Endpoint index

This page lists all 502 operations in the published Elastio API, generated from the OpenAPI document. Select any operation to open it in the API reference, where you can send it to your tenant.

Platform

16 operations across 7 resources.

System

2 operations in the reference →

• GET/gateway/api/v1/health_checkCheck API health status
• GET/gateway/api/v1/backupTypesGet available backup types

Tenant Settings

2 operations in the reference →

• GET/gateway/shared-services/v1/tenant-settingsGet tenant settings (get-or-create)
• PATCH/gateway/shared-services/v1/tenant-settingsPartially update tenant settings

Licenses

3 operations in the reference →

• GET/gateway/shared-services/v3/licensesList this tenant's licenses
• POST/gateway/shared-services/v3/licensesAdd a license key to this tenant
• DELETE/gateway/shared-services/v3/licenses/{id}Remove a license from this tenant

Plan

1 operation in the reference →

• GET/gateway/api/v1/plan/{name}Get plan

Billing

1 operation in the reference →

• GET/gateway/api/v1/billing-detailsGet last 30 days billing details metrics

Early Access

2 operations in the reference →

• GET/gateway/api/v1/early-access/featuresList early access features
• POST/gateway/api/v1/early-access/features/{featureId}/toggleToggle early access feature

AI Provider Credentials

5 operations in the reference →

• GET/gateway/shared-services/v3/ai-provider-credentialsList this tenant's AI provider credentials
• POST/gateway/shared-services/v3/ai-provider-credentialsStore an AI provider credential
• GET/gateway/shared-services/v3/ai-provider-credentials/{id}Get one AI provider credential
• PATCH/gateway/shared-services/v3/ai-provider-credentials/{id}Update an AI provider credential
• DELETE/gateway/shared-services/v3/ai-provider-credentials/{id}Delete an AI provider credential

Identity & Access

42 operations across 6 resources.

Users

15 operations in the reference →

• GET/rbac/api/v1/usersList all users
• POST/rbac/api/v1/usersCreate a new user
• POST/rbac/api/v1/users/byIdsGet user objects by ID list (bulk)
• PATCH/rbac/api/v1/users/disableDisable one or many users by ID
• PATCH/rbac/api/v1/users/enableEnable one or many users by ID
• PATCH/rbac/api/v1/users/{id}Update user attributes
• DELETE/rbac/api/v1/users/{id}Delete a user
• GET/rbac/api/v1/users/{id}/roleGet user's current role
• GET/rbac/api/v1/users/roleGet current authenticated user's role
• POST/rbac/api/v1/users/resend-inviteResend an invitation email
• GET/rbac/api/v1/users/searchSearch users by free‑text query
• GET/rbac/api/v1/users/{userId}Get a specific user by ID
• GET/rbac/api/v1/users/{userId}/rolesList roles for a user
• POST/rbac/api/v1/users/{userId}/rolesAssign role to user
• DELETE/rbac/api/v1/users/{userId}/roles/{roleId}Revoke role from user

User Groups

7 operations in the reference →

• GET/rbac/api/v1/userGroupsList user groups
• POST/rbac/api/v1/userGroupsCreate a user group
• POST/rbac/api/v1/userGroups/byIdsGet user groups by IDs (bulk)
• PATCH/rbac/api/v1/userGroups/{id}Update a user group
• DELETE/rbac/api/v1/userGroups/{id}Delete a user group
• GET/rbac/api/v1/userGroups/searchSearch user groups
• GET/rbac/api/v1/userGroups/{userGroupId}Get a specific user group by ID

Roles

5 operations in the reference →

• GET/rbac/api/v1/rolesList all roles for the tenant
• POST/rbac/api/v1/rolesCreate a new role
• GET/rbac/api/v1/roles/{id}Get a specific role by ID
• PATCH/rbac/api/v1/roles/{id}Update a specific role by ID
• DELETE/rbac/api/v1/roles/{id}Delete a specific role by ID

Account Groups

8 operations in the reference →

• GET/rbac/api/v1/accountGroupsList account groups
• POST/rbac/api/v1/accountGroupsCreate an account group
• POST/rbac/api/v1/accountGroups/byIdsGet account groups by IDs (bulk)
• PATCH/rbac/api/v1/accountGroups/{id}Update an account group
• DELETE/rbac/api/v1/accountGroups/{id}Delete an account group
• GET/rbac/api/v1/accountGroups/searchSearch account groups
• GET/rbac/api/v1/accounts/{id}Get raw cloud account ID mapping for an Elastio account group
• GET/rbac/api/v1/accountGroups/{accountGroupId}Get a specific account group by ID

Personal Access Tokens

5 operations in the reference →

• GET/gateway/shared-services/v1/personal-access-tokensList personal access tokens
• POST/gateway/shared-services/v1/personal-access-tokensIssue a personal access token
• PATCH/gateway/shared-services/v1/personal-access-tokens/{token_id}Update a personal access token
• POST/gateway/shared-services/v1/personal-access-tokens/revokeRevoke personal access tokens
• GET/gateway/shared-services/v1/personal-access-tokens/revokedList revoked personal access tokens

Audit Logs

2 operations in the reference →

• GET/rbac/api/v1/audit-logsRetrieve audit logs with filtering and pagination
• GET/rbac/api/v1/audit-logs/filtersGet available filter options for audit logs

Inventory & Deployments

116 operations across 13 resources.

