{"components": {"parameters": {"param_account_id_str": {"description": "Account ID of the object, e.g., \"00110011-0000-0000-0000-000000000000\"", "in": "path", "name": "account_id", "required": true, "schema": {"format": "uuid", "type": "string"}}, "param_auth_api": {"description": "API key for authentication", "in": "header", "name": "pax8ApiTokenV1", "required": true, "schema": {"type": "string"}}, "param_auth_authorization": {"description": "Bearer followed by JWT, e.g., \"Bearer eyJh...enA\"", "in": "header", "name": "Authorization", "required": true, "schema": {"type": "string"}}, "param_blocked": {"description": "If included, filter findings with blocked either True of False", "in": "query", "name": "blocked", "required": false, "schema": {"type": "boolean"}}, "param_blocked_eq": {"description": "If included, filter findings with blocked either True of False", "in": "query", "name": "blocked.eq", "required": false, "schema": {"type": "boolean"}}, "param_blocked_not_eq": {"description": "If included, filter out findings with blocked either True of False", "in": "query", "name": "blocked.!eq", "required": false, "schema": {"type": "boolean"}}, "param_category": {"description": "Category ID of finding", "in": "query", "name": "category", "required": false, "schema": {"type": "integer"}}, "param_category_eq": {"description": "Category ID of finding", "in": "query", "name": "category.eq", "required": false, "schema": {"type": "integer"}}, "param_category_in": {"description": "Comma-separated list of category IDs of findings to include", "in": "query", "name": "category.in", "required": false, "schema": {"type": "string"}}, "param_category_not_eq": {"description": "Category ID of finding to filter out", "in": "query", "name": "category.!eq", "required": false, "schema": {"type": "integer"}}, "param_category_not_in": {"description": "Comma-separated list of category IDs of findings to filter out", "in": "query", "name": "category.!in", "required": false, "schema": {"type": "string"}}, "param_command_id_str": {"description": "Command ID of the object, e.g., \"00110011-0000-0000-0000-000000000000\"", "in": "path", "name": "command_id", "required": true, "schema": {"format": "uuid", "type": "string"}}, "param_created": {"description": "Exact time object was created", "in": "query", "name": "created", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_created_after": {"description": "Start time of window for search (implied UTC)", "in": "query", "name": "created_after", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_created_before": {"description": "End time of window for search (implied UTC)", "in": "query", "name": "created_before", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_created_by": {"description": "If specified, limit search to findings created_by person with given UUID", "in": "query", "name": "created_by", "required": false, "schema": {"format": "uuid", "type": "string"}}, "param_created_eq": {"description": "Exact time object was created", "in": "query", "name": "created.eq", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_created_gt": {"description": "Start time of window for search (implied UTC) (exclusive)", "in": "query", "name": "created.gt", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_created_lt": {"description": "End time of window for search (implied UTC) (exclusive)", "in": "query", "name": "created.lt", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_created_not_eq": {"description": "Filter out findings with the given exact time of creation", "in": "query", "name": "created.!eq", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_created_not_gt": {"description": "End time of window for search (implied UTC) (inclusive)", "in": "query", "name": "created.!gt", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_created_not_lt": {"description": "Start time of window for search (implied UTC) (inclusive)", "in": "query", "name": "created.!lt", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_delivery_id_str": {"description": "Webhook delivery ID, e.g., \"00110011-0000-0000-0000-000000000000\"", "in": "path", "name": "delivery_id", "required": true, "schema": {"format": "uuid", "type": "string"}}, "param_delivery_status_eq": {"description": "Filter deliveries by exact status.", "in": "query", "name": "status.eq", "required": false, "schema": {"enum": ["pending", "in_flight", "succeeded", "failed", "dead_lettered"], "type": "string"}}, "param_device_id_str": {"description": "Device ID of the object, e.g., \"00110011-0000-0000-0000-000000000000\"", "in": "path", "name": "device_id", "required": true, "schema": {"format": "uuid", "type": "string"}}, "param_finding_id_str": {"description": "Finding ID of the object, e.g., \"00110011-0000-0000-0000-000000000000\"", "in": "path", "name": "finding_id", "required": true, "schema": {"format": "uuid", "type": "string"}}, "param_id_str": {"description": "ID of the object, e.g., \"00110011-0000-0000-0000-000000000000\"", "in": "path", "name": "id", "required": true, "schema": {"format": "uuid", "type": "string"}}, "param_key_id_str": {"description": "Key ID of the object, e.g., \"00110011-0000-0000-0000-000000000000\"", "in": "path", "name": "key_id", "required": true, "schema": {"format": "uuid", "type": "string"}}, "param_limit": {"description": "Maximum number of records to return, e.g., \"200\"", "in": "query", "name": "limit", "required": false, "schema": {"default": 200, "maximum": 5000, "minimum": 1, "type": "integer"}}, "param_modified": {"description": "Exact time object was modified", "in": "query", "name": "modified", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_modified_after": {"description": "Start time of window for search (implied UTC)", "in": "query", "name": "modified_after", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_modified_before": {"description": "End time of window for search (implied UTC)", "in": "query", "name": "modified_before", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_modified_by": {"description": "UUID of person who last modified finding", "in": "query", "name": "modified_by", "required": false, "schema": {"format": "uuid", "type": "string"}}, "param_modified_by_eq": {"description": "UUID of person who last modified finding", "in": "query", "name": "modified_by.eq", "required": false, "schema": {"format": "uuid", "type": "string"}}, "param_modified_by_in": {"description": "Comma-separated list of UUIDs of persons who last modified finding", "in": "query", "name": "modified_by.in", "required": false, "schema": {"type": "string"}}, "param_modified_by_not_eq": {"description": "Filter out findings where person who last modified it has the given UUID", "in": "query", "name": "modified_by.!eq", "required": false, "schema": {"format": "uuid", "type": "string"}}, "param_modified_by_not_in": {"description": "Filter out findings where person who last modified it in the given comma-separated list of UUIDs", "in": "query", "name": "modified_by.!in", "required": false, "schema": {"type": "string"}}, "param_modified_eq": {"description": "Exact time object was modified", "in": "query", "name": "modified.eq", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_modified_gt": {"description": "Start time of window for search (implied UTC) (exclusive)", "in": "query", "name": "modified.gt", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_modified_lt": {"description": "End time of window for search (implied UTC) (exclusive)", "in": "query", "name": "modified.lt", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_modified_not_eq": {"description": "Filter out findings with the given exact time of modification", "in": "query", "name": "modified.!eq", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_modified_not_gt": {"description": "End time of window for search (implied UTC) (inclusive)", "in": "query", "name": "modified.!gt", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_modified_not_lt": {"description": "Start time of window for search (implied UTC) (inclusive)", "in": "query", "name": "modified.!lt", "required": false, "schema": {"format": "date-time", "type": "string"}}, "param_name": {"description": "If specified, will limit search to findings with given name", "in": "query", "name": "name", "required": false, "schema": {"type": "string"}}, "param_name_contains": {"description": "If specified, will limit search to findings with given name substring", "in": "query", "name": "name.contains", "required": false, "schema": {"type": "string"}}, "param_name_eq": {"description": "If specified, will limit search to findings with given name", "in": "query", "name": "name.eq", "required": false, "schema": {"type": "string"}}, "param_name_in": {"description": "If specified, will limit search to findings with one of the given comma-separated list of names", "in": "query", "name": "name.in", "required": false, "schema": {"type": "string"}}, "param_name_not_contains": {"description": "If specified, will filter out findings with given name substring", "in": "query", "name": "name.!contains", "required": false, "schema": {"type": "string"}}, "param_name_not_eq": {"description": "If specified, will filter out findings with given name", "in": "query", "name": "name.!eq", "required": false, "schema": {"type": "string"}}, "param_name_not_in": {"description": "If specified, will filter out findings with any of the given comma-separated list of names", "in": "query", "name": "name.!in", "required": false, "schema": {"type": "string"}}, "param_name_not_regex": {"description": "If specified, will filter out findings with name partially matching given regular expression", "in": "query", "name": "name.!regex", "required": false, "schema": {"type": "string"}}, "param_name_regex": {"description": "If specified, will limit search to findings with name partially matching given regular expression", "in": "query", "name": "name.regex", "required": false, "schema": {"type": "string"}}, "param_order_by": {"description": "Order records by field, e.g., \"created\", \"created;asc\", \"created;desc\", \"name;desc,created;desc\"", "in": "query", "name": "order_by", "required": false, "schema": {"default": "created;desc", "type": "string"}}, "param_page": {"description": "Page to return, e.g., \"2\"", "in": "query", "name": "page", "required": false, "schema": {"default": 1, "minimum": 1, "type": "integer"}}, "param_page_size": {"description": "Number of records per page to return, e.g., \"3\"", "in": "query", "name": "page_size", "required": false, "schema": {"default": 50, "maximum": 200, "minimum": 1, "type": "integer"}}, "param_priority": {"description": "Priority number of finding", "in": "query", "name": "priority", "required": false, "schema": {"type": "integer"}}, "param_priority_eq": {"description": "Priority number of finding", "in": "query", "name": "priority.eq", "required": false, "schema": {"type": "integer"}}, "param_priority_gt": {"description": "Maximum priority number of finding to exclude", "in": "query", "name": "priority.gt", "required": false, "schema": {"type": "integer"}}, "param_priority_in": {"description": "Comma-separated list of priority numbers of findings to include", "in": "query", "name": "priority.in", "required": false, "schema": {"type": "string"}}, "param_priority_lt": {"description": "Minimum priority number of finding to exclude", "in": "query", "name": "priority.lt", "required": false, "schema": {"type": "integer"}}, "param_priority_not_eq": {"description": "Priority number of finding to filter out", "in": "query", "name": "priority.!eq", "required": false, "schema": {"type": "integer"}}, "param_priority_not_gt": {"description": "Maximum priority number of finding to include", "in": "query", "name": "priority.!gt", "required": false, "schema": {"type": "integer"}}, "param_priority_not_in": {"description": "Comma-separated list of priority numbers of findings to filter out", "in": "query", "name": "priority.!in", "required": false, "schema": {"type": "string"}}, "param_priority_not_lt": {"description": "Minimum priority number of finding to include", "in": "query", "name": "priority.!lt", "required": false, "schema": {"type": "integer"}}, "param_resolution": {"description": "Resolution ID of finding", "in": "query", "name": "resolution", "required": false, "schema": {"type": "integer"}}, "param_resolution_eq": {"description": "Resolution ID of finding", "in": "query", "name": "resolution.eq", "required": false, "schema": {"type": "integer"}}, "param_resolution_in": {"description": "Comma-separated list of Resolution IDs of findings to include", "in": "query", "name": "resolution.in", "required": false, "schema": {"type": "integer"}}, "param_resolution_not_eq": {"description": "Resolution ID of finding to filter out", "in": "query", "name": "resolution.!eq", "required": false, "schema": {"type": "integer"}}, "param_resolution_not_in": {"description": "Comma-separated list of resolution IDs of findings to filter out", "in": "query", "name": "resolution.!in", "required": false, "schema": {"type": "integer"}}, "param_rule_id_str": {"description": "Detection rule ID, e.g., \"00110011-0000-0000-0000-000000000000\"", "in": "path", "name": "rule_id", "required": true, "schema": {"format": "uuid", "type": "string"}}, "param_status": {"description": "Status ID of