openapi: 3.0.3
info:
  title: Panther REST API
  version: '1.0'
servers:
  - url: https://{api_host}
    variables:
      api_host:
        default: your-api-host
paths:
  /alert-comments:
    get:
      tags:
        - comment
      summary: List alert comments
      operationId: comment#list
      parameters:
        - name: alert-id
          in: query
          description: The alert ID the comments are associated with
          allowEmptyValue: true
          required: true
          schema:
            type: string
            description: The alert ID the comments are associated with
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 25
            format: int64
            maximum: 50
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommentAPI.ListResp'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommentAPI.BadRequestError'
    post:
      tags:
        - comment
      summary: Create a comment for an alert
      operationId: comment#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CommentAPI.ModifyCommentReq'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommentAPI.Comment'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommentAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommentAPI.NotFoundError'
  /alert-comments/{id}:
    get:
      tags:
        - comment
      summary: Get a comment for an alert
      operationId: comment#get
      parameters:
        - name: id
          in: path
          description: ID of the comment
          required: true
          schema:
            type: string
            description: ID of the comment
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommentAPI.Comment'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommentAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommentAPI.NotFoundError'
    post:
      tags:
        - comment
      summary: Update a comment for an alert
      operationId: comment#update
      parameters:
        - name: id
          in: path
          description: ID of the comment
          required: true
          schema:
            type: string
            description: ID of the comment
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CommentAPI.ModifyCommentReq'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommentAPI.Comment'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommentAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommentAPI.NotFoundError'
  /alert-context-tags:
    get:
      tags:
        - contexttag
      summary: List all context tags
      description: Returns all context tags, both managed (system-defined) and custom (user-defined)
      operationId: contexttag#list
      parameters:
        - name: cursor
          in: query
          description: Pagination token from a previous request
          allowEmptyValue: true
          schema:
            type: string
            description: Pagination token from a previous request
        - name: limit
          in: query
          description: Maximum number of results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: Maximum number of results to return
            default: 2000
            format: int64
            minimum: 1
            maximum: 2000
        - name: managed
          in: query
          description: 'Filter by tag type: true for managed tags only, false for custom tags only, omit for all tags'
          allowEmptyValue: true
          schema:
            type: boolean
            description: 'Filter by tag type: true for managed tags only, false for custom tags only, omit for all tags'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/contexttagAPI.ListContextTagsResp'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/contexttagAPI.BadRequestError'
    post:
      tags:
        - contexttag
      summary: Create a custom context tag
      description: Creates a new custom context tag. Returns 409 Conflict if the tag already exists.
      operationId: contexttag#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/contexttagAPI.CreateContextTagReq'
      responses:
        '201':
          description: Created response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/contexttagAPI.BadRequestError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/contexttagAPI.ExistsError'
  /alert-context-tags/{tag}:
    delete:
      tags:
        - contexttag
      summary: Delete a custom context tag
      description: Deletes a custom context tag. Managed tags cannot be deleted.
      operationId: contexttag#delete
      parameters:
        - name: tag
          in: path
          description: The tag value to delete
          required: true
          schema:
            type: string
            description: The tag value to delete
            pattern: ^[a-z0-9_-]+$
            minLength: 1
            maxLength: 30
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/contexttagAPI.BadRequestError'
    patch:
      tags:
        - contexttag
      summary: Rename a custom context tag
      description: Atomically renames a custom context tag. Returns 404 if the tag doesn't exist, 409 if the target tag already exists.
      operationId: contexttag#update
      parameters:
        - name: tag
          in: path
          description: The current tag value to rename
          required: true
          schema:
            type: string
            description: The current tag value to rename
            pattern: ^[a-z0-9_-]+$
            minLength: 1
            maxLength: 30
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/contexttagAPI.UpdateContextTagReq'
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/contexttagAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/contexttagAPI.NotFoundError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/contexttagAPI.ExistsError'
  /alerts:
    get:
      tags:
        - alert
      summary: List alerts
      operationId: alert#list
      parameters:
        - name: type
          in: query
          allowEmptyValue: true
          schema:
            type: string
            default: ALERT
            enum:
              - ALERT
              - DETECTION_ERROR
              - SYSTEM_ERROR
        - name: sub-type
          in: query
          description: The sub-type of the alert
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
              enum:
                - RULE
                - RULE_ERROR
                - SCHEDULED_RULE
                - SCHEDULED_RULE_ERROR
                - POLICY
                - SYSTEM_ERROR
                - CORRELATION_RULE
                - CORRELATION_RULE_ERROR
            description: The sub-type of the alert
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 25
            format: int64
            maximum: 50
        - name: created-after
          in: query
          description: The date and time after which the alerts were created. If empty we default to 30 days ago
          allowEmptyValue: true
          schema:
            type: string
            description: The date and time after which the alerts were created. If empty we default to 30 days ago
            example: '1672531200'
          examples:
            Date only:
              summary: Date only
              value: '2025-01-01'
            Month only:
              summary: Month only
              value: 2025-01
            RFC3339:
              summary: RFC3339
              value: '2025-01-01T15:04:05Z'
            Unix timestamp:
              summary: Unix timestamp
              value: '1672531200'
        - name: created-before
          in: query
          description: The date and time before which the alerts were created. If empty we default to the current time
          allowEmptyValue: true
          schema:
            type: string
            description: The date and time before which the alerts were created. If empty we default to the current time
            example: '1672531200'
          examples:
            Date only:
              summary: Date only
              value: '2025-01-01'
            Month only:
              summary: Month only
              value: 2025-01
            RFC3339:
              summary: RFC3339
              value: '2025-01-01T15:04:05Z'
            Unix timestamp:
              summary: Unix timestamp
              value: '1672531200'
        - name: detection-id
          in: query
          description: The detection ID to filter alerts by
          allowEmptyValue: true
          schema:
            type: string
            description: The detection ID to filter alerts by
        - name: sort-dir
          in: query
          description: The sort direction of the results
          allowEmptyValue: true
          schema:
            type: string
            description: The sort direction of the results
            default: desc
            enum:
              - asc
              - desc
        - name: name-contains
          in: query
          description: A string to search for in the alert name
          allowEmptyValue: true
          schema:
            type: string
            description: A string to search for in the alert name
        - name: log-source
          in: query
          description: The log source of the alert
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
            description: The log source of the alert
        - name: log-type
          in: query
          description: The log type of the alert
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
            description: The log type of the alert
        - name: resource-type
          in: query
          description: The resource type of the alert
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
            description: The resource type of the alert
        - name: status
          in: query
          description: The status of the alert
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
              enum:
                - OPEN
                - CLOSED
                - TRIAGED
                - RESOLVED
            description: The status of the alert
        - name: severity
          in: query
          description: The severity of the alert
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
              enum:
                - CRITICAL
                - HIGH
                - MEDIUM
                - LOW
                - INFO
            description: The severity of the alert
        - name: assignee
          in: query
          description: The assignee of the alert. This should be a user id
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
            description: The assignee of the alert. This should be a user id
        - name: event-count-min
          in: query
          description: The minimum number of events in the alert
          allowEmptyValue: true
          schema:
            type: integer
            description: The minimum number of events in the alert
            format: int64
        - name: event-count-max
          in: query
          description: The maximum number of events in the alert
          allowEmptyValue: true
          schema:
            type: integer
            description: The maximum number of events in the alert
            format: int64
        - name: quality
          in: query
          description: Filter by alert quality
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
              enum:
                - NOISE
                - USEFUL
            description: Filter by alert quality
        - name: context-tag
          in: query
          description: Filter by context tags applied to alerts
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
              description: Tag to provide context for this alert
              pattern: ^[a-z0-9_-]+$
              minLength: 1
              maxLength: 30
            description: Filter by context tags applied to alerts
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertAPI.ListResp'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertAPI.BadRequestError'
    patch:
      tags:
        - alert
      summary: Update the status, assignee, quality or contextTags of multiple alerts
      operationId: alert#bulkPatch
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AlertAPI.BulkPatchAlertReq2'
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertAPI.NotFoundError'
  /alerts/{id}:
    get:
      tags:
        - alert
      summary: Get an alert
      operationId: alert#get
      parameters:
        - name: id
          in: path
          description: ID of the alert
          required: true
          schema:
            type: string
            description: ID of the alert
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertAPI.Alert'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertAPI.NotFoundError'
    patch:
      tags:
        - alert
      summary: Update the status, assignee, quality or contextTags of an alert
      operationId: alert#patch
      parameters:
        - name: id
          in: path
          description: ID of the alert
          required: true
          schema:
            type: string
            description: ID of the alert
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AlertAPI.PatchAlertReq'
      responses:
        '200':
          description: OK response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertAPI.NotFoundError'
  /alerts/{id}/events:
    get:
      tags:
        - alert
      summary: List alert events
      operationId: alert#events
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 25
            format: int64
            maximum: 50
        - name: id
          in: path
          description: The alert id
          required: true
          schema:
            type: string
            description: The alert id
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertAPI.ListEventsResp'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertAPI.NotFoundError'
  /api-tokens:
    get:
      tags:
        - api token
      summary: List api tokens
      operationId: api token#list
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APITokenAPI.ListResp'
    post:
      tags:
        - api token
      summary: Create an api token
      operationId: api token#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/APITokenAPI.ModifyAPIToken'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APITokenAPI.APIToken'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APITokenAPI.BadRequestError'
  /api-tokens/{id}:
    delete:
      tags:
        - api token
      summary: delete api token
      operationId: api token#delete
      parameters:
        - name: id
          in: path
          description: 'ID of the api token to delete. Note: if self is provided, the current api token will be deleted'
          required: true
          schema:
            type: string
            description: 'ID of the api token to delete. Note: if self is provided, the current api token will be deleted'
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APITokenAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APITokenAPI.NotFoundError'
    get:
      tags:
        - api token
      summary: Get an api token
      operationId: api token#get
      parameters:
        - name: id
          in: path
          description: 'ID of the api token. Note: if self is provided, the current api token will be returned'
          required: true
          schema:
            type: string
            description: 'ID of the api token. Note: if self is provided, the current api token will be returned'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APITokenAPI.APIToken'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APITokenAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APITokenAPI.NotFoundError'
    post:
      tags:
        - api token
      summary: Update an api token
      operationId: api token#update
      parameters:
        - name: id
          in: path
          description: 'ID of the api token. Note: if self is provided, the current api token will be updated'
          required: true
          schema:
            type: string
            description: 'ID of the api token. Note: if self is provided, the current api token will be updated'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/APITokenAPI.ModifyAPIToken'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APITokenAPI.APIToken'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APITokenAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APITokenAPI.NotFoundError'
  /api-tokens/{id}/rotate:
    post:
      tags:
        - api token
      summary: Rotate an api token. If self is provided the current token will be rotated
      operationId: api token#rotate
      parameters:
        - name: id
          in: path
          description: 'ID of the api token to rotate. Note: if self is provided, the current api token will be rotated'
          required: true
          schema:
            type: string
            description: 'ID of the api token to rotate. Note: if self is provided, the current api token will be rotated'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APITokenAPI.APIToken'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APITokenAPI.BadRequestError'
        '403':
          description: 'forbidden: Forbidden response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APITokenAPI.ForbiddenErr'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APITokenAPI.NotFoundError'
  /cloud-accounts/aws:
    post:
      tags:
        - aws cloud account
      summary: create aws cloud account
      operationId: aws cloud account#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AWSCloudAccountAPI.CreateAWSCloudAccount'
      responses:
        '201':
          description: Created response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCloudAccountAPI.AWSCloudAccount'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCloudAccountAPI.BadRequestError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCloudAccountAPI.ExistsError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCloudAccountAPI.ServiceError'
  /cloud-accounts/aws/{id}:
    delete:
      tags:
        - aws cloud account
      summary: delete aws cloud account
      operationId: aws cloud account#delete
      parameters:
        - name: id
          in: path
          description: ID of the AWS Cloud Account to delete
          required: true
          schema:
            type: string
            description: ID of the AWS Cloud Account to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCloudAccountAPI.BadRequestError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCloudAccountAPI.ServiceError'
    get:
      tags:
        - aws cloud account
      summary: get aws cloud account
      operationId: aws cloud account#get
      parameters:
        - name: id
          in: path
          description: ID of the AWS Cloud Account to fetch
          required: true
          schema:
            type: string
            description: ID of the AWS Cloud Account to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCloudAccountAPI.AWSCloudAccount'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCloudAccountAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCloudAccountAPI.NotFoundError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCloudAccountAPI.ServiceError'
    put:
      tags:
        - aws cloud account
      summary: put aws cloud account
      operationId: aws cloud account#put
      parameters:
        - name: id
          in: path
          description: ID of the AWS Cloud Account to update
          required: true
          schema:
            type: string
            description: ID of the AWS Cloud Account to update
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AWSCloudAccountAPI.ModifyAWSCloudAccount'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCloudAccountAPI.AWSCloudAccount'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCloudAccountAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCloudAccountAPI.NotFoundError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCloudAccountAPI.ServiceError'
  /correlation-rules:
    get:
      tags:
        - correlation rule
      summary: list correlation rules
      operationId: correlation rule#list
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 100
            format: int64
        - name: name-contains
          in: query
          description: Substring search by name (case-insensitive)
          allowEmptyValue: true
          schema:
            type: string
            description: Substring search by name (case-insensitive)
        - name: state
          in: query
          description: Only include rules in the given state
          allowEmptyValue: true
          schema:
            type: string
            description: Only include rules in the given state
            enum:
              - enabled
              - disabled
        - name: severity
          in: query
          description: Only include rules with one of the given severities
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
              enum:
                - INFO
                - LOW
                - MEDIUM
                - HIGH
                - CRITICAL
            description: Only include rules with one of the given severities
        - name: tag
          in: query
          description: Only include rules with one of the given tags (case-insensitive)
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
            description: Only include rules with one of the given tags (case-insensitive)
        - name: created-by
          in: query