Deployments

20 operations in the reference →

• GET/gateway/shared-services/v1/deployments/asset-accountsList deployment asset accounts
• DELETE/gateway/shared-services/v1/deployments/asset-accounts/{asset_account_id}/region-stacks/{region}Delete an asset region stack
• POST/gateway/shared-services/v1/deployments/asset-accounts/{asset_account_id}/unlinkUnlink an asset account
• POST/gateway/shared-services/v1/deployments/asset-accounts/linkLink an asset account to a connector account
• PATCH/gateway/shared-services/v1/deployments/aws-accounts/{aws_account_id}Update AWS account display metadata
• GET/gateway/shared-services/v1/deployments/aws-accounts/{aws_account_id}/connector-account-install-flowGet connector account install flow
• PATCH/gateway/shared-services/v1/deployments/aws-accounts/{aws_account_id}/connector-account-install-flowUpdate connector account install flow
• POST/gateway/shared-services/v1/deployments/aws-accounts/{aws_account_id}/upgradeUpgrade an Elastio-managed Cloud Connector
• GET/gateway/shared-services/v1/deployments/aws-accounts/{aws_account_id}/upgrade-planPlan an upgrade of an Elastio-managed Cloud Connector
• GET/gateway/shared-services/v1/deployments/aws-vpcsList AWS VPCs for an account and region
• GET/gateway/shared-services/v1/deployments/cloudformation-linkGet link to CloudFormation template (S3)
• POST/gateway/shared-services/v1/deployments/discover-installed-cfnDiscover installed CloudFormation stack for an AWS account
• GET/gateway/shared-services/v1/deployments/red-stacksList Cloud Connectors
• POST/gateway/shared-services/v1/deployments/red-stacksInstall the Cloud Connector
• DELETE/gateway/shared-services/v1/deployments/red-stacks/{red_stack_id}Delete a deactivated Cloud Connector
• POST/gateway/shared-services/v1/deployments/red-stacks/{red_stack_id}/deactivateDeactivate a Cloud Connector
• POST/gateway/shared-services/v1/deployments/red-stacks/{red_stack_id}/rescanRefresh a self-managed Cloud Connector
• GET/gateway/shared-services/v1/deployments/red-stacks/latest-versionGet the latest enabled Cloud Connector version
• GET/gateway/shared-services/v1/deployments/scan-clustersList standalone scan clusters
• GET/gateway/shared-services/v1/deployments/supported-aws-regionsList supported AWS regions for deployments

Assets

34 operations in the reference →

• GET/gateway/api/v1/recovery-points/{backupId}/assets/{assetId}/threatsGet findings for an asset in a recovery point
• GET/gateway/api/v1/assets/{assetId}/recovery-points/{backupId}/entities/asset-items/{assetItemId}/threatsGet findings for an asset item in a recovery point
• GET/gateway/api/v1/assets/{assetId}/recovery-points/{backupId}/entitiesGet entities for a specific recovery point
• GET/gateway/api/v1/assets/{assetId}/scanjobs/{scanJobId}/entitiesGet the entities a hunt covered
• GET/gateway/api/v1/scanjobs/{scanJobId}/assets/{assetId}/threatsGet findings for an asset from a hunt
• GET/gateway/api/v1/assets/{assetId}/application-discoveriesGet latest application discovery for an asset
• GET/gateway/api/v1/scanjobs/{scanJobId}/asset-items/{assetItemId}/threatsGet findings for an asset item from a hunt
• GET/gateway/api/v1/assets/{assetId}/recovery-pointsGet asset recovery points
• GET/gateway/api/v1/assets/{assetId}/recovery-points/backup-typesGet backup types from recovery points for an asset
• GET/gateway/api/v1/assets/{assetId}/scanjobsList hunts for an asset
• GET/gateway/api/v1/assets/{assetId}/scanjobs/{scanJobId}Get a hunt for an asset
• GET/gateway/api/v1/assets/{assetId}/scanjobs/backup-typesGet backup types covered by an asset's hunts
• GET/gateway/api/v1/get-filtered-dataGet filtered asset data
• GET/gateway/api/v1/assets/{assetId}/recovery-points/{recoveryPointId}Get recovery point details
• GET/gateway/api/v1/infected-filesList files with findings
• GET/gateway/api/v1/s3-buckets/{awsS3BucketId}/infected-objects/last-clean-versionList S3 objects with findings and their last clean version
• GET/gateway/api/v2/assetsGet list of v2 assets (live inventory)
• GET/gateway/api/v2/assets/{assetId}Get a single live inventory asset by ID
• GET/gateway/api/v2/assets/{assetId}/machine-imageGet a machine image's lineage and derived instances
• GET/gateway/api/v2/assets/{assetId}/recovery-pointsGet asset recovery points (v2)
• GET/gateway/api/v2/assets/filtersGet contextual filter options for v2 assets
• GET/gateway/api/v2/assets/groupsGet v2 asset group summaries
• GET/gateway/api/v2/assets/summaryGet scoped live-asset dashboard summary
• GET/gateway/api/v2/assets/r-rpoGet fleet R-RPO
• GET/gateway/api/v2/policies/summaryGet per-policy live-asset dashboard summaries
• GET/gateway/api/v2/assets/coverage-by-platformGet scoped policy coverage grouped by platform
• GET/gateway/api/v1/assets-listList assets by ids
• GET/gateway/api/v1/assets/health-summaryGet asset health summary
• GET/gateway/api/v1/assets/coverage-summaryGet asset coverage summary
• GET/gateway/api/v1/assets/recovery-assuranceGet recovery assurance data
• GET/gateway/api/v1/assets/encryption-summaryGet asset encryption summary
• GET/gateway/api/v1/assets/storage-vulnerabilityGet storage vulnerability summary
• GET/gateway/api/v1/assets/storage-vulnerability/issuesList storage vulnerability issues
• GET/gateway/api/v1/assets/storage-vulnerability/filtersGet contextual filter options for storage vulnerability issues

Search

10 operations in the reference →

• GET/gateway/api/v1/search/ebs_volumesSearch EBS volumes
• GET/gateway/api/v1/search/ec2_instancesSearch EC2 instances
• GET/gateway/api/v1/search/s3_bucketsSearch S3 buckets
• GET/gateway/api/v1/search/efs_filesystemsSearch EFS filesystems
• GET/gateway/api/v1/search/generic_hostsSearch generic hosts
• GET/gateway/api/v1/search/ova_serversSearch OVA servers
• GET/gateway/api/v1/search/fsx_volumesSearch FSx ONTAP volumes
• GET/gateway/api/v1/search/assetsSearch unified assets across all platforms and types
• GET/gateway/api/v1/search/assets/filtersGet filter options for assets search
• GET/gateway/api/v1/assets_countGet assets count

Inventory

1 operation in the reference →

• POST/gateway/api/v1/aws/inventory-scansSchedule an AWS inventory refresh

Asset Accounts

1 operation in the reference →

• GET/gateway/api/v1/asset-accountsList asset accounts by connector

Tags

2 operations in the reference →

• GET/gateway/api/v2/tagsList distinct asset tag keys
• GET/gateway/api/v2/tags/valuesList distinct values for an asset tag key

Azure Subscriptions

2 operations in the reference →

• GET/gateway/api/v1/azure-subscriptionsList all Azure subscriptions
• GET/gateway/api/v1/azure-subscriptions/{subscriptionId}Get Azure subscription metadata

