{ "openapi": "3.0.3", "info": { "title": "Diagnostics API", "version": "1.0.0", "description": "Diagnostics AutoPilot \u2014 analysis sessions, path monitoring, packet capture, and SIEM/SCP connectors." }, "servers": [ { "url": "https://versus-demo.com" } ], "paths": { "/api/diagnostics/feed/": { "get": { "operationId": "diagnostics_feed_retrieve", "description": "GET the live incident feed (recent incident sessions + status).", "tags": [ "diagnostics" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "List feeds" } }, "/api/diagnostics/poll/": { "post": { "operationId": "diagnostics_poll_create", "description": "POST \u2014 run one feed poll immediately (admin-only).", "tags": [ "diagnostics" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Create poll" } }, "/api/diagnostics/settings/": { "get": { "operationId": "diagnostics_settings_retrieve", "description": "GET / PUT the per-tenant Diagnostics settings (admin-only).", "tags": [ "diagnostics" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "List settings" }, "post": { "operationId": "diagnostics_settings_create", "description": "GET / PUT the per-tenant Diagnostics settings (admin-only).", "tags": [ "diagnostics" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Create setting" }, "put": { "operationId": "diagnostics_settings_update", "description": "GET / PUT the per-tenant Diagnostics settings (admin-only).", "tags": [ "diagnostics" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Update setting" } }, "/api/diagnostics/simulate-incident/": { "post": { "operationId": "diagnostics_simulate_incident_create", "description": "POST \u2014 inject sample incidents to exercise the feed (admin-only).\n\nbody: {count?, to? in [desk,servicenow,both], priority?, domains?: [..]}", "tags": [ "diagnostics" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Create simulate incident" } }, "/api/pathmon/check-catalog/": { "get": { "operationId": "pathmon_check_catalog_retrieve", "description": "GET /api/pathmon/check-catalog/ \u2014 the checks offered as checkboxes at monitor\ncreation (single source of truth with seed_checks).", "tags": [ "pathmon" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "List check catalogs" } }, "/api/pathmon/monitors/": { "get": { "operationId": "pathmon_monitors_retrieve", "description": "GET/POST /api/pathmon/monitors/ \u2014 list + create path monitors (tenant-scoped).", "tags": [ "pathmon" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "List monitors" }, "post": { "operationId": "pathmon_monitors_create", "description": "GET/POST /api/pathmon/monitors/ \u2014 list + create path monitors (tenant-scoped).", "tags": [ "pathmon" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Create monitor" } }, "/api/pathmon/monitors/{id}/": { "get": { "operationId": "pathmon_monitors_retrieve_2", "description": "GET/DELETE /api/pathmon/monitors//", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "required": true } ], "tags": [ "pathmon" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Retrieve monitor" }, "delete": { "operationId": "pathmon_monitors_destroy", "description": "GET/DELETE /api/pathmon/monitors//", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "required": true } ], "tags": [ "pathmon" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete monitor" } }, "/api/pathmon/monitors/{id}/build/": { "post": { "operationId": "pathmon_monitors_build_create", "description": "POST /api/pathmon/monitors//build/ \u2014 discover the path + seed default checks.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "required": true } ], "tags": [ "pathmon" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Build: monitor" } }, "/api/pathmon/monitors/{id}/dashboard/": { "get": { "operationId": "pathmon_monitors_dashboard_retrieve", "description": "GET /api/pathmon/monitors//dashboard/ \u2014 per-hop health + recent events.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "required": true } ], "tags": [ "pathmon" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Dashboard: monitor" } }, "/api/pathmon/monitors/{id}/run/": { "post": { "operationId": "pathmon_monitors_run_create", "description": "POST /api/pathmon/monitors//run/ \u2014 run this monitor's checks now.\n\nRuns OFF-REQUEST in a daemon thread: a live per-hop path_health sweep can take\n>2 min (far past the gunicorn/proxy timeout \u2014 running it inline killed the worker\nand the click appeared to do nothing). Returns 202 immediately; the dashboard\nrefresh shows each hop's result as it lands.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "required": true } ], "tags": [ "pathmon" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Run: monitor" } }, "/api/pathmon/probe-path/": { "post": { "operationId": "pathmon_probe_path_create", "description": "POST /api/pathmon/probe-path/ body {source_ip, dest_ip, hostname?