openapi: 3.0.3
info:
 title: Dropzone AI
 version: 0.1.0
 description: AI SOC Analyst
paths:
 /app/api/v1/chat/:
 post:
 operationId: chat\_create
 description: \|
 Send a chat query and receive an AI response.

This endpoint creates a new chat session if no `session_id` is provided,
 or reuses an existing session to maintain conversation context.

**Usage:**

POST to this endpoint with your question

Receive `session_id`, `message_id`, and `message_url` in response

Poll the `message_url` or `GET /app/api/v1/chat/{session_id}/message/{message_id}` for results

(Optional) Include `session_id` query param in subsequent queries to maintain context

parameters:
 \- in: query
 name: session\_id
 schema:
 type: string
 description: 'Optional: UUID of existing chat session to maintain conversation
 context'
 tags:
 \- chat
 requestBody:
 content:
 application/json:
 schema:
 type: object
 properties:
 text:
 type: string
 description: Your question or chat message
 files:
 type: array
 items:
 type: object
 properties:
 name:
 type: string
 description: File name (e.g., 'document.pdf')
 content:
 type: string
 description: Base64-encoded file content
 required:
 \- name
 \- content
 description: 'Optional: Files to include with your query. Each file
 must have ''name'' and ''content'' (base64-encoded) fields.'
 required:
 \- text
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '201':
 content:
 application/json:
 schema:
 type: object
 properties:
 session\_id:
 type: string
 format: uuid
 message\_id:
 type: integer
 message\_url:
 type: string
 description: Chat query created successfully. Use the message\_url to poll
 for results.
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/chat/{session\_id}/message/{message\_id}:
 get:
 operationId: chat\_message\_retrieve
 description: \|
 Get the status and result of a chat message.

Poll this endpoint after sending a query to check for completion.

**Response fields:**

`response_text` \- AI response (null while processing)

`response_citations` \- Supporting evidence/citations (null while processing)

`progress_messages` \- Chronological list of processing status updates
 (use the last entry for the current status while processing)

When both `response_text` and `response_citations` are populated, the query is complete.
 parameters:
 \- in: path
 name: message\_id
 schema:
 type: integer
 description: The message ID returned from POST /app/api/v1/chat/
 required: true
 \- in: path
 name: session\_id
 schema:
 type: string
 description: The chat session ID (UUID)
 required: true
 tags:
 \- chat
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/ChatQueryNested'
 description: Chat message details with status and response (if complete)
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 /app/api/v1/config/investigation-threshold:
 get:
 operationId: investigation\_threshold\_retrieve\_external
 description: Get investigation threshold configuration. The threshold controls
 the maximum number of investigations allowed within a time window, with optional
 per-alert-source limits.
 tags:
 \- config
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/InvestigationThreshold'
 description: Investigation threshold configuration
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 patch:
 operationId: investigation\_threshold\_update\_external
 description: 'Update investigation threshold configuration. Supports partial
 updates. Fields: is\_enabled (bool), max\_invs (positive int), time\_unit (hour\|day\|week\|month),
 max\_by\_alert\_source (object mapping alert source labels to max counts).'
 tags:
 \- config
 requestBody:
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/PatchedInvestigationThreshold'
 application/x-www-form-urlencoded:
 schema:
 $ref: '#/components/schemas/PatchedInvestigationThreshold'
 multipart/form-data:
 schema:
 $ref: '#/components/schemas/PatchedInvestigationThreshold'
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/InvestigationThreshold'
 description: Updated investigation threshold configuration
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/config/investigation-threshold/status:
 get:
 operationId: config\_investigation\_threshold\_status\_retrieve
 description: Get investigation threshold status including current progress toward
 limits and counts of exceeded/queued investigations. Returns real-time usage
 data for the current time window.
 tags:
 \- config
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 type: object
 properties:
 progress:
 type: object
 nullable: true
 description: Current progress toward threshold limits. null when
 threshold is disabled (is\_enabled=false).
 properties:
 time\_unit:
 type: string
 enum:
 \- hour
 \- day
 \- week
 \- month
 max\_invs:
 type: integer
 minimum: 0
 curr\_invs:
 type: integer
 minimum: 0
 by\_alert\_source:
 type: object
 description: 'Per-source progress. Valid keys: \[''Check Point'',\
 ''Check Point Harmony Email & Collaboration'', ''Gem'',\
 ''Panther'', ''CrowdStrike''\]...'
