ref": "#/components/schemas/DataSourceAnalysisStatus" }, "modificationDate": { "type": "string", "format": "date-time" } }, "description": "Data Connector that is supported by the onboarding process and the" }, "DataConnectorWorkspacesDto": { "type": "object", "properties": { "workspaces": { "type": [ "null", "array" ], "items": { "type": "string" } }, "sources": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/DataConnectorWorkspaceSourceDto" } } } }, "DataConnectorWorkspaceSourceDto": { "type": "object", "properties": { "workspaceId": { "type": [ "null", "string" ] }, "workspaceName": { "type": [ "null", "string" ] }, "tenantId": { "type": [ "null", "string" ] }, "source": { "type": [ "null", "string" ] }, "dataConnectorCount": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" } } }, "DataSource": { "type": "object", "properties": { "name": { "type": [ "null", "string" ] }, "icon": { "type": [ "null", "string" ] }, "dataConnectorId": { "type": [ "null", "string" ] }, "provider": { "type": [ "null", "string" ] }, "description": { "type": [ "null", "string" ] }, "connectorType": { "$ref": "#/components/schemas/ConnectorType" }, "connected": { "type": "boolean" }, "modificationDateTime": { "type": "string", "format": "date-time" }, "parametersHelper": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/ConnectorParameterHelper" } } } }, "DataSourceAnalysisStatus": { "enum": [ "RulesDeployed", "UpdatesAvailable", "PartiallyDeployed", "NoRulesDeployed" ] }, "EntityIncidentDto": { "type": "object", "properties": { "creationTime": { "type": "string", "format": "date-time" }, "number": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "title": { "type": [ "null", "string" ] }, "description": { "type": [ "null", "string" ] }, "severity": { "$ref": "#/components/schemas/Severity" }, "status": { "$ref": "#/components/schemas/Status" }, "id": { "type": [ "null", "string" ] }, "source": { "$ref": "#/components/schemas/IncidentSource" }, "workspaceId": { "type": [ "null", "string" ] }, "classificationComment": { "type": [ "null", "string" ] }, "classification": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/Classification" } ] } } }, "EntityType": { "enum": [ "User", "IP", "File", "Process", "Device", "Malware", "CloudApplication", "DomainName", "AzureResource", "FileHash", "RegistryKey", "RegistryValue", "SecurityGroup", "URL", "IoTDevice", "Mailbox", "MailCluster", "MailMessage", "Submission", "SentinelEntities", "DnsResolution", "Registry", "OAuthApplication", "AmazonResource", "BlobContainer", "Blob", "Container", "ContainerRegistry", "ContainerImage", "GoogleCloudResource", "KubernetesCluster", "KubernetesController", "KubernetesNamespace", "KubernetesPod", "KubernetesService", "KubernetesSecret", "KubernetesServiceAccount", "AnalyzedMessage", "DNS", "Unknown" ] }, "ForbiddenBulkUpdateIncidentDto": { "type": "object", "properties": { "incidentId": { "type": [ "null", "string" ] }, "workspaceId": { "type": [ "null", "string" ] }, "reason": { "type": [ "null", "string" ] } }, "description": "Per-incident rejection detail for a bulk update." }, "GamebookDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "tracingId": { "type": [ "null", "string" ] }, "incidentId": { "type": [ "null", "string" ] }, "source": { "description": "Source of the system that owns the incident Sentinel, Defender ATP, etc.", "$ref": "#/components/schemas/IncidentSource" }, "incidentTitle": { "type": [ "null", "string" ] }, "incidentNumber": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "isOcr": { "type": "boolean" }, "isRecover": { "type": "boolean" }, "triggedByUserId": { "type": [ "null", "string" ] }, "displayName": { "type": [ "null", "string" ] }, "modificationDate": { "type": "string", "format": "date-time" }, "creationDate": { "type": "string", "format": "date-time" }, "status": { "$ref": "#/components/schemas/GamebookRunningStatus" }, "title": { "type": [ "null", "string" ] }, "isAdminRequired": { "type": "boolean" }, "workspaceId": { "type": [ "null", "string" ] }, "workspaceName": { "type": [ "null", "string" ] }, "tenantId": { "type": [ "null", "string" ] }, "isAutoRun": { "type": "boolean" }, "originalGamebookId": { "type": [ "null", "string" ], "description": "Used if the gamebook is retry gamebook and refers to the id of the gamebook id that has been retried" }, "originalGamebookTitle": { "type": [ "null", "string" ], "description": "Used if the gamebook is retry gamebook and refers to the id of the gamebook title that has been retried" }, "isRetryGamebook": { "type": "boolean", "description": "Indicator if the gamebook is a retry to failed gamebook" }, "isQueued": { "type": "boolean", "description": "Indicator if the gamebook is queued by a service provider and it is not started yet" }, "playbooks": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/PlaybookGameplanDto" } }, "summary": { "type": [ "null", "string" ] } } }, "GamebookRunningStatus": { "enum": [ "Pending", "Running", "Finished", "Failed", "Queued", "Denied", "Cancelled" ] }, "GeneralTableDto": { "type": "object", "properties": { "columns": { "type": [ "null", "array" ], "items": { "type": "string" } }, "rows": { "type": [ "null", "array" ], "items": { "type": "array" } } } }, "GetWorkspaceUsersRequest": { "required": [ "accountId" ], "type": "object", "properties": { "accountId": { "type": "string", "format": "uuid" }, "query": { "type": [ "null", "string" ] }, "role": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/WorkspaceRole" } ] } } }, "Incident": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "name": { "type": [ "null", "string" ] }, "displayId": { "type": [ "null", "string" ], "description": "Optional human-readable identifier shown in the table and\npage heading instead of the long opaque string Incident.Id.