Diagnostics API

REST API for this feature — 61 operations across 37 resource paths, auto-generated from the platform's live OpenAPI schema (drf-spectacular).

Base URL https://<your-versus-host>/api · Auth Authorization: Bearer <JWT> (from POST /api/auth/token/) · 📄 Download the OpenAPI spec for Postman/Insomnia/Swagger · see the API overview for pagination, filtering, and errors.

Diagnostics

GET /api/diagnostics/feed/

GET the live incident feed (recent incident sessions + status).

Responses: 200

POST /api/diagnostics/poll/

POST — run one feed poll immediately (admin-only).

Responses: 200

GET /api/diagnostics/settings/

GET / PUT the per-tenant Diagnostics settings (admin-only).

Responses: 200

POST /api/diagnostics/settings/

GET / PUT the per-tenant Diagnostics settings (admin-only).

Responses: 200

PUT /api/diagnostics/settings/

GET / PUT the per-tenant Diagnostics settings (admin-only).

Responses: 200

POST /api/diagnostics/simulate-incident/

POST — inject sample incidents to exercise the feed (admin-only).

Responses: 200

---

Path diagnose

POST /api/throughline/path-diagnose/

Network Path Diagnostics — return the client→server hop path plus the

Responses: 200

---

Pathmon

GET /api/pathmon/check-catalog/

GET /api/pathmon/check-catalog/ — the checks offered as checkboxes at monitor

Responses: 200

GET /api/pathmon/monitors/

GET/POST /api/pathmon/monitors/ — list + create path monitors (tenant-scoped).

Responses: 200

POST /api/pathmon/monitors/

GET/POST /api/pathmon/monitors/ — list + create path monitors (tenant-scoped).

Responses: 200

GET /api/pathmon/monitors/{id}/

GET/DELETE /api/pathmon/monitors/<id>/

Responses: 200

DELETE /api/pathmon/monitors/{id}/

GET/DELETE /api/pathmon/monitors/<id>/

Responses: 204

POST /api/pathmon/monitors/{id}/build/

POST /api/pathmon/monitors/<id>/build/ — discover the path + seed default checks.

Responses: 200

GET /api/pathmon/monitors/{id}/dashboard/

GET /api/pathmon/monitors/<id>/dashboard/ — per-hop health + recent events.

Responses: 200

POST /api/pathmon/monitors/{id}/run/

POST /api/pathmon/monitors/<id>/run/ — run this monitor's checks now.

Responses: 200

POST /api/pathmon/probe-path/

POST /api/pathmon/probe-path/ body {source_ip, dest_ip, hostname?}

Responses: 200

POST /api/pathmon/suggest/

POST /api/pathmon/suggest/ {answers, monitor_id?} — questionnaire → suggested config.

Responses: 200

---

Pcap analyses

GET /api/pcap-analyses/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 200 → PcapAnalysis[]

POST /api/pcap-analyses/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): PcapAnalysisRequest

Responses: 201 → PcapAnalysis

GET /api/pcap-analyses/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 200 → PcapAnalysis

PUT /api/pcap-analyses/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): PcapAnalysisRequest

Responses: 200 → PcapAnalysis

PATCH /api/pcap-analyses/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): PatchedPcapAnalysisRequest

Responses: 200 → PcapAnalysis

DELETE /api/pcap-analyses/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 204

POST /api/pcap-analyses/{id}/add-capture/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): PcapAnalysisRequest

Responses: 200 → PcapAnalysis

POST /api/pcap-analyses/{id}/analyze/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): PcapAnalysisRequest

Responses: 200 → PcapAnalysis

DELETE /api/pcap-analyses/{id}/captures/{capture_id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 204

POST /api/pcap-analyses/{id}/captures/{capture_id}/ask/

Ask a natural-language question about one capture. The model is grounded in the flat stats, the findings, the deep-statistics digest and a packet sample (the rows matching filter when one is passed). When the question asks to show, find or isolate packets the answer includes a validated Wireshark display filter.

Request body (application/json): {question, filter?}

Responses: 200 → {answer, filter: null | {type: "display", value} | {type: "clear"}}

GET /api/pcap-analyses/{id}/captures/{capture_id}/packets/

Packet rows for the packet list. filter is a Wireshark display filter applied server-side (validated first — an invalid expression returns 400 with the parser message); offset / limit (max 5000) page through the result and total is the true match count when a filter is set.

Responses: 200 → {packets, count, offset, limit, total, truncated, filter}

GET /api/pcap-analyses/{id}/captures/{capture_id}/deep/

The deep statistics computed in the background after upload (status is queued → analyzing → ready or error): capinfos, timeline, conversations, endpoints, rtt, tcp_health, transactions, expert, protocols, packet_lengths, http, dns, tls, icmp, security, and f5 / netscaler / decryption when the capture carries a vendor trailer. Also returns the merged findings.

Responses: 200 → {capture_id, status, error, analyzed_at, findings, deep}

POST /api/pcap-analyses/{id}/captures/{capture_id}/reanalyze/

Re-run the flat and deep statistics for one capture (for example after an upgrade added new analyses). 409 if an analysis is already running.

