For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending .md to page URLs; this page is available as Markdown.

Investigation

GET /app/api/v1/investigation

List investigations (with optional filtering, sorting, and search)

Returns a paginated list of investigations. By default, only completed investigations
(state='success') are returned. Use query parameters to filter by state, outcomes,
priorities, date ranges, and more.

{"openapi":"3.0.3","info":{"title":"Dropzone AI","version":"0.1.0"},"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"in":"header","name":"Authorization","type":"apiKey"}},"schemas":{"PaginatedInvestigationList":{"properties":{"count":{"description":"Total number of investigations","type":"integer"},"next":{"description":"URL to next page of results","format":"uri","nullable":true,"type":"string"},"previous":{"description":"URL to previous page of results","format":"uri","nullable":true,"type":"string"},"results":{"items":{"$ref":"#/components/schemas/ScriptVarSerializer_Investigation"},"type":"array"}},"required":["count","next","previous","results"],"type":"object"},"ScriptVarSerializer_Investigation":{"properties":{"alert":{"$ref":"#/components/schemas/ScriptVarSerializer_Alert"},"alert_summary":{"nullable":true,"type":"string"},"attack_surface":{"nullable":true,"type":"string"},"canceled":{"nullable":true,"oneOf":[{"$ref":"#/components/schemas/CanceledEnum"},{"$ref":"#/components/schemas/NullEnum"}]},"conclusion":{"readOnly":true,"type":"string"},"conclusion_summary":{"nullable":true,"type":"string"},"created_at":{"format":"date-time","readOnly":true,"type":"string"},"custom_outcome":{"additionalProperties":{},"nullable":true,"readOnly":true,"type":"object"},"error_msg":{"nullable":true,"type":"string"},"exec_summary":{"nullable":true,"type":"string"},"feedback":{"$ref":"#/components/schemas/ScriptVarSerializer_InvestigationFeedback"},"findings":{"additionalProperties":{},"type":"object"},"findings_ranking":{"additionalProperties":{},"type":"object"},"generated_time":{"format":"date-time","nullable":true,"type":"string"},"id":{"readOnly":true,"type":"integer"},"ignored_for_investigation_id":{"nullable":true,"readOnly":true,"type":"integer"},"insight_tags":{"additionalProperties":{},"type":"object"},"interview_proposals":{"additionalProperties":{},"type":"object"},"inv_url":{"readOnly":true,"type":"string"},"key_findings":{"additionalProperties":{},"type":"object"},"mitre_tactic":{"nullable":true,"type":"string"},"outcome":{"nullable":true,"oneOf":[{"$ref":"#/components/schemas/Outcome05cEnum"},{"$ref":"#/components/schemas/NullEnum"}]},"priority":{"nullable":true,"oneOf":[{"$ref":"#/components/schemas/PriorityEnum"},{"$ref":"#/components/schemas/NullEnum"}]},"recommended_remediations":{"additionalProperties":{},"type":"object"},"remediation_action_runs":{"items":{"$ref":"#/components/schemas/ScriptVarSerializer_RemediationActionRun"},"readOnly":true,"type":"array"},"start_time":{"format":"date-time","nullable":true,"type":"string"},"status":{"$ref":"#/components/schemas/StatusF08Enum"},"updated_at":{"format":"date-time","readOnly":true,"type":"string"}},"required":["alert","conclusion","created_at","custom_outcome","feedback","id","ignored_for_investigation_id","inv_url","remediation_action_runs","updated_at"],"type":"object"},"ScriptVarSerializer_Alert":{"properties":{"alert_type":{"type":"string"},"assets":{"additionalProperties":{},"type":"object"},"coalesce_key":{"nullable":true,"type":"string"},"create_time":{"format":"date-time","type":"string"},"created_at":{"format":"date-time","readOnly":true,"type":"string"},"direct_source_label":{"type":"string"},"entities":{"additionalProperties":{},"type":"object"},"id":{"readOnly":true,"type":"integer"},"origin_integration":{"nullable":true,"type":"string"},"origin_ticket_id":{"nullable":true,"type":"string"},"origin_ticket_id_label":{"nullable":true,"type":"string"},"origin_ticket_url":{"nullable":true,"type":"string"},"original_title":{"type":"string"},"proxy_source_label":{"nullable":true,"type":"string"},"raw_alert_content":{"type":"string"},"schema_key":{"type":"string"},"severity":{"nullable":true,"type":"string"},"start_time":{"format":"date-time","nullable":true,"type":"string"},"tenant_id":{"nullable":true,"type":"string"},"tenant_integration_key":{"nullable":true,"type":"string"},"tenant_label":{"nullable":true,"type":"string"},"tenant_union":{"$ref":"#/components/schemas/ScriptVarSerializer_TenantUnion"},"title":{"type":"string"},"updated_at":{"format":"date-time","readOnly":true,"type":"string"}},"required":["alert_type","create_time","created_at","direct_source_label","id","raw_alert_content","schema_key","tenant_union","title","updated_at"],"type":"object"},"ScriptVarSerializer_TenantUnion":{"properties":{"created_at":{"format":"date-time","readOnly":true,"type":"string"},"display_name":{"type":"string"},"id":{"readOnly":true,"type":"integer"},"lookup_dict":{"additionalProperties":{},"type":"object"},"updated_at":{"format":"date-time","readOnly":true,"type":"string"}},"required":["created_at","display_name","id","updated_at"],"type":"object"},"CanceledEnum":{"description":"* `CANCEL_MANUAL` - CANCEL_MANUAL\n* `CANCEL_THRESHOLD` - CANCEL_THRESHOLD","enum":["CANCEL_MANUAL","CANCEL_THRESHOLD"],"type":"string"},"NullEnum":{"enum":[null]},"ScriptVarSerializer_InvestigationFeedback":{"properties":{"conclusion":{"readOnly":true,"type":"string"},"conclusion_summary":{"nullable":true,"type":"string"},"created_at":{"format":"date-time","readOnly":true,"type":"string"},"findings":{"additionalProperties":{},"type":"object"},"findings_ranking":{"additionalProperties":{},"nullable":true,"type":"object"},"id":{"readOnly":true,"type":"integer"},"insight_tags":{"additionalProperties":{},"nullable":true,"type":"object"},"key_findings":{"additionalProperties":{},"nullable":true,"type":"object"},"outcome":{"nullable":true,"oneOf":[{"$ref":"#/components/schemas/Outcome05cEnum"},{"$ref":"#/components/schemas/NullEnum"}]},"outcome_note":{"nullable":true,"type":"string"},"priority":{"nullable":true,"oneOf":[{"$ref":"#/components/schemas/PriorityEnum"},{"$ref":"#/components/schemas/NullEnum"}]},"remediations_done":{"additionalProperties":{},"type":"object"},"status":{"$ref":"#/components/schemas/ScriptVarSerializerInvestigationFeedbackStatusEnum"},"updated_at":{"format":"date-time","readOnly":true,"type":"string"}},"required":["conclusion","created_at","id","updated_at"],"type":"object"},"Outcome05cEnum":{"description":"* `COMPLETED_BREACHED_CONFIRMED` - COMPLETED_BREACHED_CONFIRMED\n* `COMPLETED_BREACHED_SUSPICIOUS` - COMPLETED_BREACHED_SUSPICIOUS\n* `COMPLETED_FALSE_ALERT` - COMPLETED_FALSE_ALERT\n* `INCOMPLETE` - INCOMPLETE\n* `IGNORED` - IGNORED","enum":["COMPLETED_BREACHED_CONFIRMED","COMPLETED_BREACHED_SUSPICIOUS","COMPLETED_FALSE_ALERT","INCOMPLETE","IGNORED"],"type":"string"},"PriorityEnum":{"description":"* `informational` - Informational\n* `notable` - Notable\n* `urgent` - Urgent","enum":["informational","notable","urgent"],"type":"string"},"ScriptVarSerializerInvestigationFeedbackStatusEnum":{"description":"* `in_review` - In Review\n* `reviewed` - Reviewed","enum":["in_review","reviewed"],"type":"string"},"ScriptVarSerializer_RemediationActionRun":{"properties":{"entity":{"type":"string"},"remediation_action":{"$ref":"#/components/schemas/ScriptVarSerializer_RemediationAction"}},"required":["remediation_action"],"type":"object"},"ScriptVarSerializer_RemediationAction":{"properties":{"name":{"type":"string"}},"required":["name"],"type":"object"},"StatusF08Enum":{"description":"* `not_asked` - not_asked\n* `loading` - loading\n* `success` - success\n* `error` - error","enum":["not_asked","loading","success","error"],"type":"string"}}},"paths":{"/app/api/v1/investigation":{"get":{"description":"List investigations (with optional filtering, sorting, and search)\n\nReturns a paginated list of investigations. By default, only completed investigations\n(state='success') are returned. Use query parameters to filter by state, outcomes,\npriorities, date ranges, and more.\n","operationId":"investigation_retrieve","parameters":[{"description":"Filter by alert creation time (from). ISO 8601 format","in":"query","name":"alert_create_from","schema":{"type":"string"}},{"description":"Filter by alert creation time (until). ISO 8601 format","in":"query","name":"alert_create_until","schema":{"type":"string"}},{"description":"Filter by alert start time (from). ISO 8601 format (e.g., 2024-01-01 or 2024-01-01T00:00:00Z)","in":"query","name":"alert_start_from","schema":{"type":"string"}},{"description":"Filter by alert start time (until). ISO 8601 format","in":"query","name":"alert_start_until","schema":{"type":"string"}},{"description":"Filter by alert tenant name (can be repeated)","in":"query","name":"alert_tenants","schema":{"items":{"type":"string"},"type":"array"}},{"description":"Filter by alert type/handler key (can be repeated)","in":"query","name":"alert_types","schema":{"items":{"type":"string"},"type":"array"}},{"description":"Filter by attack surface (can be repeated)","in":"query","name":"attack_surfaces","schema":{"items":{"enum":["Cloud Infrastructure","Endpoint","Identity","Kubernetes","Network","Phishing","SaaS"],"type":"string"},"type":"array"}},{"description":"Filter