{
"openapi": "3.0.2",
"x-hideTryItPanel": true,
"info": {
"contact": {
"email": "docs-cortex@paloaltonetworks.com",
"name": "Cortex Documentation Team"
},
"title": "Cortex Xpanse REST API",
"version": "2.12.0",
"description": "Using the Cortex Xpanse APIs, you can integrate Cortex Xpanse with third-party apps or services to ingest alerts, services, assets, and IP ranges and leverage investigation capabilities. The APIs allow you to manage incidents in a ticketing or automation system of your choice by reviewing and editing the incident's details, status, and assignee."
},
"servers": [
{
"url": "https://api-{{fqdn}}"
}
],
"tags": [
{
"name": "Asset Management",
"description": "APIs for managing assets"
},
{
"name": "Attack Surface Rules",
"description": "APIs for managing attack surface rules"
},
{
"name": "Audit Log",
"description": "APIs for audit logs"
},
{
"name": "Authentication Settings",
"description": "APIs for managing authentication"
},
{
"name": "Incident Management",
"description": "APIs for managing incidents"
},
{
"name": "Remediation Path Rules",
"description": "APIs for managing remediation path rules"
},
{
"name": "Remediation Scanning",
"description": "APIs for remediation scanning"
},
{
"name": "System Management",
"description": "APIs for managing system"
},
{
"name": "Tag Management",
"description": "APIs for managing tags"
},
{
"name": "Vulnerability Testing",
"description": "APIs for vulnerability testing"
}
],
"paths": {
"/public_api/v1/assets/get_assets_internet_exposure/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetAsmAssetsResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetAsmAssetsRequest"
},
"examples": {
"Filtering and sorting on name": {
"value": {
"request_data": {
"filters": [
{
"field": "name",
"operator": "in",
"value": "string"
}
],
"search_from": 0,
"search_to": 500,
"sort": {
"field": "name",
"keyword": "asc"
},
"use_page_token": true,
"next_page_token": "string"
}
}
},
"Filtering on last_observed with a range": {
"value": {
"request_data": {
"filters": [
{
"field": "last_observed",
"value": {
"from": "{{previous30Days}}",
"to": "{{previous7Days}}"
},
"operator": "range"
}
]
}
}
}
}
}
},
"description": ""
},
"summary": "Get All Assets",
"description": "Get a list of all your assets or a filtered list of your assets.
The maximum result limit is 5000 assets.
Required license: **Cortex Xpanse Expander**\n",
"tags": [
"Asset Management"
]
}
},
"/public_api/v1/assets/get_asset_internet_exposure/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetAsmAssetDetailsResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetAsmAssetDetailsRequest"
}
}
},
"description": ""
},
"summary": "Get Asset Details",
"description": "Get asset details according to the asset ID. You can send up to 20 IDs.
Required license: **Cortex Xpanse Expander**\n",
"tags": [
"Asset Management"
]
}
},
"/public_api/v1/assets/get_assets_internet_exposure/last_external_assessment/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetLastAssessmentResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/EmptyRequest"
}
}
}
},
"summary": "Get Assets Last Assessment",
"description": "Gets the time and status of the last update of assets data in Xpanse. A status of \"true\" indicates the assets data update was successful.",
"tags": [
"Asset Management"
]
}
},
"/public_api/v1/assets/get_external_ip_address_ranges/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetExternalIpAddressRangesResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetExternalIpAddressRangesRequest"
}
}
},
"description": ""
},
"summary": "Get All Owned IP Ranges",
"description": "Get a list of all your owned IP address ranges filtered by business units and organization handles.
The maximum result limit is 1000 ranges.
Note: You can send a request to retrieve either **all** or **filtered** results.
Required license: **Cortex Xpanse Expander**\n",
"tags": [
"Asset Management"
]
}
},
"/public_api/v1/assets/get_external_ip_address_range/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetExternalIpAddressRangeDetailsResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetExternalIpAddressRangeDetailsRequest"
}
}
},
"description": ""
},
"summary": "Get Owned IP Range Details",
"description": "Get external IP address range details according to the range IDs.
Required license: **Cortex Xpanse Expander**\n",
"tags": [
"Asset Management"
]
}
},
"/public_api/v1/assets/get_external_ip_address_ranges/last_external_assessment/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetLastAssessmentResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/EmptyRequest"
}
}
}
},
"summary": "Get IP Address Ranges Last Assessment",
"description": "Gets the time and status of the last update of ip address range data in Xpanse. A status of \"true\" indicates the ip address range data update was successful.",
"tags": [
"Asset Management"
]
}
},
"/public_api/v1/assets/get_external_services/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetServicesResponse"
},
"examples": {
"Request did not include \"vulnerability_test_results: True\" ": {
"value": {
"reply": {
"total_count": 1,
"result_count": 1,
"external_services": [
{
"service_id": "2b6da586-46ca-3804-bbba-e5b02d8e53bb",
"service_name": "Kerberos at x.x.x.x:88",
"service_type": "Kerberos",
"ip_address": [
"x.x.x.x"
],
"domain": [],
"externally_detected_providers": [
"On Prem"
],
"is_active": "Active",
"first_observed": 1710233760000,
"last_observed": 1711956600000,
"port": 88,
"protocol": "TCP",
"active_classifications": [
"Kerberos"
],
"inactive_classifications": [],
"discovery_type": "DirectlyDiscovered",
"externally_inferred_vulnerability_score": " ",
"externally_inferred_cves": [],
"tls_versions": [],
"inferred_cves_observed": [],
"cloud_management_status": "Not Applicable",
"tags": [
"AR:Registered to You",
"BU:Mustang UAT 8507355851529627158"
],
"vulnerability_test_status": "true",
"confirmed_vulnerable_cve_ids": [
"CVE-2019-3396",
"CVE-2022-26134",
"CVE-2021-26084"
],
"confirmed_not_vulnerable_cve_ids": [
"CVE-2021-26085"
],
"vulnerability_test_results": [],
"ipv6_address": [],
"asm_asset_ids": [
"0b3ea202-f3fc-3176-8b5d-791afe2c0bd0"
],
"geolocations": [
{
"latitude": 55.75,
"longitude": 37.58,
"countryCode": "RU",
"city": "MOSCOW",
"regionCode": "",
"timeZone": "null"
}
],
"business_units": [
[
{
"creation_time": 1712001753495,
"family": "business_units",
"family_alias": "BU",
"id": "BU:e9b79919-f6df-4723-af55-f080d5bf9e41",
"is_active": 1,
"name": "Mustang UAT 8507355851529627158",
"parent_id": null,
"update_time": 1712001753495
}
]
]
}
]
}
}
},
"Request included \"vulnerability_test_results: True\"": {
"value": {
"reply": {
"total_count": 1,
"result_count": 1,
"external_services": [
{
"service_id": "2b6da586-46ca-3804-bbba-e5b02d8e53bb",
"service_name": "Kerberos at x.x.x.x:88",
"service_type": "Kerberos",
"ip_address": [
"x.x.x.x"
],
"domain": [],
"externally_detected_providers": [
"On Prem"
],
"is_active": "Active",
"first_observed": 1710233760000,
"last_observed": 1711956600000,
"port": 88,
"protocol": "TCP",
"active_classifications": [
"Kerberos"
],
"inactive_classifications": [],
"discovery_type": "DirectlyDiscovered",
"externally_inferred_vulnerability_score": null,
"externally_inferred_cves": [],
"tls_versions": [],
"inferred_cves_observed": [],
"cloud_management_status": "Not Applicable",
"tags": [
"AR:Registered to You",
"BU:Mustang"
],
"vulnerability_test_status": true,
"confirmed_vulnerable_cve_ids": [
"CVE-2019-3396",
"CVE-2022-26134",
"CVE-2021-26084"
],
"confirmed_not_vulnerable_cve_ids": [
"CVE-2021-26085"
],
"vulnerability_test_results": [
{
"TEST_ID": "fa8641b1-8ade-42ad-9172-ad4433f33e0f",
"SERVICE_ID": "5c1df207-c8fe-33af-8f5f-c6853981a961",
"VULNERABILITY_STATUS": "ConfirmedPositive",
"EVIDENCE": "HTTP/1.1 200 \r\nConnection: close\r\nContent-Length: 63498\r\nAccept-Ranges: bytes\r\nCache-Control: max-age=31536000\r\nCache-Control: public\r\nContent-Type: text/html;charset=UTF-8\r\nDate: Thu, 07 Mar 2024 17:32:07 GMT\r\nEtag: W/\"63498-1702546562287\"\r\nExpires: Fri, 07 Mar 2025 17:32:07 GMT\r\nLast-Modified: Thu, 14 Dec 2023 09:36:02 GMT\r\nX-Asen: SEN-5546831\r\nX-Confluence-Request-Time: 1709832727267\r\n\r\n\n\n\n Confluence\n Confluence Web App\n \n\n \n contextConfigLocation\n com.atlassian.confluence.setup.ConfluenceAppConfig\n \n\n \n contextClass\n com.atlassian.confluence.setup.ConfluenceAnnotationConfigWebApplicationContext\n \n\n \n \n\n \n debug-before-request\n com.atlassian.confluence.web.filter.DebugFilter\n \n phase\n before\n \n \n dispatcher\n REQUEST\n \n \n \n debug...",
"SCAN_TIME": 1709832727000,
"NAME": "Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability",
"DESCRIPTION": "Atlassian Confluence Server, a widely used collaboration software, is affected by a security vulnerability identified as CVE-2021-26085. This vulnerability allows remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read in the /s/ endpoint.\n",
"REMEDIATION_GUIDANCE": "The exploitation of this vulnerability could lead to unauthorized access to sensitive information and restricted resources. To mitigate the risk, it is recommended to update Atlassian Confluence Server to one of the fixed versions:\n- 7.4.10\n- 7.12.3\n- 7.13.0\n- 7.14.0\n\nBy updating to a fixed version, you can protect your Confluence Server instance from potential unauthorized access and information exposure.\n",
"REFERENCES": [
"https://jira.atlassian.com/browse/CONFSERVER-67893"
],
"VULNERABILITY_IDS": [
"CVE-2021-26085"
],
"AFFECTED_SOFTWARE": [
{
"NAME": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
"VERSION_START_INCLUDING": null,
"VERSION_START_EXCLUDING": null,
"VERSION_END_INCLUDING": null,
"VERSION_END_EXCLUDING": "7.4.10"
},
{
"NAME": "cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*",
"VERSION_START_INCLUDING": "7.5.0",
"VERSION_START_EXCLUDING": null,
"VERSION_END_INCLUDING": null,
"VERSION_END_EXCLUDING": "7.12.3"
},
{
"NAME": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
"VERSION_START_INCLUDING": null,
"VERSION_START_EXCLUDING": null,
"VERSION_END_INCLUDING": null,
"VERSION_END_EXCLUDING": "7.4.10"
},
{
"NAME": "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*",
"VERSION_START_INCLUDING": "7.5.0",
"VERSION_START_EXCLUDING": null,
"VERSION_END_INCLUDING": null,
"VERSION_END_EXCLUDING": "7.12.3"
}
],
"SEVERITY_SCORE": 5.3,
"CVES": [
{
"cveId": "CVE-2021-26085",
"cvssScoreV2": 5,
"cveSeverityV2": "MEDIUM",
"cvssScoreV3": 5.3,
"cveSeverityV3": "MEDIUM",
"confirmedVulnerable": "ConfirmedPositive",
"epssScore": 0.96202
}
]
}
],
"ipv6_address": [],
"asm_asset_ids": [
"0b3ea202-f3fc-3176-8b5d-791afe2c0bd0"
],
"geolocations": [
{
"latitude": 55.75,
"longitude": 37.58,
"countryCode": "RU",
"city": "MOSCOW",
"regionCode": null,
"timeZone": null
}
],
"business_units": [
[
{
"creation_time": 1712001753495,
"family": "business_units",
"family_alias": "BU",
"id": "BU:e9b79919-f6df-4723-af55-f080d5bf9e41",
"is_active": 1,
"name": "Mustang UAT 8507355851529627158",
"parent_id": null,
"update_time": 1712001753495
}
]
]
}
]
}
}
}
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetServicesRequest"
},
"examples": {
"Filtering on service name": {
"value": {
"request_data": {
"filters": [
{
"field": "service_name",
"operator": "in",
"value": "string"
}
],
"search_from": 0,
"search_to": 500,
"sort": {
"field": "service_name",
"keyword": "asc"
},
"use_page_token": true,
"next_page_token": "string"
}
}
},
"Get attack surface testing results for all services": {
"value": {
"request_data": {
"vulnerability_test_results": true
}
}
},
"Filtering on last_observed": {
"value": {
"request_data": {
"filters": [
{
"field": "last_observed",
"value": "{{lookback7Days}}",
"operator": "relative_timestamp"
}
]
}
}
}
}
}
},
"description": ""
},
"summary": "Get All Services",
"description": "Get a complete or filtered list of all your external services.
The maximum result limit is 500.
Required License: **Cortex Xpanse Expander**\n",
"tags": [
"Asset Management"
]
}
},
"/public_api/v1/assets/get_external_service/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetServiceDetailsResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetServiceDetailsRequest"
}
}
},
"description": ""
},
"summary": "Get Service Details",
"description": "Get service details according to the service ID. You can send up to 20 IDs.
Required license: **Cortex Xpanse Expander**\n",
"tags": [
"Asset Management"
]
}
},
"/public_api/v1/assets/get_external_services/last_external_assessment/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetLastAssessmentResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/EmptyRequest"
}
}
}
},
"summary": "Get Services Last Assessment",
"description": "Gets the time and status of the last update of services data in Xpanse. A status of \"true\" indicates the service data update was successful.",
"tags": [
"Asset Management"
]
}
},
"/public_api/v1/assets/get_external_websites/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetWebsitesResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetWebsitesRequest"
},
"examples": {
"Example 1": {
"value": {
"request_data": {
"filters": [
{
"field": "ips",
"operator": "in",
"value": "string"
}
],
"search_from": 0,
"search_to": 500,
"sort": {
"field": "host",
"keyword": "asc"
},
"use_page_token": true,
"next_page_token": "string"
}
}
}
}
}
},
"description": ""
},
"summary": "Get All Websites",
"description": "Get a complete or filtered list of your public-facing websites.
Required License: **Cortex Xpanse Expander**\n",
"tags": [
"Asset Management"
]
}
},
"/public_api/v1/assets/get_external_website/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetWebsiteDetailsResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetWebsiteDetailsRequest"
}
}
}
},
"summary": "Get Website Details",
"description": "Get details about specific websites based on website IDs. You can submit up to 20 website IDs.
Required License: **Cortex Xpanse Expander**",
"tags": [
"Asset Management"
]
}
},
"/public_api/v1/assets/get_external_websites/last_external_assessment/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetLastAssessmentResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/EmptyRequest"
}
}
}
},
"summary": "Get Websites Last Assessment",
"description": "Gets the time and status of the last update of websites data in Xpanse. A status of \"true\" indicates the websites data update was successful.",
"tags": [
"Asset Management"
]
}
},
"/public_api/v1/assets/get_business_units": {
"post": {
"summary": "Get Business Units",
"tags": [
"Asset Management"
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"type": "object",
"x-examples": {
"Example 1": {
"reply": {
"total_count": 1,
"result_count": 1,
"business_units": [
{
"business_unit_id": "d98e5499-4574-4b7e-9735-123456123456",
"business_unit_name": "PAPI Improvements",
"parent_id": null
}
]
}
}
},
"properties": {
"reply": {
"type": "object",
"properties": {
"total_count": {
"type": "integer"
},
"result_count": {
"type": "integer"
},
"business_units": {
"type": "array",
"items": {
"type": "object",
"properties": {
"business_unit_id": {
"type": "string"
},
"business_unit_name": {
"type": "string"
},
"parent_id": {
"type": "string",
"nullable": true
}
}
}
}
}
}
}
},
"examples": {
"Example 1": {
"value": {
"reply": {
"total_count": 0,
"result_count": 0,
"business_units": [
{
"business_unit_id": "string",
"business_unit_name": "string",
"parent_id": "string"
}
]
}
}
}
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON."
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"type": "object",
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"type": "object",
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"type": "object",
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"description": "Unprocessable Entity ",
"content": {
"application/json": {
"schema": {
"type": "object",
"$ref": "#/components/schemas/Error"
}
}
}
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"type": "object",
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"operationId": "post-public_api-v1-assets-get_business_units",
"description": "Fetches business unit information for all or a subset of the business units in your Cortex Xpanse tenant. The results are sorted by business_unit_name.",
"parameters": [
{
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"in": "header",
"name": "authorization",
"description": "api-key",
"required": true
},
{
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"required": true
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"x-examples": {
"Example 1": {
"request_data": {
"filters": [
{
"field": "business_unit_name",
"value": "{{businessUnitName}}",
"operator": "eq"
}
]
}
}
},
"required": [
"request_data"
],
"properties": {
"request_data": {
"type": "object",
"description": "A dictionary containing the API request fields. An empty dictionary returns all results.",
"properties": {
"filters": {
"type": "array",
"description": "An array of filter fields.",
"items": {
"type": "object",
"properties": {
"field": {
"enum": [
"business_unit_id",
"business_unit_name",
"parent_id"
],
"description": "Identifies the business unit field the filter is matching. "
},
"operator": {
"enum": [
"contains",
"eq",
"in",
"neq",
"not_contains"
],
"description": "Identifies the comparison operator you want to use for this filter. All operators listed can be used with all filter fields."
},
"value": {
"type": "string",
"description": "Value depends on the filter field used.\r\n- **business_unit_id**: string\r\n- **business_unit_name**: string\r\n- **parent_id**: string"
}
}
}
},
"use_page_token": {
"type": "boolean",
"description": "Use `\"use_page_token\":true` in the initial request to paginate the response data.\r\n"
},
"next_page_token": {
"type": "string",
"description": "If `\"use_page_token\":true` was included in the initial request, the response for that request will include a page token.
Use `\"next_page_token\":\"string\"` to pass that page token into the next request to paginate the next set of data.'\r\n"
}
}
}
}
},
"examples": {
"Example 1": {
"value": {
"request_data": {
"filters": [
{
"field": "business_unit_id",
"operator": "contains",
"value": "string"
}
],
"use_page_token": true,
"next_page_token": "string"
}
}
}
}
}
}
}
}
},
"/public_api/v1/assets/override_bu_tags/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/AssignTagsToAsmEntitiesResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/OverrideBusForAsmAssetsRequest"
}
}
}
},
"summary": "Override Business Units for Assets",
"tags": [
"Asset Management"
]
}
},
"/public_api/v1/get_attack_surface_rules/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetAttackSurfaceRulesResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetAttackSurfaceRulesRequest"
}
}
},
"description": ""
},
"summary": "Get All Attack Surface Rules",
"tags": [
"Attack Surface Rules"
],
"description": "Get all or a subset of attack surface rules.
Required License: **Cortex Xpanse Expander**\n"
}
},
"/public_api/v1/assets/assets_internet_exposure/annotation/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/UpdateAsmAssetNoteResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/UpdateAsmAssetNoteRequest"
}
}
}
},
"summary": "Update Asset Annotation",
"description": "Adds an annotation (also called a note) to an asset or IP range. If an asset or IP range has an existing annotation, you can append a new annotation to the existing annotation or replace the existing annotation with a new one.
Required License: **Cortex Xpanse Expander**\n",
"tags": [
"Asset Management"
]
}
},
"/public_api/v1/audits/management_logs/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetManagementLogsResponseApi"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetManagementLogsRequestApi"
}
}
},
"description": "Note: You can send a request to retrieve either **all** or **filtered** results."
},
"summary": "Get Audit Management Log",
"tags": [
"Audit Log"
],
"description": "Get audit management logs.
- Response is concatenated using AND condition (OR is not supported).
- Maximum result set size is 100.
- Offset is the zero-based number of incidents from the start of the result set.\n"
}
},
"/public_api/v2/alerts/get_alerts_multi_events/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetAlertsMultiEventsResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetAlertsMultiEventsRequest"
},
"examples": {
"Filtering by business_unit_list and sorting by creation_time": {
"value": {
"request_data": {
"filters": [
{
"field": "business_units_list",
"operator": "gte",
"value": "string"
}
],
"search_from": 0,
"search_to": 100,
"sort": {
"field": "creation_time",
"keyword": "desc"
},
"use_page_token": true,
"next_page_token": "string"
}
}
},
"Filtering by last_observed": {
"value": {
"request_data": {
"filters": [
{
"field": "last_observed",
"value": {
"from": "{{previous30Days}}",
"to": "{{previous7Days}}"
},
"operator": "range"
}
]
}
}
}
}
}
},
"description": "If no parameters are included, all results will be returned."
},
"summary": "Get Alerts",
"description": "Get a single alert or list of alerts with multiple events.\n - Response is concatenated using AND condition (OR is not supported).\n - Maximum result set size is 100.\n - Offset is the zero-based number of alerts from the start of the result set.\n\n
Note: You can send a request to retrieve all or filtered results.
Required license: **Cortex Xpanse Expander**\n",
"tags": [
"Incident Management"
]
}
},
"/public_api/v1/incidents/get_incidents/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetIncidentsResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetIncidentsRequest"
}
}
},
"description": "If no parameters are included, all results will be returned."
},
"summary": "Get Incidents",
"description": "Get details for a single incident or a list of incidents filtered by a list of severity or creation time. - The response is concatenated using AND condition (OR is not supported).
- The maximum result set size is >100.
- Offset is the zero-based number of incidents from the start of the result set.
Note: You can send a request to retrieve either **all** or **filtered** results.
Required license: **Cortex Xpanse Expander**
\n",
"tags": [
"Incident Management"
]
}
},
"/public_api/v1/incidents/get_incident_extra_data/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetIncidentExtraDataResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"429": {
"description": "Exceeded 10 requests in a 60-second window.\r\n\r\nIf you get this response, wait 60 seconds and retry your request. \r\n"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetIncidentExtraDataRequest"
}
}
}
},
"summary": "Get Extra Incident Data",
"description": "Get extra data fields for a specific incident including alerts and key artifacts.\n\nNote: The API includes a limit rate of 10 API requests per minute.\n\nRequired license: Cortex Xpanse Expander\n",
"tags": [
"Incident Management"
]
}
},
"/public_api/v1/alerts/update_alerts/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/UpdateAlertsResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/UpdateAlertsRequestData"
}
}
},
"description": ""
},
"summary": "Update Alerts",
"description": "Update one or more alerts. You can update up to 100 alerts per request. Missing fields are ignored.
Required license: **Cortex Xpanse Expander**\n",
"tags": [
"Incident Management"
]
}
},
"/public_api/v1/incidents/update_incident/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/UpdateIncidentResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/UpdateIncidentRequest"
}
}
},
"description": ""
},
"summary": "Update an Incident",
"description": "Update one or more fields of a specific incident. Missing fields are ignored.