GCP Projects

1 operation in the reference →

• GET/gateway/api/v1/gcp-projectsList live GCP projects

IBM

1 operation in the reference →

• GET/gateway/api/v1/ibm-scopesList IBM scopes

OVA Accounts

1 operation in the reference →

• GET/gateway/api/v1/ova-accountsGet all OVA accounts for a tenant

Vault

4 operations in the reference →

• GET/gateway/shared-services/v1/vaultsList vaults
• POST/gateway/shared-services/v1/vaultsCreate a vault
• PATCH/gateway/shared-services/v1/vaults/{vault_id}Update a vault
• POST/gateway/shared-services/v1/vaults/destroyRemove a vault

Database Monitoring

32 operations in the reference →

• GET/gateway/shared-services/v3/database-monitoring/databasesList the tenant's monitored databases
• POST/gateway/shared-services/v3/database-monitoring/databasesAdd a database and get its setup (admin)
• GET/gateway/shared-services/v3/database-monitoring/databases/{database_id}Get one database
• PATCH/gateway/shared-services/v3/database-monitoring/databases/{database_id}Rename a database, turn its Database Connector off and on, change its size, or change its settings (admin)
• DELETE/gateway/shared-services/v3/database-monitoring/databases/{database_id}Remove a database and everything recorded under it (admin)
• GET/gateway/shared-services/v3/database-monitoring/databases/{database_id}/edGet discovered tables and the latest 50 encryption detection (ED) jobs
• POST/gateway/shared-services/v3/database-monitoring/databases/{database_id}/ed/discoverQueue table discovery (admin)
• POST/gateway/shared-services/v3/database-monitoring/databases/{database_id}/ed/scansQueue a paced, read-only encryption detection (ED) scan of discovered tables (admin)
• POST/gateway/shared-services/v3/database-monitoring/databases/{database_id}/ed/scans/{job_id}/cancelCancel a queued or running encryption detection (ED) scan (admin)
• POST/gateway/shared-services/v3/database-monitoring/databases/{database_id}/ed/schedulesRepeat an encryption detection (ED) scan daily or weekly (admin)
• POST/gateway/shared-services/v3/database-monitoring/databases/{database_id}/keyReplace the Database Connector's key and get the setup with the new one (admin)
• GET/gateway/shared-services/v3/database-monitoring/databases/{database_id}/limitsList the row ceilings declared for a database
• PUT/gateway/shared-services/v3/database-monitoring/databases/{database_id}/limits/{relation}Declare the row ceilings for one relation (admin)
• DELETE/gateway/shared-services/v3/database-monitoring/databases/{database_id}/limits/{relation}Withdraw the row ceilings for one relation (admin)
• GET/gateway/shared-services/v3/database-monitoring/databases/{database_id}/metricsOne database's history, bucketed for charts
• GET/gateway/shared-services/v3/database-monitoring/databases/{database_id}/retentionHow much write-ahead log the customer's server holds for the slot
• GET/gateway/shared-services/v3/database-monitoring/databases/{database_id}/serverDiscoverable databases on the same deployed PostgreSQL server
• PATCH/gateway/shared-services/v3/database-monitoring/databases/{database_id}/serverSelect additional databases for scans and monitoring where permissions allow (admin)
• POST/gateway/shared-services/v3/database-monitoring/databases/{database_id}/server/discoverRequest a refresh of server database access checks (admin)
• GET/gateway/shared-services/v3/database-monitoring/databases/{database_id}/setupWhat the customer runs on the database and deploys beside it
• GET/gateway/shared-services/v3/database-monitoring/databases/{database_id}/updateRead deployment updater availability and progress
• PATCH/gateway/shared-services/v3/database-monitoring/databases/{database_id}/updateAdmin latest-only update or automatic upgrade preference
• GET/gateway/shared-services/v3/database-monitoring/databases/{database_id}/windowsThe live stream of judged windows
• GET/gateway/shared-services/v3/database-monitoring/detectionsList detections, newest first
• GET/gateway/shared-services/v3/database-monitoring/detections/{detection_id}Get one detection with the Database Connector's finding
• GET/gateway/shared-services/v3/database-monitoring/ed/scansList running and completed encryption detection (ED) scans across the tenant
• GET/gateway/shared-services/v3/database-monitoring/ed/schedulesA tenant's repeating encryption detection (ED) scans
• PATCH/gateway/shared-services/v3/database-monitoring/ed/schedules/{schedule_id}Change or pause a schedule (admin)
• DELETE/gateway/shared-services/v3/database-monitoring/ed/schedules/{schedule_id}Remove a schedule (admin)
• GET/gateway/shared-services/v3/database-monitoring/incidentsA tenant's incidents, the most recently active first
• GET/gateway/shared-services/v3/database-monitoring/incidents/{incident_id}One incident, with its detections, relations, commits and windows
• POST/gateway/shared-services/v3/database-monitoring/incidents/{incident_id}/resolveResolve an incident (admin)

Data

7 operations in the reference →

• GET/gateway/api/v1/data-scanned-30dGet data covered in the last 30 days
• GET/gateway/api/v1/data-scanned-by-date-rangeGet data covered for a date range
• GET/gateway/api/v1/files-scannedGet files covered
• GET/gateway/api/v1/assets-scannedGet asset coverage
• GET/gateway/api/v1/scan-insightsGet coverage summary
• GET/gateway/api/v1/billingGet rolling 12 months billing metrics
• GET/gateway/api/v1/billing-ytdGet year-to-date billing metrics

Backups & Recovery Points

2 operations across 1 resource.

Backup

2 operations in the reference →

• GET/gateway/api/v1/asset/{assetId}/last-clean-backupGet last clean backup
• GET/gateway/api/v1/backups-list-by-idsGet backup by ids

Hunts & Investigations

78 operations across 9 resources.