          description: Only include rules whose creator matches this user ID or actor ID
          allowEmptyValue: true
          schema:
            type: string
            description: Only include rules whose creator matches this user ID or actor ID
        - name: last-modified-by
          in: query
          description: Only include rules last modified by this user ID or actor ID
          allowEmptyValue: true
          schema:
            type: string
            description: Only include rules last modified by this user ID or actor ID
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CorrelationRuleAPI.ListCorrelationRuleResp'
    post:
      tags:
        - correlation rule
      summary: create correlation rule
      operationId: correlation rule#create
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CorrelationRuleAPI.ModifyCorrelationRule'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CorrelationRuleAPI.CorrelationRule'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CorrelationRuleAPI.CorrelationBadRequestErr'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CorrelationRuleAPI.ExistsError'
  /correlation-rules/{id}:
    delete:
      tags:
        - correlation rule
      summary: delete correlation rule
      operationId: correlation rule#delete
      parameters:
        - name: id
          in: path
          description: ID of the correlation rule to delete
          required: true
          schema:
            type: string
            description: ID of the correlation rule to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CorrelationRuleAPI.CorrelationBadRequestErr'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CorrelationRuleAPI.NotFoundError'
    get:
      tags:
        - correlation rule
      summary: get a correlation rule
      operationId: correlation rule#get
      parameters:
        - name: id
          in: path
          description: ID of the correlation rule to fetch
          required: true
          schema:
            type: string
            description: ID of the correlation rule to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CorrelationRuleAPI.CorrelationRule'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CorrelationRuleAPI.NotFoundError'
    put:
      tags:
        - correlation rule
      summary: put correlation rule
      description: put creates or updates a correlation rule
      operationId: correlation rule#put
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
        - name: id
          in: path
          description: the id of the correlation rule
          required: true
          schema:
            type: string
            description: the id of the correlation rule
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CorrelationRuleAPI.ModifyCorrelationRule'
      responses:
        '200':
          description: 200 returned if the item already existed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CorrelationRuleAPI.CorrelationRule'
        '201':
          description: 201 returned if the item was created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CorrelationRuleAPI.CorrelationRule'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CorrelationRuleAPI.CorrelationBadRequestErr'
  /data-models:
    get:
      tags:
        - data model
      summary: list data models
      operationId: data model#list
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 100
            format: int64
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.ListResp'
    post:
      tags:
        - data model
      summary: create data model
      operationId: data model#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DataModelAPI.ModifyDataModel'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.DataModel'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.BadRequestError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.ExistsError'
  /data-models/{id}:
    delete:
      tags:
        - data model
      summary: delete data model
      operationId: data model#delete
      parameters:
        - name: id
          in: path
          description: ID of the data model to delete
          required: true
          schema:
            type: string
            description: ID of the data model to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.NotFoundError'
    get:
      tags:
        - data model
      summary: get data model
      operationId: data model#get
      parameters:
        - name: id
          in: path
          description: ID of the data model to fetch
          required: true
          schema:
            type: string
            description: ID of the data model to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.DataModel'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.NotFoundError'
    put:
      tags:
        - data model
      summary: put data model
      description: put creates or updates a data model
      operationId: data model#put
      parameters:
        - name: id
          in: path
          description: the id of the data model
          required: true
          schema:
            type: string
            description: the id of the data model
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DataModelAPI.ModifyDataModel'
      responses:
        '200':
          description: 200 returned if the item already existed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.DataModel'
        '201':
          description: 201 returned if the item was created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.DataModel'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.BadRequestError'
  /globals:
    get:
      tags:
        - global
      summary: list globals
      operationId: global#list
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 100
            format: int64
        - name: name-contains
          in: query
          description: Substring search by name (case-insensitive)
          allowEmptyValue: true
          schema:
            type: string
            description: Substring search by name (case-insensitive)
        - name: created-by
          in: query
          description: Only include rules whose creator matches this user ID or actor ID
          allowEmptyValue: true
          schema:
            type: string
            description: Only include rules whose creator matches this user ID or actor ID
        - name: last-modified-by
          in: query
          description: Only include rules last modified by this user ID or actor ID
          allowEmptyValue: true
          schema:
            type: string
            description: Only include rules last modified by this user ID or actor ID
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.ListResp'
    post:
      tags:
        - global
      summary: create global
      operationId: global#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GlobalAPI.ModifyGlobal'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.Global'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.BadRequestError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.ExistsError'
  /globals/{id}:
    delete:
      tags:
        - global
      summary: delete global
      operationId: global#delete
      parameters:
        - name: id
          in: path
          description: ID of the global to delete
          required: true
          schema:
            type: string
            description: ID of the global to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.NotFoundError'
    get:
      tags:
        - global
      summary: get global
      operationId: global#get
      parameters:
        - name: id
          in: path
          description: ID of the global to fetch
          required: true
          schema:
            type: string
            description: ID of the global to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.Global'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.NotFoundError'
    put:
      tags:
        - global
      summary: put global
      description: put creates or updates a global
      operationId: global#put
      parameters:
        - name: id
          in: path
          description: The id of the global
          required: true
          schema:
            type: string
            description: The id of the global
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GlobalAPI.ModifyGlobal2'
      responses:
        '200':
          description: 200 returned if the item already existed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.PutGlobalResp'
        '201':
          description: 201 returned if the item was created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.PutGlobalResp'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.BadRequestError'
  /log-source-alarms/{sourceId}/{type}:
    delete:
      tags:
        - log source alarm
      summary: delete log source alarm
      description: 'Delete the drop-off alarm for a log source. Idempotent: returns 204 even if no alarm exists.'
      operationId: log source alarm#delete
      parameters:
        - name: sourceId
          in: path
          description: The ID of the log source
          required: true
          schema:
            type: string
            description: The ID of the log source
            format: uuid
        - name: type
          in: path
          description: The alarm type. Only SOURCE_NO_DATA is supported on DELETE.
          required: true
          schema:
            type: string
            description: The alarm type. Only SOURCE_NO_DATA is supported on DELETE.
            enum:
              - SOURCE_NO_DATA
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogSourceAlarmAPI.BadRequestError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogSourceAlarmAPI.ServiceError'
        '504':
          description: 'timeout: Gateway Timeout response.'
          content:
            application/vnd.goa.error:
              schema:
                $ref: '#/components/schemas/LogSourceAlarmAPI.Error'
    get:
      tags:
        - log source alarm
      summary: get log source alarm
      description: Get a specific alarm for a log source
      operationId: log source alarm#get
      parameters:
        - name: sourceId
          in: path
          description: The ID of the log source
          required: true
          schema:
            type: string
            description: The ID of the log source
            format: uuid
        - name: type
          in: path
          description: The alarm type. Only SOURCE_NO_DATA is exposed.
          required: true
          schema:
            type: string
            description: The alarm type. Only SOURCE_NO_DATA is exposed.
            enum:
              - SOURCE_NO_DATA
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogSourceAlarmAPI.SourceAlarm'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogSourceAlarmAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogSourceAlarmAPI.NotFoundError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogSourceAlarmAPI.ServiceError'
        '504':
          description: 'timeout: Gateway Timeout response.'
          content:
            application/vnd.goa.error:
              schema:
                $ref: '#/components/schemas/LogSourceAlarmAPI.Error'
    put:
      tags:
        - log source alarm
      summary: put log source alarm
      description: Create or update the drop-off threshold for a log source. Only the SOURCE_NO_DATA alarm type is user-configurable. Not supported for cloud-security sources (returns 400).
      operationId: log source alarm#put
      parameters:
        - name: sourceId
          in: path
          description: The ID of the log source
          required: true
          schema:
            type: string
            description: The ID of the log source
            format: uuid
        - name: type
          in: path
          description: The alarm type. Only SOURCE_NO_DATA is supported on PUT.
          required: true
          schema:
            type: string
            description: The alarm type. Only SOURCE_NO_DATA is supported on PUT.
            enum:
              - SOURCE_NO_DATA
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LogSourceAlarmAPI.PutSourceAlarmData'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogSourceAlarmAPI.PutSourceAlarmResp'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogSourceAlarmAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogSourceAlarmAPI.NotFoundError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogSourceAlarmAPI.ServiceError'
        '504':
          description: 'timeout: Gateway Timeout response.'
          content:
            application/vnd.goa.error:
              schema:
                $ref: '#/components/schemas/LogSourceAlarmAPI.Error'
  /log-sources/gcs:
    post:
      tags:
        - gcs source
      summary: create gcs source
      operationId: gcs source#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GcsSourceAPI.ModifyGcsSource'
      responses:
        '201':
          description: Created response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.GcsSource'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.BadRequestError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.ExistsError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.ServiceError'
  /log-sources/gcs/{id}:
    delete:
      tags:
        - gcs source
      summary: delete gcs source
      operationId: gcs source#delete
      parameters:
        - name: id
          in: path
          description: ID of the GCS source to delete
          required: true
          schema:
            type: string
            description: ID of the GCS source to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.BadRequestError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.ServiceError'
    get:
      tags:
        - gcs source
      summary: get gcs source
      operationId: gcs source#get
      parameters:
        - name: id
          in: path
          description: ID of the GCS source to fetch
          required: true
          schema:
            type: string
            description: ID of the GCS source to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.GcsSource'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.NotFoundError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.ServiceError'
    put:
      tags:
        - gcs source
      summary: put gcs source
      operationId: gcs source#put
      parameters:
        - name: id
          in: path
          description: ID of the GCS source to update
          required: true
          schema:
            type: string
            description: ID of the GCS source to update
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GcsSourceAPI.ModifyGcsSource'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.GcsSource'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.NotFoundError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.ExistsError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GcsSourceAPI.ServiceError'
  /log-sources/http:
    post:
      tags:
        - http source
      summary: create http source
      operationId: http source#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/HttpSourceAPI.ModifyHTTPSource'
      responses:
        '201':
          description: Created response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpSourceAPI.HTTPSource'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpSourceAPI.BadRequestError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpSourceAPI.ExistsError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpSourceAPI.ServiceError'
  /log-sources/http/{id}:
    delete:
      tags:
        - http source
      summary: delete http source
      operationId: http source#delete
      parameters:
        - name: id
          in: path
          description: ID of the http source to delete
          required: true
          schema:
            type: string
            description: ID of the http source to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpSourceAPI.BadRequestError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpSourceAPI.ServiceError'
    get:
      tags:
        - http source
      summary: get http source
      operationId: http source#get
      parameters:
        - name: id
          in: path
          description: ID of the http source to fetch
          required: true
          schema:
            type: string
            description: ID of the http source to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpSourceAPI.HTTPSource'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpSourceAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpSourceAPI.NotFoundError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpSourceAPI.ServiceError'
    put:
      tags:
        - http source
      summary: put http source
      description: put updates an http source
      operationId: http source#put
      parameters:
        - name: id
          in: path
          description: ID of the http source to update
          required: true
          schema:
            type: string
            description: ID of the http source to update
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/HttpSourceAPI.ModifyHTTPSource'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpSourceAPI.HTTPSource'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpSourceAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpSourceAPI.NotFoundError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpSourceAPI.ExistsError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpSourceAPI.ServiceError'
  /log-sources/log-forwarder:
    post:
      tags:
        - log forwarder source
      summary: create log forwarder source
      operationId: log forwarder source#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LogForwarderSourceAPI.ModifyLogForwarderSource'
      responses:
        '201':
          description: Created response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwarderSourceAPI.LogForwarderSource'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwarderSourceAPI.BadRequestError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwarderSourceAPI.ExistsError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwarderSourceAPI.ServiceError'
  /log-sources/log-forwarder/{id}:
    delete:
      tags:
        - log forwarder source
      summary: delete log forwarder source
      operationId: log forwarder source#delete
      parameters:
        - name: id
          in: path
          description: ID of the log forwarder source to delete
          required: true
          schema:
            type: string
            description: ID of the log forwarder source to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwarderSourceAPI.BadRequestError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwarderSourceAPI.ServiceError'
    get:
      tags:
        - log forwarder source
      summary: get log forwarder source
      operationId: log forwarder source#get
      parameters:
        - name: id
          in: path
          description: ID of the log forwarder source to fetch
          required: true
          schema:
            type: string
            description: ID of the log forwarder source to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwarderSourceAPI.LogForwarderSource'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwarderSourceAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwarderSourceAPI.NotFoundError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwarderSourceAPI.ServiceError'
    put:
      tags:
        - log forwarder source
      summary: put log forwarder source
      description: put updates a log forwarder source
      operationId: log forwarder source#put
      parameters:
        - name: id
          in: path
          description: ID of the log forwarder source to update
          required: true
          schema:
            type: string
            description: ID of the log forwarder source to update
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LogForwarderSourceAPI.ModifyLogForwarderSource'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwarderSourceAPI.LogForwarderSource'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwarderSourceAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwarderSourceAPI.NotFoundError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwarderSourceAPI.ExistsError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LogForwarderSourceAPI.ServiceError'
  /log-sources/pubsub:
    post:
      tags:
        - pub/sub source
      summary: create pub/sub source
      operationId: pub/sub source#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PubSubSourceAPI.ModifyPubSubSource'
      responses:
        '201':
          description: Created response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PubSubSourceAPI.PubSubSource'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PubSubSourceAPI.BadRequestError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PubSubSourceAPI.ExistsError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PubSubSourceAPI.ServiceError'
  /log-sources/pubsub/{id}:
    delete:
      tags:
        - pub/sub source
      summary: delete pub/sub source
      operationId: pub/sub source#delete
      parameters:
        - name: id
          in: path
          description: ID of the pubsub source to delete
          required: true
          schema:
            type: string
            description: ID of the pubsub source to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PubSubSourceAPI.BadRequestError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PubSubSourceAPI.ServiceError'