 additionalProperties:
 type: object
 properties:
 max\_invs:
 type: integer
 minimum: 0
 curr\_invs:
 type: integer
 minimum: 0
 example:
 CrowdStrike:
 max\_invs: 50
 curr\_invs: 12
 now:
 type: string
 format: date-time
 start:
 type: string
 format: date-time
 end:
 type: string
 format: date-time
 example:
 time\_unit: day
 max\_invs: 100
 curr\_invs: 42
 by\_alert\_source:
 CrowdStrike:
 max\_invs: 50
 curr\_invs: 12
 now: '2026-01-08T12:00:00Z'
 start: '2026-01-08T00:00:00Z'
 end: '2026-01-09T00:00:00Z'
 exceeded:
 type: integer
 minimum: 0
 queued:
 type: integer
 minimum: 0
 example:
 progress:
 time\_unit: day
 max\_invs: 100
 curr\_invs: 42
 by\_alert\_source: {}
 now: '2026-01-08T12:00:00Z'
 start: '2026-01-08T00:00:00Z'
 end: '2026-01-09T00:00:00Z'
 exceeded: 3
 queued: 5
 description: Threshold status with progress and counts
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/config/system:
 get:
 operationId: system\_config\_retrieve\_external
 description: 'Get all system configuration data. Returns current config values.
 Sections: org\_info, dashboard\_defaults, response\_benchmarks, time\_saved, chatops,
 advanced\_settings'
 tags:
 \- config
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 type: object
 properties:
 org\_info:
 type: object
 title: Organization Info
 properties:
 company\_name:
 title: Organization Display Name
 description: The name shown to users across the platform interface.
 This is for visual branding only.
 type: string
 company\_name\_ai:
 title: Official Company Name
 description: Your registered organization name. Our AI uses
 this during security investigations to identify your assets
 and differentiate internal networks from external entities.
 type: string
 dashboard\_defaults:
 type: object
 title: Dashboard Defaults
 properties:
 time\_range:
 title: Time Range
 type: string
 oneOf:
 \- const: last24hours
 title: Last 24 hours
 \- const: last3days
 title: Last 3 days
 \- const: last7days
 title: Last 7 days
 \- const: last30days
 title: Last 30 days
 \- const: last6months
 title: Last 6 months
 \- const: last1year
 title: Last 1 year
 default: last30days
 response\_benchmarks:
 type: object
 title: Response Metric Benchmarks
 description: These allow you to set performance targets reflecting
 a human analyst's best effort—such as acknowledging alerts within
 1 hour. This enables you to directly compare our AI SOC analyst
 platform's speed with typical human response times for detection,
 acknowledgment, investigation, and conclusion.
 properties:
 target1\_ttd:
 title: Industry Average TTD (minutes)
 type: number
 default: 10
 target2\_tta:
 title: Industry Average TTA (minutes)
 type: number
 default: 60
 target3\_tti:
 title: Industry Average TTI (minutes)
 type: number
 default: 30
 target4\_ttc:
 title: Industry Average TTC (minutes)
 type: number
 default: 120
 time\_saved:
 type: object
 title: Value Metric Benchmarks
 description: These are used as baselines in calculating dashboard
 value metrics.
 properties:
 avg\_min\_per\_inv:
 title: Average minutes spent per manual investigation in your
 environment
 type: number
 default: 25
 avg\_hours\_per\_week:
 title: Average hours worked per week for one FTE analyst
 type: number
 default: 40
 avg\_cost\_per\_hour:
 title: Average cost per hour for one FTE analyst
 type: number
 default: 60
 chatops:
 type: object
 title: ChatOps Configuration
 description: Configure Slack app secrets for ChatOps commands
 and notifications.
 properties:
 slack\_signing\_secret:
 title: Slack Signing Secret
 description: The signing secret from your Slack app, used
 to verify requests from Slack.
 type: string
 format: password
 slack\_token:
 title: Slack Bot Token
 description: The bot token from your Slack app, used for making
 API calls to Slack (e.g., xoxb-...).
 type: string
 format: password
 phishing\_simulation\_config:
 type: object
 title: Phishing Simulation Configuration
 description: Settings for identifying and ignoring phishing simulation
 emails.
 properties:
 phishing\_simulation\_domains:
 title: Phishing Simulation Domains
 description: Emails whose From-header domain or any body URL
 domain matches (or is a subdomain of) one of these will
 be marked IGNORED without investigation.
 type: array
 items:
 type: string
 uniqueItems: true
 default: \[\]
 phishing\_simulation\_headers:
 title: Phishing Simulation Headers
 description: Emails containing any of these header names will
 be marked IGNORED without investigation as phishing simulations.
 Header names are matched case-insensitively.
 type: array
 items:
 type: string
 uniqueItems: true
 default: \[\]
 advanced\_settings:
 type: object
 title: Advanced Settings
 properties:
 enable\_connector:
 title: Enable Integration Connector
 type: boolean
 default: false
 description: Enable for connecting to integrations behind
 VPNs or firewalls.
 enable\_tenant\_union:
 title: Enable Multi-Tenant Map
 type: boolean
 default: false
 description: Enable for vendor and/or dz-managed multi-tenant
 integrations.
 use\_generated\_alert\_titles:
 title: Display Generated Alert Titles
 type: boolean
 default: true
 description: Enable to display Dropzone-generated alert titles,
 otherwise display titles extracted from raw alert data.
