API docs by Redocly

Case Manager (1.0.0)

Download OpenAPI specification:Download

Case Manager V2

create a new v2 case

Authorizations:
SessionCookie
header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Request Body schema: application/json
required
name
required
string

Title to be set for the case

description
string

Description to be set for the case

case_uuid
string

Unique identifier of case

organization_identifier
string

Identifier (uuid or org code) of the organization associated with the case

type
integer (CaseType)
Enum: 0 5
status
integer
status_label
string
severity
integer
severity_label
string
disposition
integer
disposition_label
string
category
string

category the case belongs to

sub_category
string

sub category the case belongs to based on category

assignee
string

Unique identifier of the assignee

assignee_email
string

Email of the assigned user

assignee_usergroup_name
string

Name of the assignee user group

assignee_usergroup_organization
string

Organization code of the assignee user group

is_customer_request
boolean

If this flag is true then reporter field will be honored, otherwise repporter will be the user who sent the request

reporter
string

Uuid of the reporting user

reporter_email
string

Email of the reporting user

performed_by_darryl
boolean
is_agentic_case
boolean

Flag indicating whether the case was created by agentic investigation

agentic_investigation_id
string

ID of the agentic investigation associated with this case

adr_triage
integer (AdrTriage)
Enum: 0 1 5 10
object (AddCaseDetailFieldsRequest)
linked_sessions
Array of strings

Linked sessions with the case

watchers
Array of strings

Uuids of users to be added to watchers list

watcher_emails
Array of strings

Emails of the users to be added to watchers list

object (CaseConfidence)
template_version
string

Version of the template used to create the case

Responses

Request samples

Content type
application/json
{
  • "name": "string",
  • "description": "string",
  • "case_uuid": "string",
  • "organization_identifier": "string",
  • "type": 0,
  • "status": 0,
  • "status_label": "string",
  • "severity": 0,
  • "severity_label": "string",
  • "disposition": 0,
  • "disposition_label": "string",
  • "category": "string",
  • "sub_category": "string",
  • "assignee": "string",
  • "assignee_email": "string",
  • "assignee_usergroup_name": "string",
  • "assignee_usergroup_organization": "string",
  • "is_customer_request": true,
  • "reporter": "string",
  • "reporter_email": "string",
  • "performed_by_darryl": true,
  • "is_agentic_case": true,
  • "agentic_investigation_id": "string",
  • "adr_triage": 0,
  • "case_detail_fields": {
    },
  • "linked_sessions": [
    ],
  • "watchers": [
    ],
  • "watcher_emails": [
    ],
  • "confidence": {
    },
  • "template_version": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

get details of a v2 case

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id of the case to be fetched

query Parameters
requested_view
required
integer (CaseView)
Enum: 0 1

Requested view of the case

include_hidden_findings
boolean

Whether to include hidden findings in the response

subscribe_to_updates
boolean

If true, the user will receive WebSocket events when this case is updated

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

update details of a v2 case

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The uuid of the case to be updated

header Parameters
User-ID
string

The User ID of the requestor.

Organization-ID
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Request Body schema: application/json
required
name
string

Title to be set for the case

description
string

Description to be set for the case

status
integer
status_label
string
severity
integer
severity_label
string
disposition
integer
disposition_label
string
disposition_summary
string

Human-readable summary of the case disposition

investigation_tier
string

Investigation tier (L1, L2, L3) the case was investigated at. When provided, weekly investigation credits are deducted for the organization based on the tier's cost, and the tier's model (from investigation_cost_templates) is stored on the case.

category
string

category the case belongs to

sub_category
string

sub category the case belongs to based on category

assignee
string

Uuid of the assigned user

assignee_email
string

Email of the assigned user

assignee_usergroup_name
string

Name of the assignee user group

assignee_usergroup_organization
string

Organization code of the assignee user group

archived
boolean

Unarchive case if it's archived. (no change if its true)

object (UpsertEscalation)
performed_by_darryl
boolean
is_agentic_case
boolean

Flag indicating whether the case was created by agentic investigation

agentic_investigation_id
string

ID of the agentic investigation associated with this case

adr_triage
integer (AdrTriage)
Enum: 0 1 5 10
sla_response_met
boolean

Flag to indicate feedback for a case on whether it met the SLA response or not.

object (UpdateCaseDetailFieldsRequest)
replace_case_details
boolean

If this field is true, case details provided in case_detail_fields will be replace. Otherwise, it will append to previously existing value.

append_mode
integer (AppendMode)
Enum: 0 1
marked_for_review
boolean

if true, case will be marked for review

object (UpdateConfidenceRequest)
template_version
string

Version of the template used to update the case

object (UpdateCaseStructuredData)

Responses

Request samples

Content type
application/json
{
  • "name": "string",
  • "description": "string",
  • "status": 0,
  • "status_label": "string",
  • "severity": 0,
  • "severity_label": "string",
  • "disposition": 0,
  • "disposition_label": "string",
  • "disposition_summary": "string",
  • "investigation_tier": "string",
  • "category": "string",
  • "sub_category": "string",
  • "assignee": "string",
  • "assignee_email": "string",
  • "assignee_usergroup_name": "string",
  • "assignee_usergroup_organization": "string",
  • "archived": true,
  • "escalations": {
    },
  • "performed_by_darryl": true,
  • "is_agentic_case": true,
  • "agentic_investigation_id": "string",
  • "adr_triage": 0,
  • "sla_response_met": true,
  • "case_detail_fields": {
    },
  • "replace_case_details": true,
  • "append_mode": 0,
  • "marked_for_review": true,
  • "confidence": {
    },
  • "template_version": "string",
  • "structured_data": {
    }
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

archive a case

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case

header Parameters
User-ID
string

The User ID of the requestor.

Organization-ID
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

delete a case

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case

header Parameters
User-ID
string

The User ID of the requestor.

Organization-ID
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

ignore/unignore the case from metrics.

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case

header Parameters
User-ID
string

The User ID of the requestor.