Note the following:\n - `assigned_user_mail` field is validated by Cortex Xpanse to confirm the provided assignee email address belongs to a user that exists in the same Cortex Xpanse tenant.\n - To unassign an incident pass `none` or `”assigned_user_mail”: “”`.\n - To remove a manually set severity pass `none` or `“manual_severity”: “”`.\n",
"tags": [
"Incident Management"
]
}
},
"/public_api/v1/xpanse_remediation_rules/rules/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetRemediationRulesResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetRemediationRulesRequest"
}
}
},
"description": ""
},
"summary": "Get remediation path rules",
"description": "Get the list of the remediation path rules associated with an attack surface rule.
Required License: Cortex Xpanse Expander + Active Response Module Add-On\n",
"tags": [
"Remediation Path Rules"
]
}
},
"/public_api/v1/remediation_confirmation_scanning/requests/get_or_create/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "A 200 response is returned for a scan that already exists.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetOrCreateRemediationScanResponse"
}
}
}
},
"201": {
"description": "A 201 response is sent for a new scan request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetOrCreateRemediationScanResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetOrCreateRemediationScanRequest"
},
"examples": {
"Example 1": {
"value": {
"request_data": {
"filters": [
{
"field": "attack_surface_rule_id",
"operator": "EQ",
"value": "string"
},
{
"field": "alert_internal_id",
"operator": "EQ",
"value": "345487"
},
{
"field": "service_id",
"operator": "EQ",
"value": "cc550f1b-68a4-123d-456e-12345678910f"
}
]
}
}
}
}
}
},
"description": "All three filters must be included in the request. \r\n- **attack_surface_rule_id** -- **eq** -- *string*\r\n- **alert_internal_id** -- **eq** -- *integer*\r\n- **service_id** -- **eq** -- *string*"
},
"summary": "Get or Create an RCS request",
"description": "Get or create a remediation confirmation scanning request.",
"tags": [
"Remediation Scanning"
]
}
},
"/public_api/v1/remediation_confirmation_scanning/requests/get/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/PollRemediationScanResultsResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/PollRemediationScanResultsRequest"
}
}
}
},
"summary": "Poll an RCS Request",
"description": "Check the status of a remediation confirmation scan.",
"tags": [
"Remediation Scanning"
]
}
},
"/public_api/v1/rbac/get_roles/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetRolesResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetRolesRequest"
}
}
}
},
"summary": "Get Roles",
"tags": [
"System Management"
],
"description": "Retrieve information about one or more roles created in your environment.
Required license: **Cortex Xpanse Expander**\n"
}
},
"/public_api/v1/system/get_tenant_info/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetTenantLicenseInfoResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"summary": "Get Tenant Info",
"tags": [
"System Management"
],
"description": "Get your tenant license information.
Required license: **Cortex Xpanse Expander**\n"
}
},
"/public_api/v1/rbac/get_user_group/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetUserGroupsResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetUserGroupsRequest"
}
}
}
},
"summary": "Get User Groups",
"tags": [
"System Management"
],
"description": "Retrieve a list of the current user emails associated with one or more user groups in your environment.
Required license: **Cortex Xpanse Expander**\n"
}
},
"/public_api/v1/rbac/get_users/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetUsersResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"summary": "Get Users",
"tags": [
"System Management"
],
"description": "Retrieve a list of the current users in your environment.
Required license: **Cortex Xpanse Expander**\n"
}
},
"/public_api/v1/rbac/set_user_role/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SetUserRoleResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/SetUserRoleRequest"
}
}
}
},
"summary": "Set a User role",
"tags": [
"System Management"
],
"description": "Add or remove one or more users from a role.
Required license: **Cortex Xpanse Expander**\n"
}
},
"/public_api/v1/authentication-settings/create": {
"post": {
"summary": "Create authentication settings for IdP SSO or metadata URL",
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"reply": {
"type": "boolean"
}
},
"x-examples": {
"Example 1": {
"reply": true
}
}
},
"examples": {
"Example 1": {
"value": {
"reply": true
}
}
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
}
},
"operationId": "post-public_api-v1-authentication-settings-create",
"parameters": [
{
"schema": {
"type": "string"
},
"in": "header",
"name": "Authorization",
"description": "{api_key}",
"required": true
},
{
"schema": {
"type": "string"
},
"in": "header",
"name": "x-xdr-auth-id",
"description": "{api_key_id}",
"required": true
}
],
"description": "Create authentication settings for IdP SSO or metadata URL. You must include either the `metadata_url` field or all of the following fields: `idp_sso_url`, `idp_issuer`, and `idp_certificate`.\n\nYou must have **Instance Administrator** permissions to run this endpoint.",
"tags": [
"Authentication settings"
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"x-examples": {
"Example 1": {
"request_data": {
"name": "str",
"default_role": "",
"is_account_role": false,
"domain": " ",
"mappings": {
"email": "str",
"firstname": "str",
"lastname": "str",
"group_name": "str"
},
"advanced_settings": {
"relay_state": " ",
"idp_single_logout_url": " ",
"service_provider_public_cert": " ",
"service_provider_private_key": " ",
"authn_context_enabled": " ",
"force_authn": false
},
"idp_sso_url": " ",
"idp_certificate": " ",
"idp_issuer": " ",
"metadata_url": " "
}
}
},
"required": [
"request_data"
],
"properties": {
"request_data": {
"type": "object",
"required": [
"name",
"mappings"
],
"properties": {
"name": {
"type": "string",
"description": "The name of the SSO integration."
},
"default_role": {
"type": "string",
"description": "The default role automatically assigned to every user who authenticates to Cortex using SAML. This is an inherited role and is not the same as a direct role assigned to the user.\n\nIf a role with the same name exists on both Cortex Gateway and the tenant, the role will mapped to the role from the tenant. If you want to use specifically the role from Cortex Gateway, use the `is_account_role` parameter set to `true`."
},
"is_account_role": {
"type": "boolean",
"default": false,
"description": "Whether the role was created in Cortex Gateway or in the tenant. When the value is `true`, the role was created in Cortex Gateway."
},
"domain": {
"type": "string",
"description": "When configuring the first SSO, this parameter should be included as empty because it is the default SSO and has a fixed, read-only value. \nFor additional SSOs, specify this IdP with an email domain (user@). When logging in, users are redirected to the IdP associated with their email domain or to the default IdP if no association exists."
},
"mappings": {
"type": "object",
"description": "These IdP attribute mappings are dependent on your organization’s IdP.",
"required": [
"email",
"firstname",
"lastname",
"group_name"
],
"properties": {
"email": {
"type": "string",
"description": "The IdP attribute mapped to the user's email address in the Syslog server."
},
"firstname": {
"type": "string",
"description": "The IdP attribute mapped to the user's first name."
},
"lastname": {
"type": "string",
"description": "The IdP attribute mapped to the user's last name."
},
"group_name": {
"type": "string",
"description": "The IdP attribute mapped to the user's group membership for authorization.\n\n**Note:** Cortex requires the IdP to send the group membership as part of the SAML token. Some IdPs send values in a format that include a comma, which is not compatible with Cortex. In that case, you must configure your IdP to send a single value without a comma for each group membership. For example, if your IdP sends the Group DN (a comma-separated list), by default, you must configure IdP to send the Group CN (Common Name) instead."
}
}
},
"advanced_settings": {
"type": "object",
"description": "The advanced settings are optional to configure and some are specific for a particular IdP.",
"properties": {
"relay_state": {
"type": "string",
"description": "The URL for a specific page that you want users to be directed to after they've been authenticated by your organization's IdP and log in to Cortex."
},
"idp_single_logout_url": {
"type": "string",
"description": "The URL of the IdP's Single Logout endpoint. This ensures that when a user initiates a logout from Cortex, the identity provider logs the user out of all applications in the current identity provider login session."
},
"service_provider_public_cert": {
"type": "string",
"description": "The Syslog server's public X.509 certificate in PEM format for IdP validation."
},
"service_provider_private_key": {
"type": "string",
"description": "The Syslog server's private key in PEM format for signing SAML responses. (This is mostly required for ADFS)"
},
"authn_context_enabled": {
"type": "boolean",
"default": false,
"description": "Whether to remove the `RequestedAuthnContext` parameter from SAML requests.\nIf `true`, allows users to log in by using additional authentication methods."
},
"force_authn": {
"type": "boolean",
"default": false,
"description": "Whether to force users to reauthenticate to access the Cortex tenant if requested by the IdP, even if they already authenticated to access other applications."
}
}
},
"idp_sso_url": {
"type": "string",
"description": "The login URL of your IdP and should be copied from your SAML integration configuration on the IdP.\nFor example:\n- Okta: https://cortex-test.okta.com/app/cortex-test/eacbt6b2jj08CasdUQ7sdf15d7/sso/SAML\n- Microsoft Azure: https://login.microsoftonline.com/6a5a9780-96a4-41ef-bf45-0535d8a70025/saml2"
},
"idp_certificate": {
"type": "string",
"description": "The Idp's public X.509 digital certificate in PEM format for verification, which is copied from your organization's IdP."
},
"idp_issuer": {
"type": "string",
"description": "The unique identifier of the IdP issuing SAML assertions, which is copied from your organization's IdP."
},
"metadata_url": {
"type": "string",
"description": "The metadata URL provides information about hte IdP's capabilities, endpoints, keys, and more. \nFor example: \n- Okta: https://cortex-test.okta.com/app/exkbuuzw77Bh04V6M6b8/sso/saml/metadata\n- Microsoft Azure: https://login.microsoftonline.com/6a5a9780-96a4-41ef-bf45-0535d8a70025/saml2/metadata"
}
}
}
}
},
"examples": {
"Example 1": {
"value": {
"request_data": {
"name": "IdP configuration",
"default_role": "Analyst",
"domain": "my-test-domain.com",
"mappings": {
"email": "user@company.com",
"firstname": "John",
"lastname": "Smith",
"group_name": "analysts"
},
"idp_sso_url": "https://cortex-test.okta.com/app/cortex-test/xxxxxxx/sso/SAML",
"idp_certificate": "MY_CERTIFICATE_FROM_OKTA",
"idp_issuer": "https://cortex-test.okta.com/idp",
"advanced_settings": {},
"is_account_role": true
}
}
}
}
}
}
}
},
"parameters": []
},
"/public_api/v1/authentication-settings/update": {
"post": {
"summary": "Update authentication settings",
"tags": [
"Authentication settings"
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"x-examples": {
"Example 1": {
"request_data": {
"name": "str",
"default_role": "",
"is_account_role": false,
"domain": " ",
"mappings": {
"email": "str",
"firstname": "str",
"lastname": "str",
"group_name": "str"
},
"advanced_settings": {
"relay_state": " ",
"idp_single_logout_url": " ",
"service_provider_public_cert": " ",
"service_provider_private_key": " ",
"authn_context_enabled": " ",
"force_authn": false
},
"idp_sso_url": " ",
"idp_certificate": " ",
"idp_issuer": " ",
"metadata_url": " "
}
}
},
"required": [
"request_data"
],
"properties": {
"request_data": {
"type": "object",
"required": [
"name",
"mappings"
],
"properties": {
"name": {
"type": "string",
"description": "The name of the SSO integration."
},
"default_role": {
"type": "string",
"description": "The default role automatically assigned to every user who authenticates to Cortex using SAML. This is an inherited role and is not the same as a direct role assigned to the user.\n\nIf a role with the same name exists on both Cortex Gateway and the tenant, the role will mapped to the role from the tenant. If you want to use specifically the role from Cortex Gateway, use the `is_account_role` parameter set to `true`."
},
"is_account_role": {
"type": "boolean",
"default": false,
"description": "Whether the role was created in Cortex Gateway or in the tenant. When the value is `true`, the role was created in Cortex Gateway."
},
"current_domain_value": {
"type": "string",
"description": "The domain whose authentication settings you want to update."
},
"new_domain_value": {
"type": "string",
"description": "If you want to update the domain value, include a new unique domain."
},
"mappings": {
"type": "object",
"description": "These IdP attribute mappings are dependent on your organization's IdP.",
"required": [
"email",
"firstname",
"lastname",
"group_name"
],
"properties": {
"email": {
"type": "string",
"description": "The IdP attribute mapped to the user's email address in the Syslog server."
},
"firstname": {
"type": "string",
"description": "The IdP attribute mapped to the user's first name."
},
"lastname": {
"type": "string",
"description": "The IdP attribute mapped to the user's last name."
},
"group_name": {
"type": "string",
"description": "The IdP attribute mapped to the user's group membership for authorization.\n\n**Note:** Cortex requires the IdP to send the group membership as part of the SAML token. Some IdPs send values in a format that include a comma, which is not compatible with Cortex. In that case, you must configure your IdP to send a single value without a comma for each group membership. For example, if your IdP sends the Group DN (a comma-separated list), by default, you must configure IdP to send the Group CN (Common Name) instead."
}
}
},
"advanced_settings": {
"type": "object",
"description": "The advanced settings are optional to configure and some are specific for a particular IdP.",
"properties": {
"relay_state": {
"type": "string",
"description": "The URL for a specific page that you want users to be directed to after they've been authenticated by your organization's IdP and log in to Cortex."
},
"idp_single_logout_url": {
"type": "string",
"description": "The URL of the IdP's Single Logout endpoint. This ensures that when a user initiates a logout from Cortex, the identity provider logs the user out of all applications in the current identity provider login session."
},
"service_provider_public_cert": {
"type": "string",
"description": "The Syslog server's public X.509 certificate in PEM format for IdP validation."
},
"service_provider_private_key": {
"type": "string",
"description": "The Syslog server's private key in PEM format for signing SAML responses. (This is mostly required for ADFS)"
},
"authn_context_enabled": {
"type": "boolean",
"default": false,
"description": "Whether to remove the `RequestedAuthnContext` parameter from SAML requests.\nIf `true`, allows users to log in by using additional authentication methods."
},
"force_authn": {
"type": "boolean",
"default": false,
"description": "Whether to force users to reauthenticate to access the Cortex tenant if requested by the IdP, even if they already authenticated to access other applications."
}
}
},
"idp_sso_url": {
"type": "string",
"description": "The URL of your IdP's SSO, which is a fixed, read-only value based on your tenant's URL. If you are using this parameter, you must also specify: `idp_certificate` and `idp_issuer`."
},
"idp_certificate": {
"type": "string",
"description": "The Idp's public X.509 digital certificate in PEM format for verification, which is copied from your organization's IdP."
},
"idp_issuer": {
"type": "string",
"description": "The unique identifier of the IdP issuing SAML assertions, which is copied from your organization's IdP."
},
"metadata_url": {
"type": "string",
"description": "Specify your IdP SSO URL, which is a fixed, read-only value based on your tenant's URL."
}
}
}
}
},
"examples": {
"Example 1": {
"value": {
"request_data": {
"name": "IDP configuration",
"default_role": "Analyst",
"current_domain_value": "my-test-domain.com",
"new_domain_value": "my-test-domain.org",
"mappings": {
"email": "user@company.com",
"firstname": "John",
"lastname": "Smith",
"group_name": "analysts"
},
"idp_sso_url": "https://cortex-test.okta.com/app/cortex-test/xxxxxxx/sso/SAML",
"idp_certificate": "========MY_UPDATED_TEST_CERTIFICATE_FROM_OKTA======",
"idp_issuer": "https://cortex-test.okta.com/idp",
"advanced_settings": {},
"is_account_role": true
}
}
}
}
}
}
},
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"reply": {
"type": "boolean"
}
},
"x-examples": {
"Example 1": {
"reply": true
}
}
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
}
},
"operationId": "post-public_api-v1-authentication-settings-update",
"parameters": [
{
"schema": {
"type": "string"
},
"in": "header",
"name": "Authorization",
"description": "{api_key}",
"required": true
},
{
"schema": {
"type": "string"
},
"in": "header",
"name": "x-xdr-auth-id",
"description": "{api_key_id}",
"required": true
}
],
"description": "Update existing authentication settings. To update the default domain, include empty value for both `current_domain_value` and `new_domain_value`.\n\nYou must have **Instance Administrator** permissions to run this endpoint."
},
"parameters": []
},
"/public_api/v1/authentication-settings/delete": {
"post": {
"summary": "Delete authentication settings by domain",
"tags": [
"Authentication settings"
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"reply": {
"type": "boolean"
}
},
"x-examples": {
"Example 1": {
"reply": true
}
}
},
"examples": {
"Example 1": {
"value": {
"reply": true
}
}
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
}
},
"operationId": "post-public_api-v1-authentication-settings-delete",
"parameters": [
{
"schema": {
"type": "string"
},
"in": "header",
"name": "Authorization",
"description": "{api_key}",
"required": true
},
{
"schema": {
"type": "string"
},
"in": "header",
"name": "x-xdr-auth-id",
"description": "{api_key_id}",
"required": true
}
],
"description": "Delete all authentication settings for the specified domain. \n\n**Note: ** The first configuration on the tenant is the default configuration and cannot be deleted.\n\nYou must have **Instance Administrator** permissions to run this endpoint.",
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"x-examples": {
"Example 1": {
"request_data": {
"domain": "str"
}
}
},
"properties": {
"request_data": {
"type": "object",
"properties": {
"domain": {
"type": "string",
"description": "The domain whose authentication settings you want to delete."
}
}
}
}
},
"examples": {
"Example 1": {
"value": {
"request_data": {
"domain": "my-test-domain.org"
}
}
}
}
}
}
}
}
},
"/public_api/v1/authentication-settings/get/settings": {
"post": {
"summary": "Get authentication settings for all configured domains",
"tags": [
"Authentication settings"
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"type": "object",
"x-examples": {
"Example 1": {
"reply": [
{
"tenant_id": "9949042437653",
"name": "SSO Integration",
"domain": "",
"idp_enabled": true,
"default_role": null,
"is_account_role": null,
"idp_certificate": "certificate",
"idp_issuer": "http://test.com",
"idp_sso_url": "http://test.com/",
"metadata_url": "",
"mappings": {
"email": "user@company.com",
"firstname": "John",
"group_name": "Users",
"lastname": "Smith"
},
"advanced_settings": {
"authn_context_enabled": false,
"force_authn": false,
"idp_single_logout_url": "",
"relay_state": "",
"service_provider_private_key": "",
"service_provider_public_cert": ""
},
"sp_entity_id": "https://tenant.cortex.us.paloaltonetworks.com",
"sp_logout_url": "https://tenant.cortex.us.paloaltonetworks.com/idp/logout",
"sp_url": "https://tenant.cortex.us.paloaltonetworks.com/idp/saml"
}
]
}
},
"properties": {
"reply": {
"type": "array",
"items": {
"type": "object",
"properties": {
"tenant_id": {
"type": "string"
},
"name": {
"type": "string"
},
"domain": {
"type": "string"
},
"idp_enabled": {
"type": "boolean"
},
"default_role": {
"type": "string"
},
"is_account_role": {
"type": "boolean",
"nullable": true
},
"idp_certificate": {
"type": "string"
},
"idp_issuer": {
"type": "string"
},
"idp_sso_url": {
"type": "string"
},
"metadata_url": {
"type": "string"
},
"mappings": {
"type": "object",
"properties": {
"email": {
"type": "string"
},
"firstname": {
"type": "string"
},
"group_name": {
"type": "string"
},
"lastname": {
"type": "string"
}
}
},
"advanced_settings": {
"type": "object",
"properties": {
"authn_context_enabled": {
"type": "boolean"
},
"force_authn": {
"nullable": true
},
"idp_single_logout_url": {
"type": "string"
},
"relay_state": {
"type": "string"
},
"service_provider_private_key": {
"type": "string"
},
"service_provider_public_cert": {
"type": "string"
}
}
},
"sp_entity_id": {
"type": "string"
},
"sp_logout_url": {
"type": "string"
},
"sp_url": {
"type": "string"
}
}
}
}
}
},
"examples": {
"Example 1": {
"value": {
"reply": [
{
"tenant_id": "9949042437653",
"name": "SSO Integration",
"domain": "",
"idp_enabled": true,
"default_role": null,
"is_account_role": null,
"idp_certificate": "certificate",
"idp_issuer": "http://test.com",
"idp_sso_url": "http://test.com/",
"metadata_url": "",
"mappings": {
"email": "user@company.com",
"firstname": "John",
"group_name": "Users",
"lastname": "Smith"
},
"advanced_settings": {
"authn_context_enabled": false,
"force_authn": false,
"idp_single_logout_url": "",
"relay_state": "",
"service_provider_private_key": "",
"service_provider_public_cert": ""
},
"sp_entity_id": "https://tenant.cortex.us.paloaltonetworks.com",
"sp_logout_url": "https://tenant.cortex.us.paloaltonetworks.com/idp/logout",
"sp_url": "https://tenant.cortex.us.paloaltonetworks.com/idp/saml"
}
]
}
}
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
}
},
"operationId": "post-public_api-v1-authentication-settings-get-settings",
"parameters": [
{
"schema": {
"type": "string"
},
"in": "header",
"name": "Authorization",
"description": "{api_key}",
"required": true
},
{
"schema": {
"type": "string"
},
"in": "header",
"name": "x-xdr-auth-id",
"description": "{api_key_id}",
"required": true
}
],
"description": "Get all the authentication settings for every configured domain in the tenant.\n\nYou must have **Instance Administrator** permissions to run this endpoint.\n",
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"request_data": {
"type": "object",
"properties": {}
}
},
"x-examples": {
"Example 1": {
"request_data": {}
}
}
}
}
}
}
}
},
"/public_api/v1/authentication-settings/get/metadata": {
"post": {
"summary": "Get IdP metadata",
"tags": [
"Authentication settings"
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"type": "object",
"x-examples": {
"Example 1": {
"reply": {
"sp_entity_id": "",
"Sp_logout_url": "",
"sp_url": "",
"tenant_id": ""
}
}
},
"properties": {
"reply": {
"type": "object",
"properties": {
"sp_entity_id": {
"type": "string"
},
"sp_logout_url": {
"type": "string"
},
"sp_url": {
"type": "string"
},
"tenant_id": {
"type": "string"
}
}
}
}
},
"examples": {
"Example 1": {
"value": {
"reply": {
"sp_entity_id": "https://tenant.cortex.us.paloaltonetworks.com",
"sp_logout_url": "https://tenant.cortex.us.paloaltonetworks.com/idp/logout",
"sp_url": "https://tenant.cortex.us.paloaltonetworks.com/idp/saml",
"tenant_id": "9949042437653"
}
}
}
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/reply"
}
}
}
}
},
"operationId": "post-public_api-v1-authentication-settings-get-metadata",
"parameters": [
{
"schema": {
"type": "string"
},
"in": "header",
"name": "Authorization",
"description": "{api_key}",
"required": true
},
{
"schema": {
"type": "string"
},
"in": "header",
"name": "x-xdr-auth-id",
"description": "{api_key_id}",
"required": true
}
],
"description": "Get the metadata for all IdPs.\n\nYou must have **Instance Administrator** permissions to run this endpoint.",
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"request_data": {
"type": "object",
"properties": {}
}
},
"x-examples": {
"Example 1": {
"request_data": {}
}
}
}
}
}
}
}
},
"/public_api/v1/assets/tags/assets_internet_exposure/assign/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/AssignTagsToAsmEntitiesResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/AssignOrRemoveTagsFromAsmAssetsRequest"
}
}
},
"description": ""
},
"summary": "Add Tags to Assets",
"tags": [
"Tag Management"
],
"description": "Add tags in bulk to a set of assets."