}\n\nStreams the live war-room investigation of the src\u2192dest path as\ntext/event-stream frames the Network Map consumes to highlight each node and\nrender its per-step action log + the final diagnosis.", "tags": [ "pathmon" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Create probe path" } }, "/api/pathmon/suggest/": { "post": { "operationId": "pathmon_suggest_create", "description": "POST /api/pathmon/suggest/ {answers, monitor_id?} \u2014 questionnaire \u2192 suggested config.", "tags": [ "pathmon" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Create suggest" } }, "/api/pcap-analyses/": { "get": { "operationId": "pcap_analyses_list", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "pcap-analyses" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/PcapAnalysis" } } } }, "description": "" } }, "summary": "List pcap analyses" }, "post": { "operationId": "pcap_analyses_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "tags": [ "pcap-analyses" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PcapAnalysis" } } }, "description": "" } }, "summary": "Create pcap analyse" } }, "/api/pcap-analyses/{id}/": { "get": { "operationId": "pcap_analyses_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this pcap analysis.", "required": true } ], "tags": [ "pcap-analyses" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PcapAnalysis" } } }, "description": "" } }, "summary": "Retrieve pcap analyse" }, "put": { "operationId": "pcap_analyses_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this pcap analysis.", "required": true } ], "tags": [ "pcap-analyses" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PcapAnalysis" } } }, "description": "" } }, "summary": "Update pcap analyse" }, "patch": { "operationId": "pcap_analyses_partial_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this pcap analysis.", "required": true } ], "tags": [ "pcap-analyses" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedPcapAnalysisRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedPcapAnalysisRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/PatchedPcapAnalysisRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PcapAnalysis" } } }, "description": "" } }, "summary": "Update pcap analyse" }, "delete": { "operationId": "pcap_analyses_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this pcap analysis.", "required": true } ], "tags": [ "pcap-analyses" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete pcap analyse" } }, "/api/pcap-analyses/{id}/add-capture/": { "post": { "operationId": "pcap_analyses_add_capture_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this pcap analysis.", "required": true } ], "tags": [ "pcap-analyses" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PcapAnalysis" } } }, "description": "" } }, "summary": "Add capture: pcap analyse" } }, "/api/pcap-analyses/{id}/analyze/": { "post": { "operationId": "pcap_analyses_analyze_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this pcap analysis.", "required": true } ], "tags": [ "pcap-analyses" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PcapAnalysis" } } }, "description": "" } }, "summary": "Analyze: pcap analyse" } }, "/api/pcap-analyses/{id}/captures/{capture_id}/": { "delete": { "operationId": "pcap_analyses_captures_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "capture_id", "schema": { "type": "string", "pattern": "^[0-9]+$" }, "required": true }, { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this pcap analysis.", "required": true } ], "tags": [ "pcap-analyses" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete capture" } }, "/api/pcap-analyses/{id}/captures/{capture_id}/ask/": { "post": { "operationId": "pcap_analyses_captures_ask_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "capture_id", "schema": { "type": "string", "pattern": "^[0-9]+$" }, "required": true }, { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this pcap analysis.", "required": true } ], "tags": [ "pcap-analyses" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PcapAnalysis" } } }, "description": "" } }, "summary": "Ask: capture" } }, "/api/pcap-analyses/{id}/captures/{capture_id}/packets/": { "get": { "operationId": "pcap_analyses_captures_packets_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "capture_id", "schema": { "type": "string", "pattern": "^[0-9]+$" }, "required": true }, { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this pcap analysis.", "required": true } ], "tags": [ "pcap-analyses" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PcapAnalysis" } } }, "description": "" } }, "summary": "Packets: capture" } }, "/api/pcap-analyses/{id}/pull-scp/": { "post": { "operationId": "pcap_analyses_pull_scp_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this pcap analysis.", "required": true } ], "tags": [ "pcap-analyses" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/PcapAnalysisRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PcapAnalysis" } } }, "description": "" } }, "summary": "Pull