Hunts

2 operations in the reference →

• POST/gateway/api/v1/scans/scheduleSchedule hunts and investigations
• POST/gateway/scans/v1/threat-huntStart a hunt across recovery points

Hunt Results

4 operations in the reference →

• GET/gateway/api/v1/scanjobs/{scanJobId}/backupsList the backups a hunt covered
• GET/gateway/api/v1/scanjobs/{scanJobId}/threatsList what a hunt found
• GET/gateway/api/v2/scanjobs/{scanJobId}/threats/pursuit/findingsList Pursuit findings from an investigation
• GET/gateway/api/v2/scanjobs/{scanJobId}/threats/custom/findingsList custom hunt findings from a hunt

Hunt Rules

30 operations in the reference →

• GET/gateway/shared-services/v3/hunt-rulesList hunt rules
• POST/gateway/shared-services/v3/hunt-rulesCreate a hunt rule
• GET/gateway/shared-services/v3/hunt-rules/{id}Get a hunt rule
• PATCH/gateway/shared-services/v3/hunt-rules/{id}Update a hunt rule
• DELETE/gateway/shared-services/v3/hunt-rules/{id}Soft-delete a hunt rule
• GET/gateway/shared-services/v3/hunt-rules/{id}/audit-logList a hunt rule's audit entries
• POST/gateway/shared-services/v3/hunt-rules/{id}/policiesAttach a hunt rule to a policy
• DELETE/gateway/shared-services/v3/hunt-rules/{id}/policies/{policyId}Detach a hunt rule from a policy
• POST/gateway/shared-services/v3/hunt-rules/{id}/revertRevert a hunt rule to an earlier version
• POST/gateway/shared-services/v3/hunt-rules/{id}/signatures/{signatureId}/toggleEnable / disable a single signature
• GET/gateway/shared-services/v3/hunt-rules/{id}/versionsList a hunt rule's version snapshots
• POST/gateway/shared-services/v3/hunt-rules:batch-deleteBatch soft-delete hunt rules
• GET/gateway/shared-services/v3/yara-rulesList YARA rules
• POST/gateway/shared-services/v3/yara-rulesImport a YARA rule (pasted body)
• GET/gateway/shared-services/v3/yara-rules/{id}Get a YARA rule
• PATCH/gateway/shared-services/v3/yara-rules/{id}Update a YARA rule
• DELETE/gateway/shared-services/v3/yara-rules/{id}Soft-delete a YARA rule
• GET/gateway/shared-services/v3/yara-rules/{id}/audit-logList a YARA rule's audit entries
• POST/gateway/shared-services/v3/yara-rules/{id}/revertRevert a YARA rule to an earlier version
• POST/gateway/shared-services/v3/yara-rules/{id}/signatures/{signatureId}/toggleEnable / disable a single YARA signature
• GET/gateway/shared-services/v3/yara-rules/{id}/versionsList a YARA rule's version snapshots
• GET/gateway/shared-services/v3/yara-rulesetsList YARA rulesets
• POST/gateway/shared-services/v3/yara-rulesetsImport a YARA ruleset
• GET/gateway/shared-services/v3/yara-rulesets/{id}Get a YARA ruleset
• PATCH/gateway/shared-services/v3/yara-rulesets/{id}Update a YARA ruleset
• DELETE/gateway/shared-services/v3/yara-rulesets/{id}Soft-delete a YARA ruleset
• GET/gateway/shared-services/v3/yara-rulesets/{id}/audit-logGet a YARA ruleset's audit log
• POST/gateway/shared-services/v3/yara-rulesets/{id}/revertRevert a YARA ruleset to a prior version
• POST/gateway/shared-services/v3/yara-rulesets/{id}/signatures/{signatureID}/toggleEnable / disable a single ruleset signature
• GET/gateway/shared-services/v3/yara-rulesets/{id}/versionsList a YARA ruleset's version snapshots

Custom Hunts

2 operations in the reference →

• GET/gateway/api/v1/assets/{asset_id}/custom-huntsList custom hunt runs for an asset
• GET/gateway/api/v1/custom-hunts/{hunt_scan_id}Get a custom hunt run by ID

Pursuit

8 operations in the reference →

• GET/gateway/api/v1/assets/{asset_id}/pursuit-exceptionGet an asset's active Pursuit exception
• PUT/gateway/api/v1/assets/{asset_id}/pursuit-exceptionCreate, edit or reinstate an asset's Pursuit exception
• DELETE/gateway/api/v1/assets/{asset_id}/pursuit-exceptionClear an asset's Pursuit exception
• GET/gateway/api/v1/assets/{asset_id}/pursuit-exception/historyGet an asset's Pursuit exception change history
• GET/gateway/api/v1/pursuit/summaryGet the estate Pursuit summary
• GET/gateway/api/v1/pursuit/timelinePursuit timeline
• GET/gateway/api/v1/pursuit/reportsList Pursuit persistence reports
• GET/gateway/api/v1/pursuit/reports/{report_id}Get one Pursuit persistence report

Pursuit Investigations

2 operations in the reference →

• GET/gateway/api/v1/assets/{asset_id}/pursuit-scansList Pursuit investigations for an asset
• GET/gateway/api/v1/pursuit-scans/{pursuit_scan_id}Get a Pursuit investigation by ID

Hunt Findings

17 operations in the reference →

• GET/gateway/api/v1/infected-files-filter-optionsGet filter options for files with findings
• GET/gateway/api/v1/threat-kind-countCount findings by kind
• GET/gateway/api/v1/infectionsCount findings by type
• GET/gateway/api/v1/system-optimizationsGet all system optimizations
• GET/gateway/api/v1/threatsList findings
• GET/gateway/api/v2/threats/definitionsGet supported finding definitions
• GET/gateway/api/v2/threatsList findings (v2)
• GET/gateway/api/v2/threats/groupsGet v2 finding group summaries
• GET/gateway/api/v2/threats/filtersGet filter options for v2 findings
• GET/gateway/api/v2/assets/{assetId}/threatsList Hunt findings for an asset
• GET/gateway/api/v2/assets/{assetId}/threats/pursuit/findingsList the latest Pursuit findings for an asset
• GET/gateway/api/v2/assets/{assetId}/threats/custom/findings/{findingId}Get one custom hunt finding and its query hit envelopes
• GET/gateway/api/v2/assets/{assetId}/threats/{threatKind}Get finding detail for an asset by hunt kind
• GET/gateway/api/v1/threats-issues-infectedfiles-countCount findings, issues and files with findings
• GET/gateway/api/v1/threats-filtersGet finding filters
• POST/gateway/shared-services/v1/threats/{threat_id}/suppressSuppress a finding
• DELETE/gateway/shared-services/v1/threats/{threat_id}/suppressionRemove a finding suppression