}
},
"/public_api/v1/assets/tags/external_ip_address_ranges/assign/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/AssignTagsToAsmEntitiesResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/AssignOrRemoveTagsFromIpRangesRequest"
}
}
},
"description": ""
},
"summary": "Add Tags to IP Address Ranges",
"tags": [
"Tag Management"
],
"description": "Add tags in bulk to owned IP ranges."
}
},
"/public_api/v1/assets/create_asset_tag_rules/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/CreateTagRulesForIpRangesResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/CreateTagRulesForIpRangesRequest"
}
}
}
},
"summary": "Create Asset Tag Rules",
"description": "Create tag rules that apply tags automatically to assets that match your rule criteria, including any new assets that are attributed to your organization. Tag rules can be defined for IPv4 addresses and IPv4 ranges. These fields can be the same to denote a single IP address. If the list of IP addresses exceeds 100, Expander will create multiple tag rules, each with at most 100 IP addresses per rule.
Required License: Cortex Xpanse Expander\n",
"tags": [
"Tag Management"
]
}
},
"/public_api/v1/assets/tags/assets_internet_exposure/remove/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/RemoveTagsFromAsmEntitiesResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/AssignOrRemoveTagsFromAsmAssetsRequest"
}
}
},
"description": ""
},
"summary": "Remove Tags from Assets",
"tags": [
"Tag Management"
],
"description": "Remove tags in bulk from a set of assets."
}
},
"/public_api/v1/assets/tags/external_ip_address_ranges/remove/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/RemoveTagsFromAsmEntitiesResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/AssignOrRemoveTagsFromIpRangesRequest"
}
}
}
},
"summary": "Remove Tags from IP Address Ranges",
"tags": [
"Tag Management"
],
"description": "Remove tags in bulk from a set of IP address ranges."
}
},
"/public_api/v1/assets/bulk_update_vulnerability_tests/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/UpdateVulnerabilityTestsResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/UpdateVulnerabilityTestsRequest"
}
}
}
},
"summary": "Bulk Update Vulnerability Tests",
"tags": [
"Vulnerability Testing"
],
"description": "Enable or disable vulnerability tests. \n\nTo view vulnerability test results, use the [Get All Services](https://cortex-panw.stoplight.io/docs/cortex-xpanse/a2aae6dda16c5-get-all-services) or [Get Service Details](https://cortex-panw.stoplight.io/docs/cortex-xpanse/b4c3a131602c4-get-service-details) endpoints.\n"
}
},
"/public_api/v1/assets/get_vulnerability_tests/": {
"post": {
"parameters": [
{
"in": "header",
"name": "authorization",
"description": "api-key",
"schema": {
"type": "string",
"example": "{{api_key}}"
},
"required": true
},
{
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"schema": {
"type": "string",
"example": "{{api_key_id}}"
},
"required": true
}
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetVulnerabilityTestsResponse"
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"$ref": "#/components/responses/UNPROCESSABLE_ENTITY"
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"requestBody": {
"required": true,
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/GetVulnerabilityTestsRequest"
}
}
}
},
"summary": "Get Vulnerability Tests",
"tags": [
"Vulnerability Testing"
],
"description": "Get a complete or filtered list of vulnerability tests. Response include details about each test, including the number of services confirmed vulnerable. \n\nTo view vulnerability test results, use the [Get All Services](https://cortex-panw.stoplight.io/docs/cortex-xpanse/a2aae6dda16c5-get-all-services) or [Get Service Details](https://cortex-panw.stoplight.io/docs/cortex-xpanse/b4c3a131602c4-get-service-details) endpoints.\n\n"
}
},
"/public_api/v1/assets/create_user_defined_ip_range/": {
"post": {
"summary": "Create User-Defined IP Range",
"tags": [
"Asset Management"
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"reply": {
"type": "object",
"properties": {
"user_defined_ip_range": {
"type": "string"
}
}
}
},
"x-examples": {
"Example 1": {
"reply": {
"user_defined_ip_range": "succeeded"
}
}
}
},
"examples": {
"Example 1": {
"value": {
"reply": {
"user_defined_ip_range": "succeeded"
}
}
}
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"description": "Unprocessable Entity ",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"operationId": "post-public_api-v1-assets-create_user_defined_ip_range",
"description": "Define an IP address range and assign a business unit (BU) or IP address tag (IPR) to that range. Note the following guidelines:\r\n- Use the shouldReplace field to indicate whether to replace all previously applied BUs on overlapping ranges. \r\n- Tags and notes on overlapping ranges will be deleted.\r\n- If only startIp is supplied, the endpoint will create a range for that single IP address.\r\n- If only endIP is supplied, the endpoint will create a range for that single IP address.\r\n- Define the range using either the startIp and endIp OR the cidrIp range, not both. Xpanse will run the request on only one range.\r\n\r\n",
"parameters": [
{
"schema": {
"type": "string",
"example": "{{api-key}}"
},
"in": "header",
"name": "authorization",
"required": true,
"description": "api-key"
},
{
"schema": {
"type": "string",
"example": "{{api-key-id}}"
},
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"required": true
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"x-examples": {
"Example 1": {
"request_data": {
"startIp": "222.92.129.24",
"endIp": "222.92.129.25",
"cidrIp": null,
"buTagIds": [
"BU:af500527-9f45-4bd8-8eb5-e161d18a47b3"
],
"iprTagIds": [
"IPR:cc1d6312306d48c79fb3023b93d69923"
],
"shouldReplace": false
}
}
},
"required": [
"request_data"
],
"properties": {
"request_data": {
"type": "object",
"properties": {
"startIp": {
"type": "string",
"description": "First IP address of the range.",
"nullable": true
},
"endIp": {
"type": "string",
"description": "Ending IP address of the range.",
"nullable": true
},
"cidrIp": {
"type": "string",
"description": "IP range in CIDR notation. ",
"nullable": true
},
"buTagIds": {
"type": "array",
"description": "List of business unit tag IDs that will be applied to the IP range.",
"nullable": true,
"items": {
"type": "string"
}
},
"iprTagIds": {
"type": "array",
"description": "List of IP range tag IDs (IPR) that will be applied to the IP range.",
"nullable": true,
"items": {
"type": "string"
}
},
"shouldReplace": {
"type": "boolean",
"description": "Boolean denoting whether to replace all previously applied business units on overlapping ranges. "
}
}
}
}
},
"examples": {
"Example 1": {
"value": {
"request_data": {
"startIp": "x.x.x.24",
"endIp": "x.x.x.25",
"cidrIp": "null",
"buTagIds": [
"BU:af500527-9f45-4bd8-8eb5-e161d18a47b3"
],
"iprTagIds": [
"IPR:cc1d6312306d48c79fb3023b93d69923"
],
"shouldReplace": false
}
}
}
}
}
}
}
}
},
"/public_api/v1/assets/delete_unused_tag/": {
"post": {
"summary": "Delete Unused Tags",
"tags": [
"Tag Management"
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"reply": {
"type": "string"
}
},
"x-examples": {
"Example 1": {
"reply": "succeeded"
}
}
},
"examples": {
"Example 1": {
"value": {
"reply": "succeeded"
}
}
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"description": "Unprocessable Entity",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"operationId": "post-public_api-v1-assets-delete_unused_tag",
"description": "Delete unused tags by specifying tag IDs or tag names. You don't have to provide both tag_ids and tag_names, but you can use both to specify different tags. ",
"parameters": [
{
"schema": {
"type": "string",
"example": "{{api-key}}"
},
"in": "header",
"name": "authorization",
"description": "api-key",
"required": true
},
{
"schema": {
"type": "string",
"example": "{{api-key-id}}"
},
"in": "header",
"name": "x-xdr-auth-id",
"required": true,
"description": "api-key-id"
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"x-examples": {
"Example 1": {
"request_data": {
"tag_family": "ip_ranges",
"tag_ids": [
"IPR:abcd12345"
],
"tag_names": [
"tag-1"
]
}
}
},
"required": [
"request_data"
],
"properties": {
"request_data": {
"type": "object",
"description": "A dictionary containing the API request fields.\r\n\r\nAn empty dictionary returns all results.\r\n",
"properties": {
"tag_family": {
"enum": [
"assets",
"ip_ranges"
]
},
"tag_ids": {
"type": "array",
"description": "IDs of tags to be deleted. ",
"items": {
"type": "string"
}
},
"tag_names": {
"type": "array",
"description": "Names of tags to be deleted.",
"items": {
"type": "string"
}
}
}
}
}
},
"examples": {
"Example 1": {
"value": {
"request_data": {
"tag_family": "ip_ranges",
"tag_ids": [
"IPR:abcd12345"
],
"tag_names": [
"tag-1"
]
}
}
}
}
}
}
}
}
},
"/public_api/v1/asm_management/upload_asm_data/": {
"post": {
"summary": "Upload Assets",
"tags": [
"Asset Management"
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"reply": {
"type": "object",
"properties": {
"asset_names": {
"type": "array",
"items": {
"type": "string"
}
},
"errors": {
"type": "array",
"items": {
"type": "object",
"properties": {}
}
}
}
}
},
"x-examples": {
"Example 1": {
"reply": {
"asset_names": [
"blockbuster18.com",
"blockbuster19.com",
"blockbuster20.com"
],
"errors": []
}
}
}
}
}
}
},
"400": {
"description": "Bad Request. Got an invalid JSON.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"description": "Unprocessable Entity ",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"500": {
"description": "Internal server error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"operationId": "post-public_api-v1-asm_management-upload_asm_data",
"description": "Upload domains (paid-level domains (PLD) and subdomains) and IPv4 address ranges to your inventory. Upload up to 500 domains or IP ranges per request. \r\n\r\nCheck the status of your asset upload request on the Asset Uploads/Removals page in the Cortex Xpanse UI. Go to Settings → Configurations → Asset Management → Asset Uploads/Removals. Uploaded assets initially appear the Asset Uploads/Removals table with the status Pending. Within five days of submitting your request, each asset will be Accepted and added to the inventory or Rejected. Assets that are rejected include an explanation in the Decision Reason field.\r\n\r\nYou cannot upload an asset that was added or rejected in a previous upload request.\r\n\r\nRequired role: Instance Admin or Account Admin\r\n\r\nRequired license: Cortex Xpanse Expander",
"parameters": [
{
"schema": {
"type": "string",
"example": "api-key"
},
"in": "header",
"name": "authorization",
"description": "api-key",
"required": true
},
{
"schema": {
"type": "string",
"example": "api-key-id"
},
"in": "header",
"name": "x-xdr-auth-id",
"description": "api-key-id",
"required": true
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"x-examples": {
"Example 1": {
"request_data": {
"request_type": "addition",
"asset_type": "domain",
"asset_identifiers": [
"netflix.com",
"blockbuster.com"
]
}
}
},
"required": [
"request_data"
],
"properties": {
"request_data": {
"type": "object",
"description": "(Required) A dictionary containing the API request fields.",
"required": [
"request_type",
"asset_type",
"asset_identifiers",
"business_units"
],
"properties": {
"request_type": {
"description": "Indicates that you want to add new assets to your inventory.\r\n\"Addition\" is the only supported value.\r\n",
"enum": [
"addition"
]
},
"asset_type": {
"description": "Type of asset. Supported values are `ip_range` and `domain`.",
"enum": [
"ip_range",
"domain"
]
},
"asset_identifiers": {
"type": "array",
"description": "List of assets to be uploaded. \r\n- All assets in a request must be the same asset type, either domain or ip_range. \r\n- Value can be one or more domains or one or more ipv4 ranges.\r\n- Accepted formats for IPv4 address ranges are `-` and CIDR format.\r\n- Individual IPs are supported using either CIDR Notation (e.g. 8.8.8.8/32) or `-` format (e.g. 8.8.8.8-8.8.8.8).\r\n",
"items": {
"type": "string"
}
},
"business_units": {
"type": "array",
"description": "One or more business unit IDs or business unit names to which the uploaded assets will be assigned.",
"items": {
"type": "string"
}
}
}
}
}
},
"examples": {
"Example 1": {
"value": {
"request_data": {
"request_type": "addition",
"asset_type": "ip_range",
"asset_identifiers": [
"string"
],
"business_units": [
"BU:1",
"BU:2"
]
}
}
}
}
}
}
},
"x-internal": false
}
},
"/public_api/v1/asm_management/remove_asm_data": {
"post": {
"summary": "Remove Assets",
"tags": [
"Asset Management"
],
"responses": {
"200": {
"description": "OK",
"headers": {},
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"reply": {
"type": "string"
}
},
"x-examples": {
"Example 1": {
"reply": "succeeded"
}
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"401": {
"description": "Unauthorized. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"402": {
"description": "Unauthorized access. User does not have the required license type to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"403": {
"description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
},
"422": {
"description": "Unprocessable Entity ",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"500": {
"description": "Internal Server Error. A unified status for API communication type errors.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/DefaultApiErrorResponse"
}
}
}
}
},
"operationId": "post-public_api-v1-asm_management-remove_asm_data",
"description": "Remove certificates, domains (paid-level domains and subdomains), and IPv4 address ranges from your inventory. Remove up to 500 certificates, domains, or IP ranges per request.\n\nRemoved assets appear the Asset Uploads/Removals table with the status Removed. Within 24 hours of submitting your request, assets are removed from the inventory. Within a few days, related incidents, alerts, and services are also removed.\nYou cannot remove an asset that was uploaded in a previous upload request. \n\nWhen you remove a paid-level domain, related subdomains are also removed. When you remove an IPv4 range, the individual IPv4 addresses in that range are also removed.\n\nRequired role: Instance Admin \n\nRequired license: Cortex Xpanse Expander",
"parameters": [
{
"schema": {
"type": "string"
},
"in": "header",
"name": "authorization",
"description": "{api-key}",
"required": true
},
{
"schema": {
"type": "string"
},
"in": "header",
"name": "x-xdr-auth-id",
"description": "{api-key-id}",
"required": true
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"x-examples": {
"Example 1": {
"request_data": {
"asset_type": "domain",
"asset_identifiers": [
"test1.com",
"test2.com"
]
}
}
},
"required": [
"request_data"
],
"properties": {
"request_data": {
"type": "object",
"description": "A dictionary containing the API request fields.",
"required": [
"asset_type",
"asset_identifiers"
],
"properties": {
"asset_type": {
"enum": [
"certificate",
"domain",
"ip_range"
],
"description": "The type of asset being removed."
},
"asset_identifiers": {
"type": "array",
"description": "A list of one or more assets you want to add to the inventory. Note the following:\n- All assets in a request must be of the same asset type.\n- For IP ranges, the accepted format is first-last or CIDR format. \n- Individual IP addresses can be listed using either CIDR notation (for example, 8.8.8.8/32) or first-last format (for example, 8.8.8.8-8.8.8.8).",
"items": {
"type": "string"
}
}
}
}
}
}
}
}
}
}
}
},
"components": {
"schemas": {
"reply": {
"title": "reply",
"type": "object",
"description": "The query result upon error.",
"properties": {
"err_code": {
"type": "string",
"description": "HTTP response code."
},
"err_msg": {
"type": "string",
"description": "Error message.",
"example": "{\"line\": 1, \"column\": 19, \"message\": \"no viable alternative at input '|alter2'\"}"
},
"err_extra": {
"type": "string",
"description": "Additional information describing the error."
}
}
},
"Error": {
"type": "object",
"properties": {
"code": {
"type": "integer",
"description": "Error code"
},
"status": {
"type": "string",
"description": "Error name"
},
"message": {
"type": "string",
"description": "Error message"
},
"errors": {
"type": "object",
"description": "Errors"
}
}
},
"PaginationMetadata": {
"type": "object",
"properties": {
"total": {
"type": "integer"
},
"total_pages": {
"type": "integer"
},
"first_page": {
"type": "integer"
},
"last_page": {
"type": "integer"
},
"page": {
"type": "integer"
},
"previous_page": {
"type": "integer"
},
"next_page": {
"type": "integer"
}
}
},
"OrganizationRecord": {
"type": "object",
"properties": {
"address": {
"type": "string"
},
"dateAdded": {
"type": "integer"
},
"email": {
"type": "string"
},
"firstRegistered": {
"type": "integer"
},
"formattedName": {
"type": "string"
},
"handle": {
"type": "string"
},
"kind": {
"type": "string"
},
"lastChanged": {
"type": "integer"
},
"org": {
"type": "string"
},
"phone": {
"type": "string"
},
"remarks": {
"type": "string"
},
"roles": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"address",
"email",
"formattedName",
"handle",
"kind",
"org",
"phone",
"remarks"
],
"additionalProperties": true
},
"Tag": {
"type": "object",
"properties": {
"tag_id": {
"type": "string"
},
"tag_name": {
"type": "string"
}
},
"required": [
"tag_id",
"tag_name"
],
"additionalProperties": true
},
"NetworkRecord": {
"type": "object",
"properties": {
"firstIp": {
"type": "string"
},
"firstIpv6": {
"type": "string"
},
"handle": {
"type": "string"
},
"lastChanged": {
"type": "integer"
},
"lastIp": {
"type": "string"
},
"lastIpv6": {
"type": "string"
},
"name": {
"type": "string"
},
"organizationRecords": {
"type": "array",
"items": {
"$ref": "#/components/schemas/OrganizationRecord"
}
},
"remarks": {
"type": "string"
},
"whoIsServer": {
"type": "string"
}
},
"required": [
"handle",
"name",
"whoIsServer"
],
"additionalProperties": true
},
"ServiceDetailIpRangeDetails": {
"type": "object",
"properties": {
"networkRecords": {
"$ref": "#/components/schemas/NetworkRecord"
}
},
"additionalProperties": true
},
"ServiceDetailIpRange": {
"type": "object",
"properties": {
"_IS_DELETED": {
"type": "string"
},
"_LAST_MODIFIED_TIME": {
"type": "integer"
},
"ACTIVE_RESPONSIVE_IPS_COUNT": {
"type": "integer"
},
"ANNOTATION": {
"type": "string"
},
"ASN_COUNTRIES": {
"type": "array",
"items": {
"type": "string"
}
},
"ASN_HANDLES": {
"type": "array",
"items": {
"type": "string"
}
},
"ASN_RECORD_NAMES": {
"type": "array",
"items": {
"type": "string"
}
},
"ASN_REGISTRIES": {
"type": "array",
"items": {
"type": "string"
}
},
"BUSINESS_UNIT": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Tag"
}
},
"CITIES": {
"type": "array",
"items": {
"type": "string"
}
},
"DATE_ADDED": {
"type": "integer"
},
"DETAILS": {
"$ref": "#/components/schemas/ServiceDetailIpRangeDetails"
},
"ENTITY_TYPES": {
"type": "array",
"items": {
"type": "string"
}
},
"EXPLAINERS": {
"type": "array",
"items": {
"type": "string"
}
},
"FIRST_IP": {
"type": "string"
},
"FIRST_IPV6": {
"type": "string"
},
"HAS_BU_OVERRIDES": {
"type": "boolean"
},
"IP_RANGE_ID": {
"type": "string"
},
"IP_VERSION": {
"type": "integer"
},
"IS_SUBRANGE": {
"type": "boolean"
},
"LAST_IP": {
"type": "string"
},
"LAST_IPV6": {
"type": "string"
},
"ORGANIZATION_HANDLES": {
"type": "string"
},
"REGIONS": {
"type": "array",
"items": {
"type": "string"
}
},
"SBAC_TAGS": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Tag"
}
},
"SECTORS": {
"type": "array",
"items": {
"type": "string"
}
},
"SIZE": {
"type": "integer"
},
"STATES": {
"type": "array",
"items": {
"type": "string"
}
},
"SUBRANGE_CREATED_EMAIL": {
"type": "string"
},
"SUBRANGE_CREATED_TS": {
"type": "integer"
},
"SUBRANGE_CREATED_USER": {
"type": "string"
},
"SYSTEM_RANGE_FIRST_IP": {
"type": "string"
},
"SYSTEM_RANGE_ID": {
"type": "string"
},
"SYSTEM_RANGE_LAST_IP": {
"type": "string"
},
"TAGS": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Tag"
}
}
},
"required": [
"IP_RANGE_ID"
],
"additionalProperties": true
},
"GetAsmAssetDetailsRequestData": {
"type": "object",
"properties": {
"asm_id_list": {
"type": "array",
"items": {
"type": "string"
},
"description": "A list of string(s) representing the asset IDs."
}
},
"required": [
"asm_id_list"
],
"additionalProperties": true,
"description": "(Required) A dictionary containing the API request fields. An empty dictionary returns all results."
},
"GetAsmAssetDetailsRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/GetAsmAssetDetailsRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"GenericReply": {
"type": "object",
"properties": {
"err_code": {
"type": "string",
"description": "HTTP response code."
},
"err_msg": {
"type": "string",
"description": "Error message."
},
"err_extra": {
"type": "string",
"description": "Additional information describing the error."
