# API Documentation for Custom Strategies

## get/app/api/v1/custom-strategies
List all custom strategies. Use `is_protected` filter to distinguish between user-created and OOTB strategies.

### Authorizations
- ApiKeyAuth

### Query Parameters
- `alert_sources` string[] (Optional): Filter by alert sources
- `attack_surfaces` string[] (Optional): Filter by attack surfaces
- `is_archived` boolean (Optional): Filter by archived status
- `is_enabled` boolean (Optional): Filter by enabled status
- `is_protected` boolean (Optional): Filter by protected status (true=OOTB, false=user-created)
- `mitre_tactics` string[] (Optional): Filter by MITRE tactics
- `search_query` string (Optional): Search in strategy title and scenario

### Responses
- **200**: List of custom strategies

```json
{
  "alert_sources": [],
  "attack_surfaces": [],
  "created_at": "2026-07-27T03:06:07.976Z",
  "id": 1,
  "instructions": [{
    "content": "text",
    "created_at": "2026-07-27T03:06:07.976Z",
    "id": 1,
    "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
    "strategy_versions": [1],
    "usage_count": 1
  }],
  "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
  "is_archived": true,
  "is_enabled": true,
  "is_latest": true,
  "is_protected": true,
  "mitre_tactics": [],
  "outcomes": [{
    "conclusions_affected": 1,
    "condition": {"ANY_ADDITIONAL_PROPERTY": "anything"},
    "created_at": "2026-07-27T03:06:07.976Z",
    "id": 1,
    "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
    "outcome": "COMPLETED_BREACHED_CONFIRMED",
    "strategy_versions": [1]
  }],
  "priorities": [{
    "created_at": "2026-07-27T03:06:07.976Z",
    "id": 1,
    "insight_tag_rule": {"ANY_ADDITIONAL_PROPERTY": "anything"},
    "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
    "outcomes": ["COMPLETED_BREACHED_CONFIRMED"],
    "priorities_affected": 1,
    "priority": "informational",
    "ranking": 1,
    "strategy_versions": [1]
  }],
  "scenario": "text",
  "title": "text",
  "total_conclusions_affected": 1,
  "total_instructions_used": 1,
  "total_priorities_affected": 1,
  "updated_at": "2026-07-27T03:06:07.976Z",
  "version_id": 1
}
```

## post/app/api/v1/custom-strategies
Create a new custom strategy.

### Authorizations
- ApiKeyAuth

### Body
```json
{
  "alert_sources": [],
  "attack_surfaces": [],
  "instructions": [{}],
  "is_enabled": false,
  "mitre_tactics": [],
  "outcomes": [{}],
  "priorities": [{}],
  "scenario": "text",
  "title": "text"
}
```

### Responses
- **201**: Custom strategy created successfully

## get/app/api/v1/custom-strategies/{strategy_id}
Get a specific custom strategy by ID. Includes both user-created and OOTB (protected) strategies.

### Authorizations
- ApiKeyAuth

### Responses
- **200**: Custom strategy details

## put/app/api/v1/custom-strategies/{strategy_id}
Update a custom strategy (full replacement - creates new version).

### Authorizations
- ApiKeyAuth

### Body
```json
{
  "alert_sources": [],
  "attack_surfaces": [],
  "instructions": [{}],
  "is_enabled": true,
  "mitre_tactics": [],
  "outcomes": [{}],
  "priorities": [{}],
  "scenario": "text",
  "title": "text"
}
```

### Responses
- **200**: Strategy updated successfully

## delete/app/api/v1/custom-strategies/{strategy_id}
Delete or archive a custom strategy (archives if referenced by investigations).

### Authorizations
- ApiKeyAuth

### Responses
- **204**: Strategy deleted or archived successfully