\nPopulated for sources whose IDs are unwieldy (e.g. CrowdStrike\ncases use a 165-char base64 ID but expose a friendly\n\"`6F1-24`\"-style `reference_id`). When null, callers\nfall back to the existing short-form derivation of\nstring Incident.Id." }, "title": { "type": [ "null", "string" ] }, "description": { "type": [ "null", "string" ] }, "number": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "type": { "type": [ "null", "string" ] }, "source": { "$ref": "#/components/schemas/IncidentSource" }, "sourceDisplayName": { "type": [ "null", "string" ] }, "lastModificationTime": { "type": [ "null", "string" ], "description": "Date/Time represents the user's local time", "format": "date-time" }, "creationTime": { "type": "string", "description": "Date/Time represents the user's local time", "format": "date-time" }, "lastActivityTime": { "type": [ "null", "string" ], "description": "Date/Time represents the user's local time", "format": "date-time" }, "severity": { "$ref": "#/components/schemas/Severity" }, "classification": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/Classification" } ] }, "comment": { "type": [ "null", "string" ] }, "classificationReason": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/ClassificationReason" } ] }, "classificationComment": { "type": [ "null", "string" ] }, "tactics": { "type": [ "null", "array" ], "items": { "type": "string" } }, "ruleIds": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "Represents the Ids of the related rules of this incidents" }, "alertProductNames": { "type": [ "null", "array" ], "items": { "type": "string" } }, "user": { "description": "Represents the user assigned to work on this incident", "$ref": "#/components/schemas/UserSummary" }, "isAssigned": { "type": "boolean" }, "productId": { "type": [ "null", "string" ] }, "status": { "$ref": "#/components/schemas/Status" }, "alertsCount": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "entities": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/IncidentEntity" } }, "workspaceName": { "type": [ "null", "string" ], "description": "Name of the workspace in the customer tenant\nThis property is beneficial when the customer has multiple workspaces or when the partner is working under the multi-tenancy mode" }, "workspaceId": { "type": [ "null", "string" ], "description": "Name of the workspace in the customer tenant\nThis property is beneficial when the customer has multiple workspaces or when the partner is working under the multi-tenancy mode" }, "isDefenderXDRSourced": { "type": "boolean", "description": "Determines whether the incident is orginally sourced from Microsoft Defender XDR" } }, "description": "This incident object built on top of the Microsoft Azure Sentinel Incident and it's open to extend to any new provider" }, "IncidentCommentDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "message": { "type": [ "null", "string" ] }, "createdTime": { "type": [ "null", "string" ], "format": "date-time" }, "authorEmail": { "type": [ "null", "string" ] }, "authorName": { "type": [ "null", "string" ] }, "isActivityComment": { "type": "boolean", "description": "Indicates if the comment doesn't represent a written note, instead if just a system activity like status changed, priority changed, user assigned, etc." }, "isAgentComment": { "type": "boolean", "description": "Indicates if the comment was authored by an AI agent rather than a human analyst." }, "agentName": { "type": [ "null", "string" ], "description": "Name of the agent that authored the comment." }, "isClosingComment": { "type": "boolean", "description": "Indicates if the comment is the closing comment added when the incident was resolved or closed." }, "ticketNoteId": { "type": [ "null", "string" ], "description": "ID of the ticket note in the service ticketing system if the comment is related to a ticket note.\n(Nullable) only available if the tenant written this comment has a ticketing system enabled in their configuration." }, "ticketId": { "type": [ "null", "string" ], "description": "ID of the ticket in the service ticketing system if the comment is related to a ticket note.\n(Nullable) only available if the tenant written this comment has a ticketing system enabled in their configuration." } } }, "IncidentEntity": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "type": { "$ref": "#/components/schemas/EntityType" }, "kind": { "type": [ "null", "string" ] }, "displayName": { "type": [ "null", "string" ] }, "friendlyName": { "type": [ "null", "string" ] }, "fileName": { "type": [ "null", "string" ] }, "hostName": { "type": [ "null", "string" ] }, "accountEntityId": { "type": [ "null", "string" ] }, "deviceId": { "type": [ "null", "string" ] }, "deviceAzureId": { "type": [ "null", "string" ] }, "defenderAtpDeviceId": { "type": [ "null", "string" ] }, "defenderEndpointDeviceId": { "type": [ "null", "string" ] }, "networkMessageId": { "type": [ "null", "string" ] }, "hashAlgorithm": { "type": [ "null", "string" ] }, "aadUserId": { "type": [ "null", "string" ] }, "emailAddress": { "type": [ "null", "string" ] }, "userPrincipalName": { "type": [ "null", "string" ] }, "ipAddress": { "type": [ "null", "string" ] }, "fileHash": { "type": [ "null", "string" ] }, "emailId": { "type": [ "null", "string" ] }, "emailSubject": { "type": [ "null", "string" ] } }, "description": "This class is used to unify the Entities from different sources into a ContraForce Entity" }, "IncidentGamebooksCatalogDto": { "type": "object", "properties": { "recommended": { "$ref": "#/components/schemas/RecommendedGamebookDto" }, "lastGamebook": { "$ref": "#/components/schemas/GamebookDto" }, "isPreviousRunAvailable": { "type": "boolean", "description": "Indicates if the last Gamebook Run is available" }, "isRecommendedAvailable": { "type": "boolean", "description": "Indicates if the recommended Gamebook is available" }, "aiRecommendedAvailable": { "type": "boolean", "description": "Indicator if there is a recommended Gamebook by ContraForce" }, "serviceProviderRecommendedAvailable": { "type": "boolean", "description": "Indicator