}
},
"additionalProperties": true
},
"DefaultApiErrorResponse": {
"type": "object",
"properties": {
"reply": {
"description": "The query results upon error.",
"allOf": [
{
"$ref": "#/components/schemas/GenericReply"
}
]
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"Geolocation": {
"type": "object",
"properties": {
"latitude": {
"type": "number"
},
"longitude": {
"type": "number"
},
"countryCode": {
"type": "string"
},
"city": {
"type": "string"
},
"regionCode": {
"type": "string"
},
"timeZone": {
"type": "string"
}
},
"additionalProperties": true
},
"Ips": {
"type": "object",
"properties": {
"ip": {
"type": "integer"
},
"ipv6": {
"type": "string"
},
"protocol": {
"type": "string"
},
"provider": {
"type": "string"
},
"geolocation": {
"$ref": "#/components/schemas/Geolocation"
},
"activityStatus": {
"type": "string"
},
"lastObserved": {
"type": "integer"
},
"firstObserved": {
"type": "integer"
}
},
"additionalProperties": true
},
"ProviderDetails": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"displayName": {
"type": "string"
},
"firstObserved": {
"type": "integer"
},
"lastObserved": {
"type": "integer"
}
},
"required": [
"displayName",
"name"
],
"additionalProperties": true
},
"AsmDomainAdmin": {
"type": "object",
"properties": {
"city": {
"type": "string"
},
"country": {
"type": "string"
},
"emailAddress": {
"type": "string"
},
"faxExtension": {
"type": "string"
},
"faxNumber": {
"type": "string"
},
"name": {
"type": "string"
},
"organization": {
"type": "string"
},
"phoneExtension": {
"type": "string"
},
"phoneNumber": {
"type": "string"
},
"postalCode": {
"type": "string"
},
"province": {
"type": "string"
},
"registryId": {
"type": "string"
},
"street": {
"type": "string"
}
},
"additionalProperties": true
},
"AsmDomainRegistrar": {
"type": "object",
"properties": {
"abuseContactEmail": {
"type": "string"
},
"abuseContactPhone": {
"type": "string"
},
"alignedName": {
"type": "string"
},
"ianaId": {
"type": "number"
},
"name": {
"type": "string"
},
"registrationExpirationDate": {
"type": "number"
},
"url": {
"type": "string"
},
"whoisServer": {
"type": "string"
}
},
"additionalProperties": true
},
"AsmDomain": {
"type": "object",
"properties": {
"admin": {
"$ref": "#/components/schemas/AsmDomainAdmin"
},
"alignedRegistrar": {
"type": "string"
},
"collectionTime": {
"type": "integer"
},
"creationDate": {
"type": "integer"
},
"dnssec": {
"type": "string"
},
"domainName": {
"type": "string"
},
"domainStatuses": {
"type": "array",
"items": {
"type": "string"
}
},
"dropped": {
"type": "boolean"
},
"nameServers": {
"type": "array",
"items": {
"type": "string"
}
},
"registrant": {
"$ref": "#/components/schemas/AsmDomainAdmin"
},
"registrar": {
"$ref": "#/components/schemas/AsmDomainRegistrar"
},
"registryDomainId": {
"type": "string"
},
"registryExpiryDate": {
"type": "integer"
},
"reseller": {
"type": "string"
},
"retrievedDate": {
"type": "integer"
},
"tech": {
"$ref": "#/components/schemas/AsmDomainAdmin"
},
"updatedDate": {
"type": "integer"
}
},
"required": [
"collectionTime",
"domainName",
"dropped",
"registrar",
"retrievedDate"
],
"additionalProperties": true
},
"IpSource": {
"type": "object",
"properties": {
"name": {
"type": "string"
}
},
"required": [
"name"
],
"additionalProperties": true
},
"AsmProvider": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"additionalProviderInfo": {
"type": "string"
},
"isCdn": {
"type": "boolean"
},
"legacyName": {
"type": "string"
},
"displayName": {
"type": "string"
},
"cdn": {
"type": "boolean"
}
},
"required": [
"cdn",
"displayName",
"isCdn",
"legacyName",
"name"
],
"additionalProperties": true
},
"AsmAssetIp": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"ip": {
"type": "integer"
},
"ipv6": {
"type": "string"
},
"source": {
"$ref": "#/components/schemas/IpSource"
},
"provider": {
"$ref": "#/components/schemas/AsmProvider"
},
"lastObserved": {
"type": "integer"
},
"firstObserved": {
"type": "integer"
}
},
"required": [
"firstObserved",
"lastObserved"
],
"additionalProperties": true
},
"CertificateDetails": {
"type": "object",
"properties": {
"issuer": {
"type": "string"
},
"issuerAlternativeNames": {
"type": "string"
},
"issuerCountry": {
"type": "string"
},
"issuerEmail": {
"type": "string"
},
"issuerLocality": {
"type": "string"
},
"issuerName": {
"type": "string"
},
"issuerOrg": {
"type": "string"
},
"formattedIssuerOrg": {
"type": "string"
},
"issuerOrgUnit": {
"type": "string"
},
"issuerState": {
"type": "string"
},
"publicKey": {
"type": "string"
},
"publicKeyAlgorithm": {
"type": "string"
},
"publicKeyRsaExponent": {
"type": "integer"
},
"signatureAlgorithm": {
"type": "string"
},
"subject": {
"type": "string"
},
"subjectAlternativeNames": {
"type": "string"
},
"subjectCountry": {
"type": "string"
},
"subjectEmail": {
"type": "string"
},
"subjectLocality": {
"type": "string"
},
"subjectName": {
"type": "string"
},
"subjectOrg": {
"type": "string"
},
"subjectOrgUnit": {
"type": "string"
},
"subjectState": {
"type": "string"
},
"serialNumber": {
"type": "string"
},
"validNotBefore": {
"type": "integer"
},
"validNotAfter": {
"type": "integer"
},
"version": {
"type": "string"
},
"publicKeyBits": {
"type": "integer"
},
"publicKeyModulus": {
"type": "string"
},
"publicKeySpki": {
"type": "string"
},
"sha1Fingerprint": {
"type": "string"
},
"sha256Fingerprint": {
"type": "string"
},
"md5Fingerprint": {
"type": "string"
}
},
"additionalProperties": true
},
"InferredCveMatchMetadata": {
"type": "object",
"properties": {
"inferredCveMatchType": {
"type": "string"
},
"product": {
"type": "string"
},
"confidence": {
"type": "string"
},
"vendor": {
"type": "string"
},
"version": {
"type": "string"
}
},
"required": [
"confidence",
"inferredCveMatchType",
"product",
"vendor",
"version"
],
"additionalProperties": true
},
"InferredCve": {
"type": "object",
"properties": {
"cveId": {
"type": "string"
},
"cvssScoreV2": {
"type": "null"
},
"cveSeverityV2": {
"type": "null"
},
"cvssScoreV3": {
"type": "number"
},
"cveSeverityV3": {
"type": "string"
},
"inferredCveMatchMetadata": {
"type": "object",
"properties": {
"inferredCveMatchType": {
"type": "string"
},
"product": {
"type": "string"
},
"confidence": {
"type": "string"
},
"vendor": {
"type": "string"
},
"version": {
"type": "string"
},
"matchingCpeInformation": {
"type": "array",
"items": {
"type": "object",
"properties": {
"part": {
"type": "string"
},
"vendor": {
"type": "string"
},
"product": {
"type": "string"
},
"version": {
"type": "string"
},
"update": {
"type": "null"
},
"edition": {
"type": "null"
},
"language": {
"type": "null"
},
"softwareEdition": {
"type": "null"
},
"targetSoftware": {
"type": "null"
},
"targetHardware": {
"type": "null"
},
"other": {
"type": "null"
},
"sourceServiceClassificationId": {
"type": "string"
}
}
}
}
}
},
"epssScore": {
"type": "null"
},
"cvssTemporalScoreV3": {
"type": "null"
},
"cvssTemporalScoreV2": {
"type": "null"
},
"publishedExploitsCount": {
"type": "null"
},
"reportedExploitedInTheWild": {
"type": "null"
},
"firstExploitPublished": {
"type": "null"
},
"firstReportedThreatActor": {
"type": "null"
},
"firstReportedRansomware": {
"type": "null"
},
"firstReportedBotnet": {
"type": "null"
},
"lastExploitPublished": {
"type": "null"
},
"lastReportedThreatActor": {
"type": "null"
},
"lastReportedRansomware": {
"type": "null"
},
"lastReportedBotnet": {
"type": "null"
},
"cisaKevDateAdded": {
"type": "null"
}
},
"x-examples": {
"Example 1": {
"cveId": "CVE-2023-46118",
"cvssScoreV2": null,
"cveSeverityV2": null,
"cvssScoreV3": 4.9,
"cveSeverityV3": "MEDIUM",
"inferredCveMatchMetadata": {
"inferredCveMatchType": "ExactVersionMatch",
"product": "rabbitmq",
"confidence": "High",
"vendor": "vmware",
"version": "3.9.3",
"matchingCpeInformation": [
{
"part": "a",
"vendor": "vmware",
"product": "rabbitmq",
"version": "3.9.3",
"update": null,
"edition": null,
"language": null,
"softwareEdition": null,
"targetSoftware": null,
"targetHardware": null,
"other": null,
"sourceServiceClassificationId": "RabbitMQ"
}
]
},
"epssScore": null,
"cvssTemporalScoreV3": null,
"cvssTemporalScoreV2": null,
"publishedExploitsCount": null,
"reportedExploitedInTheWild": null,
"firstExploitPublished": null,
"firstReportedThreatActor": null,
"firstReportedRansomware": null,
"firstReportedBotnet": null,
"lastExploitPublished": null,
"lastReportedThreatActor": null,
"lastReportedRansomware": null,
"lastReportedBotnet": null,
"cisaKevDateAdded": null
}
}
},
"InferredCvesObserved": {
"type": "object",
"properties": {
"inferredCve": {
"type": "array",
"items": {
"$ref": "#/components/schemas/InferredCve"
}
},
"activityStatus": {
"type": "string"
},
"lastObserved": {
"type": "integer"
},
"firstObserved": {
"type": "integer"
}
},
"additionalProperties": true
},
"AsmAssetDetailsDetails": {
"type": "object",
"properties": {
"providerDetails": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ProviderDetails"
}
},
"domain": {
"type": "string"
},
"topLevelAssetMapperDomain": {
"type": "string"
},
"domainAssetType": {
"type": "string"
},
"isPaidLevelDomain": {
"type": "boolean"
},
"domainDetails": {
"$ref": "#/components/schemas/AsmDomain"
},
"dnsZone": {
"type": "string"
},
"latestSampledIp": {
"type": "number"
},
"latestSampledIpv6": {
"type": "string"
},
"subdomainMetadata": {
"type": "object"
},
"recentIps": {
"type": "array",
"items": {
"$ref": "#/components/schemas/AsmAssetIp"
}
},
"certificateDetails": {
"$ref": "#/components/schemas/CertificateDetails"
},
"inferredCvesObserved": {
"type": "array",
"items": {
"$ref": "#/components/schemas/InferredCvesObserved"
}
},
"source": {
"type": "string"
},
"ip_ranges": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/ServiceDetailIpRange"
},
"description": "Keys should be valid IPv4 address"
}
},
"additionalProperties": true
},
"AsmAssetDetailExternalService": {
"type": "object",
"properties": {
"serviceType": {
"type": "string"
},
"serviceKey": {
"type": "string"
},
"activityStatus": {
"type": "string"
}
},
"additionalProperties": true
},
"GetAsmAssetDetails": {
"type": "object",
"properties": {
"asm_ids": {
"type": "string"
},
"name": {
"type": "string"
},
"type": {
"type": "string"
},
"last_observed": {
"type": "integer"
},
"first_observed": {
"type": "integer"
},
"externally_detected_providers": {
"type": "array",
"items": {
"type": "string"
}
},
"created": {
"type": "integer"
},
"ips": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Ips"
}
},
"active_service_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"all_service_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"active_external_services_types": {
"type": "array",
"items": {
"type": "string"
}
},
"domain": {
"type": "string"
},
"certificate_issuer": {
"type": "string"
},
"certificate_algorithm": {
"type": "string"
},
"certificate_classifications": {
"type": "array",
"items": {
"type": "string"
}
},
"resolves": {
"type": "boolean"
},
"details": {
"$ref": "#/components/schemas/AsmAssetDetailsDetails"
},
"external_services": {
"type": "array",
"items": {
"$ref": "#/components/schemas/AsmAssetDetailExternalService"
}
},
"externally_inferred_vulnerability_score": {
"type": "number"
},
"externally_inferred_cves": {
"type": "array",
"items": {
"type": "string"
}
},
"explainers": {
"type": "array",
"items": {
"type": "string"
}
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"ipv6s": {
"type": "array",
"items": {
"type": "string"
}
},
"has_bu_overrides": {
"type": "boolean"
}
},
"additionalProperties": true
},
"GetAsmAssetDetailsReply": {
"type": "object",
"properties": {
"details": {
"type": "array",
"items": {
"$ref": "#/components/schemas/GetAsmAssetDetails"
}
}
},
"additionalProperties": true
},
"GetAsmAssetDetailsResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/GetAsmAssetDetailsReply"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"AsmAssetsFilter": {
"type": "object",
"properties": {
"field": {
"type": "string",
"enum": [
"name",
"has_xdr_agent",
"ip_address",
"externally_detected_providers",
"type",
"has_active_external_services",
"mac_addresses",
"externally_inferred_cves",
"aws_cloud_tags",
"gcp_cloud_tags",
"azure_cloud_tags",
"tags",
"business_units_list",
"ipv6_address",
"has_bu_overrides",
"asm_id_list",
"first_observed",
"last_observed"
],
"description": "Identifies the assets field the filter is matching. Case-sensitive."
},
"operator": {
"type": "string",
"enum": [
"in",
"contains",
"neq",
"eq",
"not_contains",
"gte",
"lte",
"range",
"relative_timestamp"
],
"description": "Identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n - **contains** / **not_contains**: use with `externally_detected_providers`, `externally_inferred_cves`, `name`\n - **eq** / **neq**: use with `name`, `ip_address`, `has_bu_overrides`.\n - **gte**: Filters data from a specific timestamp onwards. Use with `first_observed`, `last_observed`.\n - **in**: use with `has_active_external_services`, `type`, `business_units_list`, `ip_address`.\n - **lte**: Filters data up to a specific timestamp. Use with `first_observed`, `last_observed`.\n - **range**: Filters data between two specific timestamps.Use with `first_observed`, `last_observed`.\n - **relative_timestamp**: Filters data relative to the current time (e.g., last 30 days). Use with `first_observed` or `last_observed`."
},
"value": {
"oneOf": [
{
"type": "string"
},
{
"type": "boolean"
},
{
"type": "array",
"items": {
"type": "string"
}
},
{
"type": "integer"
}
],
"description": "Value depends on the filter field used.\n - business_un****its_list: string or list of strings in the format \"BU name\" or \"BU:BU name\", for example “Acme & Co, Inc.” or “BU:Acme & Co, Inc.”\n - **externally_detected_providers**: string\n - **externally_inferred_cves**: string \n - **first_observed** — values in milliseconds format\n - with **gte** or **lte** operator, specify a specific date or time as a timestamp in milliseconds format\n - with **range** operator, specify \"to\" and \"from\" values as timestamps in milliseconds format\n \"value\": { \"from\": \"{{previous30Days}}\",\"to\": \"{{previous7Days}}\"\n - with **relative_timestamp** operator, specify time interval to look back on (24H, 7D, 30D, etc.) as a value in milliseconds format\n - **has_active_external_services**: list of strings (enum values: \"yes\", \"no\", \"unknown\")\n - **has_bu_overrides**: boolean (\"true\" or \"false\")\n - **ip_address**: list of strings\n - **ipv6_address**: string\n - **last_observed** — values in milliseconds format\n - with **gte** or **lte** operator, specify a specific date or time as a timestamp in milliseconds format\n - with **range** operator, specify \"to\" and \"from\" values as timestamps in milliseconds format, as follows\n \"value\": { \"from\": \"{{previous30Days}}\",\"to\": \"{{previous7Days}}\"\n - with **relative_timestamp** operator, specify time interval to look back on (24H, 7D, 30D, etc.) as a value in milliseconds format\n - **name**: string\n - **type**: List of strings (enum values: \"certificate\", \"cloud_integration\", \"cloud_compute_instance\", \"domain\", \"unassociated_responsive_ip\")\n - **tags**: List of strings indicating the tags to filter on in the format `\"tag-family:tag-name\"`, for example `\"AR:registered to you\"`.\n - **type**: string\n"
}
}
},
"GetAsmAssetsSort": {
"type": "object",
"properties": {
"field": {
"type": "string",
"default": "name",
"enum": [
"first_observed",
"name",
"last_observed"
],
"description": "Case sensitive."
},
"keyword": {
"type": "string",
"default": "asc",
"enum": [
"ASC",
"asc",
"DESC",
"desc"
],
"description": "Case sensitive."
}
},
"additionalProperties": true,
"description": "Identifies the sort order for the result set."
},
"GetAsmAssetsData": {
"type": "object",
"description": "A dictionary containing the API request fields.\nAn empty dictionary returns all results.",
"properties": {
"filters": {
"type": "array",
"description": "An array of filter fields.",
"items": {
"$ref": "#/components/schemas/AsmAssetsFilter"
}
},
"search_from": {
"type": "integer",
"default": 0,
"minimum": 0,
"description": "Represents the start offset index of results."
},
"search_to": {
"type": "integer",
"default": 500,
"minimum": 0,
"description": "An integer representing the start offset index of results. Use this field to specify the number of results on a page when using page token pagination.
Max value - 5000\n"
},
"sort": {
"$ref": "#/components/schemas/GetAsmAssetsSort"
},
"use_page_token": {
"type": "boolean",
"description": "Use `\"use_page_token\":true` in the initial request to paginate the response data. \n"
},
"next_page_token": {
"type": "string",
"description": "If `\"use_page_token\":true` was included in the initial request, the response for that request will include a page token.
Use `\"next_page_token\":\"string\"` to pass that page token into the next request to paginate the next set of data.'\n"
}
}
},
"GetAsmAssetsRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/GetAsmAssetsData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"BusinessUnitHierarchy": {
"type": "object",
"properties": {
"creation_time": {
"type": "integer"
},
"family": {
"type": "string"
},
"family_alias": {
"type": "string"
},
"id": {
"type": "string"
},
"is_active": {
"type": "integer"
},
"name": {
"type": "string"
},
"parent_id": {
"type": "string"
},
"update_time": {
"type": "integer"
}
},
"additionalProperties": true
},
"NetworkInterface": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"ip": {
"type": "string"
},
"subnet_id": {
"type": "string"
},
"vpc_id": {
"type": "string"
}
},
"additionalProperties": true
},
"Volume": {
"type": "object",
"properties": {
"boot": {
"type": "boolean"
},
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"type": {
"type": "string"
}
},
"additionalProperties": true
},
"AssetsInternetExposureItemExtendedProperties": {
"type": "object",
"properties": {
"last_start_time": {
"type": "integer"
},
"machine_type": {
"type": "string"
},
"network_interfaces": {
"type": "array",
"items": {
"$ref": "#/components/schemas/NetworkInterface"
}
},
"private_ips": {
"type": "array",
"items": {
"type": "string"
}
},
"public_ips": {
"type": "array",
"items": {
"type": "string"
}
},
"volume": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Volume"
}
}
},
"additionalProperties": true
},
"AssetsInternetExposureItem": {
"type": "object",
"properties": {
"agent_id": {
"type": "string"
},
"annotation": {
"type": "string"
},
"asm_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"asm_va_score": {
"type": "number"
},
"asset_explainers": {
"type": "array",
"items": {
"type": "string"
}
},
"asset_type": {
"type": "string"
},
"aws_cloud_tags": {
"type": "array",
"items": {
"type": "string"
}
},
"azure_cloud_tags": {
"type": "array",
"items": {
"type": "string"
}
},
"business_units": {
"type": "array",
"items": {
"type": "array",
"items": {
"$ref": "#/components/schemas/BusinessUnitHierarchy"
}
}
},
"certificate_algorithm": {
"type": "string"
},
"certificate_classifications": {
"type": "array",
"items": {
"type": "string"
}
},
"certificate_details": {
"$ref": "#/components/schemas/CertificateDetails"
},
"certificate_expiry_date": {
"type": "integer"
},
"certificate_issuer": {
"type": "string"
},
"cloud_id": {
"type": "string"
},
"cloud_provider": {
"type": "string"
},
"cloud_resource_type": {
"type": "string"
},
"creation_time": {
"type": "integer"
},
"date_added": {
"type": "integer"
},
"domain": {
"type": "string"
},
"domain_details": {
"$ref": "#/components/schemas/AsmDomain"
},
"domain_resolves": {
"type": "boolean"
},
"extended_properties": {
"$ref": "#/components/schemas/AssetsInternetExposureItemExtendedProperties"
},
"external_ips": {
"type": "array",
"items": {
"type": "string"
}
},
"externally_detected_providers": {
"type": "array",
"items": {
"type": "string"
}
},
"externally_inferred_cves": {
"type": "array",
"items": {
"type": "string"
}
},
"first_observed": {
"type": "integer"
},
"gcp_cloud_tags": {
"type": "array",
"items": {
"type": "string"
}
},
"geo_region": {
"type": "string"
},
"has_active_externally_services": {
"type": "boolean"
},
"has_alerts": {
"type": "boolean"
},
"has_bu_overrides": {
"type": "boolean"
},
"has_incidents": {
"type": "boolean"
},
"has_xdr_agent": {
"type": "string"
},
"hierarchy": {
"type": "string"
},
"internal_ips": {
"type": "array",
"items": {
"type": "string"
}
},
"iot_category": {
"type": "string"
},
"iot_model": {
"type": "string"
},
"iot_profile": {
"type": "string"
},
"ip_ranges": {
"type": "array",
"items": {
"type": "string"
}
},
"ips": {
"type": "array",
"items": {
"type": "string"
}
},
"ipv6s": {
"type": "array",
"items": {
"type": "string"
}
},
"last_observed": {
"type": "integer"
},
"last_sampled_ip": {
"type": "integer"
},
"mac_addresses": {
"type": "array",
"items": {
"type": "string"
}
},
"management_status": {
"type": "array",
"items": {
"type": "string"
}
},
"name": {
"type": "string"
},
"open_ports": {
"type": "array",
"items": {
"type": "integer"
}
},
"operation_system": {
"type": "string"
},
"project_name": {
"type": "string"
},
"provider_account": {
"type": "string"
},
"recent_ips": {
"type": "array",
"items": {
"$ref": "#/components/schemas/AsmAssetIp"
}
},
"region": {
"type": "string"
},
"sensor": {
"type": "array",
"items": {
"type": "string"
}
},
"service_type": {
"type": "array",
"items": {
"type": "string"
}
},
"sub_region": {
"type": "array",
"items": {
"type": "string"
}
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"vpc_name_id": {
"type": "string"
}
},
"required": [
"asm_ids",
"asset_type",
"date_added",
"domain_resolves",
"first_observed",
"has_xdr_agent",
"last_observed",
"name"
],
"additionalProperties": true
},
"GetAsmAssetsReply": {
"type": "object",
"properties": {
"total_count": {
"type": "integer"
},
"result_count": {
"type": "integer"
},
"assets_internet_exposure": {
"type": "array",
"items": {
"$ref": "#/components/schemas/AssetsInternetExposureItem"
}
},
"next_page_token": {
"type": "string",
"description": "This attribute is only returned if use_page_token is provided in the request with value true"
}
},
"additionalProperties": true
},
"GetAsmAssetsResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/GetAsmAssetsReply"
}
},
"additionalProperties": true
},
"EmptyRequest": {
"type": "object",
"properties": {
"request_data": {
"type": "object",
"description": "An empty dictionary returns the time and status of the last websites assessment."
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"LastExternalAssessment": {
"type": "object",
"properties": {
"status": {
"type": "boolean",
"description": "`True`: the update of services data was successful.
`False`: the update of services data failed.\n"
},
"time": {
"type": "string"
}
}
},
"GetLastAssessmentResponse": {
"type": "object",
"properties": {
"last_external_assessment": {
"$ref": "#/components/schemas/LastExternalAssessment"
}
},
"additionalProperties": true
},
"ExternalIpAddressRangesFilter": {
"type": "object",
"properties": {
"field": {
"type": "string",
"enum": [
"organization_handles",
"tags",
"business_units_list",
"ipaddress_version",
"has_bu_overrides"
],
"description": "Identifies the external IP ranges field the filter is matching. Filters are based on the following case-sensitive keywords:\n - business_units_list\n - organization_handles\n - Ipaddress_version\n - has_bu_overrides\n - tags\n"
},
"operator": {
"type": "string",
"enum": [
"in",
"contains",
"neq",
"eq",
"not_contains"
],
"description": "Identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n - **contains** / **not_contains**\n - organization_handles\n - **in**\n - business_units_list \n - tags \n - **eq** / **neq**\n - ipaddress_version \n - has_bu_overrides\n"
},
"value": {
"oneOf": [
{
"type": "string"
},
{
"type": "boolean"
},
{
"type": "integer"
},
{
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "Values depend on the filter field used.\n - organization_handles — string\n - business_units_list — string or list of strings with syntax `“Acme & Co, Inc.”` or `“BU:Acme & Co, Inc.”`\n - tags — list of strings in format “{family alias}:{tag name}”\n - ipaddress_version — integer\n - has_bu_overrides - boolean (true/false)\n"
}
},
"additionalProperties": true
},
"ExternalIpAddressRangesSort": {
"type": "object",
"properties": {
"field": {
"type": "string",
"default": "first_ip",
"enum": [
"last_ip",
"last_ipv6",
"first_ipv6",
"first_ip",
"ipaddress_version",
"range_id_list"
],
"description": "Values are:\n - `Id` \n - `first_ip`\n - `last_ip` \n
Case sensitive.