scp: pcap analyse" } }, "/api/pcap-taps/": { "get": { "operationId": "pcap_taps_list", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "pcap-taps" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/PCAPTap" } } } }, "description": "" } }, "summary": "List pcap taps" }, "post": { "operationId": "pcap_taps_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "tags": [ "pcap-taps" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PCAPTapRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PCAPTapRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PCAPTapRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PCAPTap" } } }, "description": "" } }, "summary": "Create pcap tap" } }, "/api/pcap-taps/{id}/": { "get": { "operationId": "pcap_taps_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this pcap tap.", "required": true } ], "tags": [ "pcap-taps" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PCAPTap" } } }, "description": "" } }, "summary": "Retrieve pcap tap" }, "put": { "operationId": "pcap_taps_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this pcap tap.", "required": true } ], "tags": [ "pcap-taps" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PCAPTapRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PCAPTapRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PCAPTapRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PCAPTap" } } }, "description": "" } }, "summary": "Update pcap tap" }, "patch": { "operationId": "pcap_taps_partial_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this pcap tap.", "required": true } ], "tags": [ "pcap-taps" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedPCAPTapRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedPCAPTapRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedPCAPTapRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PCAPTap" } } }, "description": "" } }, "summary": "Update pcap tap" }, "delete": { "operationId": "pcap_taps_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this pcap tap.", "required": true } ], "tags": [ "pcap-taps" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete pcap tap" } }, "/api/scp-servers/": { "get": { "operationId": "scp_servers_list", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "scp-servers" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ScpServer" } } } }, "description": "" } }, "summary": "List scp servers" }, "post": { "operationId": "scp_servers_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "tags": [ "scp-servers" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScpServerRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/ScpServerRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/ScpServerRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScpServer" } } }, "description": "" } }, "summary": "Create scp server" } }, "/api/scp-servers/{id}/": { "get": { "operationId": "scp_servers_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this scp server.", "required": true } ], "tags": [ "scp-servers" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScpServer" } } }, "description": "" } }, "summary": "Retrieve scp server" }, "put": { "operationId": "scp_servers_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this scp server.", "required": true } ], "tags": [ "scp-servers" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScpServerRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/ScpServerRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/ScpServerRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScpServer" } } }, "description": "" } }, "summary": "Update scp server" }, "patch": { "operationId": "scp_servers_partial_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this scp server.", "required": true } ], "tags": [ "scp-servers" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedScpServerRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedScpServerRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedScpServerRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScpServer" } } }, "description": "" } }, "summary": "Update scp server" }, "delete": { "operationId": "scp_servers_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this scp server.", "required": true } ], "tags": [ "scp-servers" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete scp server" } }, "/api/scp-servers/{id}/list_files/": { "get": { "operationId": "scp_servers_list_files_retrieve", "description": "List PCAP files in the server's default_directory (or ?directory= override).