Organization-ID
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

add a new finding in case

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case to upsert finding

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Request Body schema: application/json
required
uuid
string

Unique indenfitifer of the finding

title
required
string

Finding title

summary
string

Detailed description of finding

risk
integer
risk_label
string
hidden
boolean

If true, the finding will not be shown in the UI

Array of objects (UpsertEvidenceRequest)

Evidence provided in support of the finding

Array of objects (DecisionIoc)
execution_id
string

Execution ID of the finding

ai_reasoning
string

AI reasoning for adding the finding to the case

Responses

Request samples

Content type
application/json
{
  • "uuid": "string",
  • "title": "string",
  • "summary": "string",
  • "risk": 0,
  • "risk_label": "string",
  • "hidden": true,
  • "evidences": [
    ],
  • "decision_iocs": [
    ],
  • "execution_id": "string",
  • "ai_reasoning": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

update a finding in the case

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case to upsert finding

finding_uuid
required
string

The id or uuid of the finding to be deleted

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Request Body schema: application/json
required
title
string

Finding title

summary
string

Detailed description of finding

risk
integer
risk_label
string
hidden
boolean

If true, the finding will not be shown in the UI

Array of objects (UpsertEvidenceRequest)

Evidence provided in support of the finding

Array of objects (DecisionIoc)
ai_reasoning
string

AI reasoning for adding the finding to the case

Responses

Request samples

Content type
application/json
{
  • "title": "string",
  • "summary": "string",
  • "risk": 0,
  • "risk_label": "string",
  • "hidden": true,
  • "evidences": [
    ],
  • "decision_iocs": [
    ],
  • "ai_reasoning": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

delete a finding in a case

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case to delete finding from

finding_uuid
required
string

The id or uuid of the finding to be deleted

header Parameters
User-ID
string

The User ID of the requestor.

Organization-ID
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

email details of a v2 case finding

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The uuid of the case

finding_uuid
required
string

The uuid of the finding

header Parameters
User-ID
string

The User ID of the requestor.

Organization-ID
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Request Body schema: application/json
required
to_addresses
required
Array of strings

list of emails to send the case finding details to

html_content
string

html content for the email body

message
string

message to be sent in email body along with html content

Responses

Request samples

Content type
application/json
{
  • "to_addresses": [
    ],
  • "html_content": "string",
  • "message": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "failed_deliveries": [
    ]
}

get evidence data for a finding based on uuid

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case

finding_uuid
required
string

The id or uuid of the finding

evidence_uuid
required
string

The id or uuid of the evidence to be deleted

query Parameters
version
integer

Version for evidence. If not provided, latest evidence will be returned

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

upload an image attachment for a case

Uploads a single image, stored in the case attachments S3 bucket and rendered in the images strip under the alert details section of the case. The bytes are validated server side: the declared content type is ignored in favour of magic byte sniffing, the file must decode as a real image, and SVG is never accepted because serving it same origin would be stored XSS in an analyst session.

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is performed through a darryl action

Request Body schema: multipart/form-data
required
file
required
string <binary>

The image to upload. Maximum 5 MiB. Allowed types are PNG, JPEG and GIF.

section
string
Enum: "alert_details" "comment"

Which section of the case the image belongs to. Defaults to alert_details.

caption
string

Optional analyst supplied caption.

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

list the image attachments for a case

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case

query Parameters
section
string
Enum: "alert_details" "comment"

Restrict the result to a single section. All sections are returned when omitted.

comment_id
string

Restrict the result to images attached to a single comment. Implies section=comment.

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": [
    ],
  • "total": 0
}

delete a case image attachment

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case

attachment_uuid
required
string

The uuid of the attachment

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is performed through a darryl action

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

stream the bytes of a case image attachment

Streams the image from S3 through the service so that organization access is re-checked on every request. This is the URL used as the src of the rendered img element; it is permanent and revocable, unlike a presigned S3 URL. The response Content-Type is the type sniffed at upload time and is served with X-Content-Type-Options nosniff and a restrictive Content-Security-Policy.

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case

attachment_uuid
required
string

The uuid of the attachment

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

email details of a v2 case

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The uuid of the case

header Parameters
User-ID
string

The User ID of the requestor.

Organization-ID
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Request Body schema: application/json
required
to_addresses
required
Array of strings

list of emails to send the case details to

subject
string

subject of the email

html_content
string

html content for the email body

message
string

message to be sent in email body along with html content

include_hidden_findings
boolean

if true, hidden findings will be included in the email

view_id
string

id of the saved case view whose section layout should drive the emailed case details (v2 only). Resolved against the requestor's organization. When omitted, falls back to the default saved view of the organization the case belongs to.

Responses

Request samples

Content type
application/json
{
  • "to_addresses": [
    ],
  • "subject": "string",
  • "html_content": "string",
  • "message": "string",
  • "include_hidden_findings": true,
  • "view_id": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "failed_deliveries": [
    ]
}

get case list for an organization based on filter and sort

Authorizations:
SessionCookie
query Parameters
page
required
integer

Page number for paginated results.

size
required
integer

Number of results per page.

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Request Body schema: application/json
required
requested_view
required
integer (CaseView)
Enum: 0 1
sort_on_closest_match
boolean

if true, first sort will be on closest match (opensearch default). Otherwise priority sort will be applied.

object (CaseFilterV2)
Array of objects (CaseSort)

list of sort fields in order

check_case_identifier
string

if provided, the response will include case_matches_filter indicating whether this case matches the current filter and search; accepts either case_uuid or case_id

nl_query
string

natural-language search query. When set (and filter.queries is empty), it is translated server-side into the advanced query language. Gated by a service flag; falls back to a plain text search if the translator is disabled.

Responses

Request samples

Content type
application/json
{
  • "requested_view": 0,
  • "sort_on_closest_match": true,
  • "filter": {
    },
  • "sort": [
    ],
  • "check_case_identifier": "string",
  • "nl_query": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": [
    ],
  • "total": 0,
  • "metadata": {
    },
  • "case_matches_filter": true,
  • "generated_query": "string"
}

Link given chat session to case

Authorizations:
SessionCookie
path Parameters
case_identifier
string

Unique identifier (id or uuid) of the case to which chat session will be linked

chat_session_id
string

Unique identifier uuid of the chat session to link to the case

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

Unlink given session from case

Authorizations:
SessionCookie
path Parameters
case_identifier
string

Unique identifier (id or uuid) of the case from which session will be unlinked

chat_session_id
string

Unique identifier uuid of the session to unlink from case

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

Get linked cases for given session uuid

Authorizations:
SessionCookie
path Parameters
chat_session_id
required
string

Unique identifier uuid of the session to which cases are linked

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": [
    ],
  • "total": 0,
  • "metadata": {
    },
  • "case_matches_filter": true,
  • "generated_query": "string"
}

Link given cases in request to the case

Authorizations:
SessionCookie
path Parameters
case_identifier
string

Unique identifier (id or uuid) of the case to which others cases will be linked

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Request Body schema: application/json
required
case_uuids
required
Array of strings

Responses

Request samples

Content type
application/json
{
  • "case_uuids": [
    ]
}

Response samples

Content type
application/json
{
  • "message": "string"
}

Unlink cases from one another

Authorizations:
SessionCookie
path Parameters
primary_case_identifier
string

Unique identifier (id or uuid) of the case from which second case will be unlinked

secondary_case_identifier
string

Unique identifier uuid of the second case to unlink from primary case

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

Unlink given alert from case

Authorizations:
SessionCookie
path Parameters
case_identifier
string

Unique identifier (id or uuid) of the case from which alert will be unlinked

alert_uuid
string

Unique identifier of the alert to unlink from case

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

add a new comment to the case

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case to upsert comment

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Request Body schema: application/json
required
content
required
string
content_style
string
rating
integer
comment_privacy
integer (CommentPrivacy)
Enum: 0 5
comment_type
integer (CommentType)
Enum: 0 5
attachment_uuids
Array of strings

Uuids of images previously uploaded with section=comment and not yet claimed by a comment. The server attaches them to this comment. On update, this is the complete set: uuids omitted here are detached and deleted, so send the full list rather than a delta.