finding", "in": "query", "name": "status", "required": false, "schema": {"type": "integer"}}, "param_status_eq": {"description": "Status ID of finding", "in": "query", "name": "status.eq", "required": false, "schema": {"type": "integer"}}, "param_status_in": {"description": "Comma-separated list of status IDs of findings to include", "in": "query", "name": "status.in", "required": false, "schema": {"type": "string"}}, "param_status_modified_by": {"description": "UUID of person who last modified finding status", "in": "query", "name": "status_modified_by", "required": false, "schema": {"format": "uuid", "type": "string"}}, "param_status_modified_by_eq": {"description": "UUID of person who last modified finding status", "in": "query", "name": "status_modified_by.eq", "required": false, "schema": {"format": "uuid", "type": "string"}}, "param_status_modified_by_in": {"description": "Comma-separated list of UUIDs of persons who last modified finding status", "in": "query", "name": "status_modified_by.in", "required": false, "schema": {"type": "string"}}, "param_status_modified_by_not_eq": {"description": "UUID of person who last modified finding status", "in": "query", "name": "status_modified_by.!eq", "required": false, "schema": {"format": "uuid", "type": "string"}}, "param_status_modified_by_not_in": {"description": "Comma-separated list of UUIDs of persons who last modified finding status to be filtered out", "in": "query", "name": "status_modified_by.!in", "required": false, "schema": {"type": "string"}}, "param_status_not_eq": {"description": "Status ID of finding to filter out", "in": "query", "name": "status.!eq", "required": false, "schema": {"type": "integer"}}, "param_status_not_in": {"description": "Comma-separated list of status IDs of findings to filter out", "in": "query", "name": "status.!in", "required": false, "schema": {"type": "string"}}, "param_type": {"description": "Integer type id", "in": "query", "name": "type", "required": false, "schema": {"type": "integer"}}, "param_type_eq": {"description": "Integer type id", "in": "query", "name": "type.eq", "required": false, "schema": {"type": "integer"}}, "param_type_in": {"description": "Comma-separated list of integer type IDs to include", "in": "query", "name": "type.in", "required": false, "schema": {"type": "string"}}, "param_type_not_eq": {"description": "Integer type id to filter out", "in": "query", "name": "type.!eq", "required": false, "schema": {"type": "integer"}}, "param_type_not_in": {"description": "Comma-separated list of integer type IDs to filter out", "in": "query", "name": "type.!in", "required": false, "schema": {"type": "string"}}}, "schemas": {"action_catalog": {"properties": {"actions": {"items": {"properties": {"action": {"description": "Response action name", "type": "string"}, "os": {"description": "Operating systems this action supports", "items": {"type": "string"}, "type": "array"}, "parameters": {"description": "Parameters accepted by this action", "items": {"properties": {"name": {"description": "Parameter name", "type": "string"}, "required": {"description": "Whether the parameter is required", "type": "boolean"}, "type": {"description": "Parameter type", "type": "string"}}, "required": ["name", "type", "required"], "type": "object"}, "type": "array"}, "reversible": {"description": "Whether the action can be reversed", "type": "boolean"}, "risk_tier": {"description": "Risk classification of the action", "enum": ["reversible", "destructive"], "type": "string"}}, "required": ["action", "risk_tier", "reversible", "parameters", "os"], "type": "object"}, "type": "array"}}, "required": ["actions"], "type": "object"}, "address": {"properties": {"city": {"description": "City", "example": "Denver", "type": "string"}, "country": {"description": "Country code", "example": "US", "type": "string"}, "postcode": {"description": "Postal code", "example": "80210", "type": "string"}, "stateOrProvince": {"description": "State or province", "example": "CO", "type": "string"}, "street": {"description": "Street address", "example": "123 Partner Ave.", "type": "string"}, "street2": {"description": "Additional street address line", "example": "Unit b", "type": "string", "x-nullable": true}}, "required": ["street", "city", "postcode", "country", "stateOrProvince"], "type": "object"}, "agents_devices_data_record": {"properties": {"alive": {"description": "When the agent device was last seen alive", "example": "2015-07-07T15:49:51.230", "format": "date-time", "readOnly": true, "type": "string"}, "arch": {"description": "The architecture the device is running on", "type": "string"}, "created": {"description": "When the agent device was created", "example": "2015-07-07T15:49:51.230", "format": "date-time", "readOnly": true, "type": "string"}, "description": {"description": "User-defined description of the agent device", "nullable": true, "type": "string"}, "device_id": {"description": "ID of agent device", "example": "aff08432-80ae-8fbe-bcd0-399beb09c6f1", "format": "uuid", "readOnly": true, "type": "string"}, "hostname": {"description": "Hostname of agent device", "example": "ws001", "type": "string"}, "is_domain_controller": {"description": "If the agent device is a domain controller", "type": "boolean"}, "is_excluded": {"description": "If the agent device is excluded", "type": "boolean"}, "is_isolated": {"description": "If the agent device is isolated", "type": "boolean"}, "is_sleeping": {"description": "If the agent device is is_sleeping", "type": "boolean"}, "isolation_requested": {"description": "If agent isolation has been requested", "type": "boolean"}, "key_id": {"description": "Key ID of agent device", "example": "aff08432-80ae-8fbe-bcd0-399beb09c6f1", "format": "uuid", "readOnly": true, "type": "string"}, "keyname": {"description": "The name of the key the device belongs to", "type": "string"}, "modified": {"description": "When the agent device was modified", "example": "2015-07-07T15:49:51.230", "format": "date-time", "readOnly": true, "type": "string"}, "org_id": {"description": "ID of org associated with this agent device", "example": "aff08432-80ae-8fbe-bcd0-399beb09c6f1", "format": "uuid", "type": "string"}, "plat": {"description": "The platform the device is running on", "type": "string"}}, "type": "object"}, "agents_keys_data_record": {"properties": {"agent_count": {"description": "Number of agents currently using this key supports", "example": 10, "type": "integer"}, "agent_seat_count": {"description": "Number of agents this key supports", "example": 10, "type": "integer"}, "created": {"description": "When the agent key was created", "example": "2015-07-07T15:49:51.230", "format": "date-time", "readOnly": true, "type": "string"}, "description": {"description": "Description of the agent key", "example": "AWS Lab Key", "type": "string"}, "key_id": {"description": "ID of agent key", "example": "aff08432-80ae-8fbe-bcd0-399beb09c6f1", "format": "uuid", "readOnly": true, "type": "string"}, "modified": {"description": "When the agent key was modified", "example": "2015-07-07T15:49:51.230", "format": "date-time", "readOnly": true, "type": "string"}, "org_id": {"description": "ID of org associated with this agent key", "example": "aff08432-80ae-8fbe-bcd0-399beb09c6f1", "format": "uuid", "type": "string"}}, "type": "object"}, "api_links": {"properties": {"next": {"description": "Link to next set of records (null when no next page). Path matches the request path with page query params.", "example": "/v1/{path}?page=2&page_size=25", "nullable": true, "type": "string"}, "prev": {"description": "Link to previous set of records (null when no previous page). Path matches the request path with page query params.", "example": null, "nullable": true, "type": "string"}, "self": {"description": "Link to current set of records. Path matches the request path with page query params.", "example": "/v1/{path}?page=1&page_size=25", "type": "string"}}, "type": "object"}, "api_meta": {"description": "Meta information", "properties": {"page": {"description": "Current page of records", "example": 1, "type": "integer"}, "page_size": {"description": "How many records come across on a page", "example": 100, "type": "integer"}, "total_items": {"description": "How many total records there are", "example": 156, "type": "integer"}, "total_pages": {"description": "How many total pages of records there are", "example": 2, "type": "integer"}}, "type": "object"}, "detection_rule_condition_ref": {"description": "A condition referenced by the rule.", "properties": {"analysis": {"description": "Finding analysis text with placeholders for evidence fields.", "nullable": true, "type": "string"}, "id": {"description": "Condition ID", "type": "integer"}, "investigation_guide": {"description": "Investigation guide for analysts responding to findings from this condition.", "nullable": true, "type": "string"}, "name": {"description": "Condition name", "type": "string"}}, "type": "object"}, "detection_rule_detail_record": {"allOf": [{"$ref": "#/components/schemas/detection_rule_record"}, {"description": "Additional fields returned only on single-rule detail endpoints.", "properties": {"detection": {"$ref": "#/components/schemas/detection_rule_detection"}, "evidence_schema": {"description": "Merged condition_schema fields across all conditions in this rule. Each item is a one-key object {field_name: field_definition} where field_definition contains at least data_type. Structure is variable per rule.\n", "items": {"additionalProperties": true, "type": "object"}, "type": "array"}}, "type": "object"}]}, "detection_rule_detection": {"description": "Detection metadata for the rule.", "properties": {"conditions": {"description": "List of conditions referenced by this rule.", "items": {"$ref": "#/components/schemas/detection_rule_condition_ref"}, "type": "array"}}, "type": "object"}, "detection_rule_record": {"description": "A detection rule record with enriched fields. org_id, status, and status_label are present for org-scoped rules and absent (null) for basis rules. rule_created is present for basis rules only.\n", "properties": {"analysis": {"description": "Analysis text from the first condition.", "nullable": true, "type": "string"}, "blumira_default_state": {"description": "Blumira's default enabled/disabled state for this rule. Disabled if the condition has the status:default_disabled tag; otherwise Enabled.\n", "enum": ["Enabled", "Disabled"], "type": "string"}, "category": {"description": "Finding type ID (e.g. 20=Suspect, 30=Threat). Null when unknown.", "nullable": true, "type": "integer"}, "category_label": {"description": "Human-readable finding type name (e.g. \"Threat\", \"Suspect\"). Null when unknown.", "nullable": true, "type": "string"}, "condition_set": {"description": "Raw condition steps for this rule.", "items": {"properties": {"condition": {"type": "integer"}, "step": {"type": "integer"}}, "type": "object"}, "type": "array"}, "created": {"description": "When the rule was created", "format": "date-time", "type": "string"}, "data_type": {"description": "Display names of data types that trigger this rule (e.g. [\"AWS\", \"Agent OS\"]). Derived from condition type tags via Column log_type.\n", "items": {"type": "string"}, "type": "array"}, "detection_type": {"description": "Real-Time for rules using method 500 (Indicators); Windowed otherwise.", "enum": ["Real-Time", "Windowed"], "type": "string"}, "id": {"description": "Detection rule ID", "format": "uuid", "type": "string"}, "is_ahi_supported": {"description": "True if the rule supports Automated Host Isolation (AHI): requires an AHI-compatible type tag, method 500, no AHI:disabled tag, and finding type 20 or 30.\n", "type": "boolean"}, "modified": {"description": "When the rule was last modified", "format": "date-time", "type": "string"}, "name": {"description": "Rule name", "type": "string"}, "org_id": {"description": "Org that owns the rule. Absent on basis rules.", "format": "uuid", "nullable": true, "type": "string"}, "priority": {"description": "Rule priority (range 1\u20135). Null when unknown.", "nullable": true, "type": "integer"}, "priority_label": {"description": "Priority label (e.g. \"P1\", \"P2\"). Null when priority is null.", "nullable": true, "type": "string"}, "rule_created": {"description": "Present on basis rules only. The later of rule.created and condition.created, representing when the basis rule became active.\n", "format": "date-time", "nullable": true, "type": "string"}, "status": {"description": "Rule deployment status code: 0=not_deployed, 1=enabled, 5=disabled, 50=pending_disable, 100=pending_undeploy, 101=pending_enable. Absent on basis rules.\n", "example": 1, "nullable": true, "type": "integer"}, "status_label": {"description": "Human-readable status: not_deployed, enabled, disabled, pending_disable, pending_undeploy, pending_enable. Absent on basis rules.