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this scp server.", "required": true } ], "tags": [ "scp-servers" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScpServer" } } }, "description": "" } }, "summary": "List files: scp server" } }, "/api/siem-connectors/": { "get": { "operationId": "siem_connectors_list", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "siem-connectors" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedSiemConnectorList" } } }, "description": "" } }, "summary": "List siem connectors" }, "post": { "operationId": "siem_connectors_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "tags": [ "siem-connectors" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemConnectorRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/SiemConnectorRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/SiemConnectorRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemConnector" } } }, "description": "" } }, "summary": "Create siem connector" } }, "/api/siem-connectors/{id}/": { "get": { "operationId": "siem_connectors_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this siem connector.", "required": true } ], "tags": [ "siem-connectors" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemConnector" } } }, "description": "" } }, "summary": "Retrieve siem connector" }, "put": { "operationId": "siem_connectors_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this siem connector.", "required": true } ], "tags": [ "siem-connectors" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemConnectorRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/SiemConnectorRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/SiemConnectorRequest" } } }, "required": true }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemConnector" } } }, "description": "" } }, "summary": "Update siem connector" }, "patch": { "operationId": "siem_connectors_partial_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this siem connector.", "required": true } ], "tags": [ "siem-connectors" ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PatchedSiemConnectorRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedSiemConnectorRequest" } }, "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedSiemConnectorRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SiemConnector" } } }, "description": "" } }, "summary": "Update siem connector" }, "delete": { "operationId": "siem_connectors_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this siem connector.", "required": true } ], "tags": [ "siem-connectors" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete siem connector" } }, "/api/throughline/": { "get": { "operationId": "throughline_list", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "name": "ordering", "required": false, "in": "query", "description": "Which field to use when ordering the results.", "schema": { "type": "string" } }, { "name": "page", "required": false, "in": "query", "description": "A page number within the paginated result set.", "schema": { "type": "integer" } }, { "name": "page_size", "required": false, "in": "query", "description": "Number of results to return per page.", "schema": { "type": "integer" } }, { "name": "search", "required": false, "in": "query", "description": "A search term.", "schema": { "type": "string" } } ], "tags": [ "throughline" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedAnalysisSessionList" } } }, "description": "" } }, "summary": "List throughlines" }, "post": { "operationId": "throughline_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "tags": [ "throughline" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSession" } } }, "description": "" } }, "summary": "Create throughline" } }, "/api/throughline/{id}/": { "get": { "operationId": "throughline_retrieve", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this analysis session.", "required": true } ], "tags": [ "throughline" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSession" } } }, "description": "" } }, "summary": "Retrieve throughline" }, "put": { "operationId": "throughline_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this analysis session.", "required": true } ], "tags": [ "throughline" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSession" } } }, "description": "" } }, "summary": "Update throughline" }, "patch": { "operationId": "throughline_partial_update", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this analysis session.", "required": true } ], "tags": [ "throughline" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/PatchedAnalysisSessionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/PatchedAnalysisSessionRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/PatchedAnalysisSessionRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSession" } } }, "description": "" } }, "summary": "Update throughline" }, "delete": { "operationId": "throughline_destroy", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this analysis session.", "required": true } ], "tags": [ "throughline" ], "security": [ { "jwtAuth": [] } ], "responses": { "204": { "description": "No response body" } }, "summary": "Delete throughline" } }, "/api/throughline/{id}/approve-remediation/": { "post": { "operationId": "throughline_approve_remediation_create", "description": "Approve a held remediation workflow and start its run (human-in-loop).