 enable\_reinvestigate\_btn:
 title: Enable reinvestigation button
 type: boolean
 default: false
 description: Allow users to re-run investigations for same
 alert (counts against investigation quota)
 advanced\_alert\_deduplication\_settings:
 title: Advanced Alert Deduplication Settings
 type: object
 properties:
 enable\_title\_entity\_deduplication:
 title: Enable Title and Entity Deduplication
 type: boolean
 default: false
 description: Enable to deduplicate alerts with identical
 title and entity values within an 8 hour window.
 allOf:
 \- if:
 properties:
 enable\_title\_entity\_deduplication:
 const: true
 then:
 properties:
 title\_entity\_deduplication\_settings:
 title: Title and Entity Deduplication Settings
 type: object
 properties:
 title\_entity\_deduplication\_minimum\_entity\_count:
 title: Minimum Entity Count
 description: If an alert has fewer than this many
 entities, it will not be considered for deduplication.
 type: number
 default: 3
 minimum: 2
 ui:order:
 \- org\_info
 \- dashboard\_defaults
 \- response\_benchmarks
 \- time\_saved
 \- chatops
 \- phishing\_simulation\_config
 \- advanced\_settings
 description: System configuration data
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 put:
 operationId: system\_config\_replace\_external
 description: Replace all system configuration data. Validates against JSON schema.
 Must include all sections.
 tags:
 \- config
 requestBody:
 content:
 application/json:
 schema:
 type: object
 properties:
 org\_info:
 type: object
 title: Organization Info
 properties:
 company\_name:
 title: Organization Display Name
 description: The name shown to users across the platform interface.
 This is for visual branding only.
 type: string
 company\_name\_ai:
 title: Official Company Name
 description: Your registered organization name. Our AI uses
 this during security investigations to identify your assets
 and differentiate internal networks from external entities.
 type: string
 dashboard\_defaults:
 type: object
 title: Dashboard Defaults
 properties:
 time\_range:
 title: Time Range
 type: string
 oneOf:
 \- const: last24hours
 title: Last 24 hours
 \- const: last3days
 title: Last 3 days
 \- const: last7days
 title: Last 7 days
 \- const: last30days
 title: Last 30 days
 \- const: last6months
 title: Last 6 months
 \- const: last1year
 title: Last 1 year
 default: last30days
 response\_benchmarks:
 type: object
 title: Response Metric Benchmarks
 description: These allow you to set performance targets reflecting
 a human analyst's best effort—such as acknowledging alerts within
 1 hour. This enables you to directly compare our AI SOC analyst
 platform's speed with typical human response times for detection,
 acknowledgment, investigation, and conclusion.
 properties:
 target1\_ttd:
 title: Industry Average TTD (minutes)
 type: number
 default: 10
 target2\_tta:
 title: Industry Average TTA (minutes)
 type: number
 default: 60
 target3\_tti:
 title: Industry Average TTI (minutes)
 type: number
 default: 30
 target4\_ttc:
 title: Industry Average TTC (minutes)
 type: number
 default: 120
 time\_saved:
 type: object
 title: Value Metric Benchmarks
 description: These are used as baselines in calculating dashboard
 value metrics.
 properties:
 avg\_min\_per\_inv:
 title: Average minutes spent per manual investigation in your
 environment
 type: number
 default: 25
 avg\_hours\_per\_week:
 title: Average hours worked per week for one FTE analyst
 type: number
 default: 40
 avg\_cost\_per\_hour:
 title: Average cost per hour for one FTE analyst
 type: number
 default: 60
 chatops:
 type: object
 title: ChatOps Configuration
 description: Configure Slack app secrets for ChatOps commands and
 notifications.
 properties:
 slack\_signing\_secret:
 title: Slack Signing Secret
 description: The signing secret from your Slack app, used to
 verify requests from Slack.
 type: string
 format: password
 slack\_token:
 title: Slack Bot Token
 description: The bot token from your Slack app, used for making
 API calls to Slack (e.g., xoxb-...).
 type: string
 format: password
 phishing\_simulation\_config:
 type: object
 title: Phishing Simulation Configuration
 description: Settings for identifying and ignoring phishing simulation
 emails.
 properties:
 phishing\_simulation\_domains:
 title: Phishing Simulation Domains
 description: Emails whose From-header domain or any body URL
 domain matches (or is a subdomain of) one of these will be
 marked IGNORED without investigation.
 type: array
 items:
 type: string
 uniqueItems: true
 default: \[\]
 phishing\_simulation\_headers:
 title: Phishing Simulation Headers
 description: Emails containing any of these header names will
 be marked IGNORED without investigation as phishing simulations.