Responses

Request samples

Content type
application/json
{
  • "content": "string",
  • "content_style": "string",
  • "rating": 0,
  • "comment_privacy": 0,
  • "comment_type": 0,
  • "attachment_uuids": [
    ]
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

update a comment in the case

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The uuid of the case to update comment

comment_id
required
string

The uuid of the comment to be updated

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Request Body schema: application/json
required
content
required
string
content_style
string
rating
integer
comment_privacy
integer (CommentPrivacy)
Enum: 0 5
comment_type
integer (CommentType)
Enum: 0 5
attachment_uuids
Array of strings

Uuids of images previously uploaded with section=comment and not yet claimed by a comment. The server attaches them to this comment. On update, this is the complete set: uuids omitted here are detached and deleted, so send the full list rather than a delta.

Responses

Request samples

Content type
application/json
{
  • "content": "string",
  • "content_style": "string",
  • "rating": 0,
  • "comment_privacy": 0,
  • "comment_type": 0,
  • "attachment_uuids": [
    ]
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

delete a comment in the case

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The uuid of the case to delete the comment from

comment_id
required
string

The uuid of the comment to be deleted

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

get paginated list of case comments

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case to get comments

query Parameters
page
required
integer

Page number for paginated results.

size
required
integer

Number of results per page.

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": [
    ],
  • "total": 0
}

get paginated list of case history

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case to get history

query Parameters
page
required
integer

Page number for paginated results.

size
required
integer

Number of results per page.

sort
integer (CaseHistorySort)
Enum: 1 5

Sort type for history. Possible values are 1 (Latest First), 5(Oldest First)

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": [
    ],
  • "total": 0
}

get list of case watchers

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case to get watchers

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": [
    ]
}

add list of users to case watchers

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case to get watchers

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Request Body schema: application/json
required
user_uuids
required
Array of strings

User uuids

Responses

Request samples

Content type
application/json
{
  • "user_uuids": [
    ]
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": [
    ]
}

remove list of user from case watchers

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The id or uuid of the case to get watchers

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Execution-ID
string

ID of the execution if action is perfomed through a darryl action

Organization-Hosturl
string

The host url of the organization

Request Body schema: application/json
required
user_uuids
required
Array of strings

User uuids

Responses

Request samples

Content type
application/json
{
  • "user_uuids": [
    ]
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": [
    ]
}

Clone a case

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
case_id
required
string

ID of the case to clone

target_organization_code
string

Code of the organization to clone the case to

dry_run
boolean

Whether to clone the case or just return the generated values

regenerate_obfuscated_values
boolean

Flag to regenerate the obfuscated values

prompt
string

Prompt to use for the clone

max_evidence_size
integer

Maximum size of the evidence to be cloned

Responses

Request samples

Content type
application/json
{
  • "case_id": "string",
  • "target_organization_code": "string",
  • "dry_run": true,
  • "regenerate_obfuscated_values": true,
  • "prompt": "string",
  • "max_evidence_size": 0
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

Reinvestigate a case

Authorizations:
SessionCookie
path Parameters
case_uuid
required
string

The uuid of the case to reinvestigate

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

List case comments

Authorizations:
SessionCookie
query Parameters
page
integer
size
integer
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Request Body schema: application/json
required
accessible_organization_ids
Array of strings

List of organization IDs for which comments are needed.

object (TimeRange)

Responses

Request samples

Content type
application/json
{
  • "accessible_organization_ids": [
    ],
  • "date_range": {
    }
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": [
    ],
  • "total": 0
}

Create a new saved view for case filters

Authorizations:
SessionCookie
header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
name
required
string

Name for the new saved view

required
object (CaseFilterV2)
Array of objects (CaseSort)

Sort configuration for this view

is_default
boolean

Whether to set this as the default view

view_mode
string (CaseViewMode)
Enum: "analyst" "reader"
object (ViewSettings)
is_preset
required
boolean

Whether this is a preset view

Responses

Request samples

Content type
application/json
{
  • "name": "string",
  • "filter": {
    },
  • "sort": [
    ],
  • "is_default": true,
  • "view_mode": "analyst",
  • "view_settings": {
    },
  • "is_preset": true
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

Get list of saved views for the organization

Authorizations:
SessionCookie
query Parameters
is_preset
boolean

Whether to list preset views only

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": [
    ]
}

Update an existing saved view

Authorizations:
SessionCookie
path Parameters
view_id
required
string

ID of the saved view to update

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
name
string

Updated name for the view

object (CaseFilterV2)
Array of objects (CaseSort)

Sort configuration for this view

is_default
boolean

Whether to set this as the default view

view_mode
string (CaseViewMode)
Enum: "analyst" "reader"
object (ViewSettings)

Responses

Request samples

Content type
application/json
{
  • "name": "string",
  • "filter": {
    },
  • "sort": [
    ],
  • "is_default": true,
  • "view_mode": "analyst",
  • "view_settings": {
    }
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

Delete a saved view

Authorizations:
SessionCookie
path Parameters
view_id
required
string

ID of the saved view to delete

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

Get user's current view preference and temporary filters

Authorizations:
SessionCookie
header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

Update user's selected view preference

Authorizations:
SessionCookie
header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
selected_view_id
required
string

ID of the saved view to select

selected_preset_id
required
string

ID of the preset view to select

Responses

Request samples

Content type
application/json
{
  • "selected_view_id": "string",
  • "selected_preset_id": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

Update user's temporary filters for current session

Authorizations:
SessionCookie
header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
object (CaseFilterV2)
Array of objects (CaseSort)

Temporary sort configuration for current session. Will replace existing sort configuration if provided.

selected_case_id
string

ID of the currently selected case

selected_view_mode
string (CaseViewMode)
Enum: "analyst" "reader"

Responses

Request samples

Content type
application/json
{
  • "temp_filter": {
    },
  • "temp_sort": [
    ],
  • "selected_case_id": "string",
  • "selected_view_mode": "analyst"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

Delete user's temporary filters for current session

Authorizations:
SessionCookie
header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

Clear user's selected view preference

Authorizations:
SessionCookie
header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

create a new custom field that can be used in cases

Authorizations:
SessionCookie
header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
title
required
string

Title of the custom field

type
required
integer (CustomFieldType)
Enum: 0 5 10
scope
required
integer (CustomFieldScope)
Enum: 0 5
organization_id
string

Organization to create custom field in. If value is not set, field will be created in the organization present in headers.

Responses

Request samples

Content type
application/json
{
  • "title": "string",
  • "type": 0,
  • "scope": 0,
  • "organization_id": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

get custom case fields that the organization has access to

Authorizations:
SessionCookie
query Parameters
organization_id
required
string

Organization ID to filter custom case fields by.

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
search_query
string

Search custom fields that matches the query

object (CaseSort)

Responses

Request samples

Content type
application/json
{
  • "search_query": "string",
  • "sort": {
    }
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": [
    ],
  • "total": 0
}

delete a custom field if its not used in any case

Authorizations:
SessionCookie
path Parameters
field_id
required
string

The uuid of the custom field

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

update a case custom field (title)

Authorizations:
SessionCookie
path Parameters
field_id
required
string

The uuid of the custom field

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
title
string

Updated title of the custom field

Responses

Request samples

Content type
application/json
{
  • "title": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

get custom case field values that are present in the cases available to the organization

Authorizations:
SessionCookie
query Parameters
page
required
integer

The page number to retrieve

size
required
integer

The number of items to retrieve per page

search
string

The search query to filter the custom case fields by

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": [
    ],
  • "total": 0
}

get case configuration for the organizations

Authorizations:
SessionCookie
header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
organization_ids
required
Array of strings

Organization ids to get case configurations for

Responses

Request samples

Content type
application/json
{
  • "organization_ids": [
    ]
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": [
    ]
}

Update case configuration fields (hidden_dashboard_widgets only)

Authorizations:
SessionCookie
header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
organization_id
required
string
object (HiddenDashboardWidgets)

Responses

Request samples

Content type
application/json
{
  • "organization_id": "string",
  • "hidden_dashboard_widgets": {
    }
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

create a new case configuration for the organization

Authorizations:
SessionCookie
header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
Array of objects (CaseCategory)
Array of objects (EnumOption)
Array of objects (EnumOption)
Array of objects (EnumOption)
Array of objects (EnumOption)
Array of objects (EnumOption)
Array of objects (CaseFeature)

list of case features disabled for the organization

object (CasePriorityConfig)

describe how cases will be divided in Need attention, Closed and Active tabs for the organization

case_closed_statuses
Array of integers

list of statuses that will be shown in Closed tab

organization_id
required
string

Organization id of the organization

reply_to_email
string

Email address to set as reply-to header in the emails sent by the organization

object (HiddenDashboardWidgets)

Responses

Request samples

Content type
application/json
{
  • "case_categories": [
    ],
  • "severity_options": [
    ],
  • "disposition_options": [
    ],
  • "status_options": [
    ],
  • "finding_risk_options": [
    ],
  • "action_status_options": [
    ],
  • "disabled_features": [
    ],
  • "case_priority_config": {
    },
  • "case_closed_statuses": [
    ],
  • "organization_id": "string",
  • "reply_to_email": "string",
  • "hidden_dashboard_widgets": {
    }
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

copy case configuration for the organizations

Authorizations:
SessionCookie
query Parameters
from_organization_id
required
string

The organization id to copy the case configuration from

to_organization_id
required
string

The organization id to copy the case configuration to

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

Get saved chart config (widget_id -> chart_type) for an OOB dashboard

Authorizations:
SessionCookie
query Parameters
dashboard_source
required
string

OOB dashboard identifier (case_analytics, soc_performance or executive).

organization_id
string

Target organization. Defaults to the requestor's organization.

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

Add or update chart types for widgets on an OOB dashboard

Authorizations:
SessionCookie
query Parameters
dashboard_source
required
string

OOB dashboard identifier (case_analytics, soc_performance or executive).

organization_id
required
string

Target organization to update chart config for.

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
property name*
additional property
string

Responses

Request samples

Content type
application/json
{
  • "property1": "string",
  • "property2": "string"
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

Dashboard

Retrieve metrics data

Authorizations:
SessionCookie
query Parameters
days
integer >= 1
Default: 7

Number of days to include in the metrics calculation (optional)

organization_id
string

Additional org id filter. Only applicable for Airmdr employees. If empty, metrics for all organizations are shown.

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

Retrieve case analytics dashboard metrics

Authorizations:
SessionCookie
query Parameters
days
integer >= 1
Default: 7

Number of days to include in the metrics calculation.

organization_id
string

Org ID filter. Only applicable for AirMDR employees. If empty, metrics for all accessible organizations are returned.

created_at_from
integer <int64>

Start of case creation time range as Unix timestamp (seconds).

created_at_to
integer <int64>

End of case creation time range as Unix timestamp (seconds).

force_refresh
boolean
Default: false

When true, bypass any cached result and recompute the metrics.

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

Retrieve SOC performance dashboard metrics

Authorizations:
SessionCookie
query Parameters
days
integer >= 1
Default: 7

Number of days to include in the metrics calculation.

organization_id
string

Org ID filter. Only applicable for AirMDR employees. If empty, metrics for all accessible organizations are returned.

created_at_from
integer <int64>

Start of case creation time range as Unix timestamp (seconds).

created_at_to
integer <int64>

End of case creation time range as Unix timestamp (seconds).

force_refresh
boolean
Default: false

When true, bypass any cached result and recompute the metrics.

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

Retrieve executive dashboard metrics

Authorizations:
SessionCookie
query Parameters
days
integer >= 1
Default: 7

Number of days to include in the metrics calculation.

organization_id
string

Org ID filter. Only applicable for AirMDR employees. If empty, metrics for all accessible organizations are returned.

created_at_from
integer <int64>

Start of case creation time range as Unix timestamp (seconds).

created_at_to
integer <int64>

End of case creation time range as Unix timestamp (seconds).

force_refresh
boolean
Default: false

When true, bypass any cached result and recompute the metrics.

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

Based on the parameters, retrieve LLM generated summary for the metrics data

Authorizations:
SessionCookie
query Parameters
days
integer >= 1
Default: 7

Number of days to include in the metrics calculation (optional)

organization_id
string

Additional org id filter. Only applicable for Airmdr employees. If empty, metrics for all organizations are shown.

metrics_type
required
string
Enum: "case_analytics" "soc_performance" "system_health" "security_review" "case_analytics_v2" "soc_performance_v2"

Type of metrics to generate summary for

created_at_from
integer <int64>

Start of case creation time range as Unix timestamp (seconds).

created_at_to
integer <int64>

End of case creation time range as Unix timestamp (seconds).

force_refresh
boolean
Default: false

When true, bypass any cached result and recompute the metrics.

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "message": "string",
  • "summary": [
    ]
}

Retrieve detailed metrics data

Authorizations:
SessionCookie
query Parameters
start_time
required
integer <int64>

Start time for the metrics calculation

end_time
required
integer <int64>

End time for the metrics calculation

header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
global_metrics_organization_filter
Array of strings

Organization IDs for which the global metrics should be fetched

alert_type_metrics_organization_filter
Array of strings

Organization IDs for which the alert type metrics should be fetched

Responses

Request samples

Content type
application/json
{
  • "global_metrics_organization_filter": [
    ],
  • "alert_type_metrics_organization_filter": [
    ]
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": {
    }
}

Retrieve the cost-trim analysis snapshot

Returns the latest precomputed alert-type rollup used to surface cost-trim opportunities (alert types that produce few or no customer escalations). The same base row set is rolled up at request time into one of several views (per-org, per-provider, per-type, etc.) so dashboards can request exactly the shape they need.

Efficacy (escalations / alerts) is returned per row; bucketing of efficacy into named tiers is left to the UI.

The snapshot is refreshed daily by a background scheduler; the stale field on the response indicates whether the latest snapshot is older than the configured freshness window.

Authorizations:
SessionCookie
query Parameters
view
string
Default: "org_provider_type"
Enum: "org_provider_type" "org_type" "provider_type" "org" "provider" "type" "escalations_by_type"

Roll-up shape. Defaults to org_provider_type (raw rows). Other values produce server-side aggregations of the same base rows.

organization_id
Array of strings

Restrict the response to the given organization UUIDs. If omitted, all organizations the caller has access to via RBAC are included. Values are intersected with the accessible set server-side.

provider
string

Case-insensitive exact-match filter on alert_provider.

alert_type
string

Case-insensitive substring filter on alert_type.

min_alerts
integer <int64> >= 0

Drop rows whose total alert count is below this threshold.

escalation_thresholds
string

Comma-separated list of escalation-rate thresholds (0.0–1.0) used to compute the trim_headroom columns on the org view. Defaults to 0,0.05,0.10,0.25.

limit
integer [ 1 .. 5000 ]
Default: 500

Maximum number of rows to return.

offset
integer >= 0
Default: 0

Row offset for pagination.

header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Responses

Response samples

Content type
application/json
{
  • "computed_at": 0,
  • "window_start": 0,
  • "window_end": 0,
  • "view": "string",
  • "stale": true,
  • "rows": [
    ],
  • "totals": {
    }
}

List System Widgets

Returns the catalogue of all available system widgets from the Case Analytics, SOC Performance, and Security Review dashboards.

header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Responses

Response samples

Content type
application/json
{
  • "widgets": [
    ]
}

List Dashboards

List all dashboards for the organization.

query Parameters
organization_id
string

Filter dashboards by organization.

header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Responses

Response samples

Content type
application/json
{
  • "dashboards": [
    ]
}

Create Dashboard

Create a new empty dashboard.

header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Request Body schema: application/json
required
dashboard_name
required
string
description
string

Optional free-text description of the dashboard.

organization_id
string

Target organisation to create the dashboard in. If not provided, defaults to the user's logged in organization.

object (PrintConfig)

Responses

Request samples

Content type
application/json
{
  • "dashboard_name": "string",
  • "description": "string",
  • "organization_id": "string",
  • "print_config": {
    }
}

Response samples

Content type
application/json
{
  • "dashboard_id": "string",
  • "dashboard_name": "string",
  • "description": "string",
  • "organization_id": "string",
  • "organization_code": "string",
  • "created_at": "2019-08-24T14:15:22Z",
  • "print_config": {
    },
  • "widget_count": 0,
  • "has_email_schedule": true
}

Get Dashboard with latest snapshot of widgets

Get a dashboard with all its active widgets and their latest outputs.

path Parameters
dashboard_id
required
string
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Responses

Response samples

Content type
application/json
{
  • "dashboard_id": "string",
  • "dashboard_name": "string",
  • "description": "string",
  • "organization_id": "string",
  • "created_at": "2019-08-24T14:15:22Z",
  • "widgets": [
    ],
  • "print_config": {
    }
}

Delete Dashboard

Permanently delete a dashboard and all its widgets.

path Parameters
dashboard_id
required
string
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

Update Dashboard

Rename the dashboard and/or persist widget layout positions. Only widgets listed in widget_layout_updates have their layout updated; others are untouched.

path Parameters
dashboard_id
required
string
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Request Body schema: application/json
required
dashboard_name
string

New display name for the dashboard.

description
string

New description for the dashboard.

Array of objects (WidgetLayoutUpdate)

Partial layout update. Only listed widgets are updated.

object (PrintConfig)

Responses

Request samples

Content type
application/json
{
  • "dashboard_name": "string",
  • "description": "string",
  • "widget_layout_updates": [
    ],
  • "print_config": {
    }
}

Response samples

Content type
application/json
{
  • "dashboard_id": "string",
  • "dashboard_name": "string",
  • "description": "string",
  • "updated_at": "2019-08-24T14:15:22Z",
  • "print_config": {
    }
}

Email Custom Dashboard

Renders the dashboard as an HTML report with a PDF attachment and emails it to the given recipients.

path Parameters
dashboard_id
required
string
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Request Body schema: application/json
required
required
object (GetDashboardResponse)
email_ids
required
Array of strings

List of email addresses to send the dashboard report to

subject
required
string

Email subject line. If empty, a default subject will be generated.

Responses

Request samples

Content type
application/json
{
  • "dashboard": {
    },
  • "email_ids": [
    ],
  • "subject": "string"
}

Response samples

Content type
application/json
{
  • "message": "string"
}

Create Widget

Create a new widget on a dashboard. Returns the saved widget.

path Parameters
dashboard_id
required
string
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Request Body schema: application/json
required
widget_name
required
string
source_type
required
string (WidgetSourceType)
Enum: "playbook_execution" "case_metric"
render_type
required
string

Visualization type (e.g. bar_chart, line_chart, table, number).

nl_description
required
string

Natural language description used to generate the widget code.

required
object (WidgetLayout)
object (PlaybookExecutionSource)
object (SystemWidgetSelection)

Responses

Request samples

Content type
application/json
{
  • "widget_name": "string",
  • "source_type": "playbook_execution",
  • "render_type": "string",
  • "nl_description": "string",
  • "layout": {
    },
  • "playbook_execution_source": {
    },
  • "system_widget_source": {
    }
}

Response samples

Content type
application/json
{
  • "widget_id": "string",
  • "dashboard_id": "string",
  • "widget_name": "string",
  • "source_type": "playbook_execution",
  • "render_type": "string",
  • "layout": {
    },
  • "playbook_execution_source": {
    },
  • "system_widget_source": {
    },
  • "transformation_code": "string",
  • "created_at": "2019-08-24T14:15:22Z",
  • "last_output": null
}

Create Multiple Widgets

Bulk create multiple widgets on a dashboard. Each widget follows the same model as single widget creation.

path Parameters
dashboard_id
required
string
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Request Body schema: application/json
required
required
Array of objects (CreateWidgetRequest) [ 1 .. 100 ] items

List of widgets to create (1-100 widgets per request).

Responses

Request samples

Content type
application/json
{
  • "widgets": [
    ]
}

Response samples

Content type
application/json
{
  • "widgets": [
    ]
}

Update Widget

Update widget name, render type, description, layout, or source configuration. Only provided fields are updated.

path Parameters
dashboard_id
required
string
widget_id
required
string
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Request Body schema: application/json
required
widget_name
string
render_type
string
nl_description
string
object (WidgetLayout)
object (PlaybookExecutionSource)
object (SystemWidgetSelection)

Responses

Request samples

Content type
application/json
{
  • "widget_name": "string",
  • "render_type": "string",
  • "nl_description": "string",
  • "layout": {
    },
  • "playbook_execution_source": {
    },
  • "system_widget_source": {
    }
}

Response samples

Content type
application/json
{
  • "widget_id": "string",
  • "dashboard_id": "string",
  • "widget_name": "string",
  • "render_type": "string",
  • "layout": {
    },
  • "updated_at": "2019-08-24T14:15:22Z",
  • "last_output": null
}

Delete Widget

Permanently delete a widget from a dashboard.

path Parameters
dashboard_id
required
string
widget_id
required
string
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

List Dashboard Schedules

List all email schedules for a dashboard, optionally filtered by organization.

path Parameters
dashboard_id
required
string

Dashboard to list schedules for.

query Parameters
organization_id
string

Filter schedules by organization.

header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Responses

Response samples

Content type
application/json
{
  • "schedules": [
    ],
  • "total": 0
}

Bulk Create Dashboard Schedules

Create one or more recurring email schedules for a custom dashboard. Each item is created independently — one item's failure does not block the others; see the per-item results in the response.

path Parameters
dashboard_id
required
string
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Request Body schema: application/json
required
required
Array of objects (CreateDashboardScheduleRequest) [ 1 .. 50 ] items

Responses

Request samples

Content type
application/json
{
  • "schedules": [
    ]
}

Response samples

Content type
application/json
{
  • "results": [
    ]
}

Bulk Update Dashboard Schedules

Update one or more existing dashboard schedules. Only provided fields are updated on each schedule. Each item is applied independently — one item's failure does not block the others; see the per-item results in the response.

path Parameters
dashboard_id
required
string
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Request Body schema: application/json
required
required
Array of objects (UpdateDashboardScheduleItem) [ 1 .. 50 ] items

Responses

Request samples

Content type
application/json
{
  • "schedules": [
    ]
}

Response samples

Content type
application/json
{
  • "results": [
    ]
}

Bulk Delete Dashboard Schedules

Permanently delete one or more dashboard schedules. Each item is deleted independently — one item's failure does not block the others; see the per-item results in the response.

path Parameters
dashboard_id
required
string
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Request Body schema: application/json
required
schedule_ids
required
Array of strings [ 1 .. 50 ] items

Responses

Request samples

Content type
application/json
{
  • "schedule_ids": [
    ]
}

Response samples

Content type
application/json
{
  • "results": [
    ]
}

List Dashboard Schedule Executions

List the run history across all schedules for a dashboard, most recent first. Supports filtering by organization, schedule, status, date range, and free-text search.

path Parameters
dashboard_id
required
string
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Request Body schema: application/json
optional
organization_ids
Array of strings

Filter to executions of schedules targeting these organizations.

schedule_ids
Array of strings

Filter to executions of these specific schedules.

statuses
Array of strings (ScheduleExecutionStatus)
Items Enum: "success" "partial_data" "render_error" "delivery_failed" "failed"

Filter by execution outcome.

executed_after
string <date-time>

Only include executions run at or after this time.

executed_before
string <date-time>

Only include executions run at or before this time.

search
string

Free-text search across recipients, organization, and schedule name.

page
integer
Default: 1

Page number, 1-indexed.

page_size
integer
Default: 20

Number of executions per page.

Responses

Request samples

Content type
application/json
{
  • "organization_ids": [
    ],
  • "schedule_ids": [
    ],
  • "statuses": [
    ],
  • "executed_after": "2019-08-24T14:15:22Z",
  • "executed_before": "2019-08-24T14:15:22Z",
  • "search": "string",
  • "page": 1,
  • "page_size": 20
}

Response samples

Content type
application/json
{
  • "executions": [
    ],
  • "total": 0
}

Get Dashboard Schedule Execution PDF

Download the PDF report generated by a schedule execution.

path Parameters
dashboard_id
required
string
execution_id
required
string
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

Email SOC Performance Report

Queues SOC Performance Report email for delivery.

header Parameters
User-ID
required
string

The User ID of the requestor

Organization-ID
required
string

The Organization ID associated with the requestor

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
email_ids
required
Array of strings

List of email addresses to send the report to

subject
required
string

Email subject line. If empty, a default subject will be generated.

required
object (SocEmailRequestFilter)

Responses

Request samples

Content type
application/json
{
  • "email_ids": [
    ],
  • "subject": "string",
  • "filter": {
    }
}

Response samples

Content type
application/json
{
  • "message": "string"
}

Email Case Analytics Report

Queues Case Analytics Report email for delivery.

header Parameters
User-ID
required
string

The User ID of the requestor

Organization-ID
required
string

The Organization ID associated with the requestor

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
email_ids
required
Array of strings

List of email addresses to send the report to

subject
required
string

Email subject line. If empty, a default subject will be generated.

required
object (CaseAnalyticsEmailRequestFilter)

Responses

Request samples

Content type
application/json
{
  • "email_ids": [
    ],
  • "subject": "string",
  • "filter": {
    }
}

Response samples

Content type
application/json
{
  • "message": "string"
}

Alerts

Create alerts

Create alerts

Authorizations:
SessionCookie
query Parameters
skip_investigation
boolean

Flag indicating whether the investigation for the alert should be skipped.

header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Organization-Hosturl
string

The host url of the organization.

Request Body schema: application/json
required

Request body for creating alerts.

alert_content
required
string

The content/body of the alert

alert_provider
required
string

The provider/source of the alert (e.g. aws, microsoft_graph, etc.)

alert_type
string

The type/category of the alert

fetched_playbook_id
string

ID of the playbook that fetched this alert

fetched_playbook_name
string

Name of the playbook that fetched this alert

fetched_execution_id
string

Execution ID of the playbook run that fetched this alert

organization_code
required
string

Code/identifier of the organization this alert belongs to

object (AlertsIOC)
created_at_source
integer <int64>

Timestamp when the alert was created at the source/provider

add_alert_definition
boolean

Flag to add alert definition to the alert content, True for alerts creating airmdr detection playbooks

is_test_alert
boolean

Flag indicating whether this alert is a test alert and should be treated differently

Responses

Request samples

Content type
application/json
{
  • "alert_content": "string",
  • "alert_provider": "string",
  • "alert_type": "string",
  • "fetched_playbook_id": "string",
  • "fetched_playbook_name": "string",
  • "fetched_execution_id": "string",
  • "organization_code": "string",
  • "alert_ioc": {
    },
  • "created_at_source": 0,
  • "add_alert_definition": true,
  • "is_test_alert": true
}

Response samples

Content type
application/json
{
  • "alert_id": "string",
  • "alert_uuid": "string",
  • "alert_content": "string",
  • "alert_provider": "string",
  • "alert_type": "string",
  • "alert_ioc": {
    },
  • "organization_uuid": "string",
  • "organization_code": "string",
  • "created_by": "string",
  • "created_at": 0,
  • "modified_at": 0,
  • "created_at_source": 0,
  • "fetched_playbook_id": "string",
  • "fetched_playbook_name": "string",
  • "fetched_execution_id": "string",
  • "investigation_playbook_id": "string",
  • "investigation_playbook_name": "string",
  • "investigation_status": 0,
  • "investigation_retry_count": 0,
  • "investigation_completed_time": 0,
  • "execution_id": "string",
  • "linked_case_id": "string",
  • "alert_provider_details": {
    },
  • "resolved": true,
  • "is_investigated_with_agent": true,
  • "is_alert_reinvestigated": true,
  • "alert_summary": "string",
  • "linked_case_details": [
    ],
  • "linked_case_summary": {
    },
  • "connection_details": {
    },
  • "alert_type_details": {
    },
  • "alert_link": "string"
}

Analyze alerts

Analyze alerts

Authorizations:
SessionCookie
query Parameters
return_partial_data
boolean
Default: false

If true, returns whatever fields were identified even if some are missing. If false, returns error if any field is missing.

header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Organization-Hosturl
string

The host url of the organization.

Request Body schema: application/json
required

Request body for analyzing alerts.

alert_content
required
string

Responses

Request samples

Content type
application/json
{
  • "alert_content": "string"
}

Response samples

Content type
application/json
{
  • "alert_content": "string",
  • "alert_provider": "string",
  • "alert_type": "string",
  • "created_at_source": 0
}

Export alerts data

Export alerts data

Authorizations:
SessionCookie
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Organization-Hosturl
string

The host url of the organization.

Request Body schema: application/json
required

Request body for list alerts with search and filter.

object (ListAlertsFilter)
Array of objects (SortFields)
ignore_alert_content
boolean

Flag to indicate whether to ignore the alert content. If true, the alert content will not be fetched.

Responses

Request samples

Content type
application/json
{
  • "filter": {
    },
  • "sort": [
    ],
  • "ignore_alert_content": true
}

Response samples

Content type
application/json
{
  • "message": "string"
}

get the details of an alert

get the details of an alert

Authorizations:
SessionCookie
path Parameters
alert_id
string

The ID associated with the alert

header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Organization-Hosturl
string

The host url of the organization.

Responses

Response samples

Content type
application/json
{
  • "alert_id": "string",
  • "alert_uuid": "string",
  • "alert_content": "string",
  • "alert_provider": "string",
  • "alert_type": "string",
  • "alert_ioc": {
    },
  • "organization_uuid": "string",
  • "organization_code": "string",
  • "created_by": "string",
  • "created_at": 0,
  • "modified_at": 0,
  • "created_at_source": 0,
  • "fetched_playbook_id": "string",
  • "fetched_playbook_name": "string",
  • "fetched_execution_id": "string",
  • "investigation_playbook_id": "string",
  • "investigation_playbook_name": "string",
  • "investigation_status": 0,
  • "investigation_retry_count": 0,
  • "investigation_completed_time": 0,
  • "execution_id": "string",
  • "linked_case_id": "string",
  • "alert_provider_details": {
    },
  • "resolved": true,
  • "is_investigated_with_agent": true,
  • "is_alert_reinvestigated": true,
  • "alert_summary": "string",
  • "linked_case_details": [
    ],
  • "linked_case_summary": {
    },
  • "connection_details": {
    },
  • "alert_type_details": {
    },
  • "alert_link": "string"
}

update the details of an alert

update the details of an alert

Authorizations:
SessionCookie
path Parameters
alert_id
string

The ID associated with the alert

header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Organization-Hosturl
string

The host url of the organization.

Request Body schema: application/json
required

Request body for updating an alert.

alert_provider
string
investigation_status
integer (AlertInvestigationStatus)
Enum: 0 5 10 12 15 20 25 30
investigation_playbook_id
string
investigation_playbook_name
string
investigation_retry_count
integer
execution_id
string
linked_case_id
string
object (AlertsIOC)
resolved
boolean
alert_summary
string

Human-readable summary of the alert

Responses

Request samples

Content type
application/json
{
  • "alert_provider": "string",
  • "investigation_status": 0,
  • "investigation_playbook_id": "string",
  • "investigation_playbook_name": "string",
  • "investigation_retry_count": 0,
  • "execution_id": "string",
  • "linked_case_id": "string",
  • "alert_ioc": {
    },
  • "resolved": true,
  • "alert_summary": "string"
}

Response samples

Content type
application/json
{
  • "alert_id": "string",
  • "alert_uuid": "string",
  • "alert_content": "string",
  • "alert_provider": "string",
  • "alert_type": "string",
  • "alert_ioc": {
    },
  • "organization_uuid": "string",
  • "organization_code": "string",
  • "created_by": "string",
  • "created_at": 0,
  • "modified_at": 0,
  • "created_at_source": 0,
  • "fetched_playbook_id": "string",
  • "fetched_playbook_name": "string",
  • "fetched_execution_id": "string",
  • "investigation_playbook_id": "string",
  • "investigation_playbook_name": "string",
  • "investigation_status": 0,
  • "investigation_retry_count": 0,
  • "investigation_completed_time": 0,
  • "execution_id": "string",
  • "linked_case_id": "string",
  • "alert_provider_details": {
    },
  • "resolved": true,
  • "is_investigated_with_agent": true,
  • "is_alert_reinvestigated": true,
  • "alert_summary": "string",
  • "linked_case_details": [
    ],
  • "linked_case_summary": {
    },
  • "connection_details": {
    },
  • "alert_type_details": {
    },
  • "alert_link": "string"
}

process or investigate the alert

investigate or re-investigate the alert

Authorizations:
SessionCookie
path Parameters
alert_id
string

The ID associated with the alert

header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Organization-Hosturl
string

The host url of the organization.

Responses

Response samples

Content type
application/json
{
  • "alert_id": "string",
  • "message": "string"
}

run the agentic preview investigation for a single alert

Fires the agentic investigation via the beta (preview) service asynchronously and returns immediately. Skips the playbook side entirely and does not create a case (create_case_in_airmdr is hardcoded to false). When the beta call completes successfully, the alert's is_investigated_with_agent flag is set to true.

Authorizations:
SessionCookie
path Parameters
alert_id
required
string

The ID associated with the alert

header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

delete alerts in bulk

delete alerts in bulk

Authorizations:
SessionCookie
header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Organization-Hosturl
string

The host url of the organization.

Request Body schema: application/json
required
alert_uuids
required
Array of strings

Responses

Request samples

Content type
application/json
{
  • "alert_uuids": [
    ]
}

Response samples

Content type
application/json
{
  • "message": "string",
  • "data": [
    ]
}

delete an alert

delete an alert

Authorizations:
SessionCookie
path Parameters
alert_id
string

The ID associated with the alert

header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Organization-Hosturl
string

The host url of the organization.

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

Get the list of Alert types

Get the list of Alert types

Authorizations:
SessionCookie
query Parameters
alert_provider
string

alert provider filter

header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Organization-Hosturl
string

The host url of the organization.

Responses

Response samples

Content type
application/json
[
  • "string"
]

Get the list of alerts

Get the list of alerts per org

Authorizations:
SessionCookie
query Parameters
page
integer

Page number for paginated results.

size
integer

Number of results per page.

header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Organization-Hosturl
string

The host url of the organization.

Request Body schema: application/json
required

Request body for list alerts with search and filter.

object (ListAlertsFilter)
Array of objects (SortFields)
ignore_alert_content
boolean

Flag to indicate whether to ignore the alert content. If true, the alert content will not be fetched.

Responses

Request samples

Content type
application/json
{
  • "filter": {
    },
  • "sort": [
    ],
  • "ignore_alert_content": true
}

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "total": 0
}

get the details of an alert given execution id

get the details of an alert given execution id

Authorizations:
SessionCookie
path Parameters
execution_id
string

The ID associated with the execution for which alert is to be fetched.

header Parameters
User-ID
string

The User ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

Organization-ID
string

The Organization ID of the requestor. If requests are made through API Gateway, this header will be pre filled.

X-Request-ID
string

The ID associated with the request. If requests are made through API Gateway, this header will be pre filled.

Organization-Hosturl
string

The host url of the organization.

Responses

Response samples

Content type
application/json
{
  • "alert_id": "string",
  • "alert_uuid": "string",
  • "alert_content": "string",
  • "alert_provider": "string",
  • "alert_type": "string",
  • "alert_ioc": {
    },
  • "organization_uuid": "string",
  • "organization_code": "string",
  • "created_by": "string",
  • "created_at": 0,
  • "modified_at": 0,
  • "created_at_source": 0,
  • "fetched_playbook_id": "string",
  • "fetched_playbook_name": "string",
  • "fetched_execution_id": "string",
  • "investigation_playbook_id": "string",
  • "investigation_playbook_name": "string",
  • "investigation_status": 0,
  • "investigation_retry_count": 0,
  • "investigation_completed_time": 0,
  • "execution_id": "string",
  • "linked_case_id": "string",
  • "alert_provider_details": {
    },
  • "resolved": true,
  • "is_investigated_with_agent": true,
  • "is_alert_reinvestigated": true,
  • "alert_summary": "string",
  • "linked_case_details": [
    ],
  • "linked_case_summary": {
    },
  • "connection_details": {
    },
  • "alert_type_details": {
    },
  • "alert_link": "string"
}

Query DSL

Execute a DSL query against cases or alerts

Executes a custom query using the Query DSL. Results are automatically filtered by the user's accessible organizations. Supports filtering, sorting, pagination, and aggregations for dashboard analytics.

Authorizations:
SessionCookie
header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
collection
required
string
Enum: "cases" "alerts"

The collection to query (cases or alerts)

select
Array of strings

Fields to return in the response. If empty, returns all selectable fields.

object

Filter conditions. Keys are field names, values are either direct values or operator objects.

object

Sort fields and directions

limit
integer [ 1 .. 10000 ]
Default: 100

Maximum number of results to return

offset
integer >= 0
Default: 0

Number of results to skip

object (AggregateRequest)

Responses

Request samples

Content type
application/json
Example
{
  • "collection": "cases",
  • "select": [
    ],
  • "where": {
    },
  • "sort": {
    },
  • "limit": 50
}

Response samples

Content type
application/json
Example
{
  • "data": [
    ],
  • "total": 125,
  • "limit": 50,
  • "offset": 0,
  • "collection": "cases"
}

Validate a DSL query without executing it

Validates a query against the schema without executing it. Useful for checking query syntax before execution.

Authorizations:
SessionCookie
header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Request Body schema: application/json
required
collection
required
string
Enum: "cases" "alerts"

The collection to validate against

select
Array of strings
object
object
limit
integer
offset
integer
object (AggregateRequest)

Responses

Request samples

Content type
application/json
{
  • "collection": "cases",
  • "select": [
    ],
  • "where": { },
  • "sort": {
    },
  • "limit": 0,
  • "offset": 0,
  • "aggregate": {
    }
}

Response samples

Content type
application/json
Example
{
  • "valid": true,
  • "errors": [ ]
}

Get available query schemas

Returns the schema for all queryable collections, including available fields and their capabilities (filterable, selectable, sortable, aggregatable).

Authorizations:
SessionCookie
header Parameters
User-ID
required
string

The User ID of the requestor.

Organization-ID
required
string

The Organization ID associated with the requestor.

X-Request-ID
string

The ID associated with the request

Responses

Response samples

Content type
application/json
{
  • "collections": {
    }
}