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this analysis session.", "required": true } ], "tags": [ "throughline" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSession" } } }, "description": "" } }, "summary": "Approve remediation: throughline" } }, "/api/throughline/{id}/generate-workflow/": { "post": { "operationId": "throughline_generate_workflow_create", "description": "Kick off background AI workflow generation. Returns 202 immediately.\nPoll GET /throughline/{id}/ and watch wf_status: idle\u2192generating\u2192done|error.\nOn done, wf_workflow_id holds the created WorkflowDefinition id.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this analysis session.", "required": true } ], "tags": [ "throughline" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSession" } } }, "description": "" } }, "summary": "Generate workflow: throughline" } }, "/api/throughline/{id}/pull-pcap-scp/": { "post": { "operationId": "throughline_pull_pcap_scp_create", "description": "Pull a PCAP file from a remote SCP/SFTP server and attach it to this session.", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this analysis session.", "required": true } ], "tags": [ "throughline" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSession" } } }, "description": "" } }, "summary": "Pull pcap scp: throughline" } }, "/api/throughline/{id}/reanalyze/": { "post": { "operationId": "throughline_reanalyze_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this analysis session.", "required": true } ], "tags": [ "throughline" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSession" } } }, "description": "" } }, "summary": "Reanalyze: throughline" } }, "/api/throughline/{id}/reject-remediation/": { "post": { "operationId": "throughline_reject_remediation_create", "description": "Reject a held remediation workflow (cancels the pending run).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this analysis session.", "required": true } ], "tags": [ "throughline" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSession" } } }, "description": "" } }, "summary": "Reject remediation: throughline" } }, "/api/throughline/{id}/upload-pcap/": { "post": { "operationId": "throughline_upload_pcap_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this analysis session.", "required": true } ], "tags": [ "throughline" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSession" } } }, "description": "" } }, "summary": "Upload pcap: throughline" } }, "/api/throughline/{id}/verdict/": { "post": { "operationId": "throughline_verdict_create", "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n queryset = Device.objects.select_related(...)\n ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).", "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "description": "A unique integer value identifying this analysis session.", "required": true } ], "tags": [ "throughline" ], "requestBody": { "content": { "multipart/form-data": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } }, "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSessionRequest" } } } }, "security": [ { "jwtAuth": [] } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AnalysisSession" } } }, "description": "" } }, "summary": "Verdict: throughline" } }, "/api/throughline/path-diagnose/": { "post": { "operationId": "throughline_path_diagnose_create", "description": "Network Path Diagnostics \u2014 return the client\u2192server hop path plus the\nanimated, hop-by-hop troubleshooting script (see path_diag.py). Works from a\nsession (session_id) or ad-hoc source_ip/dest_ip.", "tags": [ "throughline" ], "security": [ { "jwtAuth": [] } ], "responses": { "200": { "description": "No response body" } }, "summary": "Create path diagnose" } } }, "components": { "schemas": { "SiemTypeEnum": { "enum": [ "splunk", "sentinel", "elastic", "qradar" ], "type": "string", "description": "* `splunk` - Splunk\n* `sentinel` - Microsoft Sentinel\n* `elastic` - Elastic SIEM\n* `qradar` - IBM QRadar" }, "PCAPTapRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 200 }, "linked_device": { "type": "integer", "nullable": true, "description": "Device inventory entry representing this tap" }, "scp_server": { "type": "integer", "nullable": true, "description": "SCP/SFTP server that receives PCAP files from this tap" }, "connected_switches": { "type": "array", "items": { "type": "integer" }, "description": "Network switches this tap is physically connected to" }, "notes": { "type": "string" } }, "required": [ "name" ] }, "PcapAnalysisStatusEnum": { "enum": [ "draft", "ready", "analyzing", "complete", "error" ], "type": "string", "description": "* `draft` - Draft\n* `ready` - Ready\n* `analyzing` - Analyzing\n* `complete` - Complete\n* `error` - Error" }, "PatchedSiemConnectorRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 