Default is `first_ip`.\n"
},
"keyword": {
"type": "string",
"default": "desc",
"enum": [
"ASC",
"asc",
"DESC",
"desc"
],
"description": "Value are: \n - `ASC` (ascending order) \n - `DESC` (descending order). \n Case sensitive. Default is `DESC`.\n"
}
},
"additionalProperties": true,
"description": "Identifies the sort order for the result set."
},
"GetExternalIpAddressRangesRequestData": {
"type": "object",
"description": "A dictionary containing the API request fields. An empty dictionary returns all results.",
"properties": {
"filters": {
"type": "array",
"description": "Array of filter fields.",
"items": {
"$ref": "#/components/schemas/ExternalIpAddressRangesFilter"
}
},
"search_from": {
"type": "integer",
"default": 0,
"minimum": 0,
"description": "Represents the start offset index of results."
},
"search_to": {
"type": "integer",
"default": 500,
"minimum": 0,
"description": "An integer representing the start offset index of results. Use this field to specify the number of results on a page when using page token pagination.
Default value - 500
Max value - 1000\n"
},
"sort": {
"$ref": "#/components/schemas/ExternalIpAddressRangesSort"
},
"use_page_token": {
"type": "boolean",
"description": "Use `\"use_page_token\":true` in the initial request to paginate the response data.\n"
},
"next_page_token": {
"type": "string",
"description": "If `\"use_page_token\":true` was included in the initial request, the response for that request will include a page token. Use `\"next_page_token\":\"string\"` to pass that page token into the next request to paginate the next set of data.\n"
}
}
},
"GetExternalIpAddressRangesRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/GetExternalIpAddressRangesRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"ExternalIpAddressRange": {
"type": "object",
"properties": {
"range_id": {
"type": "string"
},
"first_ip": {
"type": "string"
},
"last_ip": {
"type": "string"
},
"ips_count": {
"type": "integer"
},
"active_responsive_ips_count": {
"type": "integer"
},
"date_added": {
"type": "integer"
},
"organization_handles": {
"type": "array",
"items": {
"type": "string"
}
},
"ipaddress_version": {
"type": "integer"
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"first_ipv6": {
"type": "string"
},
"last_ipv6": {
"type": "string"
},
"annotation": {
"type": "string"
},
"has_bu_overrides": {
"type": "boolean"
}
},
"additionalProperties": true
},
"GetExternalIpAddressRangesReply": {
"type": "object",
"properties": {
"total_count": {
"type": "integer"
},
"result_count": {
"type": "integer"
},
"external_ip_address_ranges": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ExternalIpAddressRange"
}
},
"next_page_token": {
"type": "string",
"description": "This attribute is only returned if use_page_token is provided in the request with value true"
}
},
"additionalProperties": true
},
"GetExternalIpAddressRangesResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/GetExternalIpAddressRangesReply"
}
},
"additionalProperties": true
},
"IpAddressRangeRequestData": {
"type": "object",
"properties": {
"range_id_list": {
"type": "array",
"minItems": 1,
"maxItems": 100,
"items": {
"type": "string"
},
"description": "A string representing the range ID for which you want to get the details."
}
},
"additionalProperties": true,
"description": "A dictionary containing the API request fields."
},
"GetExternalIpAddressRangeDetailsRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/IpAddressRangeRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"ExternalIpAddressRangeNestedDetails": {
"type": "object",
"properties": {
"networkRecords": {
"type": "array",
"items": {
"$ref": "#/components/schemas/NetworkRecord"
}
}
},
"additionalProperties": true
},
"ExternalIpAddressRangeDetails": {
"type": "object",
"properties": {
"range_id": {
"type": "string"
},
"first_ip": {
"type": "string"
},
"last_ip": {
"type": "string"
},
"ips_count": {
"type": "integer"
},
"active_responsive_ips_count": {
"type": "integer"
},
"date_added": {
"type": "integer"
},
"organization_handles": {
"type": "array",
"items": {
"type": "string"
}
},
"details": {
"$ref": "#/components/schemas/ExternalIpAddressRangeNestedDetails"
},
"explainers": {
"type": "array",
"items": {
"type": "string"
}
},
"ipaddress_version": {
"type": "integer"
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"first_ipv6": {
"type": "string"
},
"last_ipv6": {
"type": "string"
},
"annotation": {
"type": "string"
},
"has_bu_overrides": {
"type": "boolean"
}
},
"required": [
"has_bu_overrides",
"range_id"
],
"additionalProperties": true
},
"GetExternalIpAddressRangeDetailsReply": {
"type": "object",
"properties": {
"details": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ExternalIpAddressRangeDetails"
}
}
},
"additionalProperties": true
},
"GetExternalIpAddressRangeDetailsResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/GetExternalIpAddressRangeDetailsReply"
}
},
"additionalProperties": true
},
"ServiceIdList": {
"type": "object",
"properties": {
"service_id_list": {
"type": "array",
"minItems": 1,
"maxItems": 20,
"items": {
"type": "string"
}
}
},
"additionalProperties": true,
"description": "(Required) A dictionary containing the API request fields."
},
"GetServiceDetailsRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/ServiceIdList"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"NestedServiceCertificate": {
"type": "object",
"properties": {
"certificate": {
"$ref": "#/components/schemas/CertificateDetails"
},
"activityStatus": {
"type": "string"
},
"lastObserved": {
"type": "integer"
},
"firstObserved": {
"type": "integer"
}
},
"additionalProperties": true
},
"NestedServiceDomain": {
"type": "object",
"properties": {
"domain": {
"type": "string"
},
"activityStatus": {
"type": "string"
},
"lastObserved": {
"type": "integer"
},
"firstObserved": {
"type": "integer"
}
},
"additionalProperties": true
},
"ServiceClassificationValues": {
"type": "object",
"properties": {
"jsonValue": {
"type": "string"
},
"firstObserved": {
"type": "integer"
},
"lastObserved": {
"type": "integer"
}
},
"required": [
"firstObserved",
"jsonValue",
"lastObserved"
],
"additionalProperties": true
},
"ServiceClassification": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"activityStatus": {
"type": "string"
},
"values": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ServiceClassificationValues"
}
},
"firstObserved": {
"type": "integer"
},
"lastObserved": {
"type": "integer"
}
},
"required": [
"name"
],
"additionalProperties": true
},
"TlsVersion": {
"type": "object",
"properties": {
"tlsVersion": {
"type": "string"
},
"cipherSuite": {
"type": "string"
},
"firstObserved": {
"type": "integer"
},
"lastObserved": {
"type": "integer"
},
"activityStatus": {
"type": "string"
}
},
"additionalProperties": true
},
"NestedServiceDetails": {
"type": "object",
"properties": {
"serviceKey": {
"type": "string"
},
"serviceKeyType": {
"type": "string"
},
"providerDetails": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ProviderDetails"
}
},
"certificates": {
"type": "array",
"items": {
"$ref": "#/components/schemas/NestedServiceCertificate"
}
},
"domains": {
"type": "array",
"items": {
"$ref": "#/components/schemas/NestedServiceDomain"
}
},
"ips": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Ips"
}
},
"classifications": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ServiceClassification"
}
},
"tlsVersions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/TlsVersion"
}
},
"inferred_cves_observed": {
"type": "array",
"items": {
"$ref": "#/components/schemas/InferredCvesObserved"
}
},
"enrichedObservationSource": {
"type": "string"
},
"ip_ranges": {
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/ServiceDetailIpRange"
},
"description": "Keys should be valid IPv4 address"
}
},
"additionalProperties": true
},
"Service": {
"type": "object",
"properties": {
"service_id": {
"type": "string",
"format": "uuid"
},
"service_name": {
"type": "string"
},
"service_type": {
"type": "string"
},
"ip_address": {
"type": "array",
"items": {
"type": "string"
}
},
"domain": {
"type": "array",
"items": {
"type": "string"
}
},
"externally_detected_providers": {
"type": "array",
"items": {
"type": "string"
}
},
"is_active": {
"type": "string"
},
"first_observed": {
"type": "integer"
},
"last_observed": {
"type": "integer"
},
"port": {
"type": "integer"
},
"protocol": {
"type": "string"
},
"active_classifications": {
"type": "array",
"items": {
"type": "string"
}
},
"inactive_classifications": {
"type": "array",
"items": {
"type": "string"
}
},
"discovery_type": {
"type": "string"
},
"externally_inferred_vulnerability_score": {
"type": "number"
},
"externally_inferred_cves": {
"type": "array",
"items": {
"type": "string"
}
},
"details": {
"$ref": "#/components/schemas/NestedServiceDetails"
},
"cloud_management_status": {
"type": "string"
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"ipv6_address": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"service_id",
"service_name",
"service_type"
],
"additionalProperties": true
},
"ServiceDetails": {
"type": "object",
"properties": {
"details": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Service"
},
"description": "Service details according to the service ID."
},
"pretty_name": {
"type": "string"
},
"groups": {
"type": "array",
"items": {
"type": "string"
}
},
"users": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": true,
"description": "JSON object containing the query result."
},
"GetServiceDetailsResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/ServiceDetails"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"ExternalServicesFilter": {
"type": "object",
"description": "Provides an array of filtered fields. ",
"properties": {
"field": {
"type": "string",
"enum": [
"service_name",
"protocol",
"service_type",
"ip_address",
"domain",
"externally_detected_providers",
"externally_inferred_cves",
"discovery_type",
"active_classifications",
"inactive_classifications",
"is_active",
"confirmed_vulnerable_cve_ids",
"confirmed_not_vulnerable_cve_ids",
"vulnerability_test_status",
"tags",
"service_type_list",
"business_units_list",
"ipv6_address",
"last_observed",
"first_observed"
],
"description": "String that identifies the service field the filter is matching. Filters are based on the following case-sensitive keywords:\n - active_classifications\n - business_units_list\n - discovery_type\n - domain\n - externally_detected_providers\n - externally_inferred_cves\n - first_observed\n - inactive_classifications\n - ip_address\n - ipv6_address\n - is_active\n - last_observed\n - protocol\n - service_name\n - service_type\n - service_type_list\n - tags\n"
},
"operator": {
"type": "string",
"enum": [
"in",
"contains",
"neq",
"eq",
"not_contains",
"gte",
"lte",
"range",
"relative_timestamp"
],
"description": "String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n - **contains** / **not_contains**— use with `externally_detected_providers`, `domain`, `externally_inferred_cves`, `active_classifications`, `inactive_classifications`, service_name, `service_type`, `protocol`\n - **eq** / **neq**— use with `service_name`, `service_type`, `protocol`, `ip_address`\n - **gte**— Filters data from a specific timestamp onwards. Use with `first_observed`, `last_observed`\n - **in**— use with `is_active`, `discovery_type`, `business_units_list`, `tags`, `ip_address`\n - **lte**— Filters data up to a specific timestamp. Use with `first_observed`, `last_observed`\n - **range**— Filters data between two specific timestamps. Use with `first_observed`, `last_observed`\n - **relative_timestamp**— Filters data relative to the current time (e.g., last 30 days). Use with `first_observed`, `last_observed`\n"
},
"value": {
"oneOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
},
{
"type": "integer"
}
],
"description": "Value that this filter must match. The contents of this field will differ depending on the services field that you specified for this filter:\n - **active_classifications** — String\n - **business_units_list** — String or list of strings in the format \"BU name\" or \"BU:BU name\", for example “Acme & Co, Inc.” or “BU:Acme & Co, Inc.”\n - **discovery_type** — List of strings. Values are: `ColocatedOnIp`, `DirectlyDiscovered`, `Unknown`.\n - **domain** — String\n - **externally_detected_providers** — String \n - **externally_inferred_cves** — String\n - **first_observed** — values in milliseconds format\n - with **gte** or **lte** operator, specify a specific date or time as a timestamp in milliseconds format\n - with **range** operator, specify \"to\" and \"from\" values as timestamps in milliseconds format\n \"value\": { \"from\": \"{{previous30Days}}\",\"to\": \"{{previous7Days}}\"\n - with **relative_timestamp** operator, specify time interval to look back on (24H, 7D, 30D, etc.) as a value in milliseconds format\n - **inactive_classifications** — String\n - **ip_address** — List of strings\n - **ipv6_address** — String\n - **is_active** — String. Values are:`yes`, `no`\n - **last_observed** — values in milliseconds format\n - with **gte** or **lte** operator, specify a specific date or time as a timestamp in milliseconds format\n - with **range** operator, specify \"to\" and \"from\" values as timestamps in milliseconds format, as follows\n \"value\": { \"from\": \"{{previous30Days}}\",\"to\": \"{{previous7Days}}\"\n - with **relative_timestamp** operator, specify time interval to look back on (24H, 7D, 30D, etc.) as a value in milliseconds format\n - **protocol** — String \n - **service_name** — String\n - **service_type** — String\n - **service_type_list** — String\n - **tags** — List of strings indicating the tags to filter on in the format `\"tag-family:tag-name\"`, for example `\"AR:registered to you\"`.\n"
}
}
},
"ExternalServicesSort": {
"type": "object",
"properties": {
"field": {
"type": "string",
"default": "service_name",
"enum": [
"first_observed",
"service_name",
"last_observed"
],
"description": "Values are: \n - service_name \n - first_observed \n - last_observed \n By default, case-sensitive, sort is defined as service_name.\n"
},
"keyword": {
"type": "string",
"default": "asc",
"enum": [
"ASC",
"asc",
"DESC",
"desc"
],
"description": "Can be either ASC (ascending order) or DESC (descending order). Default is ASC. Values are case sensitive."
}
},
"additionalProperties": true,
"description": "Identifies the sort order for the result set."
},
"GetServicesRequestData": {
"type": "object",
"properties": {
"filters": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ExternalServicesFilter"
}
},
"search_from": {
"type": "integer",
"default": 0,
"minimum": 0,
"description": "An integer representing the start offset index of results."
},
"search_to": {
"type": "integer",
"default": 500,
"minimum": 0,
"description": "An integer representing the start offset index of results. Use this field to specify the number of results on a page when using page token pagination."
},
"sort": {
"$ref": "#/components/schemas/ExternalServicesSort"
},
"use_page_token": {
"type": "boolean",
"description": "Use `\"use_page_token\":true` in the initial request to paginate the response data.\n"
},
"next_page_token": {
"type": "string",
"description": "If `\"use_page_token\":true` was included in the initial request, the response for that request will include a page token.
Use `\"next_page_token\":\"string\"` to pass that page token into the next request to paginate the next set of data.\n"
},
"vulnerability_test_results": {
"enum": [
true
],
"description": "Includes vulnerability test results from the last 14 days for each service in the response."
}
}
},
"GetServicesRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/GetServicesRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"ExternalService": {
"type": "object",
"properties": {
"service_id": {
"type": "string"
},
"service_name": {
"type": "string"
},
"service_type": {
"type": "string"
},
"ip_address": {
"type": "array",
"items": {
"type": "string"
}
},
"domain": {
"type": "array",
"items": {
"type": "string"
}
},
"externally_detected_providers": {
"type": "array",
"items": {
"type": "string"
}
},
"is_active": {
"type": "string"
},
"first_observed": {
"type": "integer"
},
"last_observed": {
"type": "integer"
},
"port": {
"type": "integer"
},
"protocol": {
"type": "string"
},
"active_classifications": {
"type": "array",
"items": {
"type": "string"
}
},
"inactive_classifications": {
"type": "array",
"items": {
"type": "string"
}
},
"discovery_type": {
"type": "string"
},
"externally_inferred_vulnerability_score": {
"type": "string"
},
"externally_inferred_cves": {
"type": "array",
"items": {
"type": "string"
}
},
"tls_versions": {
"type": "array",
"items": {
"$ref": "#/components/schemas/TlsVersion"
}
},
"inferred_cves_observed": {
"type": "array",
"items": {
"$ref": "#/components/schemas/InferredCvesObserved"
}
},
"cloud_management_status": {
"type": "string"
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"vulnerability_test_status": {
"type": "string"
},
"confirmed_vulnerable_cve_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"confirmed_not_vulnerable_cve_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"ipv6_address": {
"type": "array",
"items": {
"type": "string"
}
},
"asm_asset_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"geolocations": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Geolocation"
}
},
"business_units": {
"type": "array",
"items": {
"type": "array",
"items": {
"$ref": "#/components/schemas/BusinessUnitHierarchy"
}
}
},
"service_versions": {
"type": "array",
"items": {
"type": "string"
}
}
}
},
"GetServicesReply": {
"type": "object",
"properties": {
"total_count": {
"type": "integer"
},
"result_count": {
"type": "integer"
},
"external_services": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ExternalService"
}
},
"next_page_token": {
"type": "string",
"description": "This attribute is only returned if use_page_token is provided in the request with value true"
}
},
"additionalProperties": true
},
"GetServicesResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/GetServicesReply"
}
},
"additionalProperties": true
},
"GetWebsiteDetailsRequestData": {
"type": "object",
"properties": {
"website_id_list": {
"type": "array",
"minItems": 1,
"maxItems": 20,
"items": {
"type": "string"
},
"description": "A string representing the website ID you want to get details for. Limit is 20 website ids"
}
},
"additionalProperties": true,
"description": "A dictionary containing the API request fields."
},
"GetWebsiteDetailsRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/GetWebsiteDetailsRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"PageElement": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"value": {
"type": "string"
}
},
"additionalProperties": true
},
"Page": {
"type": "object",
"properties": {
"url": {
"type": "string"
},
"message": {
"type": "string"
},
"elements": {
"type": "array",
"items": {
"$ref": "#/components/schemas/PageElement"
}
}
},
"additionalProperties": true
},
"SecurityAssessmentDetails": {
"type": "object",
"properties": {
"pages": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Page"
}
},
"description": {
"type": "string"
}
},
"additionalProperties": true
},
"SecurityAssessment": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"priority": {
"type": "integer"
},
"score": {
"type": "integer"
},
"securityAssessmentDetails": {
"$ref": "#/components/schemas/SecurityAssessmentDetails"
}
},
"additionalProperties": true
},
"WebsiteAsset": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"assetType": {
"type": "string"
}
},
"required": [
"assetType",
"id",
"name"
],
"additionalProperties": true
},
"WebsiteUrl": {
"type": "object",
"properties": {
"url": {
"type": "string"
},
"ip": {
"type": "string"
},
"observed": {
"type": "integer"
}
},
"required": [
"ip",
"observed",
"url"
],
"additionalProperties": true
},
"WebsiteEvidencePattern": {
"type": "object",
"properties": {
"type": {
"type": "string"
},
"regex": {
"type": "string"
},
"value": {
"type": "string"
}
},
"required": [
"regex",
"type",
"value"
],
"additionalProperties": true
},
"WebsiteEvidence": {
"type": "object",
"properties": {
"impliedBy": {
"type": "array",
"items": {
"type": "string"
}
},
"patterns": {
"type": "array",
"items": {
"$ref": "#/components/schemas/WebsiteEvidencePattern"
}
}
},
"required": [
"impliedBy",
"patterns"
],
"additionalProperties": true
},
"TechnologyDetails": {
"type": "object",
"properties": {
"confidence": {
"type": "number"
},
"urls": {
"type": "array",
"items": {
"$ref": "#/components/schemas/WebsiteUrl"
}
},
"evidence": {
"$ref": "#/components/schemas/WebsiteEvidence"
}
},
"additionalProperties": true
},
"WebsiteTechnologies": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"version": {
"type": "string"
},
"cpe": {
"type": "string"
},
"categoryIds": {
"type": "array",
"items": {
"type": "integer"
}
},
"technologyDetails": {
"$ref": "#/components/schemas/TechnologyDetails"
},
"name": {
"type": "string"
}
},
"additionalProperties": true
},
"WebsiteThirdPartyResourceDetails": {
"type": "object",
"properties": {
"observed": {
"type": "integer"
}
},
"required": [
"observed"
],
"additionalProperties": true
},
"WebsiteThirdPartyResource": {
"type": "object",
"properties": {
"url": {
"type": "string"
},
"type": {
"type": "string"
},
"thirdPartyResourceDetails": {
"$ref": "#/components/schemas/WebsiteThirdPartyResourceDetails"
}
},
"additionalProperties": true
},
"FormField": {
"type": "object",
"properties": {
"name": {
"type": "string"
},
"maxLength": {
"type": "integer"
},
"required": {
"type": "boolean"
},
"dataType": {
"type": "string"
}
},
"required": [
"dataType",
"maxLength",
"name",
"required"
],
"additionalProperties": true
},
"FormDetails": {
"type": "object",
"properties": {
"fields": {
"type": "array",
"items": {
"$ref": "#/components/schemas/FormField"
}
}
},
"required": [
"fields"
],
"additionalProperties": true
},
"WebsiteForm": {
"type": "object",
"properties": {
"url": {
"type": "string"
},
"action": {
"type": "string"
},
"purpose": {
"type": "string"
},
"formDetails": {
"$ref": "#/components/schemas/FormDetails"
}
},
"required": [
"action",
"formDetails",
"purpose",
"url"
],
"additionalProperties": true
},
"WebsiteIp": {
"type": "object",
"properties": {
"ip": {
"type": "string"
},
"lastObserved": {
"type": "integer"
},
"firstObserved": {
"type": "integer"
}
},
"required": [
"firstObserved",
"ip",
"lastObserved"
],
"additionalProperties": true
},
"WebsiteScreenshot": {
"type": "object",
"properties": {
"url": {
"type": "string"
},
"ip": {
"type": "string"
},
"size": {
"type": "integer"
},
"observed": {
"type": "integer"
}
},
"required": [
"ip",
"observed",
"size",
"url"
],
"additionalProperties": true
},
"WebsiteNestedDetails": {
"type": "object",
"properties": {
"ips": {
"type": "array",
"items": {
"$ref": "#/components/schemas/WebsiteIp"
}
},
"screenshots": {
"type": "array",
"items": {
"$ref": "#/components/schemas/WebsiteScreenshot"
}
}
},
"additionalProperties": true
},
"Website": {
"type": "object",
"properties": {
"website_id": {
"type": "string"
},
"host": {
"type": "string"
},
"protocol": {
"type": "string"
},
"is_active": {
"type": "string"
},
"site_categories": {
"type": "array",
"items": {
"type": "string"
}
},
"technology_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"first_observed": {
"type": "integer"
},
"last_observed": {
"type": "integer"
},
"provider_names": {
"type": "array",
"items": {
"type": "string"
}
},
"ips": {
"type": "array",
"items": {
"type": "string"
}
},
"port": {
"type": "integer"
},
"active_service_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"http_type": {
"type": "string"
},
"security_assessments": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SecurityAssessment"
}
},
"rootPageHttpStatusCode": {
"type": "string"
},
"isNonConfiguredHost": {
"type": "boolean"
},
"externally_inferred_vulnerability_score": {
"type": "number"
},
"externally_inferred_cves": {
"type": "array",
"items": {
"type": "string"
}
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"assets": {
"type": "array",
"items": {
"$ref": "#/components/schemas/WebsiteAsset"
}
},
"technologies": {
"type": "array",
"items": {
"$ref": "#/components/schemas/WebsiteTechnologies"
}
},
"third_party_resources": {
"type": "array",
"items": {
"$ref": "#/components/schemas/WebsiteThirdPartyResource"
}
},
"forms": {
"type": "array",
"items": {
"$ref": "#/components/schemas/WebsiteForm"
}
},
"details": {
"$ref": "#/components/schemas/WebsiteNestedDetails"
}
},
"additionalProperties": true
},
"WebsiteDetails": {
"type": "object",
"properties": {
"details": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Website"
}
}
},
"additionalProperties": true
},
"GetWebsiteDetailsResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/WebsiteDetails"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"ExternalWebsitesFilter": {
"type": "object",
"x-examples": {
"Example 1": {
"field": "ips",
"operator": "eq",
"value": "string"
}
},
"properties": {
"field": {
"type": "string",
"enum": [
"ips",
"technology_ids",
"http_type",
"is_active",
"provider_names",
"tags",
"active_service_ids",
"third_party_script_domains",
"host",
"authentication",
"site_categories",
"business_units_list"
],
"description": "String that identifies the external service field the filter is matching. Filters are based on the following case-sensitive keywords:\n "
},
"operator": {
"type": "string",
"enum": [
"in",
"contains",
"eq",
"neq",
"not_contains"
],
"description": "String that identifies the comparison operator you want to use for this filter. Valid operator keywords and corresponding filter fields are:\n - **contains**/**not_contains**- used with `active_service_ids`, `authentication`, `host`, `provider_names`, `site_categories`, `technology_ids`, `third_party_script_domains` \n - **eq**/**ne** - used with `ips`, `host`\n - **in** - used with `is_active`, `http_type`, `tags`, `ips`\n"
},
"value": {
"oneOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
},
{
"type": "boolean"
}
],
"description": "Value that the filter must match. The contents of this field will differ depending on the website field that you specified for this filter:\n - **host** - string\n - **is_active** - values are `yes` or `no`\n - **technology_ids** - list of strings\n - **provider_names** - string\n - **site_categories** - string\n - **active_service_ids** - list of strings\n - **ips** - list of strings\n - **tags** - list of strings\n - **http_type** - values are `http_only`, `http_redirects_to_https`, `https_only`\n - **third_party_script_domains** - list of strings\n - **authentication** - string\n - **business_units_list** - list of business unit names\n"
}
}
},
"ExternalWebsitesSort": {
"type": "object",
"properties": {
"field": {
"type": "string",
"default": "host",
"enum": [
"first_observed",
"host",
"last_observed"
],
"description": "Valid values are:\n - `host`\n - `first_observed`\n - `last_observed`\n"
},
"keyword": {
"type": "string",
"default": "asc",
"enum": [
"ASC",
"asc",
"DESC",
"desc"
],
"description": "Valid values are:\n - ASC - ascending order\n - DESC - descending order\n ASC is the default.\n"
}
},
"additionalProperties": true,
"description": "Identifies the sort order for the result set. Values are case sensitive. The default sort is defined as `is_active` and `ASC`."