 Header names are matched case-insensitively.
 type: array
 items:
 type: string
 uniqueItems: true
 default: \[\]
 advanced\_settings:
 type: object
 title: Advanced Settings
 properties:
 enable\_connector:
 title: Enable Integration Connector
 type: boolean
 default: false
 description: Enable for connecting to integrations behind VPNs
 or firewalls.
 enable\_tenant\_union:
 title: Enable Multi-Tenant Map
 type: boolean
 default: false
 description: Enable for vendor and/or dz-managed multi-tenant
 integrations.
 use\_generated\_alert\_titles:
 title: Display Generated Alert Titles
 type: boolean
 default: true
 description: Enable to display Dropzone-generated alert titles,
 otherwise display titles extracted from raw alert data.
 enable\_reinvestigate\_btn:
 title: Enable reinvestigation button
 type: boolean
 default: false
 description: Allow users to re-run investigations for same alert
 (counts against investigation quota)
 advanced\_alert\_deduplication\_settings:
 title: Advanced Alert Deduplication Settings
 type: object
 properties:
 enable\_title\_entity\_deduplication:
 title: Enable Title and Entity Deduplication
 type: boolean
 default: false
 description: Enable to deduplicate alerts with identical
 title and entity values within an 8 hour window.
 allOf:
 \- if:
 properties:
 enable\_title\_entity\_deduplication:
 const: true
 then:
 properties:
 title\_entity\_deduplication\_settings:
 title: Title and Entity Deduplication Settings
 type: object
 properties:
 title\_entity\_deduplication\_minimum\_entity\_count:
 title: Minimum Entity Count
 description: If an alert has fewer than this many
 entities, it will not be considered for deduplication.
 type: number
 default: 3
 minimum: 2
 ui:order:
 \- org\_info
 \- dashboard\_defaults
 \- response\_benchmarks
 \- time\_saved
 \- chatops
 \- phishing\_simulation\_config
 \- advanced\_settings
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 type: object
 properties:
 org\_info:
 type: object
 title: Organization Info
 properties:
 company\_name:
 title: Organization Display Name
 description: The name shown to users across the platform interface.
 This is for visual branding only.
 type: string
 company\_name\_ai:
 title: Official Company Name
 description: Your registered organization name. Our AI uses
 this during security investigations to identify your assets
 and differentiate internal networks from external entities.
 type: string
 dashboard\_defaults:
 type: object
 title: Dashboard Defaults
 properties:
 time\_range:
 title: Time Range
 type: string
 oneOf:
 \- const: last24hours
 title: Last 24 hours
 \- const: last3days
 title: Last 3 days
 \- const: last7days
 title: Last 7 days
 \- const: last30days
 title: Last 30 days
 \- const: last6months
 title: Last 6 months
 \- const: last1year
 title: Last 1 year
 default: last30days
 response\_benchmarks:
 type: object
 title: Response Metric Benchmarks
 description: These allow you to set performance targets reflecting
 a human analyst's best effort—such as acknowledging alerts within
 1 hour. This enables you to directly compare our AI SOC analyst
 platform's speed with typical human response times for detection,
 acknowledgment, investigation, and conclusion.
 properties:
 target1\_ttd:
 title: Industry Average TTD (minutes)
 type: number
 default: 10
 target2\_tta:
 title: Industry Average TTA (minutes)
 type: number
 default: 60
 target3\_tti:
 title: Industry Average TTI (minutes)
 type: number
 default: 30
 target4\_ttc:
 title: Industry Average TTC (minutes)
 type: number
 default: 120
 time\_saved:
 type: object
 title: Value Metric Benchmarks
 description: These are used as baselines in calculating dashboard
 value metrics.
 properties:
 avg\_min\_per\_inv:
 title: Average minutes spent per manual investigation in your
 environment
 type: number
 default: 25
 avg\_hours\_per\_week:
 title: Average hours worked per week for one FTE analyst
 type: number
 default: 40
 avg\_cost\_per\_hour:
 title: Average cost per hour for one FTE analyst
 type: number
 default: 60
 chatops:
 type: object
 title: ChatOps Configuration
 description: Configure Slack app secrets for ChatOps commands
 and notifications.
 properties:
 slack\_signing\_secret:
 title: Slack Signing Secret
 description: The signing secret from your Slack app, used
 to verify requests from Slack.
 type: string
 format: password
 slack\_token:
 title: Slack Bot Token
 description: The bot token from your Slack app, used for making
 API calls to Slack (e.g., xoxb-...).
 type: string
 format: password
 phishing\_simulation\_config:
 type: object
 title: Phishing Simulation Configuration
 description: Settings for identifying and ignoring phishing simulation
 emails.
 properties:
 phishing\_simulation\_domains:
 title: Phishing Simulation Domains
 description: Emails whose From-header domain or any body URL
 domain matches (or is a subdomain of) one of these will
 be marked IGNORED without investigation.
 type: array
 items:
 type: string
 uniqueItems: true
 default: \[\]
 phishing\_simulation\_headers:
 title: Phishing Simulation Headers
 description: Emails containing any of these header names will
 be marked IGNORED without investigation as phishing simulations.