    get:
      tags:
        - pub/sub source
      summary: get pub/sub source
      operationId: pub/sub source#get
      parameters:
        - name: id
          in: path
          description: ID of the pubsub source to fetch
          required: true
          schema:
            type: string
            description: ID of the pubsub source to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PubSubSourceAPI.PubSubSource'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PubSubSourceAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PubSubSourceAPI.NotFoundError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PubSubSourceAPI.ServiceError'
    put:
      tags:
        - pub/sub source
      summary: put pub/sub source
      description: put updates a pubsub source
      operationId: pub/sub source#put
      parameters:
        - name: id
          in: path
          description: ID of the pubsub source to update
          required: true
          schema:
            type: string
            description: ID of the pubsub source to update
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PubSubSourceAPI.ModifyPubSubSource'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PubSubSourceAPI.PubSubSource'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PubSubSourceAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PubSubSourceAPI.NotFoundError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PubSubSourceAPI.ExistsError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PubSubSourceAPI.ServiceError'
  /log-sources/s3:
    post:
      tags:
        - s3 source
      summary: create s3 source
      operationId: s3 source#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/S3SourceAPI.CreateS3Source'
      responses:
        '201':
          description: Created response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.S3Source'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.BadRequestError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.ExistsError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.ServiceError'
  /log-sources/s3/{id}:
    delete:
      tags:
        - s3 source
      summary: delete s3 source
      operationId: s3 source#delete
      parameters:
        - name: id
          in: path
          description: ID of the S3 source to delete
          required: true
          schema:
            type: string
            description: ID of the S3 source to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.BadRequestError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.ServiceError'
    get:
      tags:
        - s3 source
      summary: get s3 source
      operationId: s3 source#get
      parameters:
        - name: id
          in: path
          description: ID of the S3 source to fetch
          required: true
          schema:
            type: string
            description: ID of the S3 source to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.S3Source'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.NotFoundError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.ServiceError'
    put:
      tags:
        - s3 source
      summary: put s3 source
      operationId: s3 source#put
      parameters:
        - name: id
          in: path
          description: ID of the S3 source to update
          required: true
          schema:
            type: string
            description: ID of the S3 source to update
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/S3SourceAPI.ModifyS3Source'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.S3Source'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.NotFoundError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.ExistsError'
        '500':
          description: 'service: Internal Server Error response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/S3SourceAPI.ServiceError'
  /policies:
    get:
      tags:
        - policy
      summary: list policies
      operationId: policy#list
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 100
            format: int64
        - name: compliance-status
          in: query
          description: Only include policies with this compliance status
          allowEmptyValue: true
          schema:
            type: string
            description: Only include policies with this compliance status
            enum:
              - PASS
              - FAIL
              - ERROR
        - name: name-contains
          in: query
          description: Substring search by name (case-insensitive)
          allowEmptyValue: true
          schema:
            type: string
            description: Substring search by name (case-insensitive)
        - name: state
          in: query
          description: Only include policies in the given state
          allowEmptyValue: true
          schema:
            type: string
            description: Only include policies in the given state
            enum:
              - enabled
              - disabled
        - name: resource-type
          in: query
          description: Only include policies which apply to one of the given resource types
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
            description: Only include policies which apply to one of the given resource types
        - name: severity
          in: query
          description: Only include policies with one of the given severities
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
              enum:
                - INFO
                - LOW
                - MEDIUM
                - HIGH
                - CRITICAL
            description: Only include policies with one of the given severities
        - name: tag
          in: query
          description: Only include policies with one of the given tags (case-insensitive)
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
            description: Only include policies with one of the given tags (case-insensitive)
        - name: created-by
          in: query
          description: Only include policies whose creator matches this user ID or actor ID
          allowEmptyValue: true
          schema:
            type: string
            description: Only include policies whose creator matches this user ID or actor ID
        - name: last-modified-by
          in: query
          description: Only include policies last modified by this user ID or actor ID
          allowEmptyValue: true
          schema:
            type: string
            description: Only include policies last modified by this user ID or actor ID
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.ListResp'
    post:
      tags:
        - policy
      summary: create policy
      operationId: policy#create
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyAPI.ModifyPolicy'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.Policy'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.BadRequestWithTestResultsErr'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.ExistsError'
  /policies/{id}:
    delete:
      tags:
        - policy
      summary: delete policy
      operationId: policy#delete
      parameters:
        - name: id
          in: path
          description: ID of the policy to delete
          required: true
          schema:
            type: string
            description: ID of the policy to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.BadRequestWithTestResultsErr'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.NotFoundError'
    get:
      tags:
        - policy
      summary: get policy
      operationId: policy#get
      parameters:
        - name: id
          in: path
          description: the id of the policy to fetch
          required: true
          schema:
            type: string
            description: the id of the policy to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.Policy'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.NotFoundError'
    put:
      tags:
        - policy
      summary: put policy
      description: put creates or updates a policy
      operationId: policy#put
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
        - name: id
          in: path
          description: the id of the policy
          required: true
          schema:
            type: string
            description: the id of the policy
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyAPI.ModifyPolicy'
      responses:
        '200':
          description: 200 returned if the item already existed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.Policy'
        '201':
          description: 201 returned if the item was created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.Policy'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.BadRequestWithTestResultsErr'
  /queries:
    get:
      tags:
        - query
      summary: list queries
      operationId: query#list
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 100
            format: int64
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.ListResp'
    post:
      tags:
        - query
      summary: create query
      operationId: query#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/QueryAPI.ModifyQuery'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.Query'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.BadRequestError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.ExistsError'
  /queries/{id}:
    delete:
      tags:
        - query
      summary: delete query
      operationId: query#delete
      parameters:
        - name: id
          in: path
          description: ID of the query to delete
          required: true
          schema:
            type: string
            description: ID of the query to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.NotFoundError'
    get:
      tags:
        - query
      summary: get query
      operationId: query#get
      parameters:
        - name: id
          in: path
          description: ID of the query to fetch
          required: true
          schema:
            type: string
            description: ID of the query to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.Query'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.NotFoundError'
    post:
      tags:
        - query
      summary: update query
      description: updates a query
      operationId: query#update
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/QueryAPI.ModifyQuery'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.Query'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.NotFoundError'
  /roles:
    get:
      tags:
        - role
      summary: List roles
      operationId: role#list
      parameters:
        - name: name-contains
          in: query
          description: A string to search for in the Role name
          allowEmptyValue: true
          schema:
            type: string
            description: A string to search for in the Role name
        - name: name
          in: query
          description: An exact match of a role's name to return. If provided all other parameters are ignored
          allowEmptyValue: true
          schema:
            type: string
            description: An exact match of a role's name to return. If provided all other parameters are ignored
        - name: id
          in: query
          description: Set of IDS to return
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
            description: Set of IDS to return
        - name: ids
          in: query
          description: A comma delimited list of IDs
          allowEmptyValue: true
          schema:
            type: string
            description: A comma delimited list of IDs
        - name: sort-dir
          in: query
          description: The sort direction of the results
          allowEmptyValue: true
          schema:
            type: string
            description: The sort direction of the results
            default: asc
            enum:
              - asc
              - desc
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAPI.ListResp'
    post:
      tags:
        - role
      summary: Create a role
      operationId: role#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleAPI.ModifyRole'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAPI.Role'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAPI.BadRequestError'
  /roles/{id}:
    delete:
      tags:
        - role
      summary: Delete a role
      operationId: role#delete
      parameters:
        - name: id
          in: path
          description: ID of the role
          required: true
          schema:
            type: string
            description: ID of the role
      responses:
        '200':
          description: OK response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAPI.NotFoundError'
    get:
      tags:
        - role
      summary: Get a role
      operationId: role#get
      parameters:
        - name: id
          in: path
          description: ID of the role
          required: true
          schema:
            type: string
            description: ID of the role
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAPI.Role'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAPI.NotFoundError'
    post:
      tags:
        - role
      summary: Update a role
      operationId: role#update
      parameters:
        - name: id
          in: path
          description: ID of the role
          required: true
          schema:
            type: string
            description: ID of the role
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleAPI.ModifyRole'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAPI.Role'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleAPI.NotFoundError'
  /rules:
    get:
      tags:
        - rule
      summary: list rules
      operationId: rule#list
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 100
            format: int64
        - name: name-contains
          in: query
          description: Substring search by name (case-insensitive)
          allowEmptyValue: true
          schema:
            type: string
            description: Substring search by name (case-insensitive)
        - name: state
          in: query
          description: Only include rules in the given state
          allowEmptyValue: true
          schema:
            type: string
            description: Only include rules in the given state
            enum:
              - enabled
              - disabled
        - name: log-type
          in: query
          description: Only include rules which apply to one of the given log types
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
            description: Only include rules which apply to one of the given log types
        - name: severity
          in: query
          description: Only include rules with one of the given severities
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
              enum:
                - INFO
                - LOW
                - MEDIUM
                - HIGH
                - CRITICAL
            description: Only include rules with one of the given severities
        - name: tag
          in: query
          description: Only include rules with one of the given tags (case-insensitive)
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
            description: Only include rules with one of the given tags (case-insensitive)
        - name: created-by
          in: query
          description: Only include rules whose creator matches this user ID or actor ID
          allowEmptyValue: true
          schema:
            type: string
            description: Only include rules whose creator matches this user ID or actor ID
        - name: last-modified-by
          in: query
          description: Only include rules last modified by this user ID or actor ID
          allowEmptyValue: true
          schema:
            type: string
            description: Only include rules last modified by this user ID or actor ID
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.ListResp'
    post:
      tags:
        - rule
      summary: create rule
      operationId: rule#create
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RuleAPI.ModifyRule'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.Rule'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.BadRequestWithTestResultsErr'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.ExistsError'
  /rules/{id}:
    delete:
      tags:
        - rule
      summary: delete rule
      operationId: rule#delete
      parameters:
        - name: id
          in: path
          description: ID of the rule to delete
          required: true
          schema:
            type: string
            description: ID of the rule to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.BadRequestWithTestResultsErr'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.NotFoundError'
    get:
      tags:
        - rule
      summary: get rule
      operationId: rule#get
      parameters:
        - name: id
          in: path
          description: ID of the rule to fetch
          required: true
          schema:
            type: string
            description: ID of the rule to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.Rule'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.NotFoundError'
    put:
      tags:
        - rule
      summary: put rule
      description: put creates or updates a rule
      operationId: rule#put
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
        - name: id
          in: path
          description: the id of the rule
          required: true
          schema:
            type: string
            description: the id of the rule
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RuleAPI.ModifyRule'
      responses:
        '200':
          description: 200 returned if the item already existed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.Rule'
        '201':
          description: 201 returned if the item was created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.Rule'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.BadRequestWithTestResultsErr'
  /scheduled-rules:
    get:
      tags:
        - scheduled rule
      summary: list scheduled rules
      operationId: scheduled rule#list
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 100
            format: int64
        - name: name-contains
          in: query
          description: Substring search by name (case-insensitive)
          allowEmptyValue: true
          schema:
            type: string
            description: Substring search by name (case-insensitive)
        - name: state
          in: query
          description: Only include rules in the given state
          allowEmptyValue: true
          schema:
            type: string
            description: Only include rules in the given state
            enum:
              - enabled
              - disabled
        - name: scheduled-query
          in: query
          description: Only include rules which apply to one of these scheduled queries
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
            description: Only include rules which apply to one of these scheduled queries
        - name: severity
          in: query
          description: Only include rules with one of the given severities
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
              enum:
                - INFO
                - LOW
                - MEDIUM
                - HIGH
                - CRITICAL
            description: Only include rules with one of the given severities
        - name: tag
          in: query
          description: Only include rules with one of the given tags (case-insensitive)
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
            description: Only include rules with one of the given tags (case-insensitive)
        - name: created-by
          in: query
          description: Only include rules whose creator matches this user ID or actor ID
          allowEmptyValue: true
          schema:
            type: string
            description: Only include rules whose creator matches this user ID or actor ID
        - name: last-modified-by
          in: query
          description: Only include rules last modified by this user ID or actor ID
          allowEmptyValue: true
          schema:
            type: string
            description: Only include rules last modified by this user ID or actor ID
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.ListResp'
    post:
      tags:
        - scheduled rule
      summary: create scheduled rule
      operationId: scheduled rule#create
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScheduledRuleAPI.ModifyRule'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.ScheduledRule'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.BadRequestWithTestResultsErr'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.ExistsError'
  /scheduled-rules/{id}:
    delete:
      tags:
        - scheduled rule
      summary: delete scheduled rule
      operationId: scheduled rule#delete
      parameters:
        - name: id
          in: path
          description: ID of the rule to delete
          required: true
          schema:
            type: string
            description: ID of the rule to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.BadRequestWithTestResultsErr'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.NotFoundError'
    get:
      tags:
        - scheduled rule
      summary: get scheduled rule
      operationId: scheduled rule#get