},
"GetWebsitesRequestData": {
"type": "object",
"description": "A dictionary containing the API request fields. An empty dictionary returns all results.",
"properties": {
"filters": {
"type": "array",
"description": "Array of filter fields. Each JSON object must contain a field, operator, and value.",
"items": {
"$ref": "#/components/schemas/ExternalWebsitesFilter"
}
},
"search_from": {
"type": "integer",
"default": 0,
"minimum": 0,
"description": "An integer representing the start offset index of results
Default value - 0\n"
},
"search_to": {
"type": "integer",
"default": 500,
"minimum": 0,
"description": "An integer representing the start offset index of results. Use this field to specify the number of results on a page when using page token pagination.
Default value - 500\n"
},
"sort": {
"$ref": "#/components/schemas/ExternalWebsitesSort"
},
"use_page_token": {
"type": "boolean",
"description": "Use `\"use_page_token\":true` in the initial request to paginate the response data.\n"
},
"next_page_token": {
"type": "string",
"description": "If `\"use_page_token\":true` was included in the initial request, the response for that request will include a page token.
Use `\"next_page_token\":\"string\"` to pass that page token into the next request to paginate the next set of data.\n"
}
}
},
"GetWebsitesRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/GetWebsitesRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"ExternalWebsite": {
"type": "object",
"properties": {
"website_id": {
"type": "string"
},
"host": {
"type": "string"
},
"protocol": {
"type": "string"
},
"is_active": {
"type": "string"
},
"site_categories": {
"type": "array",
"items": {
"type": "string"
}
},
"technology_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"first_observed": {
"type": "integer"
},
"last_observed": {
"type": "integer"
},
"provider_names": {
"type": "array",
"items": {
"type": "string"
}
},
"ips": {
"type": "array",
"items": {
"type": "string"
}
},
"port": {
"type": "integer"
},
"active_service_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"http_type": {
"type": "string"
},
"third_party_script_domains": {
"type": "array",
"items": {
"type": "string"
}
},
"security_assessments": {
"type": "array",
"items": {
"$ref": "#/components/schemas/SecurityAssessment"
}
},
"authentication": {
"type": "array",
"items": {
"type": "string"
}
},
"rootPageHttpStatusCode": {
"type": "string"
},
"isNonConfiguredHost": {
"type": "boolean"
},
"externally_inferred_vulnerability_score": {
"type": "number"
},
"externally_inferred_cves": {
"type": "array",
"items": {
"type": "string"
}
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": true
},
"GetWebsitesReply": {
"type": "object",
"properties": {
"total_count": {
"type": "integer"
},
"result_count": {
"type": "integer"
},
"websites": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ExternalWebsite"
}
},
"next_page_token": {
"type": "string",
"description": "This attribute is only returned if use_page_token is provided in the request with value true"
}
},
"additionalProperties": true
},
"GetWebsitesResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/GetWebsitesReply"
}
},
"additionalProperties": true
},
"OverrideBusForAsmAssetsFilter": {
"type": "object",
"properties": {
"field": {
"type": "string",
"enum": [
"name",
"has_xdr_agent",
"ip_address",
"externally_detected_providers",
"type",
"has_active_external_services",
"mac_addresses",
"externally_inferred_cves",
"aws_cloud_tags",
"gcp_cloud_tags",
"azure_cloud_tags",
"tags",
"business_units_list",
"ipv6_address",
"has_bu_overrides",
"asm_id_list"
]
},
"operator": {
"type": "string",
"enum": [
"in",
"contains",
"neq",
"eq",
"not_contains"
]
},
"value": {
"oneOf": [
{
"type": "string"
},
{
"type": "boolean"
},
{
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "Value that the filter must match. The contents of this field will differ depending on the asset field that you specified for this filter:\n - name: eq, neq - string\n - type: in - list of strings\n - has_xdr_agent: eq, neq - boolean\n - ip_address: eq, neq - string\n - ipv6_address: eq, neq - string\n - externally_detected_providers: contains - string\n - has_active_external_services: eq, neq - boolean\n - mac_addresses: eq, neq - string\n - externally_inferred_cves: contains, not_contains - string\n - tags: contains, not_contains - list of strings\n - business_units_list: contains, not_contains - list of strings in format BU: uuid\n - has_bu_overrides: eq, neq - boolean\n - asm_id_list: in - list of strings\n"
}
},
"additionalProperties": true
},
"OverrideBusForAsmAssetsRequestData": {
"type": "object",
"properties": {
"filters": {
"type": "array",
"items": {
"$ref": "#/components/schemas/OverrideBusForAsmAssetsFilter"
}
},
"business_units": {
"type": "array",
"description": "List of strings in format BU: uuid.",
"items": {
"type": "string"
}
},
"include_subdomains": {
"type": "boolean",
"description": "Indicates whether these tags should propagate to subdomains."
}
}
},
"OverrideBusForAsmAssetsRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/OverrideBusForAsmAssetsRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"AssignTagsToAsmEntitiesReply": {
"type": "object",
"properties": {
"assign_tags": {
"type": "string",
"description": "succeeded if request was successful"
}
},
"required": [
"assign_tags"
],
"additionalProperties": true
},
"AssignTagsToAsmEntitiesResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/AssignTagsToAsmEntitiesReply"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"AsmAssetNotePatch": {
"type": "object",
"properties": {
"entity_id": {
"type": "string",
"description": ""
},
"entity_type": {
"type": "string",
"enum": [
"asset",
"ip_range"
],
"description": "Values are `asset` or `ip_range`."
},
"annotation": {
"type": "string",
"description": "Annotation text."
}
},
"additionalProperties": true
},
"UpdateAsmAssetNoteRequestData": {
"type": "object",
"properties": {
"assets": {
"type": "array",
"items": {
"$ref": "#/components/schemas/AsmAssetNotePatch"
},
"description": "List of dictionaries that refer to assets."
},
"should_append": {
"type": "boolean",
"default": true,
"description": "`True` append the annotation to the existing annotation.
`False` replaces the existing annotation.
The default is `true`.\n"
}
},
"additionalProperties": true,
"description": "A dictionary containing the API request fields."
},
"UpdateAsmAssetNoteRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/UpdateAsmAssetNoteRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"UpdateAsmAssetNoteResponse": {
"type": "object",
"properties": {
"reply": {
"type": "string",
"description": "Reply indicates `succeeded` if the annotation was updated."
}
},
"additionalProperties": true
},
"AttackSurfaceRulesFilter": {
"type": "object",
"properties": {
"field": {
"type": "string",
"enum": [
"attack_surface_rule_id",
"category",
"priority",
"enabled_status",
"asm_alert_categories"
],
"description": "Identifies the alert field the filter is matching. Filters are based on the following keywords:\n - enabled_status\n - category\n - priority\n - attack_surface_rule_id\n - asm_alert_categories\n"
},
"operator": {
"type": "string",
"enum": [
"in"
],
"description": "String that identifies the comparison operator you want to use for this filter. \n - in\n"
},
"value": {
"oneOf": [
{
"type": "string"
},
{
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter"
}
}
},
"GetAttackSurfaceRulesSort": {
"type": "object",
"properties": {
"field": {
"type": "string",
"default": "created",
"enum": [
"enabled_status",
"priority",
"category",
"attack_surface_rule_id",
"attack_surface_rule_name",
"created"
]
},
"keyword": {
"type": "string",
"default": "desc",
"enum": [
"ASC",
"asc",
"DESC",
"desc"
],
"description": "Can either be ASC (ascending order) or DESC (descending order)."
}
},
"additionalProperties": true,
"description": "Identifies the sort order for the result set. By default, the sort is defined as created, DESC."
},
"GetAttackSurfaceRulesRequestData": {
"type": "object",
"properties": {
"filters": {
"type": "array",
"items": {
"$ref": "#/components/schemas/AttackSurfaceRulesFilter"
},
"description": "Provides an array of filtered fields. Each JSON object can contain the following keywords:\n - field\n - operators\n - value\n"
},
"search_from": {
"type": "integer",
"default": 0,
"minimum": 0,
"description": "An integer representing the starting offset within the query result set from which you want attack surface rules returned"
},
"search_to": {
"type": "integer",
"default": 500,
"minimum": 0,
"description": "An integer representing the end offset within the result set after which you do not want attack surface rules returned.
Attack surface rules in the alerts list that are indexed higher than this value are not returned in the final results set. \n"
},
"sort": {
"$ref": "#/components/schemas/GetAttackSurfaceRulesSort"
}
},
"additionalProperties": true,
"description": "(Required) A dictionary containing the API request fields.
An empty dictionary returns all results."
},
"GetAttackSurfaceRulesRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/GetAttackSurfaceRulesRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"AttackSurfaceRule": {
"type": "object",
"properties": {
"attack_surface_rule_name": {
"type": "string"
},
"enabled_status": {
"type": "string"
},
"priority": {
"type": "string"
},
"description": {
"type": "string"
},
"attack_surface_rule_id": {
"type": "string"
},
"category": {
"type": "string"
},
"knowledge_base_link": {
"type": "string"
},
"created": {
"type": "integer"
},
"modified": {
"type": "integer"
},
"modified_by": {
"type": "string"
},
"remediation_guidance": {
"type": "string"
},
"asm_alert_categories": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"asm_alert_categories",
"attack_surface_rule_id",
"attack_surface_rule_name",
"category",
"created",
"description",
"enabled_status",
"modified",
"priority",
"remediation_guidance"
],
"additionalProperties": true
},
"AttackSurfaceRulesPage": {
"type": "object",
"properties": {
"total_count": {
"type": "integer",
"minimum": 0
},
"result_count": {
"type": "integer",
"minimum": 0
},
"attack_surface_rules": {
"type": "array",
"items": {
"$ref": "#/components/schemas/AttackSurfaceRule"
}
}
},
"required": [
"attack_surface_rules",
"result_count",
"total_count"
],
"additionalProperties": true
},
"GetAttackSurfaceRulesResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/AttackSurfaceRulesPage"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"ManagementLogsFilterApi": {
"type": "object",
"properties": {
"field": {
"type": "string",
"enum": [
"email",
"type",
"sub_type",
"result",
"timestamp",
"audit_id"
]
},
"operator": {
"type": "string",
"enum": [
"in",
"neq",
"eq",
"lte",
"gte"
]
},
"value": {
"type": "integer"
}
},
"additionalProperties": true
},
"GetManagementLogsSortApi": {
"type": "object",
"properties": {
"field": {
"type": "string",
"default": "timestamp",
"enum": [
"sub_type",
"result",
"timestamp",
"audit_id",
"type"
]
},
"keyword": {
"type": "string",
"default": "desc",
"enum": [
"ASC",
"asc",
"DESC",
"desc"
]
}
},
"additionalProperties": true
},
"GetManagementLogsRequestDataApi": {
"type": "object",
"properties": {
"filters": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ManagementLogsFilterApi"
}
},
"search_from": {
"type": "integer",
"default": 0,
"minimum": 0
},
"search_to": {
"type": "integer",
"default": 100,
"minimum": 0
},
"sort": {
"$ref": "#/components/schemas/GetManagementLogsSortApi"
}
}
},
"GetManagementLogsRequestApi": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/GetManagementLogsRequestDataApi"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"ManagementLogApi": {
"type": "object",
"properties": {
"AUDIT_ID": {
"type": "integer"
},
"AUDIT_OWNER_NAME": {
"type": "string"
},
"AUDIT_OWNER_EMAIL": {
"type": "string"
},
"AUDIT_ASSET_JSON": {
"type": "object",
"nullable": true
},
"AUDIT_ASSET_NAMES": {
"type": "string",
"nullable": true
},
"AUDIT_HOSTNAME": {
"type": "string",
"nullable": true
},
"AUDIT_RESULT": {
"type": "string"
},
"AUDIT_REASON": {
"type": "string",
"nullable": true
},
"AUDIT_DESCRIPTION": {
"type": "string",
"nullable": true
},
"AUDIT_ENTITY": {
"type": "string",
"enum": [
"LIVE_TERMINAL",
"RULES",
"RULES_EXCEPTIONS",
"AUTH",
"RESPONSE",
"INCIDENT_MANAGEMENT",
"ALERT_MANAGEMENT",
"INCIDENT_TIMELINE_EVENT",
"ENDPOINT_MANAGEMENT",
"ENDPOINT_GROUPS",
"ALERT_WHITELIST",
"PUBLIC_API",
"DISTRIBUTIONS",
"STARRED_INCIDENTS",
"POLICY_PROFILES",
"DEVICE_CONTROL_PROFILES",
"DEVICE_CONTROL_POLICY",
"PROTECTION_PROFILES",
"DEVICE_CONTROL_PROFILE",
"HOST_FIREWALL_PROFILE",
"HOST_DISK_ENCRYPTION_PROFILE",
"POLICY_RULES",
"PROTECTION_POLICY",
"DEVICE_CONTROL_TEMP_EXCEPTIONS",
"DEVICE_CONTROL_GLOBAL_EXCEPTIONS",
"DEVICE_CONTROL_CUSTOM_DEVICE",
"GLOBAL_EXCEPTIONS",
"MSSP",
"REPORTING",
"DASHBOARD",
"BROKER_API",
"BROKER_VM",
"MTH",
"MDR",
"ALERT_NOTIFICATIONS",
"INTEGRATIONS",
"QUERY",
"SCRIPT_EXECUTION",
"ALERT_RULES",
"COLLECTION",
"API_KEY",
"EDL",
"VA_RESCAN_ENDPOINT",
"HI_RESCAN_ENDPOINT",
"REMEDIATION",
"INGEST_DATA",
"LICENSING",
"AGENT_CONFIGURATION",
"PERMISSIONS",
"SCORING_RULES",
"LAYOUT_RULES",
"PLAYBOOK_TRIGGERS",
"FEATURED_ALERT_FIELDS",
"SYSTEM",
"TENANT_TAKEOVER",
"SCOUTER_POLICY",
"SCOUTER_PROFILE",
"SCOUTER_GROUPS",
"ALLOWED_DOMAINS",
"QUERY_LIBRARY",
"TENANT_CONFIGURATION",
"SCOUTER_CONFIGURATION",
"HOST_FIREWALL",
"XIF",
"XDM",
"ACTION_CENTER",
"XCLOUD_INTEGRATION",
"DATASETS",
"XSOAR",
"SECURITY_SETTINGS",
"ALERT_EXCLUSION",
"INDICATOR_RULES",
"EVENT_FORWARDING",
"ASSET_INVENTORY",
"SERVER_SETTINGS",
"ASSET_ROLES",
"CUSTOM_FIELDS",
"AUTOMATION_RULES",
"AGENT_EXCEPTION_RULES",
"REMEDIATION_PATH_RULES"
]
},
"AUDIT_ENTITY_SUBTYPE": {
"type": "string"
},
"AUDIT_SESSION_ID": {
"type": "string",
"nullable": true
},
"AUDIT_CASE_ID": {
"type": "string",
"nullable": true
},
"AUDIT_INSERT_TIME": {
"type": "integer"
},
"AUDIT_SEVERITY": {
"type": "string"
},
"AUDIT_LINK": {
"type": "string",
"nullable": true
},
"AUDIT_SOURCE_IP": {
"type": "string"
},
"AUDIT_USER_AGENT": {
"type": "string"
},
"AUDIT_USER_ROLES": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": true
},
"ManagementLogsPageApi": {
"type": "object",
"properties": {
"total_count": {
"type": "integer",
"minimum": 0
},
"result_count": {
"type": "integer",
"minimum": 0
},
"data": {
"type": "array",
"items": {
"$ref": "#/components/schemas/ManagementLogApi"
}
}
},
"required": [
"data",
"result_count",
"total_count"
],
"additionalProperties": true
},
"GetManagementLogsResponseApi": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/ManagementLogsPageApi"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"AlertFilter": {
"type": "object",
"properties": {
"field": {
"type": "string",
"enum": [
"business_units_list",
"tags",
"asm_alert_categories",
"attack_surface_rule_id",
"alert_id_list",
"external_id_list",
"alert_source",
"creation_time",
"last_modified_ts",
"server_creation_time",
"severity",
"status",
"attack_surface_rule_name",
"host_name",
"xpanse_policy_id",
"case_id_list",
"cloud_management_status",
"integration_source",
"aws_cloud_tags",
"gcp_cloud_tags",
"azure_cloud_tags",
"first_observed",
"last_observed"
],
"description": "Identifies the alert fields the filter is matching. \n "
},
"operator": {
"type": "string",
"enum": [
"gte",
"lte",
"in",
"range",
"relative_timestamp"
],
"description": "String that identifies the comparison operator you want to use for this filter. Possible values:\n - **in**— use with `alert_id_list`, `alert_source`, `asm_alert_categories`, `case_id_list`, `business_units_list`, `cloud_management_status`, `tags`, `xpanse_policy_id`, `severity`, `integration_source`\n - **gte**— Filters data from a specific timestamp onwards. Use with `creation_time`, `first_observed`, `last_observed`.\n - **lte**— Filters data up to a specific timestamp. Use with `creation_time`, `first_observed`, `last_observed`.\n - **range**— Filters data between two specific timestamps. Use with `first_observed`, `last_observed`.\n - **relative_timestamp**— Filters data relative to the current time (e.g., last 30 days). Use with `first_observed`, `last_observed`."
},
"value": {
"oneOf": [
{
"type": "string"
},
{
"type": "integer"
},
{
"type": "array",
"items": {
"type": "string"
}
}
],
"description": "Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter:\n - **alert_id_list** — List of integers. Each item in the list must be an alert ID.\n - **alert_source** — List of strings.\n - **asm_alert_categories** — List of strings. Example values: \"Development Infrastructure\", \"Unpatched, Misconfigured, and end-of-life (EOL) systems\".\n - **business_units_list** — String or list of strings in the format \"BU name\" or \"BU:BU name\", for example “Acme & Co, Inc.” or “BU:Acme & Co, Inc.”\n - **case_id_list** — List of integers. Each item in the list must be a case ID.\n - **cloud_management_status** — String. Values are `Managed Cloud`, `Unmanaged Cloud`, and `Not Applicable`.\n - **creation_time** — Integer representing the number of seconds or milliseconds after the Unix epoch, UTC timezone. The value is returned in the response under the detection_timestamp field and represented in the console under the TIMESTAMP field.\n - **external_id_list**— List of strings representing external IDs.\n - **first_observed** — Values in milliseconds format\n - with **gte** or **lte** operator, specify a specific date or time as a timestamp in milliseconds format\n - with **range** operator, specify \"to\" and \"from\" values as timestamps in milliseconds format\n \"value\": { \"from\": \"{{previous30Days}}\",\"to\": \"{{previous7Days}}\"\n - with **relative_timestamp** operator, specify time interval to look back on (24H, 7D, 30D, etc.) as a value in milliseconds format\n - **integration_source** — Valid values: `AWS`, `AZURE`, `GOOGLE`, `PRISMA_CLOUD`\n - **last_observed** — values in milliseconds format\n - with **gte** or **lte** operator, specify a specific date or time as a timestamp in milliseconds format\n - with **range** operator, specify \"to\" and \"from\" values as timestamps in milliseconds format, as follows\n \"value\": { \"from\": \"{{previous30Days}}\",\"to\": \"{{previous7Days}}\"\n - with **relative_timestamp** operator, specify time interval to look back on (24H, 7D, 30D, etc.) as a value in milliseconds format\n - **severity** — Valid values: `low`, `medium`, `high`, `critical`, `informational`\n - **status** — Valid values: `new`, `reopened`, `resolved_no_risk`, `resolved_risk_accepted`, `resolved_no_longer_observed`, `resolved_contested_asset`, `resolved_remediated_automatically`, `resolved`, `under_investigation`.\n - **tags** — List of strings indicating the tags to filter on in the format `\"tag-family:tag-name\"`, for example `\"AR:registered to you\"`.\n - **xpanse_policy_id** — List of strings representing the xpanse policy IDs."
}
}
},
"AlertSort": {
"type": "object",
"properties": {
"field": {
"type": "string",
"default": "creation_time",
"enum": [
"creation_time",
"severity",
"server_creation_time"
],
"description": "Can either be `severity` or `creation_time`."
},
"keyword": {
"type": "string",
"default": "desc",
"enum": [
"ASC",
"asc",
"DESC",
"desc"
],
"description": "Can either be ASC (ascending order) or DESC (descending order). Case sensitive."
}
},
"additionalProperties": true,
"description": "Identifies the sort order for the result set. "
},
"GetAlertsMultiEventsRequestData": {
"type": "object",
"description": "A dictionary containing the API request fields. An empty dictionary returns all results.\n",
"properties": {
"filters": {
"type": "array",
"description": "An array of filter fields.",
"items": {
"$ref": "#/components/schemas/AlertFilter"
}
},
"search_from": {
"type": "integer",
"default": 0,
"minimum": 0,
"description": "An integer representing the starting offset within the query result set from which you want alerts returned. Alerts are returned as a zero-based list. Any alert indexed less than this value is not returned in the final result set and defaults to zero.\n"
},
"search_to": {
"type": "integer",
"default": 100,
"minimum": 0,
"description": "An integer representing the end offset within the result set after which you do not want alerts returned. Alerts in the alerts list that are indexed higher than this value are not returned in the final results set. Defaults to 100, which returns all alerts to the end of the list. Use this field to specify the number of results on a page when using page token pagination.\n
Max value - 100\n"
},
"sort": {
"$ref": "#/components/schemas/AlertSort"
},
"use_page_token": {
"type": "boolean",
"description": "Use `\"use_page_token\":true` in the initial request to paginate the response data.\n"
},
"next_page_token": {
"type": "string",
"description": "If `\"use_page_token\":true` was included in the initial request, the response for that request will include a page token. Use `\"next_page_token\":\"string\"` to pass that page token into the next request to paginate the next set of data."
}
},
"x-examples": {
"Example 1": {
"request_data": {
"filters": [
{
"field": "severity",
"operator": "in",
"value": [
"medium",
"high"
]
}
]
}
}
}
},
"GetAlertsMultiEventsRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/GetAlertsMultiEventsRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"IncidentCertificate": {
"type": "object",
"properties": {
"issuerName": {
"type": "string"
},
"subjectName": {
"type": "string"
},
"validNotBefore": {
"type": "integer"
},
"validNotAfter": {
"type": "integer"
},
"serialNumber": {
"type": "string"
}
},
"additionalProperties": true
},
"AssetIdentifiers": {
"type": "object",
"properties": {
"domain": {
"type": "string"
},
"certificate": {
"$ref": "#/components/schemas/IncidentCertificate"
},
"ipv4Address": {
"type": "string"
},
"ipv6Address": {
"type": "string"
},
"httpPath": {
"type": "string"
},
"portNumber": {
"type": "integer"
},
"portProtocol": {
"type": "string"
},
"firstObserved": {
"type": "integer"
},
"lastObserved": {
"type": "integer"
}
},
"additionalProperties": true
},
"Alert": {
"type": "object",
"properties": {
"category": {
"type": "string"
},
"project": {
"type": "string"
},
"cloud_provider": {
"type": "string"
},
"resource_sub_type": {
"type": "string"
},
"resource_type": {
"type": "string"
},
"action_country": {
"type": "array",
"items": {
"type": "string"
}
},
"description": {
"type": "string"
},
"events": {
"type": "string"
},
"event_type": {
"type": "string"
},
"is_whitelisted": {
"type": "boolean"
},
"image_name": {
"type": "string"
},
"action_local_ip": {
"type": "string"
},
"action_local_port": {
"type": "string"
},
"mitre_tactic_id_and_name": {
"type": "array",
"items": {
"type": "string"
}
},
"mitre_technique_id_and_name": {
"type": "array",
"items": {
"type": "string"
}
},
"action_external_hostname": {
"type": "string"
},
"action_remote_ip": {
"type": "array",
"items": {
"type": "string"
}
},
"action_remote_port": {
"type": "array",
"items": {
"type": "integer"
}
},
"matching_service_rule_id": {
"type": "string"
},
"starred": {
"type": "boolean"
},
"external_id": {
"type": "string"
},
"severity": {
"type": "string"
},
"matching_status": {
"type": "string"
},
"end_match_attempt_ts": {
"type": "string"
},
"local_insert_ts": {
"type": "integer",
"description": "The UNIX timestamp that this record was written to the database"
},
"last_modified_ts": {
"type": "integer",
"description": "The UNIX timestamp that this record was last modified"
},
"case_id": {
"type": "integer"
},
"deduplicate_tokens": {
"type": "string"
},
"filter_rule_id": {
"type": "string"
},
"event_id": {
"type": "string"
},
"event_timestamp": {
"type": "array",
"items": {
"type": "integer"
}
},
"action_local_ip_v6": {
"type": "string"
},
"action_remote_ip_v6": {
"type": "array",
"items": {
"type": "string"
}
},
"alert_type": {
"type": "string"
},
"resolution_status": {
"type": "string"
},
"resolution_comment": {
"type": "string"
},
"dynamic_fields": {
"type": "string"
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"malicious_urls": {
"type": "string"
},
"asm_alert_categories": {
"type": "array",
"items": {
"type": "string"
}
},
"aws_cloud_tags": {
"type": "array",
"items": {
"type": "string"
}
},
"azure_cloud_tags": {
"type": "array",
"items": {
"type": "string"
}
},
"gcp_cloud_tags": {
"type": "array",
"items": {
"type": "string"
}
},
"last_observed": {
"type": "integer"
},
"country_codes": {
"type": "array",
"items": {
"type": "string"
}
},
"cloud_providers": {
"type": "array",
"items": {
"type": "string"
}
},
"ipv4_addresses": {
"type": "array",
"items": {
"type": "string"
}
},
"ipv6_addresses": {
"type": "array",
"items": {
"type": "string"
}
},
"domain_names": {
"type": "array",
"items": {
"type": "string"
}
},
"service_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"website_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"asset_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"certificate": {
"$ref": "#/components/schemas/IncidentCertificate"
},
"port_protocol": {
"type": "string"
},
"port_number": {
"type": "integer"
},
"cloud_management_status": {
"type": "string"
},
"business_unit_hierarchies": {
"type": "array",
"items": {
"type": "array",
"items": {
"$ref": "#/components/schemas/BusinessUnitHierarchy"
}
}
},
"attack_surface_rule_name": {
"type": "string"
},
"remediation_guidance": {
"type": "string"
},
"attack_surface_rule_id": {
"type": "string"
},
"asset_identifiers": {
"type": "array",
"items": {
"$ref": "#/components/schemas/AssetIdentifiers"
}
},
"integration_source": {
"type": "string"
},
"alert_id": {
"type": "string"
},
"detection_timestamp": {
"type": "integer"
},
"name": {
"type": "string"
},
"endpoint_id": {
"type": "string"
},
"host_ip": {
"type": "string"
},
"host_name": {
"type": "string"
},
"action": {
"type": "string"
},
"source": {
"type": "string"
},
"user_name": {
"type": "string"
},
"mac_addresses": {
"type": "string"
},
"action_pretty": {
"type": "string"
}
},
"additionalProperties": true
},
"GetAlertsMultiEventsPage": {
"type": "object",
"properties": {
"total_count": {
"type": "integer",
"description": "The number of total results of this filter without paging. If the filter returned 10,000 results or more than 9,999 will be the value and you can use paging to view the entire set of data."
},
"result_count": {
"type": "integer",
"description": "The number of alerts actually returned as result (integer)."
},
"alerts": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Alert"
},
"description": "A list of alerts."
},
"next_page_token": {
"type": "string",
"description": "This attribute is only returned if use_page_token is provided in the request with value true"
}
},
"required": [
"result_count",
"total_count"
],
"additionalProperties": true
},
"GetAlertsMultiEventsResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/GetAlertsMultiEventsPage"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"GetIncidentExtraDataRequestData": {
"type": "object",
"properties": {
"incident_id": {
"type": "string",
"description": "The ID of the incident for which you want to retrieve extra data."
},
"alerts_limit": {
"type": "integer",
"description": "The maximum number of related alerts in the incident that you want to retrieve.
Default: `1000`\n"
}
},
"required": [
"incident_id"
],
"additionalProperties": true,
"description": "A dictionary containing the API request fields."
},
"GetIncidentExtraDataRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/GetIncidentExtraDataRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"Cve": {
"type": "object",
"properties": {
"cveId": {
"type": "string"
},
"cvssScore": {
"type": "integer"
},
"epssScore": {
"type": "number"
},
"matchType": {
"type": "string"
},
"exploitMaturity": {
"type": "string"
},
"reportedExploitInTheWild": {
"type": "boolean"
},
"mostRecentReportedExploitDate": {
"type": "string"
},
"confidence": {
"type": "string"
}
},
"additionalProperties": true
},
"RiskFactorIssueType": {
"type": "object",
"properties": {
"displayName": {
"type": "string"
},
"issueTypeId": {
"type": "string"
}
},
"required": [
"displayName",
"issueTypeId"
],
"additionalProperties": true
},
"RiskFactor": {
"type": "object",
"properties": {
"attributeId": {
"type": "string"
},
"attributeName": {
"type": "string"
},
"issueTypes": {
"type": "array",
"items": {
"$ref": "#/components/schemas/RiskFactorIssueType"
}
}
},
"required": [
"attributeId",
"attributeName",
"issueTypes"
],
"additionalProperties": true
},
"XpanseRiskExplainer": {
"type": "object",
"properties": {
"cves": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Cve"
}
},
"riskFactors": {
"type": "array",
"items": {
"$ref": "#/components/schemas/RiskFactor"
}
},
"versionMatched": {
"type": "boolean"
}
},
"additionalProperties": true
},
"Incident": {
"type": "object",
"properties": {
"incident_id": {
"type": "string"
},
"is_blocked": {
"type": "boolean"
},
"incident_name": {
"type": "string"
},
"creation_time": {
"type": "integer"
},
"modification_time": {
"type": "integer"
},
"detection_time": {
"type": "integer"
},
"status": {
"type": "string"
},
"severity": {
"type": "string"
},
"description": {
"type": "string"
},
"assigned_user_mail": {
"type": "string"
},
"assigned_user_pretty_name": {
"type": "string"
},
"alert_count": {
"type": "integer"
},
"low_severity_alert_count": {
"type": "integer"
},
"med_severity_alert_count": {
"type": "integer"
},
"high_severity_alert_count": {
"type": "integer"
},
"critical_severity_alert_count": {
"type": "integer"
},
"user_count": {
"type": "integer"
},
"host_count": {
"type": "integer"
},
"notes": {
"type": "string"
},
"resolve_comment": {
"type": "string"
},
"resolved_timestamp": {
"type": "integer"
},
"manual_severity": {
"type": "string"
},
"manual_description": {
"type": "string"
},
"xdr_url": {
"type": "string"
},
"starred": {
"type": "boolean"
},
"starred_manually": {
"type": "boolean"
},
"hosts": {
"type": "array",
"items": {
"type": "string"
}
},
"incident_sources": {
"type": "array",
"items": {
"type": "string"
}
},
"rule_based_score": {
"type": "integer"
},
"manual_score": {
"type": "number"
},
"aggregated_score": {
"type": "integer"
},
"alerts_grouping_status": {
"type": "string"
},
"alert_categories": {
"type": "array",
"items": {
"type": "string"
}
},
"original_tags": {
"type": "array",
"items": {
"type": "string"
}
},
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"xpanse_risk_score": {
"type": "integer"
},
"xpanse_risk_explainer": {
"$ref": "#/components/schemas/XpanseRiskExplainer"
},
"cloud_management_status": {
"type": "string"
},
"integration_source": {
"type": "string"
},
"ipv4_addresses": {
"type": "array",
"items": {
"type": "string"
}
},
"ipv6_addresses": {
"type": "array",
"items": {
"type": "string"
}
},
"domain_names": {
"type": "array",
"items": {
"type": "string"
}
},
"port_number": {
"type": "integer"
},
"asset_ids": {
"type": "array",
"items": {
"type": "string",
"format": "uuid"
}
},
"ip_range_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"website_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"service_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"last_observed": {
"type": "integer"
},
"cloud_providers": {
"type": "array",
"items": {
"type": "string"
}
},
"country_codes": {
"type": "array",
"items": {
"type": "string"
}
},
"certificate_common_names": {
"type": "array",
"items": {
"type": "string"
}
},
"certificate_issuers": {
"type": "array",
"items": {
"type": "string"
}
}
},
"additionalProperties": true
},
"IncidentExtraData": {
"type": "object",
"properties": {
"category": {
"type": "string"
},
"project": {
"type": "string"
},
"cloud_provider": {
"type": "string"
},
"resource_sub_type": {
"type": "string"
},
"resource_type": {
"type": "string"
},
"action_country": {
"type": "string"
},
"event_type": {
"type": "string"
},
"is_whitelisted": {
"type": "boolean"
},
"mac": {
"type": "string"
},
"image_name": {
"type": "string"
},
"action_local_ip": {
"type": "string"
},
"action_local_port": {
"type": "string"
},
"action_external_hostname": {
"type": "string"
},
"action_remote_ip": {
"type": "array",
"items": {
"type": "string"
}
},
"action_remote_port": {
"type": "integer"
},
"matching_service_rule_id": {
"type": "string"
},
"starred": {
"type": "boolean"
},
"external_id": {
"type": "string"
},
"severity": {
"type": "string"
},
"matching_status": {
"type": "string"
},
"end_match_attempt_ts": {
"type": "string"
},
"local_insert_ts": {
"type": "integer",
"description": "The UNIX timestamp that this record was written to the database"
},
"last_modified_ts": {
"type": "integer",
"description": "The UNIX timestamp that this record was last modified"
},
"case_id": {
"type": "integer"
},
"deduplicate_tokens": {
"type": "string"
},
"filter_rule_id": {
"type": "string"
},
"event_id": {
"type": "string"
},
"event_timestamp": {
"type": "integer"
},
"action_local_ip_v6": {
"type": "string"
},
"action_remote_ip_v6": {
"type": "string"
},
"alert_type": {
"type": "string"
},
"resolution_status": {
"type": "string"
},
"resolution_comment": {
"type": "string"
},
"dynamic_fields": {
"type": "string"
},
"tags": {
"type": "string"
},
"malicious_urls": {
"type": "string"
},
"asm_alert_categories": {
"type": "string"
},
"last_observed": {
"type": "integer"
},
"country_codes": {
"type": "string"
},
"cloud_providers": {
"type": "string"
},
"ipv4_addresses": {
"type": "string"
},
"ipv6_addresses": {
"type": "string"
},
"domain_names": {
"type": "string"
},
"service_ids": {
"type": "string"
},
"website_ids": {
"type": "string"
},
"asset_ids": {
"type": "string"
},
"certificate": {
"$ref": "#/components/schemas/IncidentCertificate"
},
"port_protocol": {
"type": "string"
},
"port_number": {
"type": "integer"
},
"business_unit_hierarchies": {
"type": "array",
"items": {
"$ref": "#/components/schemas/BusinessUnitHierarchy"
}
},
"attack_surface_rule_name": {
"type": "string"
},
"remediation_guidance": {
"type": "string"
},
"attack_surface_rule_id": {
"type": "string"
},
"asset_identifiers": {
"$ref": "#/components/schemas/AssetIdentifiers"
},
"alert_id": {
"type": "string"
},
"detection_timestamp": {
"type": "integer"
},
"name": {
"type": "string"
},
"endpoint_id": {
"type": "string"
},
"description": {
"type": "string"
},
"host_ip": {
"type": "string"
},
"host_name": {
"type": "string"
},
"source": {
"type": "string"
},
"action": {
"type": "string"
},
"action_pretty": {
"type": "string"
},
"user_name": {
"type": "string"
},
"events_length": {
"type": "integer"
},
"mitre_tactic_id_and_name": {
"type": "string"
},
"mitre_technique_id_and_name": {
"type": "string"
},
"cloud_management_status": {
"type": "string"
}
},
"additionalProperties": true
},
"IncidentExtraDataAlerts": {
"type": "object",
"properties": {
"total_count": {
"type": "integer"
},
"data": {
"type": "array",
"items": {
"$ref": "#/components/schemas/IncidentExtraData"
}
}
},
"required": [
"total_count"
],
"additionalProperties": true
},
"NetworkArtifacts": {
"type": "object",
"properties": {
"total_count": {
"type": "integer"
},
"data": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"total_count"
],
"additionalProperties": true
},
"FileArtifacts": {
"type": "object",
"properties": {
"total_count": {
"type": "integer"
},
"data": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"total_count"
],
"additionalProperties": true
},
"GetIncidentExtraDataReply": {
"type": "object",
"properties": {
"incident": {
"$ref": "#/components/schemas/Incident"
},
"alerts": {
"$ref": "#/components/schemas/IncidentExtraDataAlerts"
},
"network_artifacts": {
"$ref": "#/components/schemas/NetworkArtifacts"
},
"file_artifacts": {
"$ref": "#/components/schemas/FileArtifacts"
}
},
"additionalProperties": true
},
"GetIncidentExtraDataResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/GetIncidentExtraDataReply"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"IncidentFilter": {
"type": "object",
"properties": {
"field": {
"type": "string",
"enum": [
"modification_time",
"description",
"creation_time",
"alert_sources",
"incident_id_list",
"status",
"cloud_management_status",
"starred",
"incident_id",
"integration_source"
],
"description": "Identifies the incident field the filter is matching. \n "
},
"operator": {
"type": "string",
"enum": [
"in",
"contains",
"neq",
"eq",
"lte",
"gte"
],
"description": "Identifies the comparison operator you want to use for this filter. Valid keywords are:\n- **in**: `incident_id_list`, `alert_sources`, `cloud_management_status`, `description`, `integration_source`\n- **contains**: `description` \n- **gte** / **lte**: `modification_time`, `creation_time`: Integer in timestamp epoch milliseconds \n- **eq** / **nqe**: `status`\n"
},
"value": {
"oneOf": [
{
"type": "string"
},
{
"type": "integer"
},
{
"type": "array",
"items": {
"type": "string"
}
},
{
"type": "array",
"items": {
"type": "integer"
}
}
],
"description": "Value that this filter must match. The contents of this field will differ depending on the incident field that you specified for this filter:\n - alert_sources: String\n - cloud_management_status: String. Values are `Managed Cloud`, `Unmanaged Cloud`, and `Not Applicable`.\n - creation_time:`Integer in timestamp epoch milliseconds\n - description: String\n - incident_id_list: List of strings. Each item in the list must be an incident ID.\n - integration_source: List of strings. Valid values: `AWS`, `AZURE`, `GOOGLE`, `PRISMA_CLOUD`\n - modification_time: `Integer` in timestamp epoch milliseconds\n - status: Valid values: `new`, `under_investigation`, `resolved`\n"
}
}
},
"IncidentSort": {
"type": "object",
"properties": {
"field": {
"type": "string",
"default": "modification_time",
"enum": [
"creation_time",
"modification_time",
"incident_id"
],
"description": "Can be `creation_time` or `severity`."
},
"keyword": {
"type": "string",
"default": "desc",
"enum": [
"ASC",
"asc",
"DESC",
"desc"
],
"description": "Can either be `ASC` (ascending order) or `DESC` (descending order)."
}
},
"additionalProperties": true,
"description": "Identifies the sort order for the result set. Default sort is defined as `creation_time`, `DESC`."
},
"GetIncidentsRequestData": {
"type": "object",
"description": "A dictionary containing the API request fields. An empty dictionary returns all results.",
"properties": {
"filters": {
"type": "array",
"description": "Array of filter fields.",
"items": {
"$ref": "#/components/schemas/IncidentFilter"
}
},
"search_from": {
"type": "integer",
"default": 0,
"minimum": 0,
"description": "Integer representing the starting offset within the query result set from which you want incidents returned. Incidents are returned as a zero-based list. Any incident indexed less than this value is not returned in the final result set and defaults to zero.\n"
},
"search_to": {
"type": "integer",
"default": 100,
"minimum": 0,
"description": "Integer representing the end offset within the result set after which you do not want incidents returned. Incidents in the incident list that are indexed higher than this value are not returned in the final results set. Defaults to >100, which returns all incidents to the end of the list.\n"
},
"sort": {
"$ref": "#/components/schemas/IncidentSort"
}
}
},
"GetIncidentsRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/GetIncidentsRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"GetIncidentsPage": {
"type": "object",
"properties": {
"total_count": {
"type": "integer"
},
"result_count": {
"type": "integer"
},
"incidents": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Incident"
}
},
"restricted_incident_ids": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"result_count",
"total_count"
],
"additionalProperties": true
},
"GetIncidentsResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/GetIncidentsPage"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"Alerts": {
"type": "object",
"properties": {
"severity": {
"type": "string",
"description": "Administrator-defined severity, one of the following:\n - critical\n - high\n - medium\n - low\n - unknown\n"
},
"status": {
"type": "string",
"description": "Updated alert status, one of the following:\n - resolved_-_no_longer_observed\n - new\n - resolved_-_no_risk\n - resolved_-_risk_accepted\n - under_investigation\n - resolved_-_contested_asset\n - resolved_-_remediated_automatically\n - resolved\n"
},
"comment": {
"type": "string",
"description": "Updated text that appears in the Resolution Comment field of the Alerts table."
}
}
},
"UpdateAlertsData": {
"type": "object",
"properties": {
"alert_id_list": {
"type": "array",
"items": {
"type": "string"
}
},
"update_data": {
"$ref": "#/components/schemas/Alerts"
}
},
"required": [
"update_data"
],
"additionalProperties": true,
"description": "(Required) A dictionary containing the API request fields. An empty dictionary returns all results.\n"
},
"UpdateAlertsRequestData": {
"type": "object",
"properties": {
"request_data": {
"description": "(Required) A dictionary containing the API request fields.\r\n\r\nAn empty dictionary returns all results.\r\n",
"allOf": [
{
"$ref": "#/components/schemas/UpdateAlertsData"
}
]
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"AlertIdsList": {
"type": "object",
"properties": {
"alerts_ids": {
"type": "array",
"items": {
"type": "integer"
}
}
},
"additionalProperties": true
},
"UpdateAlertsResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/AlertIdsList"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"IncidentComment": {
"type": "object",
"properties": {
"comment_action": {
"type": "string",
"default": "add",
"enum": [
"add"
]
},
"value": {
"type": "string"
}
},
"additionalProperties": true,
"description": "Add a comment to the incident."
},
"UpdateIncident": {
"type": "object",
"properties": {
"assigned_user_mail": {
"type": "string",
"description": "Updated email address of the incident assignee."
},
"assigned_user_pretty_name": {
"type": "string",
"description": "Updated full name of the incident assignee. To supply a new value in this field, you must also supply a value for `assigned_user_mail` in the same request."
},
"manual_severity": {
"type": "string",
"enum": [
"low",
"high",
"critical",
"medium"
],
"description": "Administrator-defined severity."
},
"status": {
"type": "string",
"enum": [
"resolved",
"new",
"under_investigation"
],
"description": "Updated incident status."