if there is a recommended Gamebook by the Service Provider" } }, "description": "Contains the recommended gamebooks by ContraForce or the Service Provider, in addition to the last Gamebook Run associated with an Incident" }, "IncidentInvestigationDetailsDto": { "type": "object", "properties": { "entities": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/InvestigationEntityDto" } }, "alerts": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/InvestigationAlertDto" } }, "incident": { "$ref": "#/components/schemas/Incident" }, "incidentComment": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/IncidentCommentDto" } } } }, "IncidentReference": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "source": { "$ref": "#/components/schemas/IncidentSource" }, "workspaceId": { "type": [ "null", "string" ] }, "number": { "type": [ "null", "string" ] } } }, "IncidentsByEntityResultDto": { "type": "object", "properties": { "incidents": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/EntityIncidentDto" } } } }, "IncidentSource": { "enum": [ "Sentinel", "DefenderXDR", "QRadar", "Splunk", "CrowdStrike", "SentinelOne" ] }, "InvestigationAlertDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "kind": { "type": [ "null", "string" ] }, "displayName": { "type": [ "null", "string" ] }, "alertName": { "type": [ "null", "string" ] }, "vendorName": { "type": [ "null", "string" ] }, "type": { "type": [ "null", "string" ] }, "description": { "type": [ "null", "string" ] }, "timeGenerated": { "type": [ "null", "string" ], "format": "date-time" }, "tactics": { "type": [ "null", "array" ], "items": { "type": "string" } }, "severity": { "type": [ "null", "string" ] }, "productName": { "type": [ "null", "string" ] }, "deviceId": { "type": [ "null", "string" ] } }, "description": "DTO that is being used for the investigation graph while retrieving the related Alerts of an entity" }, "InvestigationEntityDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "displayName": { "type": [ "null", "string" ] }, "fileName": { "type": [ "null", "string" ] }, "fileHash": { "type": [ "null", "string" ] }, "type": { "$ref": "#/components/schemas/EntityType" }, "friendlyName": { "type": [ "null", "string" ] }, "hostName": { "type": [ "null", "string" ] }, "kind": { "type": [ "null", "string" ] }, "accountEntityId": { "type": [ "null", "string" ] }, "networkMessageId": { "type": [ "null", "string" ] }, "commandLine": { "type": [ "null", "string" ] }, "userUpn": { "type": [ "null", "string" ] }, "deviceId": { "type": [ "null", "string" ] }, "aadUserId": { "type": [ "null", "string" ] }, "entityType": { "$ref": "#/components/schemas/PlaybookEntityType" }, "isValidEntraIdUser": { "type": "boolean", "description": "True if the user is a Microsoft Entra ID user (AAD), false indicates that the user is a local user" }, "isValidEntraIdDevice": { "type": "boolean", "description": "True if the device is a Microsoft Entra ID joined-device (AAD), false indicates that the device is a local device" } }, "description": "DTO that is being used for the investigation graph while retrieving the related entity of an node" }, "JiraIssueTypeDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "name": { "type": [ "null", "string" ] }, "projectId": { "type": [ "null", "string" ] }, "subtask": { "type": "boolean" } } }, "JiraPriorityDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "name": { "type": [ "null", "string" ] } } }, "JiraServiceDeskProjectDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "name": { "type": [ "null", "string" ] }, "key": { "type": [ "null", "string" ] } } }, "JiraServiceDeskRequestTypeDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "name": { "type": [ "null", "string" ] } } }, "JiraStatusDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "name": { "type": [ "null", "string" ] } } }, "JiraTicketDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "description": { "type": [ "null", "string" ] }, "summary": { "type": [ "null", "string" ] }, "number": { "type": [ "null", "string" ] }, "currentStatus": { "$ref": "#/components/schemas/JiraStatusDto" }, "priority": { "$ref": "#/components/schemas/JiraPriorityDto" }, "assignee": { "$ref": "#/components/schemas/JiraUserDto" }, "project": { "$ref": "#/components/schemas/JiraServiceDeskProjectDto" }, "issueType": { "$ref": "#/components/schemas/JiraIssueTypeDto" }, "requestType": { "$ref": "#/components/schemas/JiraServiceDeskRequestTypeDto" }, "labels": { "type": [ "null", "array" ], "items": { "type": "string" } }, "availablePriorities": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/JiraPriorityDto" } }, "availableStatuses": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/JiraStatusDto" } } } }, "JiraTicketPriorityUpdateRequest": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "priorityId": { "type": [ "null", "string" ] }, "priorityName": { "type": [ "null", "string" ] } } }, "JiraUserDto": { "type": "object", "properties": { "accountId": { "type": [ "null", "string" ] }, "displayName": { "type": [ "null", "string" ] }, "active": { "type": "boolean" } } }, "LinkServiceTicketRequest": { "type": "object", "properties": { "ticketId": { "type": [ "null", "string" ] }, "incident": { "$ref": "#/components/schemas/IncidentReference" } } }, "ListGamebooksResultDto": { "type": "object", "properties": { "gamebooks": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/GamebookDto" } }, "pageToken": { "type": [ "null", "string" ] }, "totalCount": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" } } }, "ListIncidentsAcrossWorkspacesRequest": { "type": "object", "properties": { "severities": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Severity" }, "description": "Filter incidents to only the listed severities. Empty list returns all severities." }, "statuses": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Status" }, "description": "Filter incidents to only the listed statuses. Empty list returns all statuses." }, "timeFilterSelection": { "description": "Time window for incident creation. Defaults to the last 24 hours.", "$ref": "#/components/schemas/TimeFilterSelection" }, "workspacePageTokens": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/WorkspaceSourcePageTokens" }, "description": "Opaque pagination tokens echoed from the previous response's `SourcePageTokens`.