\n", "example": "enabled", "nullable": true, "type": "string"}}, "type": "object"}, "error_envelope": {"properties": {"code": {"description": "Machine-readable error code discriminating the failure reason", "enum": ["invalid_param", "guardrail_reject", "sensor_not_in_org", "unknown_sensor", "dispatch_disabled", "rate_capped", "device_locked", "unsupported_os", "idempotency_conflict", "dispatch_failed"], "type": "string"}, "details": {"description": "Additional error-specific detail (e.g. blocking_command_id for device_locked)", "nullable": true, "type": "object"}, "message": {"description": "Human-readable error message", "type": "string"}, "retryable": {"description": "Whether the caller may retry the request as-is", "type": "boolean"}}, "required": ["code", "message", "retryable"], "type": "object"}, "evidence_row_dynamic": {"additionalProperties": true, "description": "One row of evidence. Keys are dynamic and match the field names in the top-level evidence_keys array (e.g. __time_matched, id, and rule-specific fields like src_ip, user). Values may be string, number, boolean, array, or object depending on the field.\n", "type": "object"}, "finding_attachment_item": {"description": "One attachment on a finding. Only id, filename, uploaded_at, uploaded_by are returned; signed_get_url is never included. uploaded_by is a person object.", "properties": {"filename": {"description": "Original filename", "type": "string"}, "id": {"description": "Attachment ID", "format": "uuid", "type": "string"}, "uploaded_at": {"description": "When the attachment was uploaded", "format": "date-time", "type": "string"}, "uploaded_by": {"description": "Person who uploaded the attachment (id, first_name, last_name, email).", "properties": {"email": {"description": "Email", "type": "string"}, "first_name": {"description": "First name", "type": "string"}, "id": {"description": "Person ID", "format": "uuid", "type": "string"}, "last_name": {"description": "Last name", "type": "string"}}, "type": "object"}}, "type": "object"}, "finding_detail_record": {"allOf": [{"$ref": "#/components/schemas/response_findings_data"}, {"$ref": "#/components/schemas/response_findings_detail_data"}], "type": "object"}, "finding_location_item": {"description": "One org location associated with the finding (id, name, city, country).", "properties": {"city": {"description": "City", "type": "string"}, "country": {"description": "Two-letter country code", "type": "string"}, "id": {"description": "Location ID", "format": "uuid", "type": "string"}, "name": {"description": "Location name", "type": "string"}}, "type": "object"}, "finding_person_item": {"description": "Person (id, first_name, last_name, email). Used for modified_by and status_modified_by on details.", "properties": {"email": {"description": "Email", "type": "string"}, "first_name": {"description": "First name", "type": "string"}, "id": {"description": "Person ID", "format": "uuid", "type": "string"}, "last_name": {"description": "Last name", "type": "string"}}, "type": "object"}, "finding_ui_action_item": {"description": "UI action for the finding (id and name). Resolved from ui_action_type via finding service constant/ui_action. Omitted when ui_action_type is absent or not in the constants list.\n", "properties": {"id": {"description": "UI action type ID (same as ui_action_type)", "type": "integer"}, "name": {"description": "Display name for the UI action", "type": "string"}}, "type": "object"}, "findings_comments_record": {"properties": {"age": {"description": "Age in seconds", "example": 147397393, "type": "integer"}, "body": {"description": "HTML body of comment", "example": "<div>Test</div>", "type": "string"}, "id": {"description": "Comment ID (comm_id from Comm service). Always present for POST add-comment (sync).", "format": "uuid", "type": "string", "x-nullable": true}, "sender": {"$ref": "#/components/schemas/response_sender"}, "subject": {"description": "Comment subject", "example": "Subject", "type": "string"}}, "type": "object"}, "findings_data_record": {"properties": {"analysis": {"description": "Finding analysis", "example": "Blumira has detected a portscan from 192.168.26.121 to 192.168.2.203 over 1, 4, 37, 9, and 2 others port(s) from an advanced raw query detector.", "type": "string"}, "blocked": {"description": "Whether the finding is blocked. Optional; present on details.", "type": "boolean"}, "category": {"description": "Numeric category ID (e.g. for category_name). Optional; present on details.", "type": "integer"}, "confirmation_completed": {"description": "When confirmation was completed. Optional; present on details.", "format": "date-time", "nullable": true, "type": "string"}, "created": {"description": "When the finding was created", "example": "2015-07-07T15:49:51.230", "format": "date-time", "readOnly": true, "type": "string"}, "escalation_completed": {"description": "When escalation was completed. Optional; present on details.", "format": "date-time", "nullable": true, "type": "string"}, "finding_id": {"description": "ID of finding", "example": "aff08432-80ae-8fbe-bcd0-399beb09c6f1", "format": "uuid", "readOnly": true, "type": "string"}, "jurisdiction": {"description": "Numeric jurisdiction ID (e.g. for jurisdiction_name). Optional; present on details.", "type": "integer"}, "match_id": {"description": "ID of the BDF match associated with this finding (used for evidence). Omitted or null if not available.", "format": "uuid", "nullable": true, "readOnly": true, "type": "string"}, "matched": {"description": "When the finding was matched. Optional; present on details.", "format": "date-time", "nullable": true, "type": "string"}, "mitigation_completed": {"description": "When mitigation was completed. Optional; present on details.", "format": "date-time", "nullable": true, "type": "string"}, "modified": {"description": "When the finding was modified", "example": "2015-07-07T15:49:51.230", "format": "date-time", "readOnly": true, "type": "string"}, "name": {"description": "Name of the finding", "example": "Active Directory Domain Admin Created", "type": "string"}, "org_id": {"description": "ID of org associated with this finding", "example": "aff08432-80ae-8fbe-bcd0-399beb09c6f1", "format": "uuid", "type": "string"}, "org_name": {"description": "Name of org associated with this finding (null for POC org path)", "example": "My Organization", "nullable": true, "type": "string"}, "priority": {"description": "Priority of finding (range 1-5)", "example": 4, "type": "integer"}, "promoted_to_id": {"description": "ID of the finding this was promoted to, if any. Optional; present on details.", "format": "uuid", "nullable": true, "type": "string"}, "seconds_in_status": {"description": "Seconds the finding has been in its current status. Optional; present on details.", "type": "integer"}, "seconds_to_status": {"description": "Seconds until a status transition (if applicable). Optional; present on details.", "type": "integer"}, "short_id": {"description": "Short identifier for the finding", "example": "F-24-16-B4B6", "type": "string"}, "status": {"description": "Numeric status code (e.g., 40 = Resolved)", "example": 40, "type": "integer"}, "status_modified": {"description": "When the status was last modified. Optional; present on details.", "format": "date-time", "nullable": true, "type": "string"}, "status_name": {"description": "Status of the finding (e.g., \"Open\", \"Analysis in Progress\", \"Resolved\", etc.)", "example": "Open", "type": "string"}, "type": {"description": "Numeric type ID (e.g. for type_name). Optional; present on details.", "type": "integer"}, "type_name": {"description": "Type of finding (e.g, \"Suspect\", \"Threat\", etc.)", "example": "Suspect", "type": "string"}, "ui_action_type": {"description": "ID of action that the UI should take when rendering this finding. Optional; present on details. Also expanded as ui_action object.\n", "example": 20, "type": "integer"}}, "type": "object"}, "pax8_provision_attempt": {"properties": {"createdDate": {"description": "When the provision attempt was created", "example": "2022-10-03T10:15:30Z", "format": "date-time", "type": "string"}, "id": {"description": "Unique identifier for the provision attempt", "example": "3a11dbb9-226d-4788-86cd-4c6601da81e9", "format": "uuid", "type": "string"}, "provisionDetailId": {"description": "Associated provision detail ID", "example": "8fcf68db-c30e-4f34-b773-bc1631cd1fef", "format": "uuid", "type": "string"}, "status": {"description": "Status of the provision attempt", "example": "Acknowledged", "type": "string"}, "webhookId": {"description": "Associated webhook ID", "example": "21110b5d-55b1-4cdf-82f7-2bcc9fef6c41", "format": "uuid", "type": "string"}}, "required": ["id", "provisionDetailId", "status", "createdDate"], "type": "object"}, "pax8_provision_detail": {"properties": {"createdDate": {"description": "When the provision detail was created", "example": "2022-10-03T10:15:30Z", "format": "date-time", "type": "string"}, "details": {"properties": {"blumiraAdminEmail": {"description": "Contact email", "example": "johndoe@email.com", "format": "email", "type": "string"}, "blumiraCoC": {"description": "Change of channel indicator", "example": "Yes", "type": "string", "x-nullable": true}, "blumiraDomain": {"description": "Contact domain", "example": "example.com", "type": "string"}, "blumiraFirstName": {"description": "Contact first name", "example": "John", "type": "string"}, "blumiraLastName": {"description": "Contact last name", "example": "Doe", "type": "string"}}, "type": "object"}, "id": {"description": "Unique identifier for the provision detail", "example": "5c425efa-60be-4bac-98b4-d3dff9099143", "format": "uuid", "type": "string"}, "provisionRequestId": {"description": "Associated provision request ID", "example": "50f31e66-9a01-43a8-b0f8-14c288bac5da", "format": "uuid", "type": "string"}}, "required": ["id", "provisionRequestId", "details", "createdDate"], "type": "object"}, "pax8_provision_request": {"properties": {"billingTerm": {"description": "Billing term", "example": "Monthly", "type": "string"}, "companyAddress": {"$ref": "#/components/schemas/address"}, "companyDomain": {"description": "Company domain", "example": "company.com", "type": "string"}, "companyId": {"description": "Company ID", "example": "0b4d7ee2-8335-433e-8196-a65b962b9f99", "format": "uuid", "type": "string"}, "companyName": {"description": "Company name", "example": "Example Company Name", "type": "string"}, "createdDate": {"description": "When the provision request was created", "example": "2024-04-08T19:54:03Z", "format": "date-time", "type": "string"}, "id": {"description": "Unique identifier for the provision request", "example": "eb77429f-b313-4916-9bed-ccc1c373dff7", "format": "uuid", "type": "string"}, "partnerAddress": {"$ref": "#/components/schemas/address"}, "partnerDomain": {"description": "Partner domain", "example": "partner.com", "type": "string"}, "partnerId": {"description": "Partner ID", "example": "2bb54fa0-21ed-481e-8627-26e3ee9e9e02", "format": "uuid", "type": "string"}, "partnerName": {"description": "Partner name", "example": "Example Partner Name", "type": "string"}, "productId": {"description": "Product ID", "example": "ada2a119-9892-4a91-8bae-b0bb3b0e81a1", "format": "uuid", "type": "string"}, "productName": {"description": "Product name", "example": "Product ABC", "type": "string"}, "quantity": {"description": "Quantity ordered", "example": 1, "type": "integer"}, "subscriptionId": {"description": "Subscription ID", "example": "475df9f9-2558-4f91-903b-5130dad67064", "format": "uuid", "type": "string"}, "type": {"description": "Type of provision request", "example": "NetNew", "type": "string"}}, "required": ["id", "partnerId", "partnerName", "partnerDomain", "partnerAddress", "companyId", "companyName", "companyDomain", "companyAddress", "productId", "productName", "subscriptionId", "type", "createdDate", "billingTerm"], "type": "object"}, "request_action_dispatch": {"properties": {"action": {"description": "Response action to dispatch (e.g. isolate, deisolate)", "enum": ["isolate", "deisolate", "kill_process", "kill_process_tree", "delete_file", "disable_local_user", "disable_ad_user"], "type": "string"}, "idempotency_key": {"description": "Caller-supplied key for deduplicating repeated dispatch requests", "type": "string"}, "parameters": {"description": "Action-specific parameters", "type": "object"}, "window_seconds": {"description": "Optional. Seconds until the command is considered timed out if not yet terminal. Defaults to 300 when omitted.", "maximum": 600, "minimum": 30, "type": "integer"}}, "required": ["action", "idempotency_key"], "type": "object"}, "request_add_comment_body": {"properties": {"body": {"description": "Comment body (required, non-empty). May contain HTML.", "example": "<p>Investigation update</p>", "type": "string"}, "sender": {"description": "UUID of the person creating the comment. Use GET /org/users or GET /msp/accounts/{account_id}/users to obtain user IDs.", "example": "00110011-0000-0000-0000-000000000001", "format": "uuid", "type": "string"}}, "required": ["body", "sender"], "type": "object"}, "request_finding_owners": {"properties": {"owner_type": {"description": "Type of owners to assign. Case-sensitive, must be lowercase.", "enum": ["responder", "analyst", "manager"], "example": "responder", "type": "string"}, "owners": {"description": "Array of person IDs (UUIDs) to assign as owners. Empty array clears all owners for the specified owner_type.", "example": ["00110011-0000-0000-0000-000000000001", "00110011-0000-0000-0000-000000000002"], "items": {"format": "uuid", "type": "string"}, "type": "array"}}, "required": ["owners", "owner_type"], "type": "object"}, "request_finding_resolve": {"properties": {"resolution": {"description": "Resolution ID (e.g., 