 Header names are matched case-insensitively.
 type: array
 items:
 type: string
 uniqueItems: true
 default: \[\]
 advanced\_settings:
 type: object
 title: Advanced Settings
 properties:
 enable\_connector:
 title: Enable Integration Connector
 type: boolean
 default: false
 description: Enable for connecting to integrations behind
 VPNs or firewalls.
 enable\_tenant\_union:
 title: Enable Multi-Tenant Map
 type: boolean
 default: false
 description: Enable for vendor and/or dz-managed multi-tenant
 integrations.
 use\_generated\_alert\_titles:
 title: Display Generated Alert Titles
 type: boolean
 default: true
 description: Enable to display Dropzone-generated alert titles,
 otherwise display titles extracted from raw alert data.
 enable\_reinvestigate\_btn:
 title: Enable reinvestigation button
 type: boolean
 default: false
 description: Allow users to re-run investigations for same
 alert (counts against investigation quota)
 advanced\_alert\_deduplication\_settings:
 title: Advanced Alert Deduplication Settings
 type: object
 properties:
 enable\_title\_entity\_deduplication:
 title: Enable Title and Entity Deduplication
 type: boolean
 default: false
 description: Enable to deduplicate alerts with identical
 title and entity values within an 8 hour window.
 allOf:
 \- if:
 properties:
 enable\_title\_entity\_deduplication:
 const: true
 then:
 properties:
 title\_entity\_deduplication\_settings:
 title: Title and Entity Deduplication Settings
 type: object
 properties:
 title\_entity\_deduplication\_minimum\_entity\_count:
 title: Minimum Entity Count
 description: If an alert has fewer than this many
 entities, it will not be considered for deduplication.
 type: number
 default: 3
 minimum: 2
 ui:order:
 \- org\_info
 \- dashboard\_defaults
 \- response\_benchmarks
 \- time\_saved
 \- chatops
 \- phishing\_simulation\_config
 \- advanced\_settings
 description: Updated system configuration
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 patch:
 operationId: system\_config\_update\_external
 description: 'Partially update system configuration (deep merge with existing).
 Send any subset of config. Example: {"advanced\_settings": {"enable\_connector":
 true}}'
 tags:
 \- config
 requestBody:
 content:
 application/json:
 schema:
 type: object
 properties:
 org\_info:
 type: object
 title: Organization Info
 properties:
 company\_name:
 title: Organization Display Name
 description: The name shown to users across the platform interface.
 This is for visual branding only.
 type: string
 company\_name\_ai:
 title: Official Company Name
 description: Your registered organization name. Our AI uses
 this during security investigations to identify your assets
 and differentiate internal networks from external entities.
 type: string
 dashboard\_defaults:
 type: object
 title: Dashboard Defaults
 properties:
 time\_range:
 title: Time Range
 type: string
 oneOf:
 \- const: last24hours
 title: Last 24 hours
 \- const: last3days
 title: Last 3 days
 \- const: last7days
 title: Last 7 days
 \- const: last30days
 title: Last 30 days
 \- const: last6months
 title: Last 6 months
 \- const: last1year
 title: Last 1 year
 default: last30days
 response\_benchmarks:
 type: object
 title: Response Metric Benchmarks
 description: These allow you to set performance targets reflecting
 a human analyst's best effort—such as acknowledging alerts within
 1 hour. This enables you to directly compare our AI SOC analyst
 platform's speed with typical human response times for detection,
 acknowledgment, investigation, and conclusion.
 properties:
 target1\_ttd:
 title: Industry Average TTD (minutes)
 type: number
 default: 10
 target2\_tta:
 title: Industry Average TTA (minutes)
 type: number
 default: 60
 target3\_tti:
 title: Industry Average TTI (minutes)
 type: number
 default: 30
 target4\_ttc:
 title: Industry Average TTC (minutes)
 type: number
 default: 120
 time\_saved:
 type: object
 title: Value Metric Benchmarks
 description: These are used as baselines in calculating dashboard
 value metrics.
 properties:
 avg\_min\_per\_inv:
 title: Average minutes spent per manual investigation in your
 environment
 type: number
 default: 25
 avg\_hours\_per\_week:
 title: Average hours worked per week for one FTE analyst
 type: number
 default: 40
 avg\_cost\_per\_hour:
 title: Average cost per hour for one FTE analyst
 type: number
 default: 60
 chatops:
 type: object
 title: ChatOps Configuration
 description: Configure Slack app secrets for ChatOps commands and
 notifications.
 properties:
 slack\_signing\_secret:
 title: Slack Signing Secret
 description: The signing secret from your Slack app, used to
 verify requests from Slack.
 type: string
 format: password
 slack\_token:
 title: Slack Bot Token
 description: The bot token from your Slack app, used for making
 API calls to Slack (e.g., xoxb-...).
 type: string
 format: password
 phishing\_simulation\_config:
 type: object
 title: Phishing Simulation Configuration
 description: Settings for identifying and ignoring phishing simulation
 emails.
 properties:
 phishing\_simulation\_domains:
 title: Phishing Simulation Domains
 description: Emails whose From-header domain or any body URL
 domain matches (or is a subdomain of) one of these will be
 marked IGNORED without investigation.
 type: array
 items:
 type: string
 uniqueItems: true
 default: \[\]
 phishing\_simulation\_headers:
 title: Phishing Simulation Headers
 description: Emails containing any of these header names will
 be marked IGNORED without investigation as phishing simulations.