Ransomware Summary

1 operation in the reference →

• GET/gateway/api/v1/ransomware-shortGet the ransomware summary

Data Classification

12 operations in the reference →

• GET/gateway/api/v1/assets/{assetId}/data-classificationGet data classification summary for an asset
• GET/gateway/api/v1/assets/{assetId}/scanjobs/{scanJobId}/data-classification/findings/filter-optionsGet filter options for a hunt's data classification findings
• GET/gateway/api/v1/assets/{assetId}/scanjobs/{scanJobId}/data-classification/findingsList sensitive files a hunt found (aggregated)
• GET/gateway/api/v2/data-classification/definitionsGet default severities for data classification types
• GET/gateway/api/v2/data-classification/findingsList assets with sensitive data classification findings
• GET/gateway/api/v2/data-classification/findings/filtersGet contextual filter options for v2 data classification findings
• GET/gateway/api/v1/data-classifications/assets/{assetId}List data classifications by asset
• GET/gateway/api/v1/data-classifications/findingsList combined sensitive files for multiple data classifications
• GET/gateway/api/v1/data-classifications/findings/filter-optionsGet filter options for combined data classification findings by ids
• GET/gateway/api/v1/data-classifications/{dataClassificationId}Get data classification by id
• GET/gateway/api/v1/data-classifications/{dataClassificationId}/findings/filter-optionsGet filter options for data classification sensitive files
• GET/gateway/api/v1/data-classifications/{dataClassificationId}/findingsList sensitive files for a data classification

Findings & Response

49 operations across 7 resources.

Incidents

10 operations in the reference →

• GET/gateway/api/v2/incident-assigneesList active tenant members eligible for assignment
• GET/gateway/api/v2/incidentsList retained incident episodes
• GET/gateway/api/v2/incidents/filtersGet contextual filter options for incidents
• GET/gateway/api/v2/incidents/{id}Get an incident and its retained audit history
• POST/gateway/api/v2/incidents/{id}/closeClose an incident
• POST/gateway/api/v2/incidents/{id}/reopenReopen an incident
• POST/gateway/api/v2/incidents/{id}/commentComment on an incident
• POST/gateway/api/v2/incidents/{id}/assignAssign an incident
• GET/gateway/api/v2/incident-settingsGet tenant incident history retention
• PUT/gateway/api/v2/incident-settingsSet tenant incident history retention, at most 730 days

Findings

9 operations in the reference →

• GET/gateway/api/v2/findings/countGet findings counts
• POST/gateway/api/v2/findings/{findingId}/acknowledgeAcknowledge a finding
• POST/gateway/api/v2/findings/{findingId}/suppressSuppress a finding
• POST/gateway/api/v2/findings/{findingId}/resolveResolve a finding
• POST/gateway/api/v2/findings/{findingId}/recoverRecover a finding by restoring from a clean recovery point
• POST/gateway/api/v2/findings/{findingId}/reopenReopen a finding
• GET/gateway/api/v2/findings/suppressionsList suppressed findings
• GET/gateway/api/v2/findings/resolutionsList resolved findings
• GET/gateway/api/v2/findings/{findingId}/status-logGet a finding's status log

Violations

6 operations in the reference →

• GET/gateway/api/v2/assets/{assetId}/violationsGet open violations for a specific asset
• GET/gateway/api/v2/violations/definitionsGet supported violation definitions
• GET/gateway/api/v2/violationsGet list of open asset violations
• GET/gateway/api/v2/violations/groupsGet v2 violation group summaries
• GET/gateway/api/v2/violations/filtersGet contextual filter options for v2 violations
• GET/gateway/api/v2/violations/{violationId}Get a violation by ID

Issues

2 operations in the reference →

• GET/gateway/api/v1/issuesList of issues
• GET/gateway/api/v1/issues-filtersGet issues filters

Cloud Configuration

19 operations in the reference →

• GET/gateway/ingestion/v1/posture/overviewGet the cloud configuration overview
• GET/gateway/ingestion/v1/posture/resourcesList cloud configuration resources
• GET/gateway/ingestion/v1/posture/findingsList cloud configuration findings (violations)
• GET/gateway/ingestion/v1/posture/complianceGet compliance framework scores
• GET/gateway/ingestion/v1/posture/lineageGet asset relationship graph
• GET/gateway/ingestion/v1/posture/lineage/countCount lineage resources (total and affected)
• POST/gateway/ingestion/v1/posture/syncRun configuration checks now
• GET/gateway/ingestion/v1/posture/sync/statusGet configuration check status
• GET/gateway/ingestion/v1/posture/connection-statusValidate stored AWS credentials for configuration checks
• GET/gateway/ingestion/v1/posture/syncsList configuration check history
• POST/gateway/ingestion/v1/posture/credentials/roleConnect a tenant's AWS account by assuming a role (preferred)
• GET/gateway/ingestion/v1/posture/credentialsGet stored AWS credential metadata
• POST/gateway/ingestion/v1/posture/credentialsSave AWS credentials for configuration checks
• DELETE/gateway/ingestion/v1/posture/credentialsDelete stored AWS credentials
• GET/gateway/ingestion/v1/posture/rulesList enabled configuration rules
• GET/gateway/ingestion/v1/posture/violation-suppressionsList active violation suppressions
• POST/gateway/ingestion/v1/posture/violation-suppressionsCreate a violation suppression
• GET/gateway/ingestion/v1/posture/violation-suppressions/{id}Get a single violation suppression
• DELETE/gateway/ingestion/v1/posture/violation-suppressions/{id}Delete a violation suppression

Compliance

1 operation in the reference →

• GET/gateway/api/v1/compliance/statusGet compliance status across all frameworks

DRS

2 operations in the reference →

• GET/gateway/api/v1/drs_source_servers/{id}Get DRS source server details
• GET/gateway/api/v1/assets/{asset_id}/drs_source_serversList DRS source servers by asset ID

Policies & Jobs

70 operations across 6 resources.