200 }, "siem_type": { "$ref": "#/components/schemas/SiemTypeEnum" }, "url": { "type": "string", "minLength": 1, "description": "Base URL, e.g. https://splunk:8089", "maxLength": 500 }, "token": { "type": "string", "writeOnly": true }, "username": { "type": "string", "maxLength": 200 }, "password": { "type": "string", "writeOnly": true }, "enabled": { "type": "boolean" }, "site": { "type": "integer", "nullable": true, "description": "Reach this SIEM through the site collector (for on-prem SIEMs)." } } }, "PatchedScpServerRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 200 }, "host": { "type": "string", "minLength": 1, "maxLength": 500 }, "port": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "username": { "type": "string", "maxLength": 200 }, "password": { "type": "string", "writeOnly": true }, "private_key": { "type": "string", "description": "PEM-encoded private key (leave blank to use password)" }, "default_directory": { "type": "string", "description": "Remote directory to browse for PCAP files", "maxLength": 1000 }, "description": { "type": "string", "maxLength": 500 }, "linked_device": { "type": "integer", "nullable": true, "description": "Device inventory entry representing this SCP server" } } }, "HumanVerdictEnum": { "enum": [ "unset", "accepted", "rejected" ], "type": "string", "description": "* `unset` - Unset\n* `accepted` - Accepted\n* `rejected` - Rejected" }, "ScpServer": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "name": { "type": "string", "maxLength": 200 }, "host": { "type": "string", "maxLength": 500 }, "port": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "username": { "type": "string", "maxLength": 200 }, "private_key": { "type": "string", "description": "PEM-encoded private key (leave blank to use password)" }, "default_directory": { "type": "string", "description": "Remote directory to browse for PCAP files", "maxLength": 1000 }, "description": { "type": "string", "maxLength": 500 }, "linked_device": { "type": "integer", "nullable": true, "description": "Device inventory entry representing this SCP server" }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "tap_count": { "type": "string", "readOnly": true } }, "required": [ "created_at", "host", "id", "name", "tap_count" ] }, "BlankEnum": { "enum": [ "" ] }, "PcapCapture": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "label": { "type": "string", "maxLength": 100 }, "filename": { "type": "string", "maxLength": 500 }, "file_size": { "type": "integer", "readOnly": true }, "stats": { "readOnly": true }, "findings": { "readOnly": true }, "order": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "created_at": { "type": "string", "format": "date-time", "readOnly": true } }, "required": [ "created_at", "file_size", "findings", "id", "stats" ] }, "AnalysisSessionSourceEnum": { "enum": [ "manual", "desk", "servicenow", "alert" ], "type": "string", "description": "* `manual` - Manual\n* `desk` - Versus Desk\n* `servicenow` - ServiceNow\n* `alert` - Alert" }, "PaginatedSiemConnectorList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/SiemConnector" } } } }, "SiemConnector": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "name": { "type": "string", "maxLength": 200 }, "siem_type": { "$ref": "#/components/schemas/SiemTypeEnum" }, "url": { "type": "string", "description": "Base URL, e.g. https://splunk:8089", "maxLength": 500 }, "username": { "type": "string", "maxLength": 200 }, "enabled": { "type": "boolean" }, "site": { "type": "integer", "nullable": true, "description": "Reach this SIEM through the site collector (for on-prem SIEMs)." }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "updated_at": { "type": "string", "format": "date-time", "readOnly": true } }, "required": [ "created_at", "id", "name", "siem_type", "updated_at", "url" ] }, "ScpServerRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 200 }, "host": { "type": "string", "minLength": 1, "maxLength": 500 }, "port": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648 }, "username": { "type": "string", "maxLength": 200 }, "password": { "type": "string", "writeOnly": true }, "private_key": { "type": "string", "description": "PEM-encoded private key (leave blank to use password)" }, "default_directory": { "type": "string", "description": "Remote directory to browse for PCAP files", "maxLength": 1000 }, "description": { "type": "string", "maxLength": 500 }, "linked_device": { "type": "integer", "nullable": true, "description": "Device inventory entry representing this SCP server" } }, "required": [ "host", "name" ] }, "PatchedPcapAnalysisRequest": { "type": "object", "properties": { "title": { "type": "string", "minLength": 1, "maxLength": 300 }, "description": { "type": "string" } } }, "PaginatedAnalysisSessionList": { "type": "object", "required": [ "count", "results" ], "properties": { "count": { "type": "integer", "example": 