 Header names are matched case-insensitively.
 type: array
 items:
 type: string
 uniqueItems: true
 default: \[\]
 advanced\_settings:
 type: object
 title: Advanced Settings
 properties:
 enable\_connector:
 title: Enable Integration Connector
 type: boolean
 default: false
 description: Enable for connecting to integrations behind VPNs
 or firewalls.
 enable\_tenant\_union:
 title: Enable Multi-Tenant Map
 type: boolean
 default: false
 description: Enable for vendor and/or dz-managed multi-tenant
 integrations.
 use\_generated\_alert\_titles:
 title: Display Generated Alert Titles
 type: boolean
 default: true
 description: Enable to display Dropzone-generated alert titles,
 otherwise display titles extracted from raw alert data.
 enable\_reinvestigate\_btn:
 title: Enable reinvestigation button
 type: boolean
 default: false
 description: Allow users to re-run investigations for same alert
 (counts against investigation quota)
 advanced\_alert\_deduplication\_settings:
 title: Advanced Alert Deduplication Settings
 type: object
 properties:
 enable\_title\_entity\_deduplication:
 title: Enable Title and Entity Deduplication
 type: boolean
 default: false
 description: Enable to deduplicate alerts with identical
 title and entity values within an 8 hour window.
 allOf:
 \- if:
 properties:
 enable\_title\_entity\_deduplication:
 const: true
 then:
 properties:
 title\_entity\_deduplication\_settings:
 title: Title and Entity Deduplication Settings
 type: object
 properties:
 title\_entity\_deduplication\_minimum\_entity\_count:
 title: Minimum Entity Count
 description: If an alert has fewer than this many
 entities, it will not be considered for deduplication.
 type: number
 default: 3
 minimum: 2
 ui:order:
 \- org\_info
 \- dashboard\_defaults
 \- response\_benchmarks
 \- time\_saved
 \- chatops
 \- phishing\_simulation\_config
 \- advanced\_settings
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 type: object
 properties:
 org\_info:
 type: object
 title: Organization Info
 properties:
 company\_name:
 title: Organization Display Name
 description: The name shown to users across the platform interface.
 This is for visual branding only.
 type: string
 company\_name\_ai:
 title: Official Company Name
 description: Your registered organization name. Our AI uses
 this during security investigations to identify your assets
 and differentiate internal networks from external entities.
 type: string
 dashboard\_defaults:
 type: object
 title: Dashboard Defaults
 properties:
 time\_range:
 title: Time Range
 type: string
 oneOf:
 \- const: last24hours
 title: Last 24 hours
 \- const: last3days
 title: Last 3 days
 \- const: last7days
 title: Last 7 days
 \- const: last30days
 title: Last 30 days
 \- const: last6months
 title: Last 6 months
 \- const: last1year
 title: Last 1 year
 default: last30days
 response\_benchmarks:
 type: object
 title: Response Metric Benchmarks
 description: These allow you to set performance targets reflecting
 a human analyst's best effort—such as acknowledging alerts within
 1 hour. This enables you to directly compare our AI SOC analyst
 platform's speed with typical human response times for detection,
 acknowledgment, investigation, and conclusion.
 properties:
 target1\_ttd:
 title: Industry Average TTD (minutes)
 type: number
 default: 10
 target2\_tta:
 title: Industry Average TTA (minutes)
 type: number
 default: 60
 target3\_tti:
 title: Industry Average TTI (minutes)
 type: number
 default: 30
 target4\_ttc:
 title: Industry Average TTC (minutes)
 type: number
 default: 120
 time\_saved:
 type: object
 title: Value Metric Benchmarks
 description: These are used as baselines in calculating dashboard
 value metrics.
 properties:
 avg\_min\_per\_inv:
 title: Average minutes spent per manual investigation in your
 environment
 type: number
 default: 25
 avg\_hours\_per\_week:
 title: Average hours worked per week for one FTE analyst
 type: number
 default: 40
 avg\_cost\_per\_hour:
 title: Average cost per hour for one FTE analyst
 type: number
 default: 60
 chatops:
 type: object
 title: ChatOps Configuration
 description: Configure Slack app secrets for ChatOps commands
 and notifications.
 properties:
 slack\_signing\_secret:
 title: Slack Signing Secret
 description: The signing secret from your Slack app, used
 to verify requests from Slack.
 type: string
 format: password
 slack\_token:
 title: Slack Bot Token
 description: The bot token from your Slack app, used for making
 API calls to Slack (e.g., xoxb-...).
 type: string
 format: password
 phishing\_simulation\_config:
 type: object
 title: Phishing Simulation Configuration
 description: Settings for identifying and ignoring phishing simulation
 emails.
 properties:
 phishing\_simulation\_domains:
 title: Phishing Simulation Domains
 description: Emails whose From-header domain or any body URL
 domain matches (or is a subdomain of) one of these will
 be marked IGNORED without investigation.
 type: array
 items:
 type: string
 uniqueItems: true
 default: \[\]
 phishing\_simulation\_headers:
 title: Phishing Simulation Headers
 description: Emails containing any of these header names will
 be marked IGNORED without investigation as phishing simulations.