Policies

36 operations in the reference →

• GET/gateway/shared-services/v1/policiesList tenant policies
• POST/gateway/shared-services/v1/policiesCreate policy (Admin only)
• GET/gateway/shared-services/v1/policies/{name}Get policy by name
• PUT/gateway/shared-services/v1/policies/{name}Update policy by name (Admin only)
• DELETE/gateway/shared-services/v1/policies/{name}Delete policy by name (Admin only)
• POST/gateway/shared-services/v1/policies/{name}/pausePause policy (Admin only)
• POST/gateway/shared-services/v1/policies/{name}/resumeResume policy (Admin only)
• GET/gateway/shared-services/v2/policiesList tenant policies v2
• POST/gateway/shared-services/v2/policiesCreate policy v2 (Admin only)
• GET/gateway/shared-services/v2/policies/{name}Get policy by name v2
• PUT/gateway/shared-services/v2/policies/{name}Update policy v2 (Admin only)
• DELETE/gateway/shared-services/v2/policies/{name}Delete policy by name v2 (Admin only)
• POST/gateway/shared-services/v2/policies/{name}/pausePause policy v2 (Admin only)
• POST/gateway/shared-services/v2/policies/{name}/resumeResume policy v2 (Admin only)
• POST/gateway/shared-services/v2/policies:validateValidate a v2 Azure/IBM policy_yaml (Admin only)
• GET/gateway/shared-services/v3/event-policiesList event-based policies
• POST/gateway/shared-services/v3/event-policiesCreate an event-based policy
• GET/gateway/shared-services/v3/event-policies/{name}Get an event-based policy
• PUT/gateway/shared-services/v3/event-policies/{name}Update an event-based policy
• DELETE/gateway/shared-services/v3/event-policies/{name}Delete an event-based policy (Admin only)
• POST/gateway/shared-services/v3/event-policies/{name}/soft-deleteSoft-delete an event-based policy by name (Admin only)
• GET/gateway/shared-services/v3/policiesList tenant policies v3
• POST/gateway/shared-services/v3/policiesCreate policy v3 (Admin only)
• GET/gateway/shared-services/v3/policies/{name}Get policy by name v3
• PUT/gateway/shared-services/v3/policies/{name}Update policy v3 (Admin only)
• DELETE/gateway/shared-services/v3/policies/{name}Delete policy by name v3 (Admin only)
• POST/gateway/shared-services/v3/policies/{name}/pausePause policy v3 (Admin only)
• POST/gateway/shared-services/v3/policies/{name}/resumeResume policy v3 (Admin only)
• POST/gateway/shared-services/v3/policies/{name}/runRun policy on demand (Admin only)
• POST/gateway/shared-services/v3/policies/{name}/soft-deleteSoft-delete a scheduled policy by name (Admin only)
• GET/gateway/shared-services/v3/policies/deletedList active policy deletions
• GET/gateway/shared-services/v3/policies/deleted/{id}Read one policy deletion / tombstone
• DELETE/gateway/shared-services/v3/policies/deleted/{id}Permanently delete a soft-deleted policy (Admin only)
• POST/gateway/shared-services/v3/policies/deleted/{id}/restoreRestore a soft-deleted policy (Admin only)
• GET/gateway/shared-services/v3/policies/pursuit-playbooksList built-in pursuit playbooks
• POST/gateway/shared-services/v3/policies:validateValidate a v3 Azure/IBM policy_yaml (Admin only)

Policy Schedules

5 operations in the reference →

• GET/gateway/shared-services/v1/schedulesList tenant schedules
• POST/gateway/shared-services/v1/schedulesCreate schedule (Admin only)
• GET/gateway/shared-services/v1/schedules/{id}Get schedule by id
• PATCH/gateway/shared-services/v1/schedules/{id}Update schedule (Admin only)
• DELETE/gateway/shared-services/v1/schedules/{id}Delete schedule (Admin only)

Policy Membership

5 operations in the reference →

• GET/gateway/shared-services/v2/assets/{id}/policiesList the policies whose membership covers an asset
• GET/gateway/shared-services/v2/azure/subscription-regionsLive Azure (subscription, region) pairs
• GET/gateway/shared-services/v2/policies/{name}/membershipCompute the assets currently selected by a stored policy
• GET/gateway/shared-services/v2/policies/{name}/subscription-regionsAzure (subscription, region) pairs a stored policy covers
• POST/gateway/shared-services/v2/policies/scope-previewCompute the assets a draft policy definition would select

System Policies

4 operations in the reference →

• GET/gateway/shared-services/v3/system-policiesList the tenant's system policies
• GET/gateway/shared-services/v3/system-policies/{id}Get a system policy
• PUT/gateway/shared-services/v3/system-policies/{id}Update a system policy
• DELETE/gateway/shared-services/v3/system-policies/{id}Delete a system policy

System Events

3 operations in the reference →

• GET/gateway/shared-services/v3/system-events/catalogList the operational event vocabulary
• GET/gateway/shared-services/v3/system-events/subscriptionsRetired, use System Policies (deprecated)
• PUT/gateway/shared-services/v3/system-events/subscriptionsRetired, use System Policies (deprecated)

Jobs

17 operations in the reference →

• GET/gateway/api/v1/s3-buckets/{s3BucketId}/aws-s3-threat-hunts/{s3ThreatHuntJobId}/scanned-objectsList the objects an AWS S3 hunt covered in a bucket
• GET/gateway/api/v1/ibm-cos-buckets/{ibmCosBucketId}/ibm-cos-bucket-threat-hunts/{ibmCosBucketThreatHuntJobId}/scanned-objectsList the objects an IBM COS bucket hunt covered
• GET/gateway/api/v1/jobs/cloud-connector/filtersGet Cloud Connector job filters
• GET/gateway/api/v1/jobs/cloud-connector/groupsGet Cloud Connector job group summaries
• GET/gateway/api/v1/jobs/groupsGet job group summaries across Cloud Connector and tenant jobs
• GET/gateway/api/v1/jobs/countCount Cloud Connector and tenant jobs in the unified catalog
• GET/gateway/api/v1/jobsList Cloud Connector and tenant jobs in one catalog
• GET/gateway/api/v1/jobs/cloud-connector/{jobId}Get Cloud Connector job by id
• GET/gateway/api/v1/jobs/cloud-connector/{jobId}/scansList the hunts in a Cloud Connector job
• GET/gateway/api/v1/jobs/cloud-connector/{jobId}/raw-dataGet Cloud Connector job raw data by id
• GET/gateway/api/v1/jobs/cloud-connector/aws-threat-hunts/{threatHuntJobId}/jobsList related jobs for an AWS hunt
• GET/gateway/api/v1/jobs/cloud-connector/aws-threat-hunts/{threatHuntJobId}/latest-healthy-related-jobGet the latest healthy related job for an AWS hunt
• GET/gateway/api/v1/jobs/cloud-connector/aws-s3-threat-hunts/{s3ThreatHuntJobId}/jobsList related jobs for an AWS S3 hunt
• GET/gateway/api/v1/jobs/cloud-connector/ibm-cos-bucket-threat-hunts/{ibmCosBucketThreatHuntJobId}/jobsList related jobs for an IBM COS bucket hunt
• GET/gateway/api/v1/jobs/cloud-connectorList Cloud Connector jobs
• GET/gateway/api/v1/jobs/tenantList tenant jobs
• GET/gateway/api/v1/jobs/tenant/filtersGet tenant job filters

Recovery & Evidence

27 operations across 5 resources.

Resilience Program

20 operations in the reference →

• DELETE/gateway/shared-services/v1/resilience-programReset the Resilience Program back to its empty state
• POST/gateway/shared-services/v1/resilience-program/commitCommit a new Resilience Program version
• GET/gateway/shared-services/v1/resilience-program/estateThe classified estate, one asset per row
• GET/gateway/shared-services/v1/resilience-program/estate/exposureLive Business-exposure rollup by spine, account, or account group
• GET/gateway/shared-services/v1/resilience-program/node-assignmentsLive per-leaf owner-scope and RPO on the program tree
• PUT/gateway/shared-services/v1/resilience-program/node-assignmentsReplace the live per-leaf owner-scope and RPO bindings
• GET/gateway/shared-services/v1/resilience-program/overridesList governance overrides
• POST/gateway/shared-services/v1/resilience-program/overridesPin one asset to a resilience class
• GET/gateway/shared-services/v1/resilience-program/overrides/{override_id}Read one governance override
• PATCH/gateway/shared-services/v1/resilience-program/overrides/{override_id}Amend a governance override
• DELETE/gateway/shared-services/v1/resilience-program/overrides/{override_id}Retire a governance override
• GET/gateway/shared-services/v1/resilience-program/overrides/{override_id}/historyOne override's timeline
• POST/gateway/shared-services/v1/resilience-program/overrides/batch-deleteRetire many governance overrides
• GET/gateway/shared-services/v1/resilience-program/overrides/summaryGovernance-override counts
• GET/gateway/shared-services/v1/resilience-program/snapshotCurrent Resilience Program snapshot
• GET/gateway/shared-services/v1/resilience-program/spineThe tenant's Mapped Inventory hierarchy
• PUT/gateway/shared-services/v1/resilience-program/spineReplace the tenant's Mapped Inventory hierarchy
• GET/gateway/shared-services/v1/resilience-program/spine/recommendA proposed hierarchy, derived from the estate's own tags
• GET/gateway/shared-services/v1/resilience-program/tag-keysThe tag keys discovered on the estate
• GET/gateway/shared-services/v1/resilience-program/timeseriesResilience Program per-class trend

Recovery Verdict

2 operations in the reference →

• GET/gateway/shared-services/v1/recovery-verdictEstate-wide recovery verdict summary
• GET/gateway/shared-services/v1/recovery-verdict/assetsPer-asset recovery verdicts, paged

Recovery Analytics

1 operation in the reference →

• GET/gateway/api/v1/recovery-analytics/backup-age-percentilesGet backup age percentiles

Evidence

2 operations in the reference →

• GET/gateway/shared-services/v1/assets/{asset_id}/evidenceGet the aggregated evidence envelope for one asset
• GET/gateway/shared-services/v1/evidence/ledgerGet one page of the fleet-wide evidence ledger

Security Metrics

2 operations in the reference →

• POST/gateway/api/v1/trends-historyGet trends history data
• GET/gateway/api/v1/security-metricsGet security metrics

Reporting

35 operations across 3 resources.

Reports

18 operations in the reference →

• GET/gateway/api/v1/scan-jobs/{scan_job_id}/reportGet a hunt report by job ID
• GET/gateway/api/v1/scans/{scan_id}/reportGet a hunt report by run ID
• GET/gateway/api/v1/reports/compliance/doraGenerate DORA Compliance Report
• GET/gateway/api/v1/reports/compliance/iso27001Generate ISO 27001 Compliance Report
• GET/gateway/api/v1/reports/compliance/nistGenerate NIST CSF Compliance Report
• GET/gateway/api/v1/reports/compliance/nydfsGenerate NYDFS Compliance Report
• GET/gateway/api/v1/reports/compliance/pciGenerate PCI DSS Compliance Report
• POST/gateway/shared-services/v1/documents/pdfRender a structured document as a PDF
• GET/gateway/reporting/v1/reportsList reports
• POST/gateway/reporting/v1/reportsCreate a report
• GET/gateway/reporting/v1/reports/{id}Get a report
• DELETE/gateway/reporting/v1/reports/{id}Delete a report
• GET/gateway/reporting/v1/reports/{id}/statusGet report status
• GET/gateway/reporting/v2/reportsList v2 reports
• POST/gateway/reporting/v2/reportsCreate a v2 report
• GET/gateway/reporting/v2/reports/{id}Get a v2 report
• DELETE/gateway/reporting/v2/reports/{id}Delete a v2 report
• GET/gateway/reporting/v2/reports/{id}/statusGet v2 report status

Report Schedules

5 operations in the reference →

• GET/gateway/reporting/v2/schedulesList report schedules
• POST/gateway/reporting/v2/schedulesCreate a report schedule
• GET/gateway/reporting/v2/schedules/{id}Get a report schedule
• PATCH/gateway/reporting/v2/schedules/{id}Update a report schedule
• DELETE/gateway/reporting/v2/schedules/{id}Delete a report schedule

EQL

12 operations in the reference →

• GET/gateway/reporting/v1/eql/datasetsDiscover EQL datasets and capabilities
• POST/gateway/reporting/v1/eql/draftDraft EQL from a natural-language report request
• POST/gateway/reporting/v1/eql/queryPreview a bounded EQL report
• GET/gateway/reporting/v1/eql/reportsList saved EQL reports
• POST/gateway/reporting/v1/eql/reportsGenerate and save an EQL report
• GET/gateway/reporting/v1/eql/reports/{id}Get a saved EQL report and its query
• GET/gateway/reporting/v1/eql/reports/{id}/pdfDownload a completed EQL PDF
• GET/gateway/reporting/v1/eql/schedulesList EQL report schedules
• POST/gateway/reporting/v1/eql/schedulesSchedule an EQL report
• GET/gateway/reporting/v1/eql/schedules/{id}Get an EQL report schedule
• PATCH/gateway/reporting/v1/eql/schedules/{id}Update or pause an EQL schedule
• DELETE/gateway/reporting/v1/eql/schedules/{id}Delete an EQL report schedule

Alerts & Integrations

67 operations across 7 resources.