Responses: 202 → PcapCapture

GET /api/pcap-analyses/{id}/captures/{capture_id}/stream/?stream=N

tcptrace-style series for one TCP stream (tcp.stream index): per direction, data segments (relative sequence), peer ACKs, receive window, RTT samples, bytes in flight, bucketed throughput and SYN/FIN/RST/zero-window events.

Responses: 200 → {stream, interval_s, duration_s, frames, directions}

GET /api/pcap-analyses/{id}/captures/{capture_id}/follow/?stream=N

Reassembled payload of one TCP stream as client/server turns (Wireshark's Follow TCP Stream); non-printable bytes are rendered as ..

Responses: 200 → {stream, client, server, turns, total_bytes, truncated}

GET /api/pcap-analyses/{id}/captures/{capture_id}/frame/?no=N

Full dissection of one frame (the packet-details pane plus hex dump, as tshark -V -x prints it).

Responses: 200 → {frame, text, truncated}

GET /api/pcap-analyses/{id}/captures/{capture_id}/export/?filter=…

Download the packets matching a display filter (or the whole capture) as a new pcapng. The response is the file (application/vnd.tcpdump.pcap, Content-Disposition: attachment); 400 if nothing matched or the filter is invalid.

Responses: 200 → pcapng bytes

POST /api/pcap-analyses/{id}/pull-scp/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): PcapAnalysisRequest

Responses: 200 → PcapAnalysis

---

Pcap taps

GET /api/pcap-taps/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 200 → PCAPTap[]

POST /api/pcap-taps/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): PCAPTapRequest

Responses: 201 → PCAPTap

GET /api/pcap-taps/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 200 → PCAPTap

PUT /api/pcap-taps/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): PCAPTapRequest

Responses: 200 → PCAPTap

PATCH /api/pcap-taps/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): PatchedPCAPTapRequest

Responses: 200 → PCAPTap

DELETE /api/pcap-taps/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 204

---

Scp servers

GET /api/scp-servers/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 200 → ScpServer[]

POST /api/scp-servers/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): ScpServerRequest

Responses: 201 → ScpServer

GET /api/scp-servers/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 200 → ScpServer

PUT /api/scp-servers/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): ScpServerRequest

Responses: 200 → ScpServer

PATCH /api/scp-servers/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): PatchedScpServerRequest

Responses: 200 → ScpServer

DELETE /api/scp-servers/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 204

GET /api/scp-servers/{id}/list_files/

List PCAP files in the server's default_directory (or ?directory= override).

Responses: 200 → ScpServer

---

Siem connectors

GET /api/siem-connectors/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 200 → PaginatedSiemConnectorList

POST /api/siem-connectors/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): SiemConnectorRequest

Responses: 201 → SiemConnector

GET /api/siem-connectors/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 200 → SiemConnector

PUT /api/siem-connectors/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): SiemConnectorRequest

Responses: 200 → SiemConnector

PATCH /api/siem-connectors/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): PatchedSiemConnectorRequest

Responses: 200 → SiemConnector

DELETE /api/siem-connectors/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 204

---

Throughline

GET /api/throughline/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 200 → PaginatedAnalysisSessionList

POST /api/throughline/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): AnalysisSessionRequest

Responses: 201 → AnalysisSession

GET /api/throughline/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 200 → AnalysisSession

PUT /api/throughline/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): AnalysisSessionRequest

Responses: 200 → AnalysisSession

PATCH /api/throughline/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): PatchedAnalysisSessionRequest

Responses: 200 → AnalysisSession

DELETE /api/throughline/{id}/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Responses: 204

POST /api/throughline/{id}/approve-remediation/

Approve a held remediation workflow and start its run (human-in-loop).

Request body (application/json): AnalysisSessionRequest

Responses: 200 → AnalysisSession

POST /api/throughline/{id}/generate-workflow/

Deprecated. This single-shot generator predates the AutoPilot expert-panel loop, which investigates with real probes and lets governance draft the remediation workflow from the diagnosis (see POST /api/throughline/{id}/reanalyze/ on an incident session). The endpoint remains for existing API callers but is no longer triggered by the UI or on session creation.

Kick off background AI workflow generation. Returns 202 immediately.

Request body (application/json): AnalysisSessionRequest

Responses: 200 → AnalysisSession

POST /api/throughline/{id}/pull-pcap-scp/

Pull a PCAP file from a remote SCP/SFTP server and attach it to this session.

Request body (application/json): AnalysisSessionRequest

Responses: 200 → AnalysisSession

POST /api/throughline/{id}/reanalyze/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): AnalysisSessionRequest

Responses: 200 → AnalysisSession

POST /api/throughline/{id}/reject-remediation/

Reject a held remediation workflow (cancels the pending run).

Request body (application/json): AnalysisSessionRequest

Responses: 200 → AnalysisSession

POST /api/throughline/{id}/upload-pcap/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (multipart/form-data): AnalysisSessionRequest

Responses: 200 → AnalysisSession

POST /api/throughline/{id}/verdict/

Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated

Request body (application/json): AnalysisSessionRequest

Responses: 200 → AnalysisSession

---

Auto-generated from drf-spectacular OpenAPI. Endpoint descriptions come from viewset docstrings/serializers; enriching those improves this page on the next generation.