by alert source label (can be repeated)","in":"query","name":"direct_source_labels","schema":{"items":{"type":"string"},"type":"array"}},{"description":"Filter by feedback last updated time (from). ISO 8601 format","in":"query","name":"feedback_updated_from","schema":{"type":"string"}},{"description":"Filter by feedback last updated time (until). ISO 8601 format","in":"query","name":"feedback_updated_until","schema":{"type":"string"}},{"description":"Filter by insight tag name (can be repeated)","in":"query","name":"insight_tag_names","schema":{"items":{"type":"string"},"type":"array"}},{"description":"Filter by interview status (can be repeated)","in":"query","name":"interview_statuses","schema":{"items":{"enum":["active","approved","canceled","declined","failed","finished","finished_with_referral","pending","timed_out"],"type":"string"},"type":"array"}},{"description":"Filter by investigation completion time (from). ISO 8601 format","in":"query","name":"inv_complete_from","schema":{"type":"string"}},{"description":"Filter by investigation completion time (until). ISO 8601 format","in":"query","name":"inv_complete_until","schema":{"type":"string"}},{"description":"Filter by investigation state. Valid values: not_asked (queued), loading (running), success (complete), error (stopped). Defaults to 'success'.","in":"query","name":"investigation_state","schema":{"enum":["error","loading","not_asked","success"],"type":"string"}},{"description":"Number of results per page","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Filter by MITRE ATT&CK tactic (can be repeated)","in":"query","name":"mitre_tactics","schema":{"items":{"enum":["Collection","Command and Control","Credential Access","Defense Evasion","Discovery","Execution","Exfiltration","Impact","Initial Access","Lateral Movement","Persistence","Privilege Escalation"],"type":"string"},"type":"array"}},{"description":"Number of results to skip","in":"query","name":"offset","schema":{"type":"integer"}},{"description":"Filter by investigation outcome/conclusion (can be repeated)","in":"query","name":"outcomes","schema":{"items":{"enum":["COMPLETED_BREACHED_CONFIRMED","COMPLETED_BREACHED_SUSPICIOUS","COMPLETED_FALSE_ALERT","IGNORED","INCOMPLETE"],"type":"string"},"type":"array"}},{"description":"Filter by investigation priority (can be repeated)","in":"query","name":"priorities","schema":{"items":{"enum":["informational","notable","urgent"],"type":"string"},"type":"array"}},{"description":"Filter by priority status (can be repeated)","in":"query","name":"priority_statuses","schema":{"items":{"type":"string"},"type":"array"}},{"description":"Free-text search across investigation fields","in":"query","name":"search","schema":{"type":"string"}},{"description":"Sort direction. Defaults to 'desc'.","in":"query","name":"sort_dir","schema":{"enum":["asc","desc"],"type":"string"}},{"description":"Sort field. Defaults to 'alert_create'.","in":"query","name":"sort_type","schema":{"enum":["activity","alert_create","alert_source","alert_title","alert_type","feedback_status","investigation_create","outcome","priority_status","stopped_reason"],"type":"string"}},{"description":"Filter by stopped reason for error/canceled investigations (can be repeated)","in":"query","name":"stopped_reasons","schema":{"items":{"type":"string"},"type":"array"}},{"description":"Filter by tenant ID","in":"query","name":"tenant_id","schema":{"type":"string"}},{"description":"Filter by tenant integration key","in":"query","name":"tenant_integration_key","schema":{"type":"string"}},{"description":"Filter by user feedback status (can be repeated)","in":"query","name":"user_statuses","schema":{"items":{"enum":["in_review","reviewed"],"type":"string"},"type":"array"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedInvestigationList"}}},"description":"<strong>Paginated list of investigations</strong>\n<br><br>\nReturns a paginated list of investigations. By default, only completed investigations\n(state='success') are returned. Use query parameters to filter by state, outcomes,\npriorities, date ranges, and more.\n<br><br>\nUse <code>next</code> and <code>previous</code>\nURLs in the response for easy page navigation.\n<br><br>\n"},"400":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"Bad request - invalid input"},"401":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"properties":{"detail":{"type":"string"}},"type":"object"}}},"description":"Access denied"},"500":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"System error"},"503":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"System not ready for requests"}},"tags":["investigation"]}}}}