Alerts

19 operations in the reference →

• GET/gateway/integration/v1/alertsList leftover unlabeled alerts (v1)
• POST/gateway/integration/v1/alertsCreate a new alert
• GET/gateway/integration/v1/alerts/{alert_id}Get leftover unlabeled alert by ID
• PUT/gateway/integration/v1/alerts/{alert_id}Update leftover unlabeled alert
• DELETE/gateway/integration/v1/alerts/{alert_id}Delete an alert
• GET/gateway/integration/v2/alertsList all alerts for a tenant (v2)
• POST/gateway/integration/v2/alertsCreate a policy-aware alert (v2)
• GET/gateway/integration/v2/alerts/{alert_id}Get alert by ID (v2)
• PUT/gateway/integration/v2/alerts/{alert_id}Update alert (v2)
• DELETE/gateway/integration/v2/alerts/{alert_id}Delete leftover unlabeled alert
• GET/gateway/integration/v2/alerts/{alert_id}/activityList alert activity (v2)
• GET/gateway/integration/v2/alerts/{alert_id}/activity/optionsFilter options for alert activity (v2)
• GET/gateway/integration/v1/alerts/{alert_id}/activityList alert activity (matched events and channel deliveries)
• GET/gateway/integration/v1/alerts/{alert_id}/activity/optionsFilter options for alert activity
• GET/gateway/integration/v1/channelsGet available notification channels
• GET/gateway/integration/v1/alerts/emailsGet available email addresses
• GET/gateway/integration/v1/alerts/eventsGet available event types
• GET/gateway/integration/v2/alerts/eventsGet available event types (v2)
• GET/gateway/integration/v1/alerts/accountsGet available accounts by platform

Webhooks

11 operations in the reference →

• GET/gateway/integration/v1/webhooksList all webhooks for a tenant
• POST/gateway/integration/v1/webhooksCreate a new webhook
• GET/gateway/integration/v1/webhooks/statisticsGet webhook delivery statistics
• GET/gateway/integration/v1/webhooks/invocationsGet webhook invocation history (all webhooks)
• GET/gateway/integration/v1/webhooks/deliveries/filter-optionsGet filter options for webhook deliveries list
• GET/gateway/integration/v1/webhooks/deliveriesGet webhook delivery history (all webhooks)
• GET/gateway/integration/v1/webhooks/{webhook_id}Get webhook by ID
• PUT/gateway/integration/v1/webhooks/{webhook_id}Update a webhook
• DELETE/gateway/integration/v1/webhooks/{webhook_id}Delete a webhook
• GET/gateway/integration/v1/webhooks/{webhook_id}/invocationsGet invocation history for a specific webhook
• GET/gateway/integration/v1/webhooks/{webhook_id}/deliveriesGet delivery history for a specific webhook

Slack

17 operations in the reference →

• GET/gateway/integration/v1/slackList Slack integrations
• POST/gateway/integration/v1/slackCreate a Slack integration from a bot token
• GET/gateway/integration/v1/slack/statusSlack service readiness
• GET/gateway/integration/v1/slack/oauth/authorizeMint the Slack consent URL
• POST/gateway/integration/v1/slack/testPost a test message
• GET/gateway/integration/v1/slack/{slack_id}Get a Slack integration
• PUT/gateway/integration/v1/slack/{slack_id}Update a Slack integration
• DELETE/gateway/integration/v1/slack/{slack_id}Delete a Slack integration
• POST/gateway/integration/v1/slack/{slack_id}/testPost a test message with this integration
• GET/gateway/integration/v1/slack/{slack_id}/channelsList the workspace's channels
• GET/gateway/integration/v1/slack/{slack_id}/channel-mappingsList channel mappings
• POST/gateway/integration/v1/slack/{slack_id}/channel-mappingsAdd a channel mapping
• DELETE/gateway/integration/v1/slack/{slack_id}/channel-mappings/{mapping_id}Remove a channel mapping
• GET/gateway/integration/v1/slack/statisticsGet Slack delivery statistics
• GET/gateway/integration/v1/slack/invocations/filter-optionsGet filter options for Slack invocations list
• GET/gateway/integration/v1/slack/invocationsGet Slack invocation history (all integrations)
• GET/gateway/integration/v1/slack/{slack_id}/invocationsGet Slack invocation history for an integration

Splunk

4 operations in the reference →

• GET/gateway/integration/v1/splunk/statisticsGet Splunk delivery statistics
• GET/gateway/integration/v1/splunk/invocations/filter-optionsGet filter options for Splunk invocations list
• GET/gateway/integration/v1/splunk/invocationsGet Splunk invocation history (all configs)
• GET/gateway/integration/v1/splunk/{splunk_id}/invocationsGet Splunk invocation history for a config

VirusTotal

5 operations in the reference →

• GET/gateway/integration/v1/virustotalGet VirusTotal integration
• POST/gateway/integration/v1/virustotalCreate VirusTotal integration
• PUT/gateway/integration/v1/virustotalUpdate VirusTotal integration
• DELETE/gateway/integration/v1/virustotalDelete VirusTotal integration
• GET/gateway/integration/v1/virustotal/files/{fileHash}Get VirusTotal file report by hash

Wiz

5 operations in the reference →

• POST/gateway/integration/v1/wiz/webhookReceive incoming Wiz event
• GET/gateway/integration/v1/wizList Wiz channels
• GET/gateway/integration/v1/wiz/{id}Get a Wiz channel
• PUT/gateway/integration/v1/wiz/{id}Update a Wiz channel
• DELETE/gateway/integration/v1/wiz/{id}Delete a Wiz channel

GuardDuty

6 operations in the reference →

• GET/gateway/ingestion/v1/accountsList AWS accounts for a tenant
• POST/gateway/ingestion/v1/enableEnable GuardDuty integration for an AWS account
• POST/gateway/ingestion/v1/disableDisable GuardDuty integration for an AWS account
• POST/gateway/ingestion/v1/guardduty/{hub_account_id}/{hub_region}/linked-accountsAdd linked accounts to a hub
• DELETE/gateway/ingestion/v1/guardduty/{hub_account_id}/{hub_region}/linked-accountsRemove linked accounts from a hub
• GET/gateway/ingestion/v1/statusGet GuardDuty integration status for a tenant