123 }, "next": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=4" }, "previous": { "type": "string", "nullable": true, "format": "uri", "example": "http://api.example.org/accounts/?page=2" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/AnalysisSession" } } } }, "ActionLevelEnum": { "enum": [ "off", "read_only", "read_only_approval", "invasive" ], "type": "string", "description": "* `` - Undetermined\n* `off` - Off\n* `read_only` - Read-only diagnosis\n* `read_only_approval` - Diagnose + workflow for approval\n* `invasive` - Autonomous remediation" }, "RemediationStateEnum": { "enum": [ "none", "planned", "awaiting_approval", "approved", "executing", "executed", "failed", "skipped", "rejected" ], "type": "string", "description": "* `none` - None\n* `planned` - Planned\n* `awaiting_approval` - Awaiting Approval\n* `approved` - Approved\n* `executing` - Executing\n* `executed` - Executed\n* `failed` - Failed\n* `skipped` - Skipped\n* `rejected` - Rejected" }, "AnalysisSessionStatusEnum": { "enum": [ "pending", "building", "collecting", "analyzing", "complete", "needs_capture", "error" ], "type": "string", "description": "* `pending` - Pending\n* `building` - Building Path\n* `collecting` - Collecting Evidence\n* `analyzing` - Analyzing\n* `complete` - Complete\n* `needs_capture` - Needs Capture\n* `error` - Error" }, "PcapAnalysisRequest": { "type": "object", "properties": { "title": { "type": "string", "minLength": 1, "maxLength": 300 }, "description": { "type": "string" } }, "required": [ "title" ] }, "PatchedAnalysisSessionRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "subject_kind": { "$ref": "#/components/schemas/SubjectKindEnum" }, "subject_ref": { "type": "string", "maxLength": 200 }, "subject_fqdn": { "type": "string", "maxLength": 500 }, "subject_symptom": { "type": "string", "maxLength": 1000 }, "virtual_server_id": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648, "nullable": true }, "wide_ip_id": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648, "nullable": true }, "client_subnet": { "type": "string", "maxLength": 100 }, "source_ip": { "type": "string", "description": "Source IP for packet-level filtering (optional)", "maxLength": 45 }, "dest_ip": { "type": "string", "description": "Destination IP for packet-level filtering (optional)", "maxLength": 45 }, "time_from": { "type": "string", "format": "date-time", "nullable": true }, "time_to": { "type": "string", "format": "date-time", "nullable": true }, "pcap_file": { "type": "string", "format": "binary", "nullable": true }, "pcap_filename": { "type": "string", "maxLength": 500 }, "pipeline_steps": {}, "human_verdict": { "$ref": "#/components/schemas/HumanVerdictEnum" } } }, "SiemConnectorRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 200 }, "siem_type": { "$ref": "#/components/schemas/SiemTypeEnum" }, "url": { "type": "string", "minLength": 1, "description": "Base URL, e.g. https://splunk:8089", "maxLength": 500 }, "token": { "type": "string", "writeOnly": true }, "username": { "type": "string", "maxLength": 200 }, "password": { "type": "string", "writeOnly": true }, "enabled": { "type": "boolean" }, "site": { "type": "integer", "nullable": true, "description": "Reach this SIEM through the site collector (for on-prem SIEMs)." } }, "required": [ "name", "siem_type", "url" ] }, "SubjectKindEnum": { "enum": [ "manual", "incident", "alert", "nl_query" ], "type": "string", "description": "* `manual` - Manual\n* `incident` - ServiceNow Incident\n* `alert` - Alert\n* `nl_query` - Natural Language Query" }, "AnalysisSessionRequest": { "type": "object", "properties": { "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "subject_kind": { "$ref": "#/components/schemas/SubjectKindEnum" }, "subject_ref": { "type": "string", "maxLength": 200 }, "subject_fqdn": { "type": "string", "maxLength": 500 }, "subject_symptom": { "type": "string", "maxLength": 1000 }, "virtual_server_id": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648, "nullable": true }, "wide_ip_id": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648, "nullable": true }, "client_subnet": { "type": "string", "maxLength": 100 }, "source_ip": { "type": "string", "description": "Source IP for packet-level filtering (optional)", "maxLength": 45 }, "dest_ip": { "type": "string", "description": "Destination IP for packet-level filtering (optional)", "maxLength": 45 }, "time_from": { "type": "string", "format": "date-time", "nullable": true }, "time_to": { "type": "string", "format": "date-time", "nullable": true }, "pcap_file": { "type": "string", "format": "binary", "nullable": true }, "pcap_filename": { "type": "string", "maxLength": 500 }, "pipeline_steps": {}, "human_verdict": { "$ref": "#/components/schemas/HumanVerdictEnum" } } }, "AnalysisSession": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "created_by_name": { "type": "string", "readOnly": true }, "tenant_id": { "type": "string", "format": "uuid", "nullable": true }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "updated_at": { "type": "string", "format": "date-time", "readOnly": true }, "subject_kind": { "$ref": "#/components/schemas/SubjectKindEnum" }, "subject_ref": { "type": "string", "maxLength": 200 }, "subject_fqdn": { "type": "string", "maxLength": 500 }, "subject_symptom": { "type": "string", "maxLength": 1000 }, "virtual_server_id": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648, "nullable": true }, "wide_ip_id": { "type": "integer", "maximum": 2147483647, "minimum": -2147483648, "nullable": true }, "client_subnet": { "type": "string", "maxLength": 100 }, "source_ip": { "type": "string", "description": "Source IP for packet-level filtering (optional)", "maxLength": 45 }, "dest_ip": { "type": "string", "description": "Destination IP for packet-level filtering (optional)", "maxLength": 45 }, "time_from": { "type": "string", "format": "date-time", "nullable": true }, "time_to": { "type": "string", "format": "date-time", "nullable": true }, "status": { "allOf": [ { "$ref": "#/components/schemas/AnalysisSessionStatusEnum" } ], "readOnly": true }, "status_message": { "type": "string", "readOnly": true }, "delivery_path": { "readOnly": true }, "findings": { "readOnly": true }, "hypotheses": { "readOnly": true }, "narrative": { "readOnly": true }, "pcap_file": { "type": "string", "format": "uri", "nullable": true }, "pcap_filename": { "type": "string", "maxLength": 500 }, "pipeline_steps": {}, "human_verdict": { "$ref": "#/components/schemas/HumanVerdictEnum" }, "wf_status": { "type": "string", "readOnly": true }, "wf_workflow_id": { "type": "integer", "readOnly": true, "nullable": true }, "wf_error": { "type": "string", "readOnly": true }, "source": { "allOf": [ { "$ref": "#/components/schemas/AnalysisSessionSourceEnum" } ], "readOnly": true }, "incident_priority": { "type": "integer", "readOnly": true, "nullable": true }, "incident_state": { "type": "string", "readOnly": true }, "remediation_state": { "allOf": [ { "$ref": "#/components/schemas/RemediationStateEnum" } ], "readOnly": true }, "remediation_run_id": { "type": "integer", "readOnly": true, "nullable": true }, "action_level": { "readOnly": true, "oneOf": [ { "$ref": "#/components/schemas/ActionLevelEnum" }, { "$ref": "#/components/schemas/BlankEnum" } ] }, "meta": { "readOnly": true }, "created_by": { "type": "integer", "readOnly": true, "nullable": true } }, "required": [ "action_level", "created_at", "created_by", "created_by_name", "delivery_path", "findings", "hypotheses", "id", "incident_priority", "incident_state", "meta", "narrative", "remediation_run_id", "remediation_state", "source", "status", "status_message", "updated_at", "wf_error", "wf_status", "wf_workflow_id" ] }, "PCAPTap": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "name": { "type": "string", "maxLength": 200 }, "linked_device": { "type": "integer", "nullable": true, "description": "Device inventory entry representing this tap" }, "scp_server": { "type": "integer", "nullable": true, "description": "SCP/SFTP server that receives PCAP files from this tap" }, "scp_server_name": { "type": "string", "readOnly": true }, "connected_switches": { "type": "array", "items": { "type": "integer" }, "description": "Network switches this tap is physically connected to" }, "connected_switch_names": { "type": "string", "readOnly": true }, "notes": { "type": "string" }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "updated_at": { "type": "string", "format": "date-time", "readOnly": true } }, "required": [ "connected_switch_names", "created_at", "id", "name", "scp_server_name", "updated_at" ] }, "PcapAnalysis": { "type": "object", "properties": { "id": { "type": "integer", "readOnly": true }, "title": { "type": "string", "maxLength": 300 }, "description": { "type": "string" }, "status": { "allOf": [ { "$ref": "#/components/schemas/PcapAnalysisStatusEnum" } ], "readOnly": true }, "ai_narrative": { "type": "string", "readOnly": true }, "captures": { "type": "array", "items": { "$ref": "#/components/schemas/PcapCapture" }, "readOnly": true }, "created_at": { "type": "string", "format": "date-time", "readOnly": true }, "updated_at": { "type": "string", "format": "date-time", "readOnly": true } }, "required": [ "ai_narrative", "captures", "created_at", "id", "status", "title", "updated_at" ] }, "PatchedPCAPTapRequest": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 200 }, "linked_device": { "type": "integer", "nullable": true, "description": "Device inventory entry representing this tap" }, "scp_server": { "type": "integer", "nullable": true, "description": "SCP/SFTP server that receives PCAP files from this tap" }, "connected_switches": { "type": "array", "items": { "type": "integer" }, "description": "Network switches this tap is physically connected to" }, "notes": { "type": "string" } } } } } }