},
"resolve_comment": {
"type": "string",
"description": "Descriptive comment explaining the incident change."
},
"comment": {
"$ref": "#/components/schemas/IncidentComment"
}
},
"required": [
"assigned_user_mail",
"assigned_user_pretty_name",
"resolve_comment",
"status"
],
"additionalProperties": true
},
"UpdateIncidentRequestData": {
"type": "object",
"properties": {
"incident_id": {
"type": "string"
},
"update_data": {
"$ref": "#/components/schemas/UpdateIncident"
}
},
"required": [
"incident_id",
"update_data"
],
"additionalProperties": true
},
"UpdateIncidentRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/UpdateIncidentRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"UpdateIncidentResponse": {
"type": "object",
"properties": {
"reply": {
"type": "boolean"
},
"warnings": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"RemediationRulesFilterCondition": {
"type": "object",
"properties": {
"field": {
"type": "string",
"enum": [
"attack_surface_rule_id"
],
"description": "String that identifies the attack surface rule field for filtering.\n"
},
"operator": {
"type": "string",
"enum": [
"neq",
"eq"
],
"description": "Identifies the comparison operator to use for this filter. Valid keywords are\n - `eq`\n - `neq`\n"
},
"value": {
"type": "string",
"description": "Value that the filter must match. Value must be the following:\n - `{attack_surface_rule_id}`: String of the attack surface rule to filter on\n"
}
},
"required": [
"field",
"operator",
"value"
],
"additionalProperties": true
},
"RemediationRulesSort": {
"type": "object",
"properties": {
"field": {
"type": "string",
"default": "created_at",
"enum": [
"created_at"
],
"description": "Sorting based on the `created_at` field is supported."
},
"keyword": {
"type": "string",
"default": "desc",
"enum": [
"ASC",
"asc",
"DESC",
"desc"
],
"description": "Sort order can be one of the following values:\n - `ASC`: ascending order\n - `DESC`: descending order\n"
}
},
"additionalProperties": true
},
"GetRemediationRulesFilters": {
"type": "object",
"properties": {
"filters": {
"type": "array",
"description": "Array of filter fields. Each JSON object must contain the following:\n - field\n - operator\n - value\n",
"items": {
"$ref": "#/components/schemas/RemediationRulesFilterCondition"
}
},
"sort": {
"description": "Identifies the sort order for the result set. By default, the sort is defined as `created_at`, `DESC`.",
"allOf": [
{
"$ref": "#/components/schemas/RemediationRulesSort"
}
]
},
"search_from": {
"type": "integer",
"default": 0,
"minimum": 0
},
"search_to": {
"type": "integer",
"default": 500,
"minimum": 0
}
},
"additionalProperties": true,
"description": "A dictionary containing the API request fields."
},
"GetRemediationRulesRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/GetRemediationRulesFilters"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"RemediationRuleCriteria": {
"type": "object",
"properties": {
"field": {
"type": "string"
},
"value": {
"type": "string"
},
"operator": {
"type": "string"
}
},
"required": [
"field",
"operator",
"value"
],
"additionalProperties": true
},
"RemediationRule": {
"type": "object",
"properties": {
"rule_id": {
"type": "string"
},
"description": {
"type": "string"
},
"attack_surface_rule_id": {
"type": "string"
},
"criteria": {
"type": "array",
"items": {
"$ref": "#/components/schemas/RemediationRuleCriteria"
}
},
"criteria_conjunction": {
"type": "string"
},
"action": {
"type": "string"
},
"created_by": {
"type": "string"
},
"created_by_pretty": {
"type": "string"
},
"created_at": {
"type": "integer"
},
"details": {
"type": "string"
}
},
"required": [
"action",
"attack_surface_rule_id",
"created_at",
"created_by",
"created_by_pretty",
"criteria",
"criteria_conjunction",
"description",
"details",
"rule_id"
],
"additionalProperties": true
},
"RemediationRulesPageResponse": {
"type": "object",
"properties": {
"result_count": {
"type": "integer"
},
"remediation_rules": {
"type": "array",
"items": {
"$ref": "#/components/schemas/RemediationRule"
}
}
},
"required": [
"remediation_rules",
"result_count"
],
"additionalProperties": true
},
"GetRemediationRulesResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/RemediationRulesPageResponse"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"RemediationScanFilterCondition": {
"type": "object",
"required": [
"field",
"operator",
"value"
],
"properties": {
"field": {
"enum": [
"attack_surface_rule_id",
"alert_internal_id",
"service_id"
],
"description": "All three of these filters must be used."
},
"operator": {
"enum": [
"eq",
"EQ"
]
},
"value": {
"anyOf": [
{
"type": "string"
},
{
"type": "integer"
}
]
}
}
},
"RemediationScanFilterRequest": {
"type": "object",
"description": "A dictionary containing the API request fields. An empty dictionary returns all results.",
"required": [
"filters"
],
"properties": {
"filters": {
"type": "array",
"minItems": 0,
"maxItems": 3,
"description": "An array of filter fields.",
"items": {
"$ref": "#/components/schemas/RemediationScanFilterCondition"
}
}
}
},
"GetOrCreateRemediationScanRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/RemediationScanFilterRequest"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"RemediationScanId": {
"type": "object",
"properties": {
"scanId": {
"type": "string"
}
},
"additionalProperties": true
},
"GetOrCreateRemediationScanResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/RemediationScanId"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"PollRemediationScanResultsFilterCondition": {
"type": "object",
"properties": {
"field": {
"type": "string",
"enum": [
"id"
],
"description": "\"id\": Indicates that you want to filter on a specific scan ID."
},
"operator": {
"type": "string",
"default": "eq",
"enum": [
"eq"
],
"description": "EQ"
},
"value": {
"type": "string",
"description": "The scan ID (string)."
}
},
"required": [
"value"
],
"additionalProperties": true
},
"RemediationScanResultsFilterRequest": {
"type": "object",
"properties": {
"filters": {
"type": "array",
"minItems": 1,
"maxItems": 1,
"items": {
"$ref": "#/components/schemas/PollRemediationScanResultsFilterCondition"
}
}
},
"required": [
"filters"
],
"additionalProperties": true
},
"PollRemediationScanResultsRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/RemediationScanResultsFilterRequest"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"RemediationScanStatus": {
"type": "object",
"properties": {
"status": {
"type": "string",
"description": "Possible values are:\n - IN_PROGRESS\n - FAILED_TIMEOUT\n - FAILED_ERROR\n - SUCCESS\n"
},
"result": {
"type": "string",
"description": "If the status equals \"SUCCESS\", then possible result values are:\n - REMEDIATED\n - UNREMEDIATED\n"
}
},
"required": [
"status"
],
"additionalProperties": true
},
"PollRemediationScanResultsResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/RemediationScanStatus"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"GetRolesFilter": {
"type": "object",
"properties": {
"role_names": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of one or more role names in your environment for which you want detailed information."
}
},
"additionalProperties": true,
"description": "A dictionary containing the API request fields."
},
"GetRolesRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/GetRolesFilter"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"Role": {
"type": "object",
"properties": {
"pretty_name": {
"type": "string",
"description": "Name of the role as it appears in the Management Console."
},
"permissions": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of permissions associated with this role."
},
"insert_time": {
"type": "integer",
"description": "Timestamp of when the Role was created."
},
"update_time": {
"type": "integer",
"description": "Timestamp of when the Role was last updated."
},
"created_by": {
"type": "string",
"description": "Email of the user who created the Role."
},
"description": {
"type": "string",
"description": "Description of the Role, if available."
},
"groups": {
"type": "array",
"items": {
"type": "string"
},
"description": "Group names associated with the Role."
},
"users": {
"type": "array",
"items": {
"type": "string"
},
"description": "Email addresses of users associated with the Role."
}
},
"required": [
"created_by",
"description",
"permissions",
"pretty_name"
],
"additionalProperties": true
},
"GetRolesResponse": {
"type": "object",
"properties": {
"reply": {
"type": "array",
"items": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Role"
}
},
"description": "JSON object containing the query result."
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"TenantLicenseInfo": {
"type": "object",
"properties": {
"aum": {
"type": "integer"
},
"expiration_date": {
"type": "string"
},
"activation_date": {
"type": "string"
},
"status": {
"type": "string"
}
},
"required": [
"activation_date",
"aum",
"expiration_date",
"status"
],
"additionalProperties": true,
"description": "List of available licenses, number of devices, and purchased add-ons on your tenant."
},
"GetTenantLicenseInfoResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/TenantLicenseInfo"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"GetUserGroupsFilter": {
"type": "object",
"properties": {
"group_names": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of one or more user group names for which you want the associated users."
}
},
"additionalProperties": true,
"description": "A dictionary containing the API request fields."
},
"GetUserGroupsRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/GetUserGroupsFilter"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"UserGroup": {
"type": "object",
"properties": {
"group_name": {
"type": "string",
"description": "Name of the User Group."
},
"description": {
"type": "string",
"description": "Description of the User Group, if available."
},
"created_by": {
"type": "string"
},
"pretty_name": {
"type": "string",
"description": "Name of the User Group as it appears in the Management Console."
},
"insert_time": {
"type": "integer",
"description": "Timestamp of when the User Group was created."
},
"update_time": {
"type": "integer",
"description": "Timestamp of when the User Group was last updated."
},
"user_email": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of email addresses belonging to the users associated with the User Group."
},
"source": {
"type": "string",
"description": "Type of User Group."
}
},
"required": [
"group_name",
"insert_time",
"source"
],
"additionalProperties": true
},
"GetUserGroupsResponse": {
"type": "object",
"properties": {
"reply": {
"type": "array",
"items": {
"$ref": "#/components/schemas/UserGroup"
},
"description": "JSON object containing the query result."
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"Scope": {
"type": "object",
"properties": {
"tag_id": {
"type": "string"
},
"tag_name_with_alias": {
"type": "string"
}
},
"required": [
"tag_id",
"tag_name_with_alias"
],
"additionalProperties": true
},
"User": {
"type": "object",
"properties": {
"user_email": {
"type": "string",
"description": "Email address of the user."
},
"user_first_name": {
"type": "string",
"description": "First name of the user."
},
"user_last_name": {
"type": "string",
"description": "Last name of the user."
},
"role_name": {
"type": "string",
"description": "Role name associated with the user."
},
"last_logged_in": {
"type": "integer",
"description": "Timestamp of when the user last logged in."
},
"user_type": {
"type": "string",
"description": "Type of user."
},
"groups": {
"type": "array",
"items": {
"type": "string"
},
"description": "Name of user groups associated with the user, if applicable."
},
"scope": {
"type": "array",
"items": {
"$ref": "#/components/schemas/Scope"
},
"description": "Name of scope associated with the user, if applicable."
}
},
"required": [
"groups",
"user_email",
"user_first_name",
"user_last_name",
"user_type"
],
"additionalProperties": true
},
"GetUsersResponse": {
"type": "object",
"properties": {
"reply": {
"type": "array",
"items": {
"$ref": "#/components/schemas/User"
},
"description": "JSON object containing the query result."
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"SetUserRoleFilter": {
"type": "object",
"properties": {
"user_emails": {
"type": "array",
"items": {
"type": "string"
},
"description": "List of one or more user emails of users you want to add to or remove from a role."
},
"role_name": {
"type": "string",
"description": "Name of the role you want to add a user to. Send an empty field to remove the user."
}
},
"required": [
"role_name"
],
"additionalProperties": true,
"description": "A dictionary containing the API request fields."
},
"SetUserRoleRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/SetUserRoleFilter"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"UpdateCountResponse": {
"type": "object",
"properties": {
"update_count": {
"type": "integer",
"description": "Number of updated users."
}
},
"required": [
"update_count"
],
"additionalProperties": true,
"description": "JSON object containing the query result."
},
"SetUserRoleResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/UpdateCountResponse"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"AssignOrRemoveTagsFromAsmAssetsRequestFilter": {
"type": "object",
"required": [
"field",
"operator",
"value"
],
"properties": {
"field": {
"type": "string",
"enum": [
"name",
"has_xdr_agent",
"ip_address",
"externally_detected_providers",
"type",
"has_active_external_services",
"mac_addresses",
"externally_inferred_cves",
"aws_cloud_tags",
"gcp_cloud_tags",
"azure_cloud_tags",
"tags",
"business_units_list",
"ipv6_address",
"has_bu_overrides",
"asm_id_list"
],
"description": "Identifies the asset field the filter matches. Case-sensitive."
},
"operator": {
"type": "string",
"enum": [
"in",
"contains",
"neq",
"eq",
"not_contains"
],
"description": "Comparison operator for the filter. Valid operators depend on the field:\n - **contains** / **not_contains**: use with externally_detected_providers, externally_inferred_cves, name\n - **eq** / **neq**: use with name, ip_address, has_bu_overrides\n - **in**: use with asm_id_list, has_active_external_services, type, business_units_list, ip_address\n"
},
"value": {
"oneOf": [
{ "type": "string" },
{ "type": "boolean" },
{ "type": "array", "items": { "type": "string" } }
],
"description": "Value depends on the filter field used.\n - **asm_id_list**: list of asset ID strings\n - **business_units_list**: string or list of strings in the format \"BU name\" or \"BU:BU name\"\n - **externally_detected_providers**: string\n - **externally_inferred_cves**: string\n - **has_active_external_services**: list of strings (enum values: \"yes\", \"no\", \"unknown\")\n - **has_bu_overrides**: boolean (\"true\" or \"false\")\n - **has_xdr_agent**: string (enum values: \"yes\", \"no\")\n - **ip_address**: list of strings\n - **ipv6_address**: string\n - **mac_addresses**: string\n - **name**: string\n - **tags**: list of strings in the format \"tag-family:tag-name\"\n - **type**: list of strings (enum values: \"certificate\", \"cloud_compute_instance\", \"domain\", \"unassociated_responsive_ip\")\n"
}
}
},
"AssignOrRemoveTagsFromAsmAssetsRequestData": {
"type": "object",
"description": "A dictionary containing the API request fields. An empty dictionary returns all results.",
"properties": {
"filters": {
"type": "array",
"items": {
"$ref": "#/components/schemas/AssignOrRemoveTagsFromAsmAssetsRequestFilter"
}
},
"tags": {
"type": "array",
"description": "List of tag names to add or remove. These do not need to include the tag family.",
"items": {
"type": "string"
}
}
}
},
"AssignOrRemoveTagsFromAsmAssetsRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/AssignOrRemoveTagsFromAsmAssetsRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"AssignOrRemoveTagsFromIpRangesRequestFilter": {
"type": "object",
"properties": {
"field": {
"type": "string",
"enum": [
"organization_handles",
"tags",
"business_units_list",
"ipaddress_version",
"has_bu_overrides",
"range_id_list"
],
"description": "range_id_list: indicates that the set of IP ranges will be a list of IDs."
},
"operator": {
"type": "string",
"enum": [
"in",
"contains",
"neq",
"eq",
"not_contains"
],
"description": "in"
},
"value": {
"oneOf": [
{
"type": "string"
},
{
"type": "integer"
},
{
"type": "array",
"items": {
"type": "string"
}
},
{
"type": "array",
"items": {
"type": "integer"
}
}
],
"description": "List of strings, the ip range IDs that should be removed from the tag."
}
},
"required": [
"field",
"operator",
"value"
],
"additionalProperties": true
},
"AssignOrRemoveTagsFromIpRangesRequestData": {
"type": "object",
"properties": {
"filters": {
"type": "array",
"items": {
"$ref": "#/components/schemas/AssignOrRemoveTagsFromIpRangesRequestFilter"
},
"description": "An array of filter fields."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Name of the tag to add to the ranges. The tag name does not need to include the tag family."
}
},
"additionalProperties": true,
"description": "A dictionary containing the API request fields. An empty dictionary returns all results."
},
"AssignOrRemoveTagsFromIpRangesRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/AssignOrRemoveTagsFromIpRangesRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"IpRange": {
"type": "object",
"properties": {
"from_ip": {
"type": "string"
},
"to_ip": {
"type": "string"
}
},
"additionalProperties": true
},
"CreateTagRulesForIpRangesRequestData": {
"type": "object",
"properties": {
"ip_ranges": {
"type": "array",
"items": {
"$ref": "#/components/schemas/IpRange"
},
"description": "List of dictionaries containing \"from_ip\" and \"to_ip\" to define an IP range. These fields can be the same to denote a single IP address.
For example,
`\"from_ip\": \"1.1.1.1\", \"to_ip\": \"1.1.1.3\"`.'\n"
},
"rule_name": {
"type": "string",
"description": "Name of the tag rule. Will use `tag_name` if left empty."
},
"description": {
"type": "string",
"description": "(Optional) Description of the tag rule."
},
"tag_name": {
"type": "string",
"description": "Name of the tag to be used to tag assets. If a rules-based tag with the same name already exists, it will use that tag. If not, a new rules-based tag will be created."
}
},
"required": [
"ip_ranges"
],
"additionalProperties": true,
"description": "A dictionary containing the API request fields."
},
"CreateTagRulesForIpRangesRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/CreateTagRulesForIpRangesRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"CreateTagRulesForIpRangesResponse": {
"type": "object",
"properties": {
"reply": {
"type": "string"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"RemoveTagsFromAsmEntitiesReply": {
"type": "object",
"properties": {
"remove_tags": {
"type": "string",
"description": "succeeded if request was successful"
}
},
"required": [
"remove_tags"
],
"additionalProperties": true
},
"RemoveTagsFromAsmEntitiesResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/RemoveTagsFromAsmEntitiesReply"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"UpdateVulnerabilityTestsRequestData": {
"type": "object",
"properties": {
"test_names": {
"type": "array",
"description": "Names of tests, for example [\"test1\", \"test2\", \"test3\"]",
"items": {
"type": "string"
}
},
"status": {
"type": "string",
"enum": [
"enabled",
"disabled"
]
}
},
"additionalProperties": true
},
"UpdateVulnerabilityTestsRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/UpdateVulnerabilityTestsRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"UpdateVulnerabilityTestsReply": {
"type": "object",
"properties": {
"bulk_update_result": {
"type": "string",
"enum": [
"Success"
]
}
},
"additionalProperties": true
},
"UpdateVulnerabilityTestsResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/UpdateVulnerabilityTestsReply"
}
},
"required": [
"reply"
],
"additionalProperties": true
},
"VulnerabilityTestFilter": {
"type": "object",
"properties": {
"field": {
"type": "string",
"enum": [
"name",
"test_names",
"vulnerability_ids",
"description",
"vendor_names",
"status",
"affected_software",
"severity_score",
"cwe_ids",
"epss_score",
"count_vulnerable_services"
]
},
"operator": {
"type": "string",
"enum": [
"in",
"contains",
"neq",
"eq",
"lte",
"gte",
"not_contains"
],
"description": "Identifies the comparison operator to use for this filter. The following list shows which operator can be used for each filter field:\n - `name`: contains, eq, neq\n - `status`: eq\n - `vulnerability_ids`: contains, not_contains\n - `description`: contains\n - `affected_software`: contains, not_contains\n - `cwe_ids`: contains, not_contains\n - `vendor_names`: contains, not_contains\n - `severity_score`: eq, neq, gte, lte\n - `epss_score`: eq, neq, gte, lte\n - `count_vulnerable_services`: eq, neq, gte, lte\n"
},
"value": {
"oneOf": [
{
"type": "string"
},
{
"type": "integer"
},
{
"type": "number",
"format": "float"
},
{
"type": "array",
"items": {
"type": "string"
}
},
{
"type": "array",
"items": {
"type": "integer"
}
}
],
"description": "Value depends on the filter field used.\n - `name`: string e.g. apache\n - `status`: Enabled, Disabled\n - `vulnerability_ids`: strings in the form of CVE IDs, such as CVE-1, CVE-2\n - `description`: string e.g. apache\n - `affected_software`: strings\n - `cwe_ids`: strings in the form of CWE IDs such as CWE-20\n - `vendor_names`: strings such as Cisco, Siemens\n - `severity_score`: numbers, such as 2, 3.5\n - `epss_score`: numbers, such as 2, 3.5\n - `count_vulnerable_services`: integers, such as 1,2,5\n"
}
},
"additionalProperties": true
},
"VulnerabilityTestSort": {
"type": "object",
"properties": {
"field": {
"type": "string",
"default": "severity_score",
"enum": [
"severity_score",
"created",
"first_published",
"status"
]
},
"keyword": {
"type": "string",
"default": "desc",
"enum": [
"ASC",
"asc",
"DESC",
"desc"
]
}
},
"additionalProperties": true
},
"GetVulnerabilityTestsRequestData": {
"type": "object",
"properties": {
"filters": {
"type": "array",
"items": {
"$ref": "#/components/schemas/VulnerabilityTestFilter"
}
},
"search_from": {
"type": "integer",
"default": 0,
"minimum": 0
},
"search_to": {
"type": "integer",
"default": 500,
"minimum": 0
},
"sort": {
"$ref": "#/components/schemas/VulnerabilityTestSort"
}
},
"additionalProperties": true
},
"GetVulnerabilityTestsRequest": {
"type": "object",
"properties": {
"request_data": {
"$ref": "#/components/schemas/GetVulnerabilityTestsRequestData"
}
},
"required": [
"request_data"
],
"additionalProperties": true
},
"AffectedSoftware": {
"type": "object",
"properties": {
"NAME": {
"type": "string"
},
"VERSION_START_INCLUDING": {
"type": "string"
},
"VERSION_START_EXCLUDING": {
"type": "string"
},
"VERSION_END_INCLUDING": {
"type": "string"
},
"VERSION_END_EXCLUDING": {
"type": "string"
},
"VENDOR": {
"type": "string"
},
"PRODUCT": {
"type": "string"
},
"VERSION": {
"type": "string"
}
},
"additionalProperties": true
},
"VulnerabilityTest": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"vulnerability_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"description": {
"type": "string"
},
"status": {
"type": "string"
},
"vendor_names": {
"type": "array",
"items": {
"type": "string"
}
},
"affected_software": {
"type": "array",
"items": {
"$ref": "#/components/schemas/AffectedSoftware"
}
},
"severity_score": {
"type": "number"
},
"cwe_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"epss_score": {
"type": "number"
},
"references": {
"type": "array",
"items": {
"type": "string"
}
},
"remediation_guidance": {
"type": "string"
},
"first_published": {
"type": "integer"
},
"created": {
"type": "integer"
},
"count_vulnerable_services": {
"type": "integer"
}
},
"additionalProperties": true
},
"GetVulnerabilityTestsPage": {
"type": "object",
"properties": {
"total_count": {
"type": "integer"
},
"result_count": {
"type": "integer"
},
"vulnerability_tests": {
"type": "array",
"items": {
"$ref": "#/components/schemas/VulnerabilityTest"
}
}
},
"required": [
"result_count",
"total_count"
],
"additionalProperties": true
},
"GetVulnerabilityTestsResponse": {
"type": "object",
"properties": {
"reply": {
"$ref": "#/components/schemas/GetVulnerabilityTestsPage"
}
},
"required": [
"reply"
],
"additionalProperties": true
}
},
"responses": {
"UNPROCESSABLE_ENTITY": {
"description": "Unprocessable Entity",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
}
}
}
}