\nLeave empty on the first call. See type-level remarks for the pagination protocol." }, "query": { "type": [ "null", "string" ], "description": "Free-text search applied across incident title/description fields. Empty matches all." }, "isFirstCall": { "type": "boolean", "description": "`true` for the initial request; `false` when echoing\n List<WorkspaceSourcePageTokens> ListIncidentsAcrossWorkspacesRequest.WorkspacePageTokens back for subsequent pages. See type-level\n remarks for the pagination protocol." }, "sources": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/IncidentSource" }, "description": "Filter incidents to only the listed sources (e.g. Sentinel, DefenderXDR,\nCrowdStrike). Empty list returns all sources the caller has access to." }, "assigneeIds": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "Filter incidents assigned to any of the listed ContraForce user IDs." }, "assigneeEmails": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "Filter incidents assigned to any of the listed user email addresses." }, "includeUnassigned": { "type": "boolean", "description": "When `true`, include incidents that have no assignee alongside any\nmatches from List<string> ListIncidentsAcrossWorkspacesRequest.AssigneeIds / List<string> ListIncidentsAcrossWorkspacesRequest.AssigneeEmails." } }, "description": "v2 request for listing incidents across multiple workspaces." }, "ListIncidentsForWorkspacesResultDto": { "type": "object", "properties": { "incidents": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/Incident" }, "description": "Incidents returned for this page across all workspaces and sources the caller\nhas access to. Aggregated and merged in time-descending order by the server." }, "sourcePageTokens": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/WorkspaceSourcePageTokens" }, "description": "Opaque per-workspace, per-source continuation tokens for fetching the next\npage. Pass this value verbatim as `WorkspacePageTokens` on the next\nrequest along with `IsFirstCall = false`." }, "moreIncidentsAvailable": { "type": "boolean", "description": "`true` when at least one workspace/source still has additional pages.\n When `false`, the caller has consumed the full result set and may stop\n paging." } }, "description": "Wraps the result of listing incidents for multiple workspaces in the multi-tenancy mode." }, "ListMultipleWorkspacesGeneralRequestDto": { "type": "object", "properties": { "workspaceIds": { "type": [ "null", "array" ], "items": { "type": "string" } }, "timeFilterSelection": { "$ref": "#/components/schemas/TimeFilterSelection" } } }, "NetworkSecurityGroupDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "name": { "type": [ "null", "string" ] }, "location": { "type": [ "null", "string" ] } } }, "OrganizationalRole": { "enum": [ "Admin", "UserAdmin", "WorkspaceAdmin", "AgentAdmin", "Member" ] }, "PagedResultOfWebhookDeliveryLogDto": { "type": "object", "properties": { "items": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/WebhookDeliveryLogDto" } }, "continuationToken": { "type": [ "null", "string" ] }, "hasMore": { "type": "boolean" } }, "description": "Represents a page of results with a token to load more." }, "PageListOfGamebookDto": { "type": "object", "properties": { "items": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/GamebookDto" } }, "currentPage": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "totalPages": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "pageSize": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "totalCount": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "hasPreviousPage": { "type": "boolean" }, "hasNextPage": { "type": "boolean" } } }, "PlaybookEntityType": { "enum": [ "User", "Endpoint", "General", "Network", "Email" ] }, "PlaybookGameplanDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "referenceId": { "type": [ "null", "string" ], "description": "Reference Id (readonly) which is the id of the playbook + the id of the entity" }, "entityId": { "type": [ "null", "string" ] }, "name": { "type": [ "null", "string" ] }, "description": { "type": [ "null", "string" ] }, "entityType": { "$ref": "#/components/schemas/PlaybookEntityType" }, "affectedEntity": { "type": [ "null", "string" ] }, "isRecommended": { "type": "boolean" }, "status": { "$ref": "#/components/schemas/PlaybookRunningStatus" }, "errorMessage": { "type": [ "null", "string" ] }, "sequence": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "modificationDate": { "type": "string", "format": "date-time" }, "startingDate": { "type": [ "null", "string" ], "format": "date-time" }, "finishingDate": { "type": [ "null", "string" ], "format": "date-time" }, "executionTime": { "type": [ "null", "string" ], "description": "Total execution time taken to execute the playbook, the value is null until the DateTime? PlaybookGameplanDto.FinishingDate property is populated" }, "tracingId": { "type": [ "null", "string" ] }, "parameters": { "type": [ "null", "object" ], "description": "Represents the parameters of the playbooks to be sent in the message\nThe value will be populated only if the playbook is configurable (Block IP)" }, "isAdminRequired": { "type": "boolean" } } }, "PlaybookMetadataDto": { "type": "object", "properties": { "playbookId": { "type": [ "null", "string" ] }, "playbookName": { "type": [ "null", "string" ] }, "playbookDescription": { "type": [ "null", "string" ] }, "incidentTitle": { "type": [ "null", "string" ] }, "entity": { "type": [ "null", "string" ] }, "sentinelEntities": { "type": [ "null", "array" ], "items": { "type": "string" } }, "recoverPlaybookId": { "type": [ "null", "string" ] }, "isAdminRequired": { "type": "boolean" } } }, "PlaybookRunningStatus": { "enum": [ "Pending", "Running", "Finished", "Failed", "Terminated" ] }, "ProblemDetails": { "type": "object", "properties": { "type": { "type": [ "null", "string" ] }, "title": { "type": [ "null", "string" ] }, "status": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "null", "integer", "string" ], "format": "int32" }, "detail": { "type": [ "null", "string" ] }, "instance": { "type": [ "null", "string" ] } } }, "RecommendedGamebookDto": { "type": "object", "properties": { "aiGamebook": { "$ref": "#/components/schemas/GamebookDto" }, "serviceProviderGamebook": { "$ref": "#/components/schemas/GamebookDto" } } }, "RedeliverErrorCode": { "enum": [ "NotFailed", "AlreadyRedelivered", "NoPayload", "ConfigNotFound", "ConfigNotActive", null ] }, "RedeliverWebhookCommandResult": { "type": "object", "properties": { "isSuccess": { "type": "boolean" }, "result": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/RedeliverWebhookResult" } ] }, "errorReason": { "type": [ "null", "string" ] }, "errorCode": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/RedeliverErrorCode" } ] } } }, "RedeliverWebhookResult": { "type": "object", "properties": { "webhookConfigurationId": { "type": "string", "format": "uuid" }, "webhookConfigurationName": { "type": [ "null", "string" ] }, "originalDeliveryLogId": { "type": "string", "format": "uuid" }, "eventId": { "type": "string", "format": "uuid" }, "message": { "type": [ "null", "string" ] } } }, "ResponseMeta": { "type": "object", "properties": { "requestId": { "type": [ "null", "string" ] }, "timestamp": { "type": [ "null", "string" ] } } }, "SendTestWebhookResult": { "type": "object", "properties": { "webhookConfigurationId": { "type": "string", "format": "uuid" }, "webhookConfigurationName": { "type": [ "null", "string" ] }, "eventId": { "type": "string", "format": "uuid" }, "message": { "type": [ "null", "string" ] } }, "description": "Result returned after a test webhook has been queued for delivery." }, "ServiceAccountCreatedDto": { "type": "object", "properties": { "clientId": { "type": "string", "format": "uuid" }, "clientSecret": { "type": [ "null", "string" ] }, "id": { "type": "string", "format": "uuid" }, "accountId": { "type": "string", "format": "uuid" }, "name": { "type": [ "null", "string" ] }, "description": { "type": [ "null", "string" ] }, "isActive": { "type": "boolean" }, "organizationalRole": { "$ref": "#/components/schemas/OrganizationalRole" }, "clientSecretPrefix": { "type": [ "null", "string" ] }, "credentialExpirationDate": { "type": [ "null", "string" ], "format": "date-time" }, "workspaceAssignments": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/WorkspaceRoleAssignmentDto" } }, "credentials": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/ServiceAccountCredentialDto" } }, "lastUsedAt": { "type": [ "null", "string" ], "format": "date-time" }, "createdAt": { "type": "string", "format": "date-time" }, "lastModifiedAt": { "type": "string", "format": "date-time" } }, "description": "Returned only on service account creation. Contains the plaintext client secret which is shown once." }, "ServiceAccountCredentialCreatedDto": { "type": "object", "properties": { "clientId": { "type": "string", "format": "uuid" }, "clientSecret": { "type": [ "null", "string" ] }, "id": { "type": "string", "format": "uuid" }, "clientSecretPrefix": { "type": [ "null", "string" ] }, "status": { "$ref": "#/components/schemas/ServiceAccountCredentialStatus" }, "expirationDate": { "type": [ "null", "string" ], "format": "date-time" }, "lastUsedAt": { "type": [ "null", "string" ], "format": "date-time" }, "createdAt": { "type": "string", "format": "date-time" }, "scopes": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "The API scopes granted to this credential." } }, "description": "Returned only when a credential is created. Contains the plaintext client secret which is shown once." }, "ServiceAccountCredentialDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "clientSecretPrefix": { "type": [ "null", "string" ] }, "status": { "$ref": "#/components/schemas/ServiceAccountCredentialStatus" }, "expirationDate": { "type": [ "null", "string" ], "format": "date-time" }, "lastUsedAt": { "type": [ "null", "string" ], "format": "date-time" }, "createdAt": { "type": "string", "format": "date-time" }, "scopes": { "type": [ "null", "array" ], "items": { "type": "string" }, "description": "The API scopes granted to this credential." } }, "description": "Represents a single API credential belonging to a service account." }, "ServiceAccountCredentialStatus": { "enum": [ "Active", "Revoked" ] }, "ServiceAccountDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "accountId": { "type": "string", "format": "uuid" }, "name": { "type": [ "null", "string" ] }, "description": { "type": [ "null", "string" ] }, "isActive": { "type": "boolean" }, "organizationalRole": { "$ref": "#/components/schemas/OrganizationalRole" }, "clientSecretPrefix": { "type": [ "null", "string" ] }, "credentialExpirationDate": { "type": [ "null", "string" ], "format": "date-time" }, "workspaceAssignments": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/WorkspaceRoleAssignmentDto" } }, "credentials": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/ServiceAccountCredentialDto" } }, "lastUsedAt": { "type": [ "null", "string" ], "format": "date-time" }, "createdAt": { "type": "string", "format": "date-time" }, "lastModifiedAt": { "type": "string", "format": "date-time" } } }, "ServiceNowTicketCommentDto": { "type": "object", "properties": { "sysId": { "type": [ "null", "string" ] }, "elementId": { "type": [ "null", "string" ] }, "value": { "type": [ "null", "string" ] }, "createdOn": { "type": "string", "format": "date-time" }, "createdBy": { "type": [ "null", "string" ] }, "element": { "type": [ "null", "string" ] } } }, "ServiceNowTicketDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "description": { "type": [ "null", "string" ] }, "shortDescription": { "type": [ "null", "string" ] }, "number": { "type": [ "null", "string" ] }, "state": { "$ref": "#/components/schemas/ServiceNowTicketState" }, "urgency": { "$ref": "#/components/schemas/ServiceNowTicketUrgency" }, "comments": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/ServiceNowTicketCommentDto" } } } }, "ServiceNowTicketState": { "enum": [ "New", "InProgress", "OnHold", "Resolved", "Closed", "Canceled" ] }, "ServiceNowTicketUrgency": { "enum": [ "High", "Medium", "Low" ] }, "ServiceNowTicketUrgencyUpdateRequest": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "urgency": { "$ref": "#/components/schemas/ServiceNowTicketUrgency" } } }, "ServiceTicketDto": { "type": "object", "properties": { "autotaskTicket": { "$ref": "#/components/schemas/AutotaskTicketDto" }, "serviceNowTicket": { "$ref": "#/components/schemas/ServiceNowTicketDto" }, "jiraTicket": { "$ref": "#/components/schemas/JiraTicketDto" }, "ticketingSystemType": { "$ref": "#/components/schemas/ServiceTicketingSystemType" }, "isTicketSet": { "type": "boolean" } } }, "ServiceTicketingSystemType": { "enum": [ "Autotask", "ServiceNow", "Jira", "Zendesk", "None" ] }, "ServiceTicketUpdatePriorityRequest": { "type": "object", "properties": { "autotaskRequeest": { "$ref": "#/components/schemas/AutotaskTicketPriorityUpdateRequest" }, "serviceNowRequest": { "$ref": "#/components/schemas/ServiceNowTicketUrgencyUpdateRequest" }, "jiraRequest": { "$ref": "#/components/schemas/JiraTicketPriorityUpdateRequest" }, "resourceId": { "type": [ "null", "string" ], "description": "Gets or sets the unique identifier of the associated resource. Used to identify the target resource like Incident IDs." }, "resourceType": { "description": "Gets or sets the type of the resource represented by this instance.", "$ref": "#/components/schemas/AuditedResourceType" }, "resourceName": { "type": [ "null", "string" ], "description": "An optional human-readable name of the resource." } }, "description": "This DTO is a wrapper for priority (urgency for Snow) update calls." }, "Severity": { "enum": [ "Informational", "Low", "Medium", "High" ] }, "SignInLogsResultDto": { "type": "object", "properties": { "dataTable": { "description": "The user sign-in log data table.", "$ref": "#/components/schemas/GeneralTableDto" }, "nextPageLink": { "type": [ "null", "string" ], "description": "The link to load the next page of user sign-in logs." }, "message": { "type": [ "null", "string" ], "description": "A consumer-neutral message describing why data could not be retrieved.\nPresent when bool SignInLogsResultDto.CanRetrieveData is `false`." }, "canRetrieveData": { "type": "boolean", "description": "Indicates whether the handler was able to retrieve the requested data.\nWhen `false`, callers should check string SignInLogsResultDto.Message for the reason\nand avoid retrying the same request without addressing the underlying cause." } } }, "Status": { "enum": [ "Active", "New", "Closed" ] }, "SubmitAddUsersRequest": { "type": "object", "properties": { "users": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/SubmitUserManagementRequest" } }, "assignToWorkspace": { "type": "boolean", "description": "Set to true if the user is needed to be assigned for the workspace by default" } } }, "SubmitUserManagementRequest": { "type": "object", "properties": { "displayName": { "type": [ "null", "string" ] }, "tenantId": { "type": [ "null", "string" ] }, "userId": { "type": [ "null", "string" ] }, "organizationalRole": { "$ref": "#/components/schemas/OrganizationalRole" }, "email": { "type": [ "null", "string" ] }, "isOwner": { "type": "boolean" } } }, "TimeFilteringType": { "enum": [ "ThreeHours", "SixHours", "TwelveHours", "TwentyFourHours", "FourtyEightHours", "Custom", null ] }, "TimeFilterSelection": { "type": "object", "properties": { "type": { "$ref": "#/components/schemas/TimeFilteringType" }, "customStartUtc": { "type": [ "null", "string" ], "format": "date-time" }, "customEndUtc": { "type": [ "null", "string" ], "format": "date-time" } }, "description": "Canonical representation of a global time filter.\nWhen Type == Custom, CustomStartUtc and CustomEndUtc must be provided (UTC)." }, "UnlinkServiceTicketRequest": { "type": "object", "properties": { "incident": { "$ref": "#/components/schemas/IncidentReference" } } }, "UpdateIncidentCommentRequest": { "required": [ "content", "extensionId" ], "type": "object", "properties": { "content": { "type": [ "null", "string" ], "description": "Replacement body for the comment." }, "extensionId": { "type": [ "null", "string" ], "description": "Id of the extension associated with the incident; required to route the\nwrite back to the originating system." } }, "description": "v2 request body for updating an existing comment on an incident." }, "UpdateIncidentRequest": { "required": [ "id" ], "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "status": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/Status" } ] }, "user": { "$ref": "#/components/schemas/UserSummary" }, "workspace": { "type": [ "null", "string" ], "description": "Indicates the workspace that the incident is related to in case of multi-workspace environments" }, "removeAssignee": { "type": "boolean", "description": "If UserId is set to null but this is set to true,\nthe incident will be unassigned,\notherwise it will stay assigned to the current user" }, "comment": { "type": [ "null", "string" ] }, "classification": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/Classification" } ] }, "classificationReason": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/ClassificationReason" } ] }, "incidentSource": { "description": "The source system that contains the incident like Sentinel, Defender ..etc", "$ref": "#/components/schemas/IncidentSource" } } }, "UpdateIncidentStatusRequest": { "required": [ "status" ], "type": "object", "properties": { "status": { "description": "New status to apply to the incident.", "$ref": "#/components/schemas/Status" }, "comment": { "type": [ "null", "string" ], "description": "Optional comment recorded alongside the status change. Recommended when\ntransitioning to Status.Closed." }, "classification": { "oneOf": [ { "type": "null" }, { "description": "Required by Sentinel when closing an incident; ignored by sources that do\nnot surface classifications.", "$ref": "#/components/schemas/Classification" } ] }, "classificationReason": { "oneOf": [ { "type": "null" }, { "description": "Required by Sentinel when closing an incident; ignored by sources that do\nnot surface classification reasons.", "$ref": "#/components/schemas/ClassificationReason" } ] }, "updateTicket": { "type": "boolean", "description": "When `true`, also closes the linked service ticket identified by\nstring UpdateIncidentStatusRequest.TicketId." }, "ticketId": { "type": [ "null", "string" ], "description": "Linked service ticket id; required when bool UpdateIncidentStatusRequest.UpdateTicket is `true`." } }, "description": "v2 request body for updating an incident's status." }, "UpdateServiceAccountRequest": { "type": "object", "properties": { "name": { "type": [ "null", "string" ] }, "description": { "type": [ "null", "string" ] }, "organizationalRole": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/OrganizationalRole" } ] }, "workspaceAssignments": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/WorkspaceRoleAssignment" } } } }, "UpdateUserOrganizationalRoleRequest": { "type": "object", "properties": { "userId": { "type": [ "null", "string" ] }, "organizationalRole": { "$ref": "#/components/schemas/OrganizationalRole" } } }, "UpdateWebhookConfigurationRequest": { "type": "object", "properties": { "name": { "type": [ "null", "string" ] }, "url": { "type": [ "null", "string" ] }, "eventTypes": { "type": [ "null", "array" ], "items": { "type": "string" } }, "monitoredAccountIds": { "type": [ "null", "array" ], "items": { "type": "string", "format": "uuid" } } } }, "UpdateWebhookCredentialsRequest": { "type": "object", "properties": { "authenticationType": { "$ref": "#/components/schemas/WebhookAuthenticationType" }, "token": { "type": [ "null", "string" ] }, "signingToken": { "type": [ "null", "string" ] }, "username": { "type": [ "null", "string" ] }, "password": { "type": [ "null", "string" ] } } }, "User": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "displayName": { "type": [ "null", "string" ] }, "firstName": { "type": [ "null", "string" ] }, "lastName": { "type": [ "null", "string" ] }, "profilePictureUrl": { "type": [ "null", "string" ] }, "email": { "type": [ "null", "string" ] }, "username": { "type": [ "null", "string" ] }, "appRole": { "$ref": "#/components/schemas/AppRole" }, "addedOn": { "type": "string", "format": "date-time" }, "hasLoggedIn": { "type": "boolean" }, "isServiceAccount": { "type": "boolean" }, "isAgentUser": { "type": "boolean" }, "organizationRole": { "$ref": "#/components/schemas/OrganizationalRole" }, "workspaceRole": { "$ref": "#/components/schemas/WorkspaceRole" }, "groups": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/UserGroup" } }, "roleAssignments": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/UserRoleAssignment" } } }, "description": "Represents an employee or a user in ContraForce client's tenant and it's built on top of the Microsoft Graph user model and could be extended based on other provider needs" }, "UserGroup": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "accountId": { "type": "string", "format": "uuid" }, "accountName": { "type": [ "null", "string" ] }, "creationDate": { "type": "string", "format": "date-time" }, "lastModificationDate": { "type": "string", "format": "date-time" }, "groupOwner": { "type": [ "null", "string" ] }, "name": { "type": [ "null", "string" ] }, "description": { "type": [ "null", "string" ] }, "members": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/User" } }, "role": { "$ref": "#/components/schemas/WorkspaceRole" }, "workspacesAssigned": { "type": [ "null", "array" ], "items": { "type": "string" } } } }, "UserProfileDto": { "type": "object", "properties": { "name": { "type": [ "null", "string" ] }, "email": { "type": [ "null", "string" ] }, "upn": { "type": [ "null", "string" ] }, "userId": { "type": [ "null", "string" ] }, "role": { "$ref": "#/components/schemas/OrganizationalRole" }, "organization": { "type": [ "null", "string" ] }, "organizationId": { "type": [ "null", "string" ] }, "tenantId": { "type": [ "null", "string" ] }, "preferredTimeZoneId": { "type": [ "null", "string" ] }, "lastReleaseNotesSeenId": { "type": [ "null", "string" ] } } }, "UserRoleAssignment": { "type": "object", "properties": { "userId": { "type": [ "null", "string" ] }, "workspaceId": { "type": [ "null", "string" ] }, "workspaceName": { "type": [ "null", "string" ] }, "assignmentType": { "type": [ "null", "string" ] }, "role": { "$ref": "#/components/schemas/WorkspaceRole" } } }, "UserSummary": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "displayName": { "type": [ "null", "string" ] }, "email": { "type": [ "null", "string" ] } }, "description": "Represents a light version of the user object, that is used to add reference to a specific user in a foriegn entities" }, "VersionDto": { "type": "object", "properties": { "dataConnectorId": { "type": [ "null", "string" ] }, "version": { "type": [ "null", "string" ] }, "creationDate": { "type": "string", "format": "date-time" } } }, "WebhookAuthenticationType": { "enum": [ "None", "BasicAuth", "BearerToken" ] }, "WebhookConfigurationCreatedDto": { "type": "object", "properties": { "secret": { "type": [ "null", "string" ] }, "id": { "type": "string", "format": "uuid" }, "serviceProviderId": { "type": "string", "format": "uuid" }, "targetAccountId": { "type": "string", "format": "uuid" }, "targetAccountName": { "type": [ "null", "string" ] }, "workspaceId": { "type": [ "null", "string" ], "format": "uuid" }, "name": { "type": [ "null", "string" ] }, "url": { "type": [ "null", "string" ] }, "status": { "$ref": "#/components/schemas/WebhookConfigurationStatus" }, "eventTypes": { "type": [ "null", "array" ], "items": { "type": "string" } }, "monitoredAccountIds": { "type": [ "null", "array" ], "items": { "type": "string", "format": "uuid" } }, "authenticationType": { "$ref": "#/components/schemas/WebhookAuthenticationType" }, "hasSigningToken": { "type": "boolean" }, "disableReason": { "type": [ "null", "string" ] }, "disabledAt": { "type": [ "null", "string" ], "format": "date-time" }, "createdAt": { "type": "string", "format": "date-time" }, "lastModifiedAt": { "type": "string", "format": "date-time" } } }, "WebhookConfigurationDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "serviceProviderId": { "type": "string", "format": "uuid" }, "targetAccountId": { "type": "string", "format": "uuid" }, "targetAccountName": { "type": [ "null", "string" ] }, "workspaceId": { "type": [ "null", "string" ], "format": "uuid" }, "name": { "type": [ "null", "string" ] }, "url": { "type": [ "null", "string" ] }, "status": { "$ref": "#/components/schemas/WebhookConfigurationStatus" }, "eventTypes": { "type": [ "null", "array" ], "items": { "type": "string" } }, "monitoredAccountIds": { "type": [ "null", "array" ], "items": { "type": "string", "format": "uuid" } }, "authenticationType": { "$ref": "#/components/schemas/WebhookAuthenticationType" }, "hasSigningToken": { "type": "boolean" }, "disableReason": { "type": [ "null", "string" ] }, "disabledAt": { "type": [ "null", "string" ], "format": "date-time" }, "createdAt": { "type": "string", "format": "date-time" }, "lastModifiedAt": { "type": "string", "format": "date-time" } } }, "WebhookConfigurationStatus": { "enum": [ "Active", "Paused", "Disabled" ] }, "WebhookCredentialsUpdatedDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "authenticationType": { "$ref": "#/components/schemas/WebhookAuthenticationType" }, "hasSigningToken": { "type": "boolean" } } }, "WebhookDeliveryLogDto": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "eventId": { "type": "string", "format": "uuid" }, "eventType": { "type": [ "null", "string" ] }, "status": { "$ref": "#/components/schemas/WebhookDeliveryStatus" }, "httpStatusCode": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "null", "integer", "string" ], "format": "int32" }, "errorMessage": { "type": [ "null", "string" ] }, "eventSourceAccountId": { "type": [ "null", "string" ], "description": "An optional reference to the account from which the event originated.", "format": "uuid" }, "eventSourceAccountName": { "type": [ "null", "string" ], "description": "The name of the account from which event originates" }, "eventSubjectId": { "type": [ "null", "string" ] }, "eventSubjectDisplayName": { "type": [ "null", "string" ] }, "eventSubjectAttributes": { "type": [ "null", "object" ], "additionalProperties": { "type": "string" } }, "webhookConfigurationId": { "type": "string", "format": "uuid" }, "isTest": { "type": "boolean" }, "originalDeliveryId": { "type": [ "null", "string" ], "format": "uuid" }, "attemptNumber": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "latencyMs": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "null", "integer", "string" ], "format": "int64" }, "responseSnippet": { "type": [ "null", "string" ] }, "eventPayload": { "type": [ "null", "string" ] }, "eventOccurredAt": { "type": [ "null", "string" ], "format": "date-time" }, "completedAt": { "type": [ "null", "string" ], "format": "date-time" }, "redeliveryRequestedAt": { "type": [ "null", "string" ], "format": "date-time" }, "createdAt": { "type": "string", "format": "date-time" } } }, "WebhookDeliveryStatus": { "enum": [ "Pending", "Succeeded", "Failed" ] }, "WorkspaceRole": { "enum": [ "Owner", "ContentAdmin", "IncidentResponder", "IncidentAnalyst", "WorkspaceReader" ] }, "WorkspaceRoleAssignment": { "type": "object", "properties": { "workspaceId": { "type": "string", "format": "uuid" }, "role": { "$ref": "#/components/schemas/WorkspaceRole" } } }, "WorkspaceRoleAssignmentDto": { "type": "object", "properties": { "workspaceId": { "type": "string", "format": "uuid" }, "workspaceName": { "type": [ "null", "string" ] }, "role": { "$ref": "#/components/schemas/WorkspaceRole" } } }, "WorkspaceSourcePageTokens": { "type": "object", "properties": { "workspaceId": { "type": [ "null", "string" ], "description": "Identifier of the workspace these tokens belong to." }, "sourceTokens": { "type": [ "null", "object" ], "additionalProperties": { "type": "string" }, "description": "Per-source continuation tokens. Each entry represents one more page of incidents\navailable from that source within this workspace; absent sources have no further\npages." } }, "description": "Opaque continuation tokens for a single workspace, partitioned by incident source." }, "WorkspaceUserDto": { "type": "object", "properties": { "id": { "type": [ "null", "string" ] }, "displayName": { "type": [ "null", "string" ] }, "email": { "type": [ "null", "string" ] }, "workspaceId": { "type": [ "null", "string" ] }, "role": { "$ref": "#/components/schemas/WorkspaceRole" }, "userId": { "type": [ "null", "string" ] } } } } }, "tags": [ { "name": "Incidents" }, { "name": "Gamebooks" }, { "name": "Data sources" }, { "name": "Service tickets" }, { "name": "Investigation" }, { "name": "agent-tools" }, { "name": "Cross-workspace incidents" }, { "name": "Cross-workspace gamebooks" }, { "name": "Cross-workspace data sources" }, { "name": "Webhooks" }, { "name": "Service accounts" }, { "name": "Users" }, { "name": "Azure resources" } ] }