 Header names are matched case-insensitively.
 type: array
 items:
 type: string
 uniqueItems: true
 default: \[\]
 advanced\_settings:
 type: object
 title: Advanced Settings
 properties:
 enable\_connector:
 title: Enable Integration Connector
 type: boolean
 default: false
 description: Enable for connecting to integrations behind
 VPNs or firewalls.
 enable\_tenant\_union:
 title: Enable Multi-Tenant Map
 type: boolean
 default: false
 description: Enable for vendor and/or dz-managed multi-tenant
 integrations.
 use\_generated\_alert\_titles:
 title: Display Generated Alert Titles
 type: boolean
 default: true
 description: Enable to display Dropzone-generated alert titles,
 otherwise display titles extracted from raw alert data.
 enable\_reinvestigate\_btn:
 title: Enable reinvestigation button
 type: boolean
 default: false
 description: Allow users to re-run investigations for same
 alert (counts against investigation quota)
 advanced\_alert\_deduplication\_settings:
 title: Advanced Alert Deduplication Settings
 type: object
 properties:
 enable\_title\_entity\_deduplication:
 title: Enable Title and Entity Deduplication
 type: boolean
 default: false
 description: Enable to deduplicate alerts with identical
 title and entity values within an 8 hour window.
 allOf:
 \- if:
 properties:
 enable\_title\_entity\_deduplication:
 const: true
 then:
 properties:
 title\_entity\_deduplication\_settings:
 title: Title and Entity Deduplication Settings
 type: object
 properties:
 title\_entity\_deduplication\_minimum\_entity\_count:
 title: Minimum Entity Count
 description: If an alert has fewer than this many
 entities, it will not be considered for deduplication.
 type: number
 default: 3
 minimum: 2
 ui:order:
 \- org\_info
 \- dashboard\_defaults
 \- response\_benchmarks
 \- time\_saved
 \- chatops
 \- phishing\_simulation\_config
 \- advanced\_settings
 description: Updated system configuration
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/context-memory:
 get:
 operationId: context\_memory\_retrieve
 description: \|
 List Context Memory Items with optional filtering, sorting, and pagination.

Returns active and/or archived user-created context memory entries accessible to this tenant.
 Use \`limit\` and \`offset\` for pagination. Supports filtering by source type, status, tenant union,
 and free-text search.
 parameters:
 \- in: query
 name: limit
 schema:
 type: integer
 description: Number of results per page
 \- in: query
 name: offset
 schema:
 type: integer
 description: Number of results to skip
 \- in: query
 name: search\_query
 schema:
 type: string
 description: Free-text search against item content
 \- in: query
 name: sort\_by
 schema:
 type: string
 enum:
 \- id
 \- updated\_at
 \- usage\_count
 description: 'Sort field (default: \`updated\_at\`)'
 \- in: query
 name: sort\_order
 schema:
 type: string
 enum:
 \- asc
 \- desc
 description: 'Sort direction (default: \`desc\`)'
 \- in: query
 name: source\_types
 schema:
 type: array
 items:
 type: string
 enum:
 \- chat\_message
 \- config\_form
 \- integration\_scrape
 \- investigation\_edit
 description: Filter by source type(s). Repeatable.
 \- in: query
 name: status
 schema:
 type: string
 enum:
 \- active
 \- all
 \- inactive
 description: 'Filter by archive status (default: \`all\`)'
 \- in: query
 name: tags
 schema:
 type: array
 items:
 type: string
 description: Filter by tag(s). Returns items that have \*any\* of the specified
 tags. Repeatable.
 \- in: query
 name: tenant\_union\_id
 schema:
 type: string
 description: Filter by tenant union. Pass an integer ID to scope to a specific
 union, or the string \`null\` to return only untenanted items. Omit to return
 all.
 tags:
 \- context-memory
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/PaginatedContextMemoryList'
 description: Paginated list of Context Memory Items
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/context-memory/{item\_id}:
 get:
 operationId: context\_memory\_retrieve\_2
 description: Retrieve a single Context Memory Item by ID.
 parameters:
 \- in: path
 name: item\_id
 schema:
 type: integer
 description: ID of the Context Memory Item
 required: true
 tags:
 \- context-memory
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/ContextMemoryItemToCustomer'
 description: Context Memory Item
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/context-memory/create:
 post:
 operationId: context\_memory\_create\_create
 description: Create a new user Context Memory Item (+ optional tenant union
 OR tenant id/label). Prefer tenant\_union\_id for union-scoped context (multiple
 integration slots); tenant\_id+tenant\_label for upstream tenant scoping.