10=Valid, 20=False Positive, 30=No Action Needed, 40=Risk Accepted)", "example": 10, "type": "integer"}, "resolution_notes": {"description": "Optional notes related to the resolution", "example": "Resolved after investigation", "type": "string", "x-nullable": true}}, "required": ["resolution"], "type": "object"}, "request_pax8_provision": {"properties": {"isSimulation": {"description": "Whether this is a simulation request", "example": false, "type": "boolean", "x-nullable": true}, "provisionAttempt": {"$ref": "#/components/schemas/pax8_provision_attempt"}, "provisionDetail": {"$ref": "#/components/schemas/pax8_provision_detail"}, "provisionRequest": {"$ref": "#/components/schemas/pax8_provision_request"}}, "required": ["provisionRequest", "provisionDetail", "provisionAttempt"], "type": "object"}, "resolution_record": {"properties": {"id": {"description": "Resolution ID", "example": 10, "type": "integer"}, "name": {"description": "Resolution name", "example": "Valid", "type": "string"}}, "type": "object"}, "response_agents_device_detail_record": {"$ref": "#/components/schemas/agents_devices_data_record"}, "response_agents_devices_by_org": {"properties": {"data": {"items": {"anyOf": [{"$ref": "#/components/schemas/agents_devices_data_record"}]}, "type": "array"}, "links": {"$ref": "#/components/schemas/api_links"}, "meta": {"$ref": "#/components/schemas/api_meta"}, "status": {"description": "Status of request", "example": "OK", "type": "string"}}, "required": ["data", "status", "links", "meta"], "type": "object"}, "response_agents_key_detail_record": {"$ref": "#/components/schemas/agents_keys_data_record"}, "response_agents_keys_by_org": {"properties": {"data": {"items": {"anyOf": [{"$ref": "#/components/schemas/agents_keys_data_record"}]}, "type": "array"}, "links": {"$ref": "#/components/schemas/api_links"}, "meta": {"$ref": "#/components/schemas/api_meta"}, "status": {"description": "Status of request", "example": "OK", "type": "string"}}, "required": ["data", "status", "links", "meta"], "type": "object"}, "response_command_record": {"properties": {"action": {"description": "Response action that was dispatched", "type": "string"}, "command_id": {"description": "UUID of the command", "format": "uuid", "type": "string"}, "device_id": {"description": "UUID of the agent device the command targets", "format": "uuid", "type": "string"}, "dispatched_at": {"description": "When the command was dispatched", "format": "date-time", "type": "string"}, "error": {"$ref": "#/components/schemas/error_envelope", "nullable": true}, "result": {"description": "Action-specific terminal result; null until the command reaches a terminal status. Task actions: {exit_code, reason?}. isolate/deisolate: {is_isolated}. Fan-out (parent commands): {children: [{device_id, status, exit_code?, error?}]}.", "nullable": true, "type": "object"}, "status": {"description": "Current lifecycle status of the command", "enum": ["accepted", "running", "succeeded", "failed", "timed_out", "dispatch_failed"], "type": "string"}, "terminal_at": {"description": "When the command reached a terminal status; null until then", "format": "date-time", "nullable": true, "type": "string"}}, "required": ["command_id", "action", "device_id", "status", "dispatched_at"], "type": "object"}, "response_detection_rule_detail": {"properties": {"data": {"$ref": "#/components/schemas/detection_rule_detail_record"}}, "required": ["data"], "type": "object"}, "response_detection_rules_list": {"properties": {"data": {"description": "Paginated list of detection rule records.", "items": {"$ref": "#/components/schemas/detection_rule_record"}, "type": "array"}, "links": {"$ref": "#/components/schemas/api_links"}, "meta": {"$ref": "#/components/schemas/api_meta"}}, "required": ["data", "links", "meta"], "type": "object"}, "response_finding_evidence": {"properties": {"data": {"description": "Paginated evidence rows; each object has keys from evidence_keys.", "items": {"$ref": "#/components/schemas/evidence_row_dynamic"}, "type": "array"}, "evidence_keys": {"description": "Field names that appear in each evidence row (data items). Use these to interpret the keys of each object in data. Sorted alphabetically; __time_matched is the reserved field for the evidence created timestamp.\n", "example": ["__time_matched", "src_ip", "user"], "items": {"type": "string"}, "type": "array"}, "links": {"$ref": "#/components/schemas/api_links"}, "meta": {"$ref": "#/components/schemas/api_meta"}, "status": {"description": "Status of request", "example": "OK", "type": "string"}}, "required": ["data", "status", "links", "meta"], "type": "object"}, "response_findings_by_org": {"properties": {"data": {"items": {"anyOf": [{"$ref": "#/components/schemas/findings_data_record"}]}, "type": "array"}, "links": {"$ref": "#/components/schemas/api_links"}, "meta": {"$ref": "#/components/schemas/api_meta"}, "status": {"description": "Status of request", "example": "OK", "type": "string"}}, "required": ["data", "status", "links", "meta"], "type": "object"}, "response_findings_comments": {"items": {"$ref": "#/components/schemas/findings_comments_record"}, "type": "array"}, "response_findings_data": {"allOf": [{"$ref": "#/components/schemas/findings_data_record"}], "type": "object"}, "response_findings_detail_by_org": {"properties": {"data": {"items": {"$ref": "#/components/schemas/finding_detail_record"}, "type": "array"}, "links": {"$ref": "#/components/schemas/api_links"}, "meta": {"$ref": "#/components/schemas/api_meta"}, "status": {"description": "Status of request", "example": "OK", "type": "string"}}, "required": ["data", "status", "links", "meta"], "type": "object"}, "response_findings_detail_data": {"properties": {"attachments": {"description": "Attachments on the finding (signed_get_url stripped).", "items": {"$ref": "#/components/schemas/finding_attachment_item"}, "type": "array"}, "category_name": {"description": "Category of the finding (e.g., \"Malicious Code\", \"Unauthorized Access Attempt\", etc.)", "example": "Malicious Code", "type": "string"}, "confirmation": {"description": "Workflow for confirmation (array of step objects). Pass-through from finding service.", "items": {"type": "object"}, "type": "array"}, "escalation": {"description": "Workflow for escalation (array of step objects). Pass-through from finding service.", "items": {"type": "object"}, "type": "array"}, "jurisdiction_name": {"description": "Jurisdiction of the finding (e.g., \"administrator\", \"responder\", etc.)", "example": "administrator", "type": "string"}, "locations": {"description": "Org locations associated with the finding. Expanded from org_location_ids; order matches org_location_ids. Omitted or empty when org_location_ids is empty or locations could not be resolved.\n", "items": {"$ref": "#/components/schemas/finding_location_item"}, "type": "array"}, "mitigation": {"description": "Workflow for mitigation (array of step objects). Pass-through from finding service.", "items": {"type": "object"}, "type": "array"}, "modified_by": {"$ref": "#/components/schemas/finding_person_item"}, "org_location_ids": {"description": "Array of org location UUIDs (finding service pass-through).", "items": {"format": "uuid", "type": "string"}, "type": "array"}, "owners": {"description": "object with types and UUIDs of finding owners", "properties": {"analysts": {"$ref": "#/components/schemas/response_owners"}, "managers": {"$ref": "#/components/schemas/response_owners"}, "responders": {"$ref": "#/components/schemas/response_owners"}}, "type": "object"}, "owners_by_email": {"description": "Owners of the finding by email. Pass-through from finding service.", "items": {"type": "object"}, "nullable": true, "type": "array"}, "related_findings": {"description": "Finding UUIDs related to this finding. Pass-through from finding service.", "items": {"format": "uuid", "type": "string"}, "type": "array"}, "resolution": {"description": "Resolution ID (e.g., 10=Valid, 20=False Positive, 30=No Action Needed, 40=Risk Accepted)", "example": 10, "type": "integer"}, "resolution_name": {"description": "Resolution of the finding (e.g., \"Valid\", \"False Positive\", etc.)", "example": "Valid", "type": "string"}, "resolution_notes": {"description": "Any notes related to the resolution", "type": "string"}, "src_country": {"description": "Two-letter country codes implicated in the finding. Pass-through from finding service.", "items": {"type": "string"}, "type": "array"}, "status_modified_by": {"$ref": "#/components/schemas/finding_person_item"}, "summary": {"description": "Executive summary of the finding (<=512 characters)", "example": "Detects potentially innapropriately created domain administrators through Event ID.", "type": "string"}, "ui_action": {"$ref": "#/components/schemas/finding_ui_action_item"}, "url": {"description": "UI URL to the finding", "example": "https://app.blumira.com/f0eee000-0000-0000-0000-c0ffee000001/query/findings/ffffffff-1111-2555-0000-000000000001", "readOnly": true, "type": "string"}}, "type": "object"}, "response_findings_detail_record": {"properties": {"data": {"$ref": "#/components/schemas/finding_detail_record"}, "status": {"description": "whether query succeeded", "example": "OK", "type": "string"}}, "required": ["data", "status"], "type": "object"}, "response_findings_record": {"$ref": "#/components/schemas/findings_data_record"}, "response_health": {"example": {"data": {"api_name": "Blumira Public API", "build_time": "2024-03-27T16:22:03Z", "commit_hash": "oe5d4300"}, "status": "OK"}, "properties": {"data": {"$ref": "#/components/schemas/response_health_data"}, "status": {"description": "whether query succeeded (will always be OK if http response code is a non-error code)", "type": "string"}}, "required": ["status"], "type": "object"}, "response_health_data": {"description": "Health payload (api_name, build_time, commit_hash). Code returns this as the top-level data field.", "properties": {"api_name": {"example": "Blumira Public API", "type": "string"}, "build_time": {"example": "2024-03-27T16:22:03Z", "type": "string"}, "commit_hash": {"example": "oe5d4300", "type": "string"}}, "type": "object"}, "response_msp_subaccount_record": {"allOf": [{"$ref": "#/components/schemas/subaccount_data_record"}], "type": "object"}, "response_msp_subaccounts": {"properties": {"data": {"items": {"anyOf": [{"$ref": "#/components/schemas/subaccounts_data_record"}]}, "type": "array"}, "links": {"$ref": "#/components/schemas/api_links"}, "meta": {"$ref": "#/components/schemas/api_meta"}, "status": {"description": "Status of request", "example": "OK", "type": "string"}}, "required": ["data", "status", "links", "meta"], "type": "object"}, "response_org_users": {"properties": {"data": {"items": {"anyOf": [{"$ref": "#/components/schemas/users_data_record"}]}, "type": "array"}, "links": {"$ref": "#/components/schemas/api_links"}, "meta": {"$ref": "#/components/schemas/api_meta"}, "status": {"description": "Status of request", "example": "OK", "type": "string"}}, "required": ["data", "status", "links", "meta"], "type": "object"}, "response_owners": {"items": {"properties": {"email": {"description": "Email", "type": "string"}, "first_name": {"description": "First name", "type": "string"}, "id": {"description": "ID", "format": "uuid", "type": "string"}, "last_name": {"description": "Last name", "type": "string"}}, "type": "object"}, "type": "array"}, "response_resolutions": {"description": "List of resolution options", "items": {"$ref": "#/components/schemas/resolution_record"}, "type": "array"}, "response_sender": {"properties": {"email": {"description": "Email", "nullable": true, "type": "string"}, "first_name": {"description": "First name", "nullable": true, "type": "string"}, "id": {"description": "ID (null when sender is masked, e.g. superadmin)", "format": "uuid", "nullable": true, "type": "string"}, "last_name": {"description": "Last name", "nullable": true, "type": "string"}}, "type": "object"}, "response_webhook_deliveries_list": {"properties": {"data": {"items": {"$ref": "#/components/schemas/webhook_delivery_summary_record"}, "type": "array"}, "links": {"$ref": "#/components/schemas/api_links"}, "meta": {"$ref": "#/components/schemas/api_meta"}, "status": {"example": "OK", "type": "string"}}, "required": ["data", "links", "meta"], "type": "object"}, "response_webhook_delivery": {"properties": {"data": {"$ref": "#/components/schemas/webhook_delivery_summary_record"}}, "required": ["data"], "type": "object"}, "response_webhook_delivery_detail": {"properties": {"data": {"$ref": "#/components/schemas/webhook_delivery_detail_record"}}, "required": ["data"], "type": "object"}, "response_webhook_endpoint": {"properties": {"data": {"$ref": "#/components/schemas/webhook_endpoint_summary_record"}}, "required": ["data"], "type": "object"}, "response_webhook_endpoint_with_secret": {"properties": {"data": {"$ref": "#/components/schemas/webhook_endpoint_with_secret_record"}}, "required": ["data"], "type": "object"}, "response_webhook_endpoints_list": {"properties": {"data": {"items": {"$ref": "#/components/schemas/webhook_endpoint_summary_record"}, "type": "array"}, "links": {"$ref": "#/components/schemas/api_links"}, "meta": {"$ref": "#/components/schemas/api_meta"}, "status": {"example": "OK", "type": "string"}}, "required": ["data", "links", "meta"], "type": "object"}, "subaccount_data_record": {"properties": {"account_id": {"description": "ID of MSP sub-account", "example": "aff08432-80ae-8fbe-bcd0-399beb09c6f1", "format": "uuid", "readOnly": true, "type": "string"}, "agent_count_available": {"description": "Count of agent seats available for installation", "example": 10, "type": "integer"}, "agent_count_used": {"description": "Count of agent seats currently used", "example": 10, "type": "integer"}, "license": {"description": "MSP sub-account license", "example": "FREE", "type": "string"}, "name": {"description": "Name of the MSP sub-account", "example": "My MSP sub-account", "type": "string"}, "open_findings": {"description": "Number of open findings", "example": 10, "type": "integer"}, "user_count": {"description": "MSP sub-account user user_count", "example": 50, "type": "integer"}}, "type": "object"}, "subaccounts_data_record": {"properties": {"account_id": {"description": "ID of MSP sub-account", "example": "aff08432-80ae-8fbe-bcd0-399beb09c6f1", "format": "uuid", "readOnly": true, "type": "string"}, "name": {"description": "Name of the MSP sub-account", "example": "My MSP sub-account", "type": "string"}, "open_findings": {"description": "Number of open findings", "example": 10, "type": "integer"}}, "type": "object"}, "users_data_record": {"properties": {"email": {"description": "User email address", "example": "user@example.com", "format": "email", "type": "string"}, "first_name": {"description": "User first name", "example": "Jane", "type": "string"}, "id": {"description": "User ID", "example": "aff08432-80ae-8fbe-bcd0-399beb09c6f1", "format": "uuid", "readOnly": true, "type": "string"}, "last_name": {"description": "User last name", "example": "Doe", "type": "string"}, "org_roles": {"description": "List of roles for this user in the organization.", "example": [{"role_id": 40, "role_name": "responder"}, {"role_id": 10, "role_name": "analyst"}], "items": {"properties": {"role_id": {"description": "Role ID (e.g., 40 for responder role)", "example": 40, "type": "integer"}, "role_name": {"description": "Human-readable role name", "example": "responder", "type": "string"}}, "required": ["role_id", "role_name"], "type": "object"}, "type": "array"}}, "type": "object"}, "webhook_delivery_attempt_record": {"properties": {"attempted": {"format": "date-time", "type": "string"}, "delivery_id": {"format": "uuid", "type": "string"}, "error_class": {"nullable": true, "type": "string"}, "id": {"format": "uuid", "type": "string"}, "response_code": {"nullable": true, "type": "integer"}, "response_ms": {"nullable": true, "type": "integer"}}, "type": "object"}, "webhook_delivery_detail_record": {"allOf": [{"$ref": "#/components/schemas/webhook_delivery_summary_record"}, {"properties": {"attempts": {"items": {"$ref": "#/components/schemas/webhook_delivery_attempt_record"}, "type": "array"}}, "type": "object"}]}, "webhook_delivery_summary_record": {"properties": {"attempt_count": {"type": "integer"}, "completed": {"format": "date-time", "nullable": true, "type": "string"}, "created": {"format": "date-time", "type": "string"}, "endpoint_id": {"format": "uuid", "type": "string"}, "event_id": {"type": "string"}, "event_type": {"type": "string"}, "id": {"format": "uuid", "type": "string"}, "last_response_code": {"nullable": true, "type": "integer"}, "status": {"type": "string"}}, "type": "object"}, "webhook_endpoint_create_record": {"properties": {"auth_header_enabled": {"default": false, "type": "boolean"}, "auth_header_value": {"nullable": true, "type": "string"}, "custom_headers": {"additionalProperties": {"type": "string"}, "nullable": true, "type": "object"}, "description": {"nullable": true, "type": "string"}, "enabled": {"default": true, "type": "boolean"}, "filters": {"items": {"$ref": "#/components/schemas/webhook_endpoint_filter_create_record"}, "type": "array"}, "schema_version": {"default": "1", "type": "string"}, "url": {"format": "uri", "type": "string"}}, "required": ["url"], "type": "object"}, "webhook_endpoint_filter_create_record": {"properties": {"event_type": {"type": "string"}, "finding_types": {"description": "Finding type slugs to filter on. Valid values: operational, risk, suspect, threat, system. The alias \"alert\" is accepted during transition and canonicalized to \"system\" before persisting.", "example": ["system"], "items": {"type": "string"}, "nullable": true, "type": "array"}, "priorities": {"description": "Finding priority as an integer: 1 (P1), 2 (P2), 3 (P3). The console displays P1\u2013P3.", "example": [1, 2], "items": {"enum": [1, 2, 3], "type": "integer"}, "nullable": true, "type": "array"}, "severities": {"description": "Case severity. Valid values: critical, high, medium, low.", "example": ["high", "critical"], "items": {"enum": ["critical", "high", "medium", "low"], "type": "string"}, "nullable": true, "type": "array"}}, "required": ["event_type"], "type": "object"}, "webhook_endpoint_filter_nested_record": {"properties": {"event_type": {"type": "string"}, "finding_types": {"description": "Finding type slugs to filter on. Valid values: operational, risk, suspect, threat, system. The alias \"alert\" is accepted during transition and canonicalized to \"system\" before persisting.", "example": ["system"], "items": {"type": "string"}, "nullable": true, "type": "array"}, "id": {"format": "uuid", "type": "string"}, "priorities": {"description": "Finding priority as an integer: 1 (P1), 2 (P2), 3 (P3). The console displays P1\u2013P3.", "example": [1, 2], "items": {"enum": [1, 2, 3], "type": "integer"}, "nullable": true, "type": "array"}, "severities": {"description": "Case severity. Valid values: critical, high, medium, low.", "example": ["high", "critical"], "items": {"enum": ["critical", "high", "medium", "low"], "type": "string"}, "nullable": true, "type": "array"}}, "type": "object"}, "webhook_endpoint_summary_record": {"properties": {"auth_header_enabled": {"type": "boolean"}, "auto_disable_reason": {"nullable": true, "type": "string"}, "auto_disabled": {"format": "date-time", "nullable": true, "type": "string"}, "consecutive_failures": {"type": "integer"}, "created": {"format": "date-time", "type": "string"}, "custom_headers": {"items": {"type": "string"}, "nullable": true, "type": "array"}, "description": {"nullable": true, "type": "string"}, "dual_sign_until": {"format": "date-time", "nullable": true, "type": "string"}, "enabled": {"type": "boolean"}, "filters": {"items": {"$ref": "#/components/schemas/webhook_endpoint_filter_nested_record"}, "type": "array"}, "id": {"format": "uuid", "type": "string"}, "last_success": {"format": "date-time", "nullable": true, "type": "string"}, "modified": {"format": "date-time", "nullable": true, "type": "string"}, "msp_org_id": {"format": "uuid", "nullable": true, "type": "string"}, "org_id": {"format": "uuid", "nullable": true, "type": "string"}, "schema_version": {"type": "string"}, "secret_stale": {"type": "boolean"}, "url": {"type": "string"}, "verification_pending": {"type": "boolean"}, "verification_success_count": {"type": "integer"}}, "type": "object"}, "webhook_endpoint_update_record": {"properties": {"auth_header_enabled": {"type": "boolean"}, "auth_header_value": {"nullable": true, "type": "string"}, "custom_headers": {"additionalProperties": {"type": "string"}, "nullable": true, "type": "object"}, "description": {"nullable": true, "type": "string"}, "enabled": {"type": "boolean"}, "filters": {"items": {"$ref": "#/components/schemas/webhook_endpoint_filter_create_record"}, "type": "array"}, "remove_custom_headers": {"items": {"type": "string"}, "nullable": true, "type": "array"}, "schema_version": {"type": "string"}, "url": {"format": "uri", "type": "string"}}, "type": "object"}, "webhook_endpoint_with_secret_record": {"allOf": [{"$ref": "#/components/schemas/webhook_endpoint_summary_record"}, {"properties": {"secret": {"description": "32-byte HMAC key (base64). Returned ONCE on create/rotate.", "type": "string"}}, "required": ["secret"], "type": "object"}]}}, "securitySchemes": {"ApiKeyAuth": {"in": "header", "name": "pax8ApiTokenV1", "type": "apiKey", "x-apikeyInfoFunc": "api.controller.auth.verify_pax8_api_key"}, "bearerAuth": {"bearerFormat": "JWT", "scheme": "bearer", "type": "http", "x-bearerInfoFunc": "api.controller.auth.decode_token"}}}, "info": {"title": "Public Api", "version": "1.0"}, "openapi": "3.0.0", "paths": {"/health": {"get": {"operationId": "api.controller.health.search", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_health"}}}, "description": "Return JSON with API health information, including version and host/pod name"}}, "summary": "Get API health"}}, "/msp/accounts": {"get": {"operationId": "api.controller.msp.get_accounts", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_msp_subaccounts"}}}, "description": "A list of sub-accounts for your MSP"}}, "summary": "Get or search sub-accounts for your MSP"}}, "/msp/accounts/findings": {"get": {"operationId": "api.controller.msp.get_accounts_findings", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}, {"$ref": "#/components/parameters/param_blocked"}, {"$ref": "#/components/parameters/param_blocked_eq"}, {"$ref": "#/components/parameters/param_blocked_not_eq"}, {"$ref": "#/components/parameters/param_category"}, {"$ref": "#/components/parameters/param_category_eq"}, {"$ref": "#/components/parameters/param_category_not_eq"}, {"$ref": "#/components/parameters/param_category_in"}, {"$ref": "#/components/parameters/param_category_not_in"}, {"$ref": "#/components/parameters/param_created"}, {"$ref": "#/components/parameters/param_created_after"}, {"$ref": "#/components/parameters/param_created_before"}, {"$ref": "#/components/parameters/param_created_eq"}, {"$ref": "#/components/parameters/param_created_not_eq"}, {"$ref": "#/components/parameters/param_created_lt"}, {"$ref": "#/components/parameters/param_created_not_lt"}, {"$ref": "#/components/parameters/param_created_gt"}, {"$ref": "#/components/parameters/param_created_not_gt"}, {"$ref": "#/components/parameters/param_created_by"}, {"$ref": "#/components/parameters/param_modified"}, {"$ref": "#/components/parameters/param_modified_after"}, {"$ref": "#/components/parameters/param_modified_before"}, {"$ref": "#/components/parameters/param_modified_eq"}, {"$ref": "#/components/parameters/param_modified_not_eq"}, {"$ref": "#/components/parameters/param_modified_lt"}, {"$ref": "#/components/parameters/param_modified_not_lt"}, {"$ref": "#/components/parameters/param_modified_gt"}, {"$ref": "#/components/parameters/param_modified_not_gt"}, {"$ref": "#/components/parameters/param_modified_by"}, {"$ref": "#/components/parameters/param_modified_by_eq"}, {"$ref": "#/components/parameters/param_modified_by_not_eq"}, {"$ref": "#/components/parameters/param_modified_by_in"}, {"$ref": "#/components/parameters/param_modified_by_not_in"}, {"$ref": "#/components/parameters/param_name"}, {"$ref": "#/components/parameters/param_name_eq"}, {"$ref": "#/components/parameters/param_name_not_eq"}, {"$ref": "#/components/parameters/param_name_in"}, {"$ref": "#/components/parameters/param_name_not_in"}, {"$ref": "#/components/parameters/param_name_contains"}, {"$ref": "#/components/parameters/param_name_not_contains"}, {"$ref": "#/components/parameters/param_name_regex"}, {"$ref": "#/components/parameters/param_name_not_regex"}, {"$ref": "#/components/parameters/param_priority"}, {"$ref": "#/components/parameters/param_priority_eq"}, {"$ref": "#/components/parameters/param_priority_not_eq"}, {"$ref": "#/components/parameters/param_priority_in"}, {"$ref": "#/components/parameters/param_priority_not_in"}, {"$ref": "#/components/parameters/param_priority_lt"}, {"$ref": "#/components/parameters/param_priority_not_lt"}, {"$ref": "#/components/parameters/param_priority_gt"}, {"$ref": "#/components/parameters/param_priority_not_gt"}, {"$ref": "#/components/parameters/param_resolution"}, {"$ref": "#/components/parameters/param_resolution_eq"}, {"$ref": "#/components/parameters/param_resolution_not_eq"}, {"$ref": "#/components/parameters/param_resolution_in"}, {"$ref": "#/components/parameters/param_resolution_not_in"}, {"$ref": "#/components/parameters/param_status"}, {"$ref": "#/components/parameters/param_status_eq"}, {"$ref": "#/components/parameters/param_status_not_eq"}, {"$ref": "#/components/parameters/param_status_in"}, {"$ref": "#/components/parameters/param_status_not_in"}, {"$ref": "#/components/parameters/param_status_modified_by"}, {"$ref": "#/components/parameters/param_status_modified_by_eq"}, {"$ref": "#/components/parameters/param_status_modified_by_not_eq"}, {"$ref": "#/components/parameters/param_status_modified_by_in"}, {"$ref": "#/components/parameters/param_status_modified_by_not_in"}, {"$ref": "#/components/parameters/param_type"}, {"$ref": "#/components/parameters/param_type_eq"}, {"$ref": "#/components/parameters/param_type_not_eq"}, {"$ref": "#/components/parameters/param_type_in"}, {"$ref": "#/components/parameters/param_type_not_in"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_findings_detail_by_org"}}}, "description": "A list of findings for all your MSP sub-account"}}, "summary": "Get or search findings for all your MSP sub-accounts"}}, "/msp/accounts/{account_id}": {"get": {"operationId": "api.controller.msp.get", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_msp_subaccount_record"}}}, "description": "A specific MSP sub-account with the given ID"}, "404": {"description": "Not found. MSP sub-account does not exist"}}, "summary": "Get a specific MSP sub-account by ID"}}, "/msp/accounts/{account_id}/agents/actions/{command_id}": {"get": {"operationId": "api.controller.msp.get_account_agent_action", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_command_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_command_record"}}}, "description": "A specific command with the given ID"}, "403": {"description": "Forbidden"}, "404": {"description": "Not found. Command does not exist for this sub-account"}}, "summary": "Get the status of a dispatched response action command for your MSP sub-account"}}, "/msp/accounts/{account_id}/agents/devices": {"get": {"operationId": "api.controller.msp.get_account_agents_devices", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_agents_devices_by_org"}}}, "description": "A list of agents devices for your MSP sub-account"}}, "summary": "Get or search agents devices for your MSP sub-account"}}, "/msp/accounts/{account_id}/agents/devices/{device_id}": {"get": {"operationId": "api.controller.msp.get_agents_device", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_device_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_agents_device_detail_record"}}}, "description": "A specific agents device with the given ID for your MSP sub-account"}, "404": {"description": "Not found. Device does not exist"}}, "summary": "Get a specific agents device by ID for your MSP sub-account"}}, "/msp/accounts/{account_id}/agents/devices/{device_id}/actions": {"post": {"operationId": "api.controller.msp.dispatch_account_agent_action", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_device_id_str"}], "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/request_action_dispatch"}}}, "required": true}, "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_command_record"}}}, "description": "Idempotent replay of a previously-dispatched command"}, "202": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_command_record"}}}, "description": "Command dispatched"}, "400": {"description": "Request was malformed or failed validation"}, "403": {"description": "Forbidden"}, "404": {"description": "Not found. Device does not exist for this sub-account"}, "409": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/error_envelope"}}}, "description": "Conflict. Idempotency key conflict, or device locked by an in-flight command"}}, "summary": "Dispatch a response action to an agent device for your MSP sub-account"}}, "/msp/accounts/{account_id}/agents/keys": {"get": {"operationId": "api.controller.msp.get_account_agents_keys", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_agents_keys_by_org"}}}, "description": "A list of agents keys for your MSP sub-account"}}, "summary": "Get or search agents keys for your MSP sub-account"}}, "/msp/accounts/{account_id}/agents/keys/{key_id}": {"get": {"operationId": "api.controller.msp.get_agents_key", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_key_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_agents_key_detail_record"}}}, "description": "A specific agents key with the given ID for your MSP sub-account"}, "404": {"description": "Not found. Key does not exist"}}, "summary": "Get a specific agents key by ID for your MSP sub-account"}}, "/msp/accounts/{account_id}/detection-rules": {"get": {"operationId": "api.controller.msp.get_detection_rules_by_account", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_detection_rules_list"}}}, "description": "Paginated list of detection rules for the sub-account"}, "403": {"description": "Forbidden - sub-account not authorized or org lacks capability"}}, "summary": "List detection rules for your MSP sub-account"}}, "/msp/accounts/{account_id}/detection-rules/{rule_id}": {"get": {"operationId": "api.controller.msp.get_detection_rule_by_account", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_rule_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_detection_rule_detail"}}}, "description": "A single detection rule with evidence_schema and detection.conditions"}, "403": {"description": "Forbidden - rule not in sub-account or org lacks capability"}, "404": {"description": "Not found - rule does not exist or not in this sub-account"}}, "summary": "Get a detection rule by ID for your MSP sub-account"}}, "/msp/accounts/{account_id}/findings": {"get": {"operationId": "api.controller.msp.get_account_findings", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}, {"$ref": "#/components/parameters/param_blocked"}, {"$ref": "#/components/parameters/param_blocked_eq"}, {"$ref": "#/components/parameters/param_blocked_not_eq"}, {"$ref": "#/components/parameters/param_category"}, {"$ref": "#/components/parameters/param_category_eq"}, {"$ref": "#/components/parameters/param_category_not_eq"}, {"$ref": "#/components/parameters/param_category_in"}, {"$ref": "#/components/parameters/param_category_not_in"}, {"$ref": "#/components/parameters/param_created"}, {"$ref": "#/components/parameters/param_created_after"}, {"$ref": "#/components/parameters/param_created_before"}, {"$ref": "#/components/parameters/param_created_eq"}, {"$ref": "#/components/parameters/param_created_not_eq"}, {"$ref": "#/components/parameters/param_created_lt"}, {"$ref": "#/components/parameters/param_created_not_lt"}, {"$ref": "#/components/parameters/param_created_gt"}, {"$ref": "#/components/parameters/param_created_not_gt"}, {"$ref": "#/components/parameters/param_created_by"}, {"$ref": "#/components/parameters/param_modified"}, {"$ref": "#/components/parameters/param_modified_after"}, {"$ref": "#/components/parameters/param_modified_before"}, {"$ref": "#/components/parameters/param_modified_eq"}, {"$ref": "#/components/parameters/param_modified_not_eq"}, {"$ref": "#/components/parameters/param_modified_lt"}, {"$ref": "#/components/parameters/param_modified_not_lt"}, {"$ref": "#/components/parameters/param_modified_gt"}, {"$ref": "#/components/parameters/param_modified_not_gt"}, {"$ref": "#/components/parameters/param_modified_by"}, {"$ref": "#/components/parameters/param_modified_by_eq"}, {"$ref": "#/components/parameters/param_modified_by_not_eq"}, {"$ref": "#/components/parameters/param_modified_by_in"}, {"$ref": "#/components/parameters/param_modified_by_not_in"}, {"$ref": "#/components/parameters/param_name"}, {"$ref": "#/components/parameters/param_name_eq"}, {"$ref": "#/components/parameters/param_name_not_eq"}, {"$ref": "#/components/parameters/param_name_in"}, {"$ref": "#/components/parameters/param_name_not_in"}, {"$ref": "#/components/parameters/param_name_contains"}, {"$ref": "#/components/parameters/param_name_not_contains"}, {"$ref": "#/components/parameters/param_name_regex"}, {"$ref": "#/components/parameters/param_name_not_regex"}, {"$ref": "#/components/parameters/param_priority"}, {"$ref": "#/components/parameters/param_priority_eq"}, {"$ref": "#/components/parameters/param_priority_not_eq"}, {"$ref": "#/components/parameters/param_priority_in"}, {"$ref": "#/components/parameters/param_priority_not_in"}, {"$ref": "#/components/parameters/param_priority_lt"}, {"$ref": "#/components/parameters/param_priority_not_lt"}, {"$ref": "#/components/parameters/param_priority_gt"}, {"$ref": "#/components/parameters/param_priority_not_gt"}, {"$ref": "#/components/parameters/param_resolution"}, {"$ref": "#/components/parameters/param_resolution_eq"}, {"$ref": "#/components/parameters/param_resolution_not_eq"}, {"$ref": "#/components/parameters/param_resolution_in"}, {"$ref": "#/components/parameters/param_resolution_not_in"}, {"$ref": "#/components/parameters/param_status"}, {"$ref": "#/components/parameters/param_status_eq"}, {"$ref": "#/components/parameters/param_status_not_eq"}, {"$ref": "#/components/parameters/param_status_in"}, {"$ref": "#/components/parameters/param_status_not_in"}, {"$ref": "#/components/parameters/param_status_modified_by"}, {"$ref": "#/components/parameters/param_status_modified_by_eq"}, {"$ref": "#/components/parameters/param_status_modified_by_not_eq"}, {"$ref": "#/components/parameters/param_status_modified_by_in"}, {"$ref": "#/components/parameters/param_status_modified_by_not_in"}, {"$ref": "#/components/parameters/param_type"}, {"$ref": "#/components/parameters/param_type_eq"}, {"$ref": "#/components/parameters/param_type_not_eq"}, {"$ref": "#/components/parameters/param_type_in"}, {"$ref": "#/components/parameters/param_type_not_in"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_findings_detail_by_org"}}}, "description": "A list of findings for your MSP sub-account"}, "403": {"description": "Forbidden"}}, "summary": "Get or search findings for your MSP sub-account"}}, "/msp/accounts/{account_id}/findings/{finding_id}": {"get": {"operationId": "api.controller.msp.get_account_finding", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_finding_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/finding_detail_record"}}}, "description": "A specific finding with the given ID for your MSP sub-account"}, "403": {"description": "Forbidden"}, "404": {"description": "Not Found"}}, "summary": "Get a specific finding by ID for your MSP sub-account"}}, "/msp/accounts/{account_id}/findings/{finding_id}/assign": {"post": {"operationId": "api.controller.msp.set_finding_owners", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_finding_id_str"}], "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/request_finding_owners"}}}, "description": "Owners and owner type to assign", "required": true}, "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/finding_detail_record"}}}, "description": "Finding with updated owners"}, "400": {"description": "Bad request - invalid owners or owner_type"}, "403": {"description": "Forbidden"}, "404": {"description": "Not Found"}, "500": {"description": "Internal server error"}}, "summary": "Assign owners to a finding for your MSP sub-account"}}, "/msp/accounts/{account_id}/findings/{finding_id}/comments": {"get": {"operationId": "api.controller.msp.get_account_finding_comments", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_finding_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_findings_comments"}}}, "description": "Comments for a specific finding for your MSP sub-account"}, "204": {"description": "No comments for finding"}, "403": {"description": "Forbidden"}, "404": {"description": "Not Found"}}, "summary": "Get comments for a specific finding for your MSP sub-account"}, "post": {"operationId": "api.controller.msp.add_account_finding_comment", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_finding_id_str"}], "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/request_add_comment_body"}}}, "description": "Comment body and sender (person UUID)", "required": true}, "responses": {"201": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/findings_comments_record"}}}, "description": "Created comment (raw record, no envelope)"}, "400": {"description": "Bad request - invalid body, sender, or sender not in finding's org"}, "403": {"description": "Forbidden"}, "404": {"description": "Not Found"}, "500": {"description": "Internal server error - e.g. comment creation did not return a sync result"}}, "summary": "Add a comment to a finding for your MSP sub-account"}}, "/msp/accounts/{account_id}/findings/{finding_id}/evidence": {"get": {"description": "Returns evidence keys and a paginated first page of evidence rows for the finding in one call. Same contract as GET /org/findings/{finding_id}/evidence; finding must belong to the sub-account (account_id).\n", "operationId": "api.controller.msp.get_account_finding_evidence", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_finding_id_str"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_finding_evidence"}}}, "description": "Evidence keys and paginated evidence rows for the finding"}, "403": {"description": "Forbidden - finding's org does not match account_id or MSP sub-account not authorized"}, "404": {"description": "Not found. Finding does not exist, is not in the sub-account, or has no associated match"}, "500": {"description": "Internal server error"}}, "summary": "Get evidence for a finding (keys and first page of evidence)"}}, "/msp/accounts/{account_id}/findings/{finding_id}/resolve": {"post": {"operationId": "api.controller.msp.resolve_finding", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_finding_id_str"}], "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/request_finding_resolve"}}}, "description": "Resolution and optional resolution notes", "required": true}, "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/finding_detail_record"}}}, "description": "Finding with updated resolution"}, "400": {"description": "Bad request - missing or invalid resolution, or non-string resolution_notes"}, "401": {"description": "Unauthorized - invalid or missing authentication"}, "403": {"description": "Forbidden"}, "404": {"description": "Not Found"}, "405": {"description": "Method Not Allowed"}, "500": {"description": "Internal server error - Finding service or Account service error"}}, "summary": "Resolve a finding for your MSP sub-account"}}, "/msp/accounts/{account_id}/users": {"get": {"operationId": "api.controller.msp.list_users", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_account_id_str"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_org_users"}}}, "description": "A list of users for your MSP sub-account"}, "401": {"description": "Unauthorized - invalid or missing authentication"}, "403": {"description": "Forbidden - user not authorized to access the org"}, "404": {"description": "Sub-account not found"}, "405": {"description": "Method Not Allowed"}, "500": {"description": "Internal server error"}}, "summary": "Get or search users for your MSP sub-account"}}, "/msp/basis-detection-rules": {"get": {"operationId": "api.controller.msp.get_msp_detection_rules", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_detection_rules_list"}}}, "description": "Paginated list of basis rules (org_id=null, is_basis=true) for MSP bulk"}, "403": {"description": "Forbidden - caller is not an MSP org"}}, "summary": "List basis detection rules (catalog) for MSP bulk"}}, "/msp/basis-detection-rules/{rule_id}": {"get": {"operationId": "api.controller.msp.get_msp_detection_rule", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_rule_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_detection_rule_detail"}}}, "description": "A single basis rule with evidence_schema, detection.conditions, rule_created"}, "403": {"description": "Forbidden - caller is not an MSP org"}, "404": {"description": "Not found - rule does not exist or is not a basis rule"}}, "summary": "Get a basis detection rule by ID (for MSP bulk detail)"}}, "/msp/webhooks": {"get": {"operationId": "api.controller.webhooks_resource.get_endpoints_msp", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_endpoints_list"}}}, "description": "Paginated list of webhook endpoints (no secret)"}, "403": {"description": "Forbidden - caller is not an MSP-market organization"}}, "summary": "List webhook endpoints for your MSP parent organization"}, "post": {"description": "Creates a webhook endpoint. The HMAC signing secret is returned ONCE in this response and is never retrievable again.", "operationId": "api.controller.webhooks_resource.create_endpoint_msp", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}], "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/webhook_endpoint_create_record"}}}, "required": true}, "responses": {"201": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_endpoint_with_secret"}}}, "description": "Endpoint created; HMAC secret returned ONCE"}, "400": {"description": "Request was malformed or failed validation"}, "403": {"description": "Forbidden - caller is not an MSP-market organization"}, "409": {"description": "Conflict (e.g. quota exceeded)"}, "422": {"description": "Request body fails semantic validation"}}, "summary": "Create a webhook endpoint for your MSP parent organization"}}, "/msp/webhooks/{id}": {"delete": {"operationId": "api.controller.webhooks_resource.delete_endpoint_msp", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_id_str"}], "responses": {"204": {"description": "Endpoint soft-deleted"}, "403": {"description": "Forbidden - caller is not an MSP-market organization"}, "404": {"description": "Not found - endpoint does not exist for your organization"}}, "summary": "Soft-delete a webhook endpoint"}, "get": {"operationId": "api.controller.webhooks_resource.get_endpoint_msp", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_endpoint"}}}, "description": "A single webhook endpoint (no secret)"}, "403": {"description": "Forbidden - caller is not an MSP-market organization"}, "404": {"description": "Not found - endpoint does not exist for your organization"}}, "summary": "Get a webhook endpoint by ID (secret NOT included)"}, "put": {"operationId": "api.controller.webhooks_resource.update_endpoint_msp", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_id_str"}], "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/webhook_endpoint_update_record"}}}, "required": true}, "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_endpoint"}}}, "description": "Endpoint updated; no secret returned"}, "400": {"description": "Request was malformed or failed validation"}, "403": {"description": "Forbidden - caller is not an MSP-market organization"}, "404": {"description": "Not found - endpoint does not exist for your organization"}, "409": {"description": "Conflict"}, "422": {"description": "Request body fails semantic validation"}}, "summary": "Update a webhook endpoint (partial update; no secret returned)"}}, "/msp/webhooks/{id}/deliveries": {"get": {"operationId": "api.controller.webhooks_resource.get_deliveries_msp", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_id_str"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}, {"$ref": "#/components/parameters/param_delivery_status_eq"}, {"$ref": "#/components/parameters/param_created_gt"}, {"$ref": "#/components/parameters/param_created_lt"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_deliveries_list"}}}, "description": "Paginated list of deliveries"}, "400": {"description": "Request was malformed or failed validation"}, "403": {"description": "Forbidden - caller is not an MSP-market organization"}, "404": {"description": "Not found - endpoint does not exist for your organization"}}, "summary": "List delivery history for a webhook endpoint (paginated)"}}, "/msp/webhooks/{id}/deliveries/{delivery_id}": {"get": {"operationId": "api.controller.webhooks_resource.get_delivery_msp", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_id_str"}, {"$ref": "#/components/parameters/param_delivery_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_delivery_detail"}}}, "description": "Delivery detail with nested attempts"}, "403": {"description": "Forbidden - caller is not an MSP-market organization"}, "404": {"description": "Not found - delivery does not exist for this endpoint"}}, "summary": "Get a single delivery with its attempt list"}}, "/msp/webhooks/{id}/rotate-secret": {"post": {"description": "Rotates the HMAC signing secret and opens the default dual-sign overlap window. The new secret is returned ONCE in this response.", "operationId": "api.controller.webhooks_resource.rotate_secret_msp", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_endpoint_with_secret"}}}, "description": "Secret rotated; new secret returned ONCE"}, "403": {"description": "Forbidden - caller is not an MSP-market organization"}, "404": {"description": "Not found - endpoint does not exist for your organization"}, "422": {"description": "Request body fails semantic validation"}}, "summary": "Rotate the HMAC secret for a webhook endpoint"}}, "/msp/webhooks/{id}/test": {"post": {"operationId": "api.controller.webhooks_resource.test_endpoint_msp", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_id_str"}], "responses": {"202": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_delivery"}}}, "description": "Test delivery enqueued"}, "403": {"description": "Forbidden - caller is not an MSP-market organization"}, "404": {"description": "Not found - endpoint does not exist for your organization"}, "429": {"description": "Rate limit exceeded for test deliveries on this endpoint"}}, "summary": "Send a synthetic test delivery to a webhook endpoint"}}, "/org/agents/actions": {"get": {"operationId": "api.controller.direct_org.get_action_catalog", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/action_catalog"}}}, "description": "The action catalog"}}, "summary": "Get the catalog of response actions available for your organization"}}, "/org/agents/actions/{command_id}": {"get": {"operationId": "api.controller.direct_org.get_action_status", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_command_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_command_record"}}}, "description": "A specific command with the given ID"}, "403": {"description": "Forbidden"}, "404": {"description": "Not found. Command does not exist"}}, "summary": "Get the status of a dispatched response action command"}}, "/org/agents/devices": {"get": {"operationId": "api.controller.direct_org.get_agents_devices", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_agents_devices_by_org"}}}, "description": "A list of agents devices"}}, "summary": "Get or search agents devices"}}, "/org/agents/devices/{device_id}": {"get": {"operationId": "api.controller.direct_org.get_agents_device", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_device_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_agents_device_detail_record"}}}, "description": "A specific agents device with the given ID"}, "404": {"description": "Not found. Agent device does not exist"}}, "summary": "Get a specific agents device by ID"}}, "/org/agents/devices/{device_id}/actions": {"post": {"operationId": "api.controller.direct_org.dispatch_action_endpoint", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_device_id_str"}], "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/request_action_dispatch"}}}, "required": true}, "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_command_record"}}}, "description": "Idempotent replay of a previously-dispatched command"}, "202": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_command_record"}}}, "description": "Command dispatched"}, "400": {"description": "Request was malformed or failed validation"}, "403": {"description": "Forbidden"}, "404": {"description": "Not found. Agent device does not exist"}, "409": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/error_envelope"}}}, "description": "Conflict. Idempotency key conflict, or device locked by an in-flight command"}}, "summary": "Dispatch a response action to an agent device"}}, "/org/agents/keys": {"get": {"operationId": "api.controller.direct_org.get_agents_keys", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_agents_keys_by_org"}}}, "description": "A list of agents keys"}}, "summary": "Get or search agents keys"}}, "/org/agents/keys/{key_id}": {"get": {"operationId": "api.controller.direct_org.get_agents_key", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_key_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_agents_key_detail_record"}}}, "description": "A specific agents key with the given ID"}, "404": {"description": "Not found. Agent key does not exist"}}, "summary": "Get a specific agents key by ID"}}, "/org/detection-rules": {"get": {"operationId": "api.controller.direct_org.get_detection_rules_by_org", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_detection_rules_list"}}}, "description": "Paginated list of detection rules"}, "403": {"description": "Forbidden - org lacks rules_detection_filters capability"}}, "summary": "List detection rules for your organization"}}, "/org/detection-rules/{rule_id}": {"get": {"operationId": "api.controller.direct_org.get_detection_rule", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_rule_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_detection_rule_detail"}}}, "description": "A single detection rule with evidence_schema and detection.conditions"}, "403": {"description": "Forbidden - rule belongs to another org or org lacks capability"}, "404": {"description": "Not found - rule does not exist"}}, "summary": "Get a detection rule by ID"}}, "/org/findings": {"get": {"operationId": "api.controller.direct_org.get_by_org", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}, {"$ref": "#/components/parameters/param_blocked"}, {"$ref": "#/components/parameters/param_blocked_eq"}, {"$ref": "#/components/parameters/param_blocked_not_eq"}, {"$ref": "#/components/parameters/param_category"}, {"$ref": "#/components/parameters/param_category_eq"}, {"$ref": "#/components/parameters/param_category_not_eq"}, {"$ref": "#/components/parameters/param_category_in"}, {"$ref": "#/components/parameters/param_category_not_in"}, {"$ref": "#/components/parameters/param_created"}, {"$ref": "#/components/parameters/param_created_after"}, {"$ref": "#/components/parameters/param_created_before"}, {"$ref": "#/components/parameters/param_created_eq"}, {"$ref": "#/components/parameters/param_created_not_eq"}, {"$ref": "#/components/parameters/param_created_lt"}, {"$ref": "#/components/parameters/param_created_not_lt"}, {"$ref": "#/components/parameters/param_created_gt"}, {"$ref": "#/components/parameters/param_created_not_gt"}, {"$ref": "#/components/parameters/param_created_by"}, {"$ref": "#/components/parameters/param_modified"}, {"$ref": "#/components/parameters/param_modified_after"}, {"$ref": "#/components/parameters/param_modified_before"}, {"$ref": "#/components/parameters/param_modified_eq"}, {"$ref": "#/components/parameters/param_modified_not_eq"}, {"$ref": "#/components/parameters/param_modified_lt"}, {"$ref": "#/components/parameters/param_modified_not_lt"}, {"$ref": "#/components/parameters/param_modified_gt"}, {"$ref": "#/components/parameters/param_modified_not_gt"}, {"$ref": "#/components/parameters/param_modified_by"}, {"$ref": "#/components/parameters/param_modified_by_eq"}, {"$ref": "#/components/parameters/param_modified_by_not_eq"}, {"$ref": "#/components/parameters/param_modified_by_in"}, {"$ref": "#/components/parameters/param_modified_by_not_in"}, {"$ref": "#/components/parameters/param_name"}, {"$ref": "#/components/parameters/param_name_eq"}, {"$ref": "#/components/parameters/param_name_not_eq"}, {"$ref": "#/components/parameters/param_name_in"}, {"$ref": "#/components/parameters/param_name_not_in"}, {"$ref": "#/components/parameters/param_name_contains"}, {"$ref": "#/components/parameters/param_name_not_contains"}, {"$ref": "#/components/parameters/param_name_regex"}, {"$ref": "#/components/parameters/param_name_not_regex"}, {"$ref": "#/components/parameters/param_priority"}, {"$ref": "#/components/parameters/param_priority_eq"}, {"$ref": "#/components/parameters/param_priority_not_eq"}, {"$ref": "#/components/parameters/param_priority_in"}, {"$ref": "#/components/parameters/param_priority_not_in"}, {"$ref": "#/components/parameters/param_priority_lt"}, {"$ref": "#/components/parameters/param_priority_not_lt"}, {"$ref": "#/components/parameters/param_priority_gt"}, {"$ref": "#/components/parameters/param_priority_not_gt"}, {"$ref": "#/components/parameters/param_resolution"}, {"$ref": "#/components/parameters/param_resolution_eq"}, {"$ref": "#/components/parameters/param_resolution_not_eq"}, {"$ref": "#/components/parameters/param_resolution_in"}, {"$ref": "#/components/parameters/param_resolution_not_in"}, {"$ref": "#/components/parameters/param_status"}, {"$ref": "#/components/parameters/param_status_eq"}, {"$ref": "#/components/parameters/param_status_not_eq"}, {"$ref": "#/components/parameters/param_status_in"}, {"$ref": "#/components/parameters/param_status_not_in"}, {"$ref": "#/components/parameters/param_status_modified_by"}, {"$ref": "#/components/parameters/param_status_modified_by_eq"}, {"$ref": "#/components/parameters/param_status_modified_by_not_eq"}, {"$ref": "#/components/parameters/param_status_modified_by_in"}, {"$ref": "#/components/parameters/param_status_modified_by_not_in"}, {"$ref": "#/components/parameters/param_type"}, {"$ref": "#/components/parameters/param_type_eq"}, {"$ref": "#/components/parameters/param_type_not_eq"}, {"$ref": "#/components/parameters/param_type_in"}, {"$ref": "#/components/parameters/param_type_not_in"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_findings_by_org"}}}, "description": "A list of findings for your organization"}}, "summary": "Get or search findings for your organization"}}, "/org/findings/{finding_id}": {"get": {"operationId": "api.controller.direct_org.get", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_finding_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_findings_record"}}}, "description": "A specific finding with the given ID"}, "404": {"description": "Not found. Finding does not exist"}}, "summary": "Get a specific finding by ID"}}, "/org/findings/{finding_id}/assign": {"post": {"operationId": "api.controller.direct_org.set_owners", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_finding_id_str"}], "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/request_finding_owners"}}}, "description": "Owners and owner type to assign", "required": true}, "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/finding_detail_record"}}}, "description": "Finding with updated owners"}, "400": {"description": "Bad request - invalid owners or owner_type"}, "403": {"description": "Forbidden"}, "404": {"description": "Not Found"}, "500": {"description": "Internal server error"}}, "summary": "Assign owners to a finding"}}, "/org/findings/{finding_id}/comments": {"get": {"operationId": "api.controller.direct_org.get_comments", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_finding_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_findings_comments"}}}, "description": "Comments for a specific finding"}, "204": {"description": "No comments for finding"}, "404": {"description": "Not found. Finding does not exist"}}, "summary": "Get comments for a specific finding"}, "post": {"operationId": "api.controller.direct_org.add_comment", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_finding_id_str"}], "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/request_add_comment_body"}}}, "description": "Comment body and sender (person UUID)", "required": true}, "responses": {"201": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/findings_comments_record"}}}, "description": "Created comment"}, "400": {"description": "Bad request - invalid body, sender, or sender not in finding's org"}, "403": {"description": "Forbidden"}, "404": {"description": "Not Found"}, "500": {"description": "Internal server error - e.g. comment creation did not return a sync result"}}, "summary": "Add a comment to a finding in the org"}}, "/org/findings/{finding_id}/details": {"get": {"operationId": "api.controller.direct_org.get_details", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_finding_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/finding_detail_record"}}}, "description": "Details for a specific finding"}, "404": {"description": "Not found. Finding does not exist"}}, "summary": "Get details for a specific finding"}}, "/org/findings/{finding_id}/evidence": {"get": {"description": "Returns evidence keys (schema) and a paginated first page of evidence rows for the finding in one call. Resolves the finding to its match and orchestrates evidence_key + evidence from bdf-matches. Use query params for pagination (e.g. page=2 for subsequent pages).\n", "operationId": "api.controller.direct_org.get_evidence", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_finding_id_str"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_finding_evidence"}}}, "description": "Evidence keys and paginated evidence rows for the finding"}, "403": {"description": "Forbidden - user not authorized to access the org"}, "404": {"description": "Not found. Finding does not exist, is not in the org, has no org_id, or has no associated match"}}, "summary": "Get evidence for a finding (keys and first page of evidence)"}}, "/org/findings/{finding_id}/resolve": {"post": {"operationId": "api.controller.direct_org.resolve_finding", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_finding_id_str"}], "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/request_finding_resolve"}}}, "description": "Resolution and optional resolution notes", "required": true}, "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/finding_detail_record"}}}, "description": "Finding with updated resolution"}, "400": {"description": "Bad request - missing or invalid resolution, or non-string resolution_notes"}, "401": {"description": "Unauthorized - invalid or missing authentication"}, "403": {"description": "Forbidden"}, "404": {"description": "Not Found"}, "405": {"description": "Method Not Allowed"}, "500": {"description": "Internal server error - Finding service error"}}, "summary": "Resolve a finding"}}, "/org/users": {"get": {"operationId": "api.controller.direct_org.list_users", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_org_users"}}}, "description": "A list of users for your organization"}, "401": {"description": "Unauthorized - invalid or missing authentication"}, "405": {"description": "Method Not Allowed"}, "500": {"description": "Internal server error"}}, "summary": "Get or search users for your organization"}}, "/org/webhooks": {"get": {"operationId": "api.controller.webhooks_resource.get_endpoints", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_endpoints_list"}}}, "description": "Paginated list of webhook endpoints (no secret)"}}, "summary": "List webhook endpoints for your organization"}, "post": {"description": "Creates a webhook endpoint. The HMAC signing secret is returned ONCE in this response and is never retrievable again.", "operationId": "api.controller.webhooks_resource.create_endpoint", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}], "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/webhook_endpoint_create_record"}}}, "required": true}, "responses": {"201": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_endpoint_with_secret"}}}, "description": "Endpoint created; HMAC secret returned ONCE"}, "400": {"description": "Request was malformed or failed validation"}, "403": {"description": "Forbidden"}, "409": {"description": "Conflict (e.g. quota exceeded)"}, "422": {"description": "Request body fails semantic validation"}}, "summary": "Create a webhook endpoint"}}, "/org/webhooks/{id}": {"delete": {"operationId": "api.controller.webhooks_resource.delete_endpoint", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_id_str"}], "responses": {"204": {"description": "Endpoint soft-deleted"}, "404": {"description": "Not found - endpoint does not exist for your organization"}}, "summary": "Soft-delete a webhook endpoint"}, "get": {"operationId": "api.controller.webhooks_resource.get_endpoint", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_endpoint"}}}, "description": "A single webhook endpoint (no secret)"}, "404": {"description": "Not found - endpoint does not exist for your organization"}}, "summary": "Get a webhook endpoint by ID (secret NOT included)"}, "put": {"operationId": "api.controller.webhooks_resource.update_endpoint", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_id_str"}], "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/webhook_endpoint_update_record"}}}, "required": true}, "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_endpoint"}}}, "description": "Endpoint updated; no secret returned"}, "400": {"description": "Request was malformed or failed validation"}, "403": {"description": "Forbidden"}, "404": {"description": "Not found - endpoint does not exist for your organization"}, "409": {"description": "Conflict"}, "422": {"description": "Request body fails semantic validation"}}, "summary": "Update a webhook endpoint (partial update; no secret returned)"}}, "/org/webhooks/{id}/deliveries": {"get": {"operationId": "api.controller.webhooks_resource.get_deliveries", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_id_str"}, {"$ref": "#/components/parameters/param_page"}, {"$ref": "#/components/parameters/param_page_size"}, {"$ref": "#/components/parameters/param_limit"}, {"$ref": "#/components/parameters/param_order_by"}, {"$ref": "#/components/parameters/param_delivery_status_eq"}, {"$ref": "#/components/parameters/param_created_gt"}, {"$ref": "#/components/parameters/param_created_lt"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_deliveries_list"}}}, "description": "Paginated list of deliveries"}, "400": {"description": "Request was malformed or failed validation"}, "404": {"description": "Not found - endpoint does not exist for your organization"}}, "summary": "List delivery history for a webhook endpoint (paginated)"}}, "/org/webhooks/{id}/deliveries/{delivery_id}": {"get": {"operationId": "api.controller.webhooks_resource.get_delivery", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_id_str"}, {"$ref": "#/components/parameters/param_delivery_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_delivery_detail"}}}, "description": "Delivery detail with nested attempts"}, "404": {"description": "Not found - delivery does not exist for this endpoint"}}, "summary": "Get a single delivery with its attempt list"}}, "/org/webhooks/{id}/rotate-secret": {"post": {"description": "Rotates the HMAC signing secret and opens the default dual-sign overlap window. The new secret is returned ONCE in this response.", "operationId": "api.controller.webhooks_resource.rotate_secret", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_id_str"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_endpoint_with_secret"}}}, "description": "Secret rotated; new secret returned ONCE"}, "403": {"description": "Forbidden"}, "404": {"description": "Not found - endpoint does not exist for your organization"}, "422": {"description": "Request body fails semantic validation"}}, "summary": "Rotate the HMAC secret for a webhook endpoint"}}, "/org/webhooks/{id}/test": {"post": {"operationId": "api.controller.webhooks_resource.test_endpoint", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}, {"$ref": "#/components/parameters/param_id_str"}], "responses": {"202": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_webhook_delivery"}}}, "description": "Test delivery enqueued"}, "403": {"description": "Forbidden"}, "404": {"description": "Not found - endpoint does not exist for your organization"}, "429": {"description": "Rate limit exceeded for test deliveries on this endpoint"}}, "summary": "Send a synthetic test delivery to a webhook endpoint"}}, "/resolutions": {"get": {"operationId": "api.controller.resolutions.get_resolutions", "parameters": [{"$ref": "#/components/parameters/param_auth_authorization"}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/response_resolutions"}}}, "description": "List of resolution options"}, "401": {"description": "Unauthorized - invalid or missing authentication"}, "405": {"description": "Method Not Allowed"}, "500": {"description": "Internal server error - Finding service error"}}, "summary": "Get resolution options for findings"}}}, "security": [{"bearerAuth": []}], "servers": [{"url": "/public-api/v1"}], "x-tyk-api-gateway": {"info": {"id": "public_api", "name": "Public API", "state": {"active": true}}, "server": {"authentication": {"enabled": true, "securitySchemes": {"bearerAuth": {"defaultPolicies": ["default_policy"], "enabled": true, "header": {"enabled": true, "name": "Authorization"}, "identityBaseField": "sub", "policyFieldName": "pol", "signingMethod": "rsa", "source": "https://blumira1.auth0.com/.well-known/jwks.json"}}}, "listenPath": {"strip": true, "value": "/public-api/v1/"}}, "upstream": {"url": "http://pub-api.blu.svc.cluster.local/v1"}}}