      parameters:
        - name: id
          in: path
          description: ID of the rule to fetch
          required: true
          schema:
            type: string
            description: ID of the rule to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.ScheduledRule'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.NotFoundError'
    put:
      tags:
        - scheduled rule
      summary: put scheduled rule
      description: put creates or updates a scheduled rule
      operationId: scheduled rule#put
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
        - name: id
          in: path
          description: the id of the scheduled rule
          required: true
          schema:
            type: string
            description: the id of the scheduled rule
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScheduledRuleAPI.ModifyRule'
      responses:
        '200':
          description: 200 returned if the item already existed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.ScheduledRule'
        '201':
          description: 201 returned if the item was created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.ScheduledRule'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.BadRequestWithTestResultsErr'
  /simple-rules:
    get:
      tags:
        - simple rule
      summary: list simple rules
      operationId: simple rule#list
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 100
            format: int64
        - name: include-python
          in: query
          description: determines if associated python for the generated rule is returned
          allowEmptyValue: true
          schema:
            type: boolean
            description: determines if associated python for the generated rule is returned
            default: false
        - name: name-contains
          in: query
          description: Substring search by name (case-insensitive)
          allowEmptyValue: true
          schema:
            type: string
            description: Substring search by name (case-insensitive)
        - name: state
          in: query
          description: Only include rules in the given state
          allowEmptyValue: true
          schema:
            type: string
            description: Only include rules in the given state
            enum:
              - enabled
              - disabled
        - name: log-type
          in: query
          description: Only include rules which apply to one of the given log types
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
            description: Only include rules which apply to one of the given log types
        - name: severity
          in: query
          description: Only include rules with one of the given severities
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
              enum:
                - INFO
                - LOW
                - MEDIUM
                - HIGH
                - CRITICAL
            description: Only include rules with one of the given severities
        - name: tag
          in: query
          description: Only include rules with one of the given tags (case-insensitive)
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
            description: Only include rules with one of the given tags (case-insensitive)
        - name: created-by
          in: query
          description: Only include rules whose creator matches this user ID or actor ID
          allowEmptyValue: true
          schema:
            type: string
            description: Only include rules whose creator matches this user ID or actor ID
        - name: last-modified-by
          in: query
          description: Only include rules last modified by this user ID or actor ID
          allowEmptyValue: true
          schema:
            type: string
            description: Only include rules last modified by this user ID or actor ID
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.ListResp'
    post:
      tags:
        - simple rule
      summary: create simple rule
      operationId: simple rule#create
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SimpleRuleAPI.ModifyRule'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.SimpleRule'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.BadRequestWithTestResultsErr'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.ExistsError'
  /simple-rules/{id}:
    delete:
      tags:
        - simple rule
      summary: delete simple rule
      operationId: simple rule#delete
      parameters:
        - name: id
          in: path
          description: ID of the simple rule to delete
          required: true
          schema:
            type: string
            description: ID of the simple rule to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.BadRequestWithTestResultsErr'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.NotFoundError'
    get:
      tags:
        - simple rule
      summary: get a simple rule
      operationId: simple rule#get
      parameters:
        - name: include-python
          in: query
          description: determines if associated python for the generated rule is returned
          allowEmptyValue: true
          schema:
            type: boolean
            description: determines if associated python for the generated rule is returned
            default: false
        - name: id
          in: path
          description: ID of the rule to fetch
          required: true
          schema:
            type: string
            description: ID of the rule to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.SimpleRule'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.NotFoundError'
    put:
      tags:
        - simple rule
      summary: put simple rule
      description: put creates or updates a rule
      operationId: simple rule#put
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
        - name: id
          in: path
          description: the id of the rule
          required: true
          schema:
            type: string
            description: the id of the rule
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SimpleRuleAPI.ModifyRule'
      responses:
        '200':
          description: 200 returned if the item already existed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.SimpleRule'
        '201':
          description: 201 returned if the item was created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.SimpleRule'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.BadRequestWithTestResultsErr'
  /users:
    get:
      tags:
        - user
      summary: List users
      operationId: user#list
      parameters:
        - name: cursor
          in: query
          description: Pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: Pagination token
        - name: limit
          in: query
          description: Maximum number of results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: Maximum number of results to return
            default: 60
            format: int64
            minimum: 1
            maximum: 60
        - name: contains
          in: query
          description: Search name and email fields in a case-insensitive fashion
          allowEmptyValue: true
          schema:
            type: string
            description: Search name and email fields in a case-insensitive fashion
        - name: email
          in: query
          description: An exact match of a user's email to return. If provided all other parameters are ignored
          allowEmptyValue: true
          schema:
            type: string
            description: An exact match of a user's email to return. If provided all other parameters are ignored
        - name: id
          in: query
          description: Set of IDS to return
          allowEmptyValue: true
          schema:
            type: array
            items:
              type: string
            description: Set of IDS to return
        - name: ids
          in: query
          description: A comma delimited list of IDs
          allowEmptyValue: true
          schema:
            type: string
            description: A comma delimited list of IDs
        - name: include-deactivated
          in: query
          description: Include deactivated users
          allowEmptyValue: true
          schema:
            type: boolean
            description: Include deactivated users
        - name: status
          in: query
          description: Show only users with this Cognito status
          allowEmptyValue: true
          schema:
            type: string
            description: Show only users with this Cognito status
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserAPI.ListResp'
    post:
      tags:
        - user
      summary: Create a user
      operationId: user#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserAPI.ModifyUser'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserAPI.User'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserAPI.BadRequestError'
  /users/{id}:
    delete:
      tags:
        - user
      summary: Delete a user
      operationId: user#delete
      parameters:
        - name: id
          in: path
          description: ID of the user
          required: true
          schema:
            type: string
            description: ID of the user
      responses:
        '200':
          description: OK response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserAPI.NotFoundError'
    get:
      tags:
        - user
      summary: Get a user
      operationId: user#get
      parameters:
        - name: id
          in: path
          description: ID of the user
          required: true
          schema:
            type: string
            description: ID of the user
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserAPI.User'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserAPI.NotFoundError'
    post:
      tags:
        - user
      summary: Update a user
      operationId: user#update
      parameters:
        - name: id
          in: path
          description: ID of the user
          required: true
          schema:
            type: string
            description: ID of the user
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserAPI.ModifyUser'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserAPI.User'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserAPI.BadRequestError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserAPI.NotFoundError'
components:
  schemas:
    APITokenAPI.APIToken:
      type: object
      properties:
        allowedCIDRBlocks:
          type: array
          items:
            type: string
          description: The set of CIDR blocks that are allowed to use this API token. If empty, all CIDR blocks are allowed
        createdAt:
          type: string
          description: Time when the API token was created
        createdBy:
          type: object
          properties:
            id:
              type: string
              enum:
                - user
                - api-token
                - system
            type:
              type: string
          description: The actor who created the token
        expiresAt:
          type: string
          description: Time when the API token will expire. Will be null if the token is non-expiring
        id:
          type: string
          description: The unique identifier of the token
        lastUsedAt:
          type: string
          description: The last time this token was used to authenticate
        name:
          type: string
          description: The name of the token
        permissions:
          type: array
          items:
            type: string
            enum:
              - AIRunAsModify
              - AlertModify
              - AlertRead
              - BulkUpload
              - BulkUploadValidate
              - CloudsecSourceModify
              - CloudsecSourceRead
              - DataAnalyticsModify
              - DataAnalyticsRead
              - DestinationModify
              - DestinationRead
              - GeneralSettingsModify
              - GeneralSettingsRead
              - InfraCostRead
              - LogSourceModify
              - LogSourceRawDataRead
              - LogSourceRead
              - LookupModify
              - LookupRead
              - ManageAIResponses
              - ManageAISkills
              - ManageScheduledPrompts
              - McpServerModify
              - McpServerRead
              - NotificationsSend
              - OrganizationAPITokenModify
              - OrganizationAPITokenRead
              - PolicyModify
              - PolicyRead
              - ResourceModify
              - ResourceRead
              - RuleModify
              - RuleRead
              - RunPantherAI
              - SummaryRead
              - UserModify
              - UserRead
              - ViewAIPrivateResponses
              - ViewAISkills
              - ViewScheduledPrompts
        rotatedAt:
          type: string
          description: Time when the API token was rotated
        updatedAt:
          type: string
          description: Time when the API token was updated
        updatedBy:
          type: object
          properties:
            id:
              type: string
              enum:
                - user
                - api-token
                - system
            type:
              type: string
          description: The actor who updated the token
        value:
          type: string
          description: The API token value, only populated during create and rotate actions
      required:
        - name
        - permissions
        - id
        - createdAt
    APITokenAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    APITokenAPI.ForbiddenErr:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    APITokenAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: Pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/APITokenAPI.APIToken'
      required:
        - results
    APITokenAPI.ModifyAPIToken:
      type: object
      properties:
        allowedCIDRBlocks:
          type: array
          items:
            type: string
          description: The set of CIDR blocks that are allowed to use this API token. If empty, all CIDR blocks are allowed
        name:
          type: string
          description: The name of the token
        permissions:
          type: array
          items:
            type: string
            enum:
              - AIRunAsModify
              - AlertModify
              - AlertRead
              - BulkUpload
              - BulkUploadValidate
              - CloudsecSourceModify
              - CloudsecSourceRead
              - DataAnalyticsModify
              - DataAnalyticsRead
              - DestinationModify
              - DestinationRead
              - GeneralSettingsModify
              - GeneralSettingsRead
              - InfraCostRead
              - LogSourceModify
              - LogSourceRawDataRead
              - LogSourceRead
              - LookupModify
              - LookupRead
              - ManageAIResponses
              - ManageAISkills
              - ManageScheduledPrompts
              - McpServerModify
              - McpServerRead
              - NotificationsSend
              - OrganizationAPITokenModify
              - OrganizationAPITokenRead
              - PolicyModify
              - PolicyRead
              - ResourceModify
              - ResourceRead
              - RuleModify
              - RuleRead
              - RunPantherAI
              - SummaryRead
              - UserModify
              - UserRead
              - ViewAIPrivateResponses
              - ViewAISkills
              - ViewScheduledPrompts
      required:
        - name
        - permissions
    APITokenAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    AWSCloudAccountAPI.AWSCloudAccount:
      type: object
      properties:
        awsAccountId:
          type: string
          description: The 12-digit AWS account ID (immutable)
        awsScanConfig:
          $ref: '#/components/schemas/AWSCloudAccountAPI.AWSScanConfig'
        integrationId:
          type: string
          description: The unique ID of the AWS Cloud Account integration
        integrationLabel:
          type: string
          description: The display name for the AWS Cloud Account integration
          pattern: ^[0-9a-zA-Z- ]+$
          maxLength: 36
        regionIgnoreList:
          type: array
          items:
            type: string
            pattern: ^[a-z]{2}(?:-gov)?-[a-z]+-\d+$
          description: Regions to exclude from scanning
        resourceRegexIgnoreList:
          type: array
          items:
            type: string
          description: Regex patterns matching resource ARNs to exclude from scanning
        resourceTypeIgnoreList:
          type: array
          items:
            type: string
          description: Resource types to exclude from scanning (e.g. AWS.S3.Bucket)
      required:
        - regionIgnoreList
        - resourceTypeIgnoreList
        - resourceRegexIgnoreList
    AWSCloudAccountAPI.AWSScanConfig:
      type: object
      properties:
        auditRole:
          type: string
          description: The IAM role ARN that Panther assumes to scan the AWS account
    AWSCloudAccountAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    AWSCloudAccountAPI.CreateAWSCloudAccount:
      type: object
      properties:
        awsAccountId:
          type: string
          description: The 12-digit AWS account ID
          pattern: ^[0-9]{12}$
        awsScanConfig:
          $ref: '#/components/schemas/AWSCloudAccountAPI.AWSScanConfig'
        integrationLabel:
          type: string
          description: The display name for the AWS Cloud Account integration
          pattern: ^[0-9a-zA-Z- ]+$
          maxLength: 36
        regionIgnoreList:
          type: array
          items:
            type: string
            pattern: ^[a-z]{2}(?:-gov)?-[a-z]+-\d+$
          description: Regions to exclude from scanning
        resourceRegexIgnoreList:
          type: array
          items:
            type: string
          description: Regex patterns matching resource ARNs to exclude from scanning
        resourceTypeIgnoreList:
          type: array
          items:
            type: string
          description: Resource types to exclude from scanning (e.g. AWS.S3.Bucket)
      required:
        - awsAccountId
        - integrationLabel
        - awsScanConfig
    AWSCloudAccountAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    AWSCloudAccountAPI.ModifyAWSCloudAccount:
      type: object
      properties:
        awsScanConfig:
          $ref: '#/components/schemas/AWSCloudAccountAPI.AWSScanConfig'
        integrationLabel:
          type: string
          description: The display name for the AWS Cloud Account integration
          pattern: ^[0-9a-zA-Z- ]+$
          maxLength: 36
        regionIgnoreList:
          type: array
          items:
            type: string
            pattern: ^[a-z]{2}(?:-gov)?-[a-z]+-\d+$
          description: Regions to exclude from scanning
        resourceRegexIgnoreList:
          type: array
          items:
            type: string
          description: Regex patterns matching resource ARNs to exclude from scanning
        resourceTypeIgnoreList:
          type: array
          items:
            type: string
          description: Resource types to exclude from scanning (e.g. AWS.S3.Bucket)
      required:
        - integrationLabel
        - awsScanConfig
    AWSCloudAccountAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    AWSCloudAccountAPI.ServiceError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    AlertAPI.Alert:
      type: object
      properties:
        assignee:
          type: object
          properties:
            id:
              type: string
              enum:
                - user
                - api-token
                - system
            type:
              type: string
          description: The Actor that is assigned to this alert
        context:
          description: The context of this alert
        contextTags:
          type: array
          items:
            type: string
            description: Tag to provide context for this alert
            pattern: ^[a-z0-9_-]+$
            minLength: 1
            maxLength: 30
          description: the context tags for the alert
          maxItems: 10
        createdAt:
          type: string
          description: Date and time when the alert got created
        deliveries:
          type: array
          items:
            $ref: '#/components/schemas/AlertAPI.Delivery'
          description: The metadata around the alert's delivery attempts
        detection:
          $ref: '#/components/schemas/AlertAPI.DetectionInfo'
        eventCount:
          type: integer
          description: The number of events that have been received for this alert
          format: int64
        firstEventOccurredAt:
          type: string
          description: Date and time of this alert's first event
        id:
          type: string
          description: The unique identifier of this alert
        lastReceivedEventAt:
          type: string
          description: Date and time that the last event related to this alert was received
        quality:
          type: string
          description: The quality of this Alert
          enum:
            - NOISE
            - USEFUL
        runbook:
          type: string
          description: The runbook for this Alert, as extracted from its origin
        severity:
          type: string
          description: The severity of this Alert
          enum:
            - CRITICAL
            - HIGH
            - MEDIUM
            - LOW
            - INFO
        status:
          type: string
          description: The status of this Alert
          enum:
            - OPEN
            - CLOSED
            - TRIAGED
            - RESOLVED
        systemError:
          $ref: '#/components/schemas/AlertAPI.SystemError'
        title:
          type: string
          description: The title of this alert
        type:
          type: string
          description: The type of this alert
        updatedBy:
          type: object
          properties:
            id:
              type: string
              enum:
                - user
                - api-token
                - system
            type:
              type: string
          description: The Actor that last updated the state of this alert
      required:
        - id
        - type
        - status
    AlertAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    AlertAPI.BulkPatchAlertReq2:
      type: object
      properties:
        assignee:
          type: string
          description: The ID of the assignee for this alert
        contextTags:
          type: array
          items:
            type: string
            pattern: ^[a-z0-9_-]+$
            minLength: 1
            maxLength: 30
          description: the context tags for the alert
          maxItems: 10
        ids:
          type: array
          items:
            type: string
          description: The IDs of the alerts to patch
        quality:
          type: string
          description: The quality of this Alert
          enum:
            - NOISE
            - USEFUL
            - ''
        status:
          type: string
          description: The status of this Alert
          enum:
            - OPEN
            - CLOSED
            - TRIAGED
            - RESOLVED
      required:
        - ids
    AlertAPI.Delivery:
      type: object
      properties:
        dispatchedAt:
          type: string
        label:
          type: string
          description: The label of the alert at where it was delivered (channel name/ID, jira ticket, asana issue, etc)
        message:
          type: string
        outputId:
          type: string
        statusCode:
          type: integer
          format: int64
        success:
          type: boolean
      required:
        - dispatchedAt
        - label
        - message
        - statusCode
        - success
        - outputId
    AlertAPI.DetectionInfo:
      type: object
      properties:
        id:
          type: string
          description: The unique identifier of this Detection
        type:
          type: string
          description: The type of this Detection
          enum:
            - RULE
            - CORRELATION_RULE
            - POLICY
            - SCHEDULED_RULE
    AlertAPI.ListEventsResp:
      type: object
      properties:
        next:
          type: string
          description: Pagination token for the next page of results
        results:
          type: array
          items: {}
      required:
        - results
    AlertAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: Pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/AlertAPI.Alert'
      required:
        - results
    AlertAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    AlertAPI.PatchAlertReq:
      type: object
      properties:
        assignee:
          type: string
          description: The ID of the assignee for this alert
        contextTags:
          type: array
          items:
            type: string
            description: Tag to provide context for this alert
            pattern: ^[a-z0-9_-]+$
            minLength: 1
            maxLength: 30
          description: the context tags for the alert
          maxItems: 10
        quality:
          type: string
          description: The quality of this Alert
          enum:
            - NOISE
            - USEFUL
            - ''
        status:
          type: string
          description: The status of this Alert
          enum:
            - OPEN
            - CLOSED
            - TRIAGED
            - RESOLVED
    AlertAPI.SystemError:
      type: object
      properties:
        detection:
          $ref: '#/components/schemas/AlertAPI.DetectionInfo'
        sourceId:
          type: string
          description: The source ID of this SystemError
        sourceType:
          type: string
          description: The source type of this SystemError
        type:
          type: string
          description: The type of this SystemError
    CommentAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    CommentAPI.Comment:
      type: object
      properties:
        alertId:
          type: string
          description: The alert ID the comment is associated with
        body:
          description: The body of the comment
        createdAt:
          type: string
          description: The date the comment was created
        createdBy:
          type: object
          properties:
            id:
              type: string
              enum:
                - user
                - api-token
                - system
            type:
              type: string
          description: The actor who created the comment
        format:
          type: string
          description: The format of the comment
          enum:
            - PLAIN_TEXT
            - HTML
        id:
          type: string
          description: The comment ID
        updatedAt:
          type: string
          description: The date the comment was updated
        updatedBy:
          type: object
          properties:
            id:
              type: string
              enum:
                - user
                - api-token
                - system
            type:
              type: string
          description: The actor who updated the comment
    CommentAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: Pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/CommentAPI.Comment'
      required:
        - results
    CommentAPI.ModifyCommentReq:
      type: object
      properties:
        alertId:
          type: string
          description: The alert ID the comment is associated with
        body:
          type: string
          description: The body of the comment
        format:
          type: string
          description: The format of the comment
          enum:
            - PLAIN_TEXT
            - HTML
      required:
        - alertId
        - body
        - format
    CommentAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    CorrelationRuleAPI.CorrelationBadRequestErr:
      type: object
      properties:
        message:
          type: string
        testResults:
          type: array
          items:
            $ref: '#/components/schemas/CorrelationRuleAPI.CorrelationTestResult'
      required:
        - message
    CorrelationRuleAPI.CorrelationRule:
      type: object
      properties:
        correlationRuleReferenceIds:
          type: array
          items:
            type: string
          description: The IDs of the rules referenced by this correlation rule
        createAlert:
          type: boolean
          description: Determines whether the rule should create alerts when it triggers
        createdAt:
          type: string
        createdBy:
          type: object
          properties:
            id:
              type: string
              enum:
                - user
                - api-token
                - system
            type:
              type: string
          description: The actor who created the rule
        createdByExternal:
          type: string
          description: The text of the user-provided CreatedBy field when uploaded via CI/CD
        dedupPeriodMinutes:
          type: integer
          description: The amount of time in minutes for grouping alerts
          default: 60
          format: int64
          minimum: 1
        description:
          type: string
          description: The description of the correlation rule
        detection:
          type: string
          description: The yaml representation of the correlation rule
        displayName:
          type: string
          description: The display name of the correlation rule
        enabled:
          type: boolean
          description: Determines whether or not the correlation rule is active
        id:
          type: string
          description: The id of the correlation rule
        lastModified:
          type: string
        lastModifiedBy:
          type: object
          properties:
            id:
              type: string
              enum:
                - user
                - api-token
                - system
            type:
              type: string
          description: The actor who last modified the rule
        logTypes:
          type: array
          items:
            type: string
          description: The log types derived from the correlation rule references
        managed:
          type: boolean
          description: Determines if the correlation rule is managed by panther
        outputIDs:
          type: array
          items:
            type: string
          description: Destination IDs that override default alert routing based on severity
        reference:
          type: string
          description: A URL or note for additional reference material
        reports:
          type: object
          description: reports
          additionalProperties:
            items:
              type: string
            type: array
        runbook:
          type: string
          description: How to handle the generated alert
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        summaryAttributes:
          type: array
          items:
            type: string
          description: A list of fields in the event to create top 5 summaries for
        tags:
          type: array
          items:
            type: string
          description: The tags for the correlation rule
        tests:
          type: array
          items:
            $ref: '#/components/schemas/CorrelationRuleAPI.CorrelationRuleUnitTest'
          description: Unit tests for the correlation rule
        threshold:
          type: integer
          description: the number of events that must match before an alert is triggered
          default: 1
          format: int64
          minimum: 1
      required:
        - id
        - detection
    CorrelationRuleAPI.CorrelationRuleTestMatch:
      type: object
      additionalProperties:
        items: {}
        type: array
    CorrelationRuleAPI.CorrelationRuleTestOutput:
      type: object
      properties:
        id:
          type: string
          description: The sequence/group ID from the correlation rule
        matches:
          type: object
          description: Match field to match value to event times
          additionalProperties:
            $ref: '#/components/schemas/CorrelationRuleAPI.CorrelationRuleTestMatch'
      required:
        - id
    CorrelationRuleAPI.CorrelationRuleUnitTest:
      type: object
      properties:
        expectedResult:
          type: boolean
          description: Whether the correlation rule should trigger
        name:
          type: string
          description: The name of the test case
        ruleOutputs:
          type: array
          items:
            $ref: '#/components/schemas/CorrelationRuleAPI.CorrelationRuleTestOutput'
          description: Simulated rule outputs for the test
      required:
        - name
        - expectedResult
        - ruleOutputs
    CorrelationRuleAPI.CorrelationTestResult:
      type: object
      properties:
        error:
          type: string
          description: Error message if the test failed
        name:
          type: string
          description: The name of the test
        passed:
          type: boolean
          description: Whether the test passed
    CorrelationRuleAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    CorrelationRuleAPI.ListCorrelationRuleResp:
      type: object
      properties:
        next:
          type: string
          description: pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/CorrelationRuleAPI.CorrelationRule'
    CorrelationRuleAPI.ModifyCorrelationRule:
      type: object
      properties:
        createAlert:
          type: boolean
          description: Determines whether the rule should create alerts when it triggers
        dedupPeriodMinutes:
          type: integer
          description: The amount of time in minutes for grouping alerts
          default: 60
          format: int64
          minimum: 1
        description:
          type: string
          description: The description of the correlation rule
        detection:
          type: string
          description: The yaml representation of the correlation rule
        displayName:
          type: string
          description: The display name of the correlation rule
        enabled:
          type: boolean
          description: Determines whether or not the correlation rule is active
        id:
          type: string
          description: The id of the correlation rule
        outputIDs:
          type: array
          items:
            type: string
          description: Destination IDs that override default alert routing based on severity
        reference:
          type: string
          description: A URL or note for additional reference material
        reports:
          type: object
          description: reports
          additionalProperties:
            items:
              type: string
            type: array
        runbook:
          type: string
          description: How to handle the generated alert
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        summaryAttributes:
          type: array
          items:
            type: string
          description: A list of fields in the event to create top 5 summaries for
        tags:
          type: array
          items:
            type: string
          description: The tags for the correlation rule
        tests:
          type: array
          items:
            $ref: '#/components/schemas/CorrelationRuleAPI.CorrelationRuleUnitTest'
          description: Unit tests for the correlation rule
        threshold:
          type: integer
          description: the number of events that must match before an alert is triggered
          default: 1
          format: int64
          minimum: 1
      required:
        - id
        - detection
        - severity
    CorrelationRuleAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    DataModelAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    DataModelAPI.DataModel:
      type: object
      properties:
        body:
          type: string
          description: The python body of the data model
        createdAt:
          type: string
        description:
          type: string
          description: The description of the data model
        displayName:
          type: string
          description: The name used for the data model
        enabled:
          type: boolean
          description: enables/disables a data model
        id:
          type: string
          description: The id of the data model
        lastModified:
          type: string
        logTypes:
          type: array
          items:
            type: string
          description: 'The log type this data model should associate to. NOTE: only one data model can be assigned to a log type'
        mappings:
          type: array
          items:
            $ref: '#/components/schemas/DataModelAPI.DataModelMapping'
    DataModelAPI.DataModelMapping:
      type: object
      properties:
        method:
          type: string
          description: the python function name that should be called
        name:
          type: string
          description: the name of the mapping
        path:
          type: string
          description: the json path
      required:
        - name
    DataModelAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    DataModelAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/DataModelAPI.DataModel'
    DataModelAPI.ModifyDataModel:
      type: object
      properties:
        body:
          type: string
          description: The python body of the data model
        description:
          type: string
          description: The description of the data model
        displayName:
          type: string
          description: The name used for the data model
        enabled:
          type: boolean
          description: enables/disables a data model
        id:
          type: string
          description: The id of the data model
        logTypes:
          type: array
          items:
            type: string
          description: 'The log type this data model should associate to. NOTE: only one data model can be assigned to a log type'
        mappings:
          type: array
          items:
            $ref: '#/components/schemas/DataModelAPI.DataModelMapping'
      required:
        - id
    DataModelAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    GcsSourceAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    GcsSourceAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    GcsSourceAPI.GcsSource:
      type: object
      properties:
        credentials:
          type: string
          description: The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.
        credentialsType:
          type: string
          description: 'The type of credentials being used: service_account or wif (Workload Identity Federation).'
          enum:
            - service_account
            - wif
        gcsBucket:
          type: string
          description: The GCS bucket name
        integrationId:
          type: string
          description: The id of the GCS source
        integrationLabel:
          type: string
          description: The integration label (name)
        logStreamType:
          type: string
          description: 'The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML'
          enum:
            - Auto
            - JSON
            - JsonArray
            - Lines
            - XML
        logStreamTypeOptions:
          $ref: '#/components/schemas/GcsSourceAPI.LogStreamTypeOptions'
        prefixLogTypes:
          type: array
          items:
            $ref: '#/components/schemas/GcsSourceAPI.PrefixLogTypesMapping'
          description: Prefix-based log type mappings for parsing ingested data
        projectId:
          type: string
          description: The GCP project ID. Optional for service_account credentials. Required for WIF.
        subscriptionId:
          type: string
          description: The GCP Pub/Sub subscription ID used to receive GCS bucket notifications
    GcsSourceAPI.LogStreamTypeOptions:
      type: object
      properties:
        jsonArrayEnvelopeField:
          type: string
          description: Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself
        xmlRootElement:
          type: string
          description: The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element
    GcsSourceAPI.ModifyGcsSource:
      type: object
      properties:
        credentials:
          type: string
          description: The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.
        credentialsType:
          type: string
          description: 'The type of credentials being used: service_account or wif (Workload Identity Federation).'
          enum:
            - service_account
            - wif
        gcsBucket:
          type: string
          description: The GCS bucket name
        integrationLabel:
          type: string
          description: The integration label (name)
        logStreamType:
          type: string
          description: 'The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML'
          enum:
            - Auto
            - JSON
            - JsonArray
            - Lines
            - XML
        logStreamTypeOptions:
          $ref: '#/components/schemas/GcsSourceAPI.LogStreamTypeOptions'
        prefixLogTypes:
          type: array
          items:
            $ref: '#/components/schemas/GcsSourceAPI.PrefixLogTypesMapping'
          description: Prefix-based log type mappings for parsing ingested data
        projectId:
          type: string
          description: The GCP project ID. Optional for service_account credentials. Required for WIF.
        subscriptionId:
          type: string
          description: The GCP Pub/Sub subscription ID used to receive GCS bucket notifications
      required:
        - integrationLabel
        - subscriptionId
        - gcsBucket
        - prefixLogTypes
        - logStreamType
        - credentialsType
    GcsSourceAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    GcsSourceAPI.PrefixLogTypesMapping:
      type: object
      properties:
        excludedPrefixes:
          type: array
          items:
            type: string
          description: Prefixes to exclude from matching. Supports '*' as a wildcard for dynamic path segments.
        logTypes:
          type: array
          items:
            type: string
          description: The log types (schemas) to apply for this prefix
        prefix:
          type: string
          description: GCS prefix to match. Leave empty to match all files in the bucket.
    GcsSourceAPI.ServiceError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    GlobalAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    GlobalAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    GlobalAPI.Global:
      type: object
      properties:
        body:
          type: string
          description: The python body of the global
        createdAt:
          type: string
        description:
          type: string
          description: The description of the global
        id:
          type: string
          description: The id of the global
        lastModified:
          type: string
        tags:
          type: array
          items:
            type: string
          description: The tags for the global
    GlobalAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/GlobalAPI.Global'
    GlobalAPI.ModifyGlobal:
      type: object
      properties:
        body:
          type: string
          description: The python body of the global
        description:
          type: string
          description: The description of the global
        id:
          type: string
          description: The id of the global
        tags:
          type: array
          items:
            type: string
          description: The tags for the global
      required:
        - id
        - body
    GlobalAPI.ModifyGlobal2:
      type: object
      properties:
        body:
          type: string
          description: The python body of the global
        description:
          type: string
          description: The description of the global
        tags:
          type: array
          items:
            type: string
          description: The tags for the global
      required:
        - body
    GlobalAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    GlobalAPI.PutGlobalResp:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/GlobalAPI.Global'
    HttpSourceAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    HttpSourceAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    HttpSourceAPI.HTTPSource:
      type: object
      properties:
        authBearerToken:
          type: string
          description: The authentication bearer token value of the http source. Used for Bearer auth method
        authHeaderKey:
          type: string
          description: The authentication header key of the http source. Used for HMAC and SharedSecret auth methods
        authHmacAlg:
          type: string
          description: The authentication algorithm of the http source. Used for HMAC auth method
        authMethod:
          type: string
          description: The authentication method of the http source
          enum:
            - SharedSecret
            - HMAC
            - Bearer
            - Basic
            - None
        authPassword:
          type: string
          description: The authentication header password of the http source. Used for Basic auth method
        authSecretValue:
          type: string
          description: The authentication header secret value of the http source. Used for HMAC and SharedSecret auth methods
        authUsername:
          type: string
          description: The authentication header username of the http source. Used for Basic auth method
        integrationId:
          type: string
          description: The id of the http source
        integrationLabel:
          type: string
          description: The integration label (name)
        logStreamType:
          type: string
          description: 'The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML'
          enum:
            - Auto
            - JSON
            - JsonArray
            - Lines
            - XML
        logStreamTypeOptions:
          $ref: '#/components/schemas/HttpSourceAPI.LogStreamTypeOptions'
        logTypes:
          type: array
          items:
            type: string
          description: The log types of the integration
    HttpSourceAPI.LogStreamTypeOptions:
      type: object
      properties:
        jsonArrayEnvelopeField:
          type: string
          description: Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself
        xmlRootElement:
          type: string
          description: The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element
    HttpSourceAPI.ModifyHTTPSource:
      type: object
      properties:
        authBearerToken:
          type: string
          description: The authentication bearer token value of the http source. Used for Bearer auth method
        authHeaderKey:
          type: string
          description: The authentication header key of the http source. Used for HMAC and SharedSecret auth methods
        authHmacAlg:
          type: string
          description: The authentication algorithm of the http source. Used for HMAC auth method
        authMethod:
          type: string
          description: The authentication method of the http source
          enum:
            - SharedSecret
            - HMAC
            - Bearer
            - Basic
            - None
        authPassword:
          type: string
          description: The authentication header password of the http source. Used for Basic auth method
        authSecretValue:
          type: string
          description: The authentication header secret value of the http source. Used for HMAC and SharedSecret auth methods
        authUsername:
          type: string
          description: The authentication header username of the http source. Used for Basic auth method
        integrationLabel:
          type: string
          description: The integration label (name)
        logStreamType:
          type: string
          description: 'The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML'
          enum:
            - Auto
            - JSON
            - JsonArray
            - Lines
            - XML
        logStreamTypeOptions:
          $ref: '#/components/schemas/HttpSourceAPI.LogStreamTypeOptions'
        logTypes:
          type: array
          items:
            type: string
          description: The log types of the integration
      required:
        - integrationLabel
        - logTypes
        - logStreamType
        - authMethod
    HttpSourceAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    HttpSourceAPI.ServiceError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    LogForwarderSourceAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    LogForwarderSourceAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    LogForwarderSourceAPI.LogForwarderSource:
      type: object
      properties:
        integrationId:
          type: string
          description: The id of the log forwarder source
        integrationLabel:
          type: string
          description: The integration label (name)
        logStreamType:
          type: string
          description: 'The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML'
          enum:
            - Auto
            - JSON
            - JsonArray
            - Lines
            - XML
        logStreamTypeOptions:
          $ref: '#/components/schemas/LogForwarderSourceAPI.LogStreamTypeOptions'
        logTypes:
          type: array
          items:
            type: string
          description: The log types of the integration
    LogForwarderSourceAPI.LogStreamTypeOptions:
      type: object
      properties:
        jsonArrayEnvelopeField:
          type: string
          description: Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself
        xmlRootElement:
          type: string
          description: The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element
    LogForwarderSourceAPI.ModifyLogForwarderSource:
      type: object
      properties:
        integrationLabel:
          type: string
          description: The integration label (name)
        logStreamType:
          type: string
          description: 'The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML'
          enum:
            - Auto
            - JSON
            - JsonArray
            - Lines
            - XML
        logStreamTypeOptions:
          $ref: '#/components/schemas/LogForwarderSourceAPI.LogStreamTypeOptions'
        logTypes:
          type: array
          items:
            type: string
          description: The log types of the integration
      required:
        - integrationLabel
        - logTypes
        - logStreamType
    LogForwarderSourceAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    LogForwarderSourceAPI.ServiceError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    LogSourceAlarmAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    LogSourceAlarmAPI.Error:
      type: object
      properties:
        fault:
          type: boolean
          description: Is the error a server-side fault?
        id:
          type: string
          description: ID is a unique identifier for this particular occurrence of the problem.
          example: 123abc
        message:
          type: string
          description: Message is a human-readable explanation specific to this occurrence of the problem.
          example: parameter 'p' must be an integer
        name:
          type: string
          description: Name is the name of this class of errors.
          example: bad_request
        temporary:
          type: boolean
          description: Is the error temporary?
        timeout:
          type: boolean
          description: Is the error a timeout?
      required:
        - name
        - id
        - message
        - temporary
        - timeout
        - fault
    LogSourceAlarmAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    LogSourceAlarmAPI.PutSourceAlarmData:
      type: object
      properties:
        minutesThreshold:
          type: integer
          description: The no-data evaluation period in minutes. Minimum 15, maximum 43200 (30 days).
          format: int32
      required:
        - minutesThreshold
    LogSourceAlarmAPI.PutSourceAlarmResp:
      type: object
      properties:
        minutesThreshold:
          type: integer
          description: The configured no-data evaluation period in minutes
          format: int32
        type:
          type: string
          description: The alarm type
          enum:
            - SOURCE_NO_DATA
      required:
        - type
        - minutesThreshold
    LogSourceAlarmAPI.ServiceError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    LogSourceAlarmAPI.SourceAlarm:
      type: object
      properties:
        minutesThreshold:
          type: integer
          description: The no-data evaluation period in minutes.
          format: int32
        state:
          type: string
          description: The current CloudWatch state of the alarm
          enum:
            - OK
            - ALARM
            - INSUFFICIENT_DATA
        type:
          type: string
          description: The alarm type
          enum:
            - SOURCE_NO_DATA
      required:
        - type
    PolicyAPI.BadRequestWithTestResultsErr:
      type: object
      properties:
        message:
          type: string
        testResults:
          type: array
          items:
            $ref: '#/components/schemas/PolicyAPI.TestDetectionRecord'
      required:
        - message
    PolicyAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    PolicyAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/PolicyAPI.Policy'
    PolicyAPI.ModifyPolicy:
      type: object
      properties:
        body:
          type: string
          description: The python body of the policy
        description:
          type: string
          description: The description of the policy
        displayName:
          type: string
          description: The display name of the policy
        enabled:
          type: boolean
          description: Determines whether or not the policy is active
        id:
          type: string
          description: The id of the policy
        managed:
          type: boolean
          description: Determines if the policy is managed by panther
        outputIDs:
          type: array
          items:
            type: string
          description: Destination IDs that override default alert routing based on severity
        reference:
          type: string
          description: A URL or note for additional reference material
        reports:
          type: object
          description: Reports
          additionalProperties:
            items:
              type: string
            type: array
        resourceTypes:
          type: array
          items:
            type: string
          description: Resource types
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        suppressions:
          type: array
          items:
            type: string
          description: Resources to ignore via a pattern that matches the resource id
          example:
            - aws::s3::*
        tags:
          type: array
          items:
            type: string
          description: The tags for the policy
        tests:
          type: array
          items:
            $ref: '#/components/schemas/PolicyAPI.UnitTest'
          description: Unit tests for the Policy. Best practice is to include a positive and negative case
      required:
        - id
        - body
        - severity
    PolicyAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    PolicyAPI.Policy:
      type: object
      properties:
        body:
          type: string
          description: The python body of the policy
        createdAt:
          type: string
        createdBy:
          type: object
          properties:
            id:
              type: string
              enum:
                - user
                - api-token
                - system
            type:
              type: string
          description: The actor who created the rule
        createdByExternal:
          type: string
          description: The text of the user-provided CreatedBy field when uploaded via CI/CD
        description:
          type: string
          description: The description of the policy
        displayName:
          type: string
          description: The display name of the policy
        enabled:
          type: boolean
          description: Determines whether or not the policy is active
        id:
          type: string
          description: The id of the policy
        lastModified:
          type: string
        managed:
          type: boolean
          description: Determines if the policy is managed by panther
        outputIDs:
          type: array
          items:
            type: string
          description: Destination IDs that override default alert routing based on severity
        reference:
          type: string
          description: A URL or note for additional reference material
        reports:
          type: object
          description: Reports
          additionalProperties:
            items:
              type: string
            type: array
        resourceTypes:
          type: array
          items:
            type: string
          description: Resource types
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        suppressions:
          type: array
          items:
            type: string
          description: Resources to ignore via a pattern that matches the resource id
          example:
            - aws::s3::*
        tags:
          type: array
          items:
            type: string
          description: The tags for the policy
        tests:
          type: array
          items:
            $ref: '#/components/schemas/PolicyAPI.UnitTest'
          description: Unit tests for the Policy. Best practice is to include a positive and negative case
    PolicyAPI.TestDetectionRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/PolicyAPI.TestErr'
        errored:
          type: boolean
        functions:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionRecordFunctions'
        name:
          type: string
        passed:
          type: boolean
        triggerAlert:
          type: boolean
    PolicyAPI.TestDetectionRecordFunctions:
      type: object
      properties:
        alertContext:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        dedup:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        description:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        destinations:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        detection:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        reference:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        runbook:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        severity:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        title:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
    PolicyAPI.TestDetectionSubRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/PolicyAPI.TestErr'
        output:
          type: string
    PolicyAPI.TestErr:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
    PolicyAPI.UnitTest:
      type: object
      properties:
        expectedResult:
          type: boolean
          description: The expected result
        log:
          description: A test event object that your detection will receive as input.
        mocks:
          type: array
          items:
            $ref: '#/components/schemas/PolicyAPI.UnitTestMock'
          description: mocks
        name:
          type: string
          description: name
        resource:
          type: string
          description: A test event object that your detection will receive as input, JSON-encoded. Prefer `log`.
      required:
        - name
        - expectedResult
    PolicyAPI.UnitTestMock:
      type: object
      additionalProperties:
        type: string
    PubSubSourceAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    PubSubSourceAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    PubSubSourceAPI.LogStreamTypeOptions:
      type: object
      properties:
        jsonArrayEnvelopeField:
          type: string
          description: Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself
        xmlRootElement:
          type: string
          description: The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element
    PubSubSourceAPI.ModifyPubSubSource:
      type: object
      properties:
        credentials:
          type: string
          description: The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.
        credentialsType:
          type: string
          description: 'The type of credentials being used: service_account or wif (Workload Identity Federation).'
          enum:
            - service_account
            - wif
        integrationLabel:
          type: string
          description: The integration label (name)
        logStreamType:
          type: string
          description: 'The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML'
          enum:
            - Auto
            - JSON
            - JsonArray
            - Lines
            - XML
        logStreamTypeOptions:
          $ref: '#/components/schemas/PubSubSourceAPI.LogStreamTypeOptions'
        logTypes:
          type: array
          items:
            type: string
          description: The log types for parsing ingested data
        projectId:
          type: string
          description: The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF.
        regionalEndpoint:
          type: string
          description: Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used.
        subscriptionId:
          type: string
          description: The GCP Pub/Sub subscription ID
      required:
        - integrationLabel
        - subscriptionId
        - logTypes
        - logStreamType
        - credentialsType
    PubSubSourceAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    PubSubSourceAPI.PubSubSource:
      type: object
      properties:
        credentials:
          type: string
          description: The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.
        credentialsType:
          type: string
          description: 'The type of credentials being used: service_account or wif (Workload Identity Federation).'
          enum:
            - service_account
            - wif
        integrationId:
          type: string
          description: The id of the pubsub source
        integrationLabel:
          type: string
          description: The integration label (name)
        logStreamType:
          type: string
          description: 'The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML'
          enum:
            - Auto
            - JSON
            - JsonArray
            - Lines
            - XML
        logStreamTypeOptions:
          $ref: '#/components/schemas/PubSubSourceAPI.LogStreamTypeOptions'
        logTypes:
          type: array
          items:
            type: string
          description: The log types for parsing ingested data
        projectId:
          type: string
          description: The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF.
        regionalEndpoint:
          type: string
          description: Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used.
        subscriptionId:
          type: string
          description: The GCP Pub/Sub subscription ID
    PubSubSourceAPI.ServiceError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    QueryAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    QueryAPI.EmailConfig:
      type: object
      properties:
        preferAttachment:
          type: boolean
          description: If true, prefer sending query results as attachment (if possible within 10MB limit). Otherwise results will be sent via link
          default: false
        recipients:
          type: array
          items:
            type: string
          description: List of email addresses to send the query results to
        sendEmpty:
          type: boolean
          description: If true, sends an email even if the query returned no rows
          default: false
    QueryAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    QueryAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: Pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/QueryAPI.Query'
    QueryAPI.ModifyQuery:
      type: object
      properties:
        description:
          type: string
          description: The description of the query
        emailConfig:
          $ref: '#/components/schemas/QueryAPI.EmailConfig'
        name:
          type: string
          description: The name of the query
        schedule:
          $ref: '#/components/schemas/QueryAPI.Schedule'
        sql:
          type: string
          description: The raw sql of the query
      required:
        - sql
        - name
    QueryAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    QueryAPI.Query:
      type: object
      properties:
        createdAt:
          type: string
        description:
          type: string
          description: The description of the query
        emailConfig:
          $ref: '#/components/schemas/QueryAPI.EmailConfig'
        id:
          type: string
          description: The generated ID of the query
        managed:
          type: boolean
          description: Determines if the query is managed by panther
        name:
          type: string
          description: The name of the query
        schedule:
          $ref: '#/components/schemas/QueryAPI.Schedule'
        sql:
          type: string
          description: The raw sql of the query
        updatedAt:
          type: string
    QueryAPI.Schedule:
      type: object
      properties:
        cron:
          type: string
          description: The cron expression
        disabled:
          type: boolean
          description: Disable the schedule
        rateMinutes:
          type: integer
          format: int64
        timeoutMinutes:
          type: integer
          format: int64
    RoleAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    RoleAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: Pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/RoleAPI.Role'
      required:
        - results
    RoleAPI.ModifyRole:
      type: object
      properties:
        logTypeAccess:
          type: array
          items:
            type: string
          description: The log types that the role can or cannot access, according to the `logTypeAccessKind` field. This field should be omitted if `logTypeAccessKind` has a value of `ALLOW_ALL` or `DENY_ALL`
        logTypeAccessKind:
          type: string
          description: Defines the role's access to log types. This field is required and has effect only if the datalake RBAC feature is enabled.
          enum:
            - ALLOW
            - ALLOW_ALL
            - DENY
            - DENY_ALL
        name:
          type: string
          description: The name of the role
        permissions:
          type: array
          items:
            type: string
            enum:
              - AIRunAsModify
              - AlertModify
              - AlertRead
              - BulkUpload
              - BulkUploadValidate
              - CloudsecSourceModify
              - CloudsecSourceRead
              - DataAnalyticsModify
              - DataAnalyticsRead
              - DestinationModify
              - DestinationRead
              - GeneralSettingsModify
              - GeneralSettingsRead
              - InfraCostRead
              - LogSourceModify
              - LogSourceRawDataRead
              - LogSourceRead
              - LookupModify
              - LookupRead
              - ManageAIResponses
              - ManageAISkills
              - ManageScheduledPrompts
              - McpServerModify
              - McpServerRead
              - NotificationsSend
              - OrganizationAPITokenModify
              - OrganizationAPITokenRead
              - PolicyModify
              - PolicyRead
              - ResourceModify
              - ResourceRead
              - RuleModify
              - RuleRead
              - RunPantherAI
              - SummaryRead
              - UserModify
              - UserRead
              - ViewAIPrivateResponses
              - ViewAISkills
              - ViewScheduledPrompts
      required:
        - name
        - permissions
    RoleAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    RoleAPI.Role:
      type: object
      properties:
        createdAt:
          type: string
        id:
          type: string
          description: ID of the role
        logTypeAccess:
          type: array
          items:
            type: string
          description: The log types that the role can or cannot access, according to the `logTypeAccessKind` field. This field should be omitted if `logTypeAccessKind` has a value of `ALLOW_ALL` or `DENY_ALL`
        logTypeAccessKind:
          type: string
          description: Defines the role's access to log types. This field is required and has effect only if the datalake RBAC feature is enabled.
          enum:
            - ALLOW
            - ALLOW_ALL
            - DENY
            - DENY_ALL
        name:
          type: string
          description: The name of the role
        permissions:
          type: array
          items:
            type: string
            enum:
              - AIRunAsModify
              - AlertModify
              - AlertRead
              - BulkUpload
              - BulkUploadValidate
              - CloudsecSourceModify
              - CloudsecSourceRead
              - DataAnalyticsModify
              - DataAnalyticsRead
              - DestinationModify
              - DestinationRead
              - GeneralSettingsModify
              - GeneralSettingsRead
              - InfraCostRead
              - LogSourceModify
              - LogSourceRawDataRead
              - LogSourceRead
              - LookupModify
              - LookupRead
              - ManageAIResponses
              - ManageAISkills
              - ManageScheduledPrompts
              - McpServerModify
              - McpServerRead
              - NotificationsSend
              - OrganizationAPITokenModify
              - OrganizationAPITokenRead
              - PolicyModify
              - PolicyRead
              - ResourceModify
              - ResourceRead
              - RuleModify
              - RuleRead
              - RunPantherAI
              - SummaryRead
              - UserModify
              - UserRead
              - ViewAIPrivateResponses
              - ViewAISkills
              - ViewScheduledPrompts
        updatedAt:
          type: string
      required:
        - name
        - permissions
        - logTypeAccessKind
    RuleAPI.BadRequestWithTestResultsErr:
      type: object
      properties:
        message:
          type: string
        testResults:
          type: array
          items:
            $ref: '#/components/schemas/RuleAPI.TestDetectionRecord'
      required:
        - message
    RuleAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    RuleAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/RuleAPI.Rule'
    RuleAPI.ModifyRule:
      type: object
      properties:
        body:
          type: string
          description: The python body of the rule
        createAlert:
          type: boolean
          description: Determines whether the rule should create alerts when it triggers
        dedupPeriodMinutes:
          type: integer
          description: The amount of time in minutes for grouping alerts
          default: 60
          format: int64
          minimum: 1
        description:
          type: string
          description: The description of the rule
        displayName:
          type: string
          description: The display name of the rule
        enabled:
          type: boolean
          description: Determines whether or not the rule is active
        id:
          type: string
          description: The id of the rule
        inlineFilters:
          type: string
          description: The filter for the rule represented in YAML
        logTypes:
          type: array
          items:
            type: string
          description: log types
        managed:
          type: boolean
          description: Determines if the rule is managed by panther
        outputIDs:
          type: array
          items:
            type: string
          description: Destination IDs that override default alert routing based on severity
        reference:
          type: string
          description: A URL or note for additional reference material
        reports:
          type: object
          description: reports
          additionalProperties:
            items:
              type: string
            type: array
        runbook:
          type: string
          description: How to handle the generated alert
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        summaryAttributes:
          type: array
          items:
            type: string
          description: A list of fields in the event to create top 5 summaries for
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule
        tests:
          type: array
          items:
            $ref: '#/components/schemas/RuleAPI.UnitTest'
          description: Unit tests for the Rule. Best practice is to include a positive and negative case
        threshold:
          type: integer
          description: the number of events that must match before an alert is triggered
          default: 1
          format: int64
          minimum: 1
      required:
        - id
        - body
        - severity
    RuleAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    RuleAPI.Rule:
      type: object
      properties:
        body:
          type: string
          description: The python body of the rule
        createAlert:
          type: boolean
          description: Determines whether the rule should create alerts when it triggers
        createdAt:
          type: string
        createdBy:
          type: object
          properties:
            id:
              type: string
              enum:
                - user
                - api-token
                - system
            type:
              type: string
          description: The actor who created the rule
        createdByExternal:
          type: string
          description: The text of the user-provided CreatedBy field when uploaded via CI/CD
        dedupPeriodMinutes:
          type: integer
          description: The amount of time in minutes for grouping alerts
          default: 60
          format: int64
          minimum: 1
        description:
          type: string
          description: The description of the rule
        displayName:
          type: string
          description: The display name of the rule
        enabled:
          type: boolean
          description: Determines whether or not the rule is active
        id:
          type: string
          description: The id of the rule
        inlineFilters:
          type: string
          description: The filter for the rule represented in YAML
        lastModified:
          type: string
        logTypes:
          type: array
          items:
            type: string
          description: log types
        managed:
          type: boolean
          description: Determines if the rule is managed by panther
        outputIDs:
          type: array
          items:
            type: string
          description: Destination IDs that override default alert routing based on severity
        reference:
          type: string
          description: A URL or note for additional reference material
        reports:
          type: object
          description: reports
          additionalProperties:
            items:
              type: string
            type: array
        runbook:
          type: string
          description: How to handle the generated alert
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        summaryAttributes:
          type: array
          items:
            type: string
          description: A list of fields in the event to create top 5 summaries for
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule
        tests:
          type: array
          items:
            $ref: '#/components/schemas/RuleAPI.UnitTest'
          description: Unit tests for the Rule. Best practice is to include a positive and negative case
        threshold:
          type: integer
          description: the number of events that must match before an alert is triggered
          default: 1
          format: int64
          minimum: 1
    RuleAPI.TestDetectionRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/RuleAPI.TestErr'
        errored:
          type: boolean
        functions:
          $ref: '#/components/schemas/RuleAPI.TestDetectionRecordFunctions'
        name:
          type: string
        passed:
          type: boolean
        triggerAlert:
          type: boolean
    RuleAPI.TestDetectionRecordFunctions:
      type: object
      properties:
        alertContext:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        dedup:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        description:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        destinations:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        detection:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        reference:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        runbook:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        severity:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        title:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
    RuleAPI.TestDetectionSubRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/RuleAPI.TestErr'
        output:
          type: string
    RuleAPI.TestErr:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
    RuleAPI.UnitTest:
      type: object
      properties:
        expectedResult:
          type: boolean
          description: The expected result
        log:
          description: A test event object that your detection will receive as input.
        mocks:
          type: array
          items:
            $ref: '#/components/schemas/RuleAPI.UnitTestMock'
          description: mocks
        name:
          type: string
          description: name
        resource:
          type: string
          description: A test event object that your detection will receive as input, JSON-encoded. Prefer `log`.
      required:
        - name
        - expectedResult
    RuleAPI.UnitTestMock:
      type: object
      additionalProperties:
        type: string
    S3SourceAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    S3SourceAPI.CreateS3Source:
      type: object
      properties:
        awsAccountId:
          type: string
          description: The 12-digit AWS account ID where the S3 bucket resides
        integrationLabel:
          type: string
          description: The integration label (name)
        kmsKey:
          type: string
          description: KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.
        logProcessingRole:
          type: string
          description: The IAM role ARN that Panther assumes to read from the S3 bucket
        logStreamType:
          type: string
          description: 'The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs'
          enum:
            - Auto
            - JSON
            - JsonArray
            - Lines
            - XML
            - CloudWatchLogs
        logStreamTypeOptions:
          $ref: '#/components/schemas/S3SourceAPI.S3LogStreamTypeOptions'
        managedBucketNotifications:
          type: boolean
          description: Whether Panther should configure the S3 bucket notifications automatically
        s3Bucket:
          type: string
          description: The S3 bucket name
        s3PrefixLogTypes:
          type: array
          items:
            $ref: '#/components/schemas/S3SourceAPI.PrefixLogTypesMapping'
          description: Prefix-based log type mappings for parsing ingested data
      required:
        - awsAccountId
        - s3Bucket
        - integrationLabel
        - s3PrefixLogTypes
        - managedBucketNotifications
        - logProcessingRole
        - logStreamType
    S3SourceAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    S3SourceAPI.ModifyS3Source:
      type: object
      properties:
        integrationLabel:
          type: string
          description: The integration label (name)
        kmsKey:
          type: string
          description: KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.
        logProcessingRole:
          type: string
          description: The IAM role ARN that Panther assumes to read from the S3 bucket
        logStreamType:
          type: string
          description: 'The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs'
          enum:
            - Auto
            - JSON
            - JsonArray
            - Lines
            - XML
            - CloudWatchLogs
        logStreamTypeOptions:
          $ref: '#/components/schemas/S3SourceAPI.S3LogStreamTypeOptions'
        managedBucketNotifications:
          type: boolean
          description: Whether Panther should configure the S3 bucket notifications automatically
        s3PrefixLogTypes:
          type: array
          items:
            $ref: '#/components/schemas/S3SourceAPI.PrefixLogTypesMapping'
          description: Prefix-based log type mappings for parsing ingested data
      required:
        - integrationLabel
        - s3PrefixLogTypes
        - managedBucketNotifications
        - logProcessingRole
        - logStreamType
    S3SourceAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    S3SourceAPI.PrefixLogTypesMapping:
      type: object
      properties:
        excludedPrefixes:
          type: array
          items:
            type: string
          description: Prefixes to exclude from matching. Use '*' as a wildcard for dynamic path segments.
        logTypes:
          type: array
          items:
            type: string
          description: The log types (schemas) to apply for this prefix
        prefix:
          type: string
          description: S3 prefix to match. Leave empty to match all objects in the bucket.
    S3SourceAPI.S3LogStreamTypeOptions:
      type: object
      properties:
        jsonArrayEnvelopeField:
          type: string
          description: Path to the JSON array field to extract records from. Only applicable when logStreamType is JsonArray. Omit if the input is already a top-level array.
        retainEnvelopeFields:
          type: boolean
          description: Preserve CloudWatch Logs envelope metadata (accountId, logGroup, subscriptionFilters) in a p_header column. Only applicable when logStreamType is CloudWatchLogs.
        xmlRootElement:
          type: string
          description: Root element wrapping XML events. Only applicable when logStreamType is XML. Omit if events are not enclosed in a root element.
    S3SourceAPI.S3Source:
      type: object
      properties:
        awsAccountId:
          type: string
          description: The AWS account ID where the S3 bucket resides
        integrationId:
          type: string
          description: The unique ID of the S3 log source
        integrationLabel:
          type: string
          description: The integration label (name)
        kmsKey:
          type: string
          description: KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.
        logProcessingRole:
          type: string
          description: The IAM role ARN that Panther assumes to read from the S3 bucket
        logStreamType:
          type: string
          description: 'The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs'
          enum:
            - Auto
            - JSON
            - JsonArray
            - Lines
            - XML
            - CloudWatchLogs
        logStreamTypeOptions:
          $ref: '#/components/schemas/S3SourceAPI.S3LogStreamTypeOptions'
        managedBucketNotifications:
          type: boolean
          description: Whether Panther should configure the S3 bucket notifications automatically
        s3Bucket:
          type: string
          description: The S3 bucket name
        s3PrefixLogTypes:
          type: array
          items:
            $ref: '#/components/schemas/S3SourceAPI.PrefixLogTypesMapping'
          description: Prefix-based log type mappings for parsing ingested data
    S3SourceAPI.ServiceError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    ScheduledRuleAPI.BadRequestWithTestResultsErr:
      type: object
      properties:
        message:
          type: string
        testResults:
          type: array
          items:
            $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionRecord'
      required:
        - message
    ScheduledRuleAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    ScheduledRuleAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/ScheduledRuleAPI.ScheduledRule'
    ScheduledRuleAPI.ModifyRule:
      type: object
      properties:
        body:
          type: string
          description: The python body of the scheduled rule
        createAlert:
          type: boolean
          description: Determines whether the scheduled rule should create alerts when it triggers
        dedupPeriodMinutes:
          type: integer
          description: The amount of time in minutes for grouping alerts
          default: 60
          format: int64
          minimum: 1
        description:
          type: string
          description: The description of the scheduled rule
        displayName:
          type: string
          description: The display name of the scheduled rule
        enabled:
          type: boolean
          description: Determines whether or not the scheduled rule is active
        id:
          type: string
          description: The id of the scheduled rule
        managed:
          type: boolean
          description: Determines if the scheduled rule is managed by panther
        outputIDs:
          type: array
          items:
            type: string
          description: Destination IDs that override default alert routing based on severity
        reference:
          type: string
          description: A URL or note for additional reference material
        reports:
          type: object
          description: reports
          additionalProperties:
            items:
              type: string
            type: array
        runbook:
          type: string
          description: How to handle the generated alert
        scheduledQueries:
          type: array
          items:
            type: string
          description: the queries that this scheduled rule utilizes
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        summaryAttributes:
          type: array
          items:
            type: string
          description: A list of fields in the event to create top 5 summaries for
        tags:
          type: array
          items:
            type: string
          description: The tags for the scheduled rule
        tests:
          type: array
          items:
            $ref: '#/components/schemas/ScheduledRuleAPI.UnitTest'
          description: Unit tests for the Rule. Best practice is to include a positive and negative case
        threshold:
          type: integer
          description: the number of events that must match before an alert is triggered
          default: 1
          format: int64
          minimum: 1
      required:
        - id
        - body
        - severity
    ScheduledRuleAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    ScheduledRuleAPI.ScheduledRule:
      type: object
      properties:
        body:
          type: string
          description: The python body of the scheduled rule
        createAlert:
          type: boolean
          description: Determines whether the scheduled rule should create alerts when it triggers
        createdAt:
          type: string
        createdBy:
          type: object
          properties:
            id:
              type: string
              enum:
                - user
                - api-token
                - system
            type:
              type: string
          description: The actor who created the rule
        createdByExternal:
          type: string
          description: The text of the user-provided CreatedBy field when uploaded via CI/CD
        dedupPeriodMinutes:
          type: integer
          description: The amount of time in minutes for grouping alerts
          default: 60
          format: int64
          minimum: 1
        description:
          type: string
          description: The description of the scheduled rule
        displayName:
          type: string
          description: The display name of the scheduled rule
        enabled:
          type: boolean
          description: Determines whether or not the scheduled rule is active
        id:
          type: string
          description: The id of the scheduled rule
        lastModified:
          type: string
        managed:
          type: boolean
          description: Determines if the scheduled rule is managed by panther
        outputIDs:
          type: array
          items:
            type: string
          description: Destination IDs that override default alert routing based on severity
        reference:
          type: string
          description: A URL or note for additional reference material
        reports:
          type: object
          description: reports
          additionalProperties:
            items:
              type: string
            type: array
        runbook:
          type: string
          description: How to handle the generated alert
        scheduledQueries:
          type: array
          items:
            type: string
          description: the queries that this scheduled rule utilizes
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        summaryAttributes:
          type: array
          items:
            type: string
          description: A list of fields in the event to create top 5 summaries for
        tags:
          type: array
          items:
            type: string
          description: The tags for the scheduled rule
        tests:
          type: array
          items:
            $ref: '#/components/schemas/ScheduledRuleAPI.UnitTest'
          description: Unit tests for the Rule. Best practice is to include a positive and negative case
        threshold:
          type: integer
          description: the number of events that must match before an alert is triggered
          default: 1
          format: int64
          minimum: 1
    ScheduledRuleAPI.TestDetectionRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestErr'
        errored:
          type: boolean
        functions:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionRecordFunctions'
        name:
          type: string
        passed:
          type: boolean
        triggerAlert:
          type: boolean
    ScheduledRuleAPI.TestDetectionRecordFunctions:
      type: object
      properties:
        alertContext:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        dedup:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        description:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        destinations:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        detection:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        reference:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        runbook:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        severity:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        title:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
    ScheduledRuleAPI.TestDetectionSubRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestErr'
        output:
          type: string
    ScheduledRuleAPI.TestErr:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
    ScheduledRuleAPI.UnitTest:
      type: object
      properties:
        expectedResult:
          type: boolean
          description: The expected result
        log:
          description: A test event object that your detection will receive as input.
        mocks:
          type: array
          items:
            $ref: '#/components/schemas/ScheduledRuleAPI.UnitTestMock'
          description: mocks
        name:
          type: string
          description: name
        resource:
          type: string
          description: A test event object that your detection will receive as input, JSON-encoded. Prefer `log`.
      required:
        - name
        - expectedResult
    ScheduledRuleAPI.UnitTestMock:
      type: object
      additionalProperties:
        type: string
    SimpleRuleAPI.BadRequestWithTestResultsErr:
      type: object
      properties:
        message:
          type: string
        testResults:
          type: array
          items:
            $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionRecord'
      required:
        - message
    SimpleRuleAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    SimpleRuleAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/SimpleRuleAPI.SimpleRule'
    SimpleRuleAPI.ModifyRule:
      type: object
      properties:
        alertContext:
          type: string
          description: The alert context represented in YAML
        alertTitle:
          type: string
          description: The alert title represented in YAML
        createAlert:
          type: boolean
          description: Determines whether the rule should create alerts when it triggers
        dedupPeriodMinutes:
          type: integer
          description: The amount of time in minutes for grouping alerts
          default: 60
          format: int64
          minimum: 1
        description:
          type: string
          description: The description of the rule
        detection:
          type: string
          description: The yaml representation of the rule
        displayName:
          type: string
          description: The display name of the rule
        dynamicSeverities:
          type: string
          description: The dynamic severity represented in YAML
        enabled:
          type: boolean
          description: Determines whether or not the rule is active
        groupBy:
          type: string
          description: The key on an event to group by represented in YAML
        id:
          type: string
          description: The id of the rule
        inlineFilters:
          type: string
          description: The filter for the rule represented in YAML
        logTypes:
          type: array
          items:
            type: string
          description: log types
        managed:
          type: boolean
          description: Determines if the simple rule is managed by panther
        outputIDs:
          type: array
          items:
            type: string
          description: Destination IDs that override default alert routing based on severity
        pythonBody:
          type: string
          description: The python body of the rule
        reference:
          type: string
          description: A URL or note for additional reference material
        reports:
          type: object
          description: reports
          additionalProperties:
            items:
              type: string
            type: array
        runbook:
          type: string
          description: How to handle the generated alert
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        summaryAttributes:
          type: array
          items:
            type: string
          description: A list of fields in the event to create top 5 summaries for
        tags:
          type: array
          items:
            type: string
          description: The tags for the simple rule
        tests:
          type: array
          items:
            $ref: '#/components/schemas/SimpleRuleAPI.UnitTest'
          description: Unit tests for the Rule. Best practice is to include a positive and negative case
        threshold:
          type: integer
          description: the number of events that must match before an alert is triggered
          default: 1
          format: int64
          minimum: 1
      required:
        - id
        - detection
        - severity
    SimpleRuleAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    SimpleRuleAPI.SimpleRule:
      type: object
      properties:
        alertContext:
          type: string
          description: The alert context represented in YAML
        alertTitle:
          type: string
          description: The alert title represented in YAML
        createAlert:
          type: boolean
          description: Determines whether the rule should create alerts when it triggers
        createdAt:
          type: string
        createdBy:
          type: object
          properties:
            id:
              type: string
              enum:
                - user
                - api-token
                - system
            type:
              type: string
          description: The actor who created the rule
        createdByExternal:
          type: string
          description: The text of the user-provided CreatedBy field when uploaded via CI/CD
        dedupPeriodMinutes:
          type: integer
          description: The amount of time in minutes for grouping alerts
          default: 60
          format: int64
          minimum: 1
        description:
          type: string
          description: The description of the rule
        detection:
          type: string
          description: The yaml representation of the rule
        displayName:
          type: string
          description: The display name of the rule
        dynamicSeverities:
          type: string
          description: The dynamic severity represented in YAML
        enabled:
          type: boolean
          description: Determines whether or not the rule is active
        groupBy:
          type: string
          description: The key on an event to group by represented in YAML
        id:
          type: string
          description: The id of the rule
        inlineFilters:
          type: string
          description: The filter for the rule represented in YAML
        lastModified:
          type: string
        logTypes:
          type: array
          items:
            type: string
          description: log types
        managed:
          type: boolean
          description: Determines if the simple rule is managed by panther
        outputIDs:
          type: array
          items:
            type: string
          description: Destination IDs that override default alert routing based on severity
        pythonBody:
          type: string
          description: The python body of the rule
        reference:
          type: string
          description: A URL or note for additional reference material
        reports:
          type: object
          description: reports
          additionalProperties:
            items:
              type: string
            type: array
        runbook:
          type: string
          description: How to handle the generated alert
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        summaryAttributes:
          type: array
          items:
            type: string
          description: A list of fields in the event to create top 5 summaries for
        tags:
          type: array
          items:
            type: string
          description: The tags for the simple rule
        tests:
          type: array
          items:
            $ref: '#/components/schemas/SimpleRuleAPI.UnitTest'
          description: Unit tests for the Rule. Best practice is to include a positive and negative case
        threshold:
          type: integer
          description: the number of events that must match before an alert is triggered
          default: 1
          format: int64
          minimum: 1
    SimpleRuleAPI.TestDetectionRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/SimpleRuleAPI.TestErr'
        errored:
          type: boolean
        functions:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionRecordFunctions'
        name:
          type: string
        passed:
          type: boolean
        triggerAlert:
          type: boolean
    SimpleRuleAPI.TestDetectionRecordFunctions:
      type: object
      properties:
        alertContext:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        dedup:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        description:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        destinations:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        detection:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        reference:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        runbook:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        severity:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        title:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
    SimpleRuleAPI.TestDetectionSubRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/SimpleRuleAPI.TestErr'
        output:
          type: string
    SimpleRuleAPI.TestErr:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
    SimpleRuleAPI.UnitTest:
      type: object
      properties:
        expectedResult:
          type: boolean
          description: The expected result
        log:
          description: A test event object that your detection will receive as input.
        mocks:
          type: array
          items:
            $ref: '#/components/schemas/SimpleRuleAPI.UnitTestMock'
          description: mocks
        name:
          type: string
          description: name
        resource:
          type: string
          description: A test event object that your detection will receive as input, JSON-encoded. Prefer `log`.
      required:
        - name
        - expectedResult
    SimpleRuleAPI.UnitTestMock:
      type: object
      additionalProperties:
        type: string
    UserAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    UserAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: Pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/UserAPI.User'
      required:
        - results
    UserAPI.ModifyUser:
      type: object
      properties:
        email:
          type: string
          description: The email address of the user
        familyName:
          type: string
          description: The family/last name of the user
        givenName:
          type: string
          description: The given/first name of the user
        role:
          $ref: '#/components/schemas/UserAPI.Role'
      required:
        - email
        - givenName
        - familyName
        - role
    UserAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    UserAPI.Role:
      type: object
      properties:
        id:
          type: string
          description: 'The id of the role. Note: id should be excluded if name is provided during a modify operation'
        name:
          type: string
          description: 'The name of the role. Note: name should be excluded if id is provided during a modify operation'
    UserAPI.User:
      type: object
      properties:
        createdAt:
          type: string
        email:
          type: string
          description: The email address of the user
        enabled:
          type: boolean
          description: Whether the user is active or deactivated
        familyName:
          type: string
          description: The family/last name of the user
        givenName:
          type: string
          description: The given/first name of the user
        id:
          type: string
          description: ID of the user
        lastLoggedInAt:
          type: string
        role:
          $ref: '#/components/schemas/UserAPI.Role'
        status:
          type: string
          description: The Cognito auth-related status of this User
      required:
        - email
        - givenName
        - familyName
        - role
        - enabled
    contexttagAPI.BadRequestError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    contexttagAPI.ContextTag:
      type: object
      properties:
        category:
          type: string
          description: The category of the tag
        managed:
          type: boolean
          description: Whether the tag is managed by Panther
        tag:
          type: string
          description: The tag value
          pattern: ^[a-z0-9_-]+$
          minLength: 1
          maxLength: 30
      description: A context tag that can be applied to alerts
      required:
        - tag
        - category
        - managed
    contexttagAPI.CreateContextTagReq:
      type: object
      properties:
        tag:
          type: string
          description: The tag value to create
          pattern: ^[a-z0-9_-]+$
          minLength: 1
          maxLength: 30
      description: Request to create a custom context tag
      required:
        - tag
    contexttagAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    contexttagAPI.ListContextTagsResp:
      type: object
      properties:
        next:
          type: string
          description: Pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/contexttagAPI.ContextTag'
          description: The list of context tags
      description: Response for listing context tags
      required:
        - results
    contexttagAPI.NotFoundError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    contexttagAPI.UpdateContextTagReq:
      type: object
      properties:
        tag:
          type: string
          description: The new tag value
          pattern: ^[a-z0-9_-]+$
          minLength: 1
          maxLength: 30
      description: Request to rename a custom context tag
      required:
        - tag
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      name: X-API-Key
      in: header
tags:
  - name: alert
    description: The alert api handles all operations for alerts
  - name: comment
    description: The comment api handles all operations for alerts comments
  - name: contexttag
    description: The context tag API handles all operations for alert context tags
  - name: aws cloud account
    description: The AWS Cloud Account API handles all operations for AWS Cloud Account scanner integrations
  - name: correlation rule
    description: The correlation rule api handles all operations for correlation rules
  - name: data model
    description: The data model api handles all operations for data models
  - name: global
    description: The global api handles all operations for globals
  - name: policy
    description: The policy api handles all operations for policies
  - name: query
    description: The query api handles operations for queries
  - name: rule
    description: The rule api handles all operations for rules
  - name: scheduled rule
    description: The scheduled rule api handles all operations for scheduled rules
  - name: simple rule
    description: The simple rule api handles all operations for simple rules
  - name: log source alarm
    description: Manage the drop-off alarm (SOURCE_NO_DATA) for log source integrations. Other alarm types shown in the Panther UI (permissions checks, classification failures, log-processing errors, scanning errors) are system-managed and not exposed via this API.
  - name: gcs source
    description: The GCS source API handles all operations for Google Cloud Storage log sources
  - name: http source
    description: The http source api handles all operations for http sources
  - name: log forwarder source
    description: The log forwarder source api handles all operations for log forwarder sources
  - name: pub/sub source
    description: The Pub/Sub source API handles all operations for GCP Pub/Sub log sources
  - name: s3 source
    description: The S3 source API handles all operations for AWS S3 log sources
  - name: api token
    description: The api token api handles all operations for api tokens
  - name: role
    description: The role api handles all operations for roles
  - name: user
    description: The user api handles all operations for users
security:
  - ApiKeyAuth: []