 tags:
 \- context-memory
 requestBody:
 content:
 application/json:
 schema:
 type: object
 properties:
 content:
 type: string
 default: Hello world
 tenant\_id:
 type: string
 default: null
 tenant\_label:
 type: string
 default: null
 tenant\_union\_id:
 type: number
 default: null
 tags:
 type: array
 items:
 type: string
 maxLength: 64
 maxItems: 20
 description: Optional free-form organizational tags.
 default: \[\]
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '201':
 content:
 application/json:
 schema:
 type: object
 properties:
 item\_id:
 type: number
 description: Context Memory Item created
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/context-memory/delete/{item\_id}:
 delete:
 operationId: context\_memory\_delete\_destroy
 description: Delete an existing user Context Memory Item
 parameters:
 \- in: path
 name: item\_id
 schema:
 type: string
 required: true
 tags:
 \- context-memory
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 type: object
 properties:
 item\_id:
 type: number
 description: Context Memory Item deleted
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/context-memory/update/{item\_id}:
 put:
 operationId: context\_memory\_update\_update
 description: Update an existing user Context Memory Item (+ optional tenant
 union OR tenant id/label). Prefer tenant\_union\_id for union-scoped context
 (multiple integration slots); tenant\_id+tenant\_label for upstream tenant scoping.
 parameters:
 \- in: path
 name: item\_id
 schema:
 type: string
 required: true
 tags:
 \- context-memory
 requestBody:
 content:
 application/json:
 schema:
 type: object
 properties:
 content:
 type: string
 default: Hello world
 tenant\_id:
 type: string
 default: null
 tenant\_label:
 type: string
 default: null
 tenant\_union\_id:
 type: number
 default: null
 tags:
 type: array
 items:
 type: string
 maxLength: 64
 maxItems: 20
 description: Optional free-form organizational tags. Omit to leave
 existing tags unchanged.
 default: \[\]
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 type: object
 properties:
 item\_id:
 type: number
 description: Context Memory Item updated
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 '409':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Invalid action taken on resource
 /app/api/v1/custom-strategies:
 get:
 operationId: custom\_strategies\_list\_external
 description: List all custom strategies. Use is\_protected filter to distinguish
 between user-created and OOTB strategies.
 parameters:
 \- in: query
 name: alert\_sources
 schema:
 type: array
 items:
 type: string
 description: Filter by alert sources
 \- in: query
 name: attack\_surfaces
 schema:
 type: array
 items:
 type: string
 description: Filter by attack surfaces
 \- in: query
 name: is\_archived
 schema:
 type: boolean
 description: Filter by archived status
 \- in: query
 name: is\_enabled
 schema:
 type: boolean
 description: Filter by enabled status
 \- in: query
 name: is\_protected
 schema:
 type: boolean
 description: Filter by protected status (true=OOTB, false=user-created)
 \- in: query
 name: mitre\_tactics
 schema:
 type: array
 items:
 type: string
 description: Filter by MITRE tactics
 \- in: query
 name: search\_query
 schema:
 type: string
 description: Search in strategy title and scenario
 tags:
 \- custom-strategies
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 type: array
 items:
 $ref: '#/components/schemas/FullCustomStrategy'
 description: List of custom strategies
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 post:
 operationId: custom\_strategies\_create\_external
 description: Create a new custom strategy
 tags:
 \- custom-strategies
 requestBody:
 content:
 application/json:
 schema:
 type: object
 properties:
 title:
 type: string
 is\_enabled:
 type: boolean
 default: false
 attack\_surfaces:
 type: array
 items:
 type: string
 mitre\_tactics:
 type: array
 items:
 type: string
 alert\_sources:
 type: array
 items:
 type: string
 scenario:
 type: string
 outcomes:
 type: array
 items:
 type: object
 instructions:
 type: array
 items:
 type: object
 priorities:
 type: array
 items:
 type: object
 required:
 \- title
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '201':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/FullCustomStrategy'
 description: Custom strategy created successfully
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/custom-strategies/{strategy\_id}:
 get:
 operationId: custom\_strategy\_retrieve\_external
 description: Get a specific custom strategy by ID. Includes both user-created
 and OOTB (protected) strategies.
 parameters:
 \- in: path
 name: strategy\_id
 schema:
 type: integer
 required: true
 tags:
 \- custom-strategies
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/FullCustomStrategy'
 description: Custom strategy details
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 put:
 operationId: custom\_strategy\_update\_external
 description: Update a custom strategy (full replacement - creates new version)
 parameters:
 \- in: path
 name: strategy\_id
 schema:
 type: string
 required: true
 tags:
 \- custom-strategies
 requestBody:
 content:
 application/json:
 schema:
 type: object
 properties:
 title:
 type: string
 is\_enabled:
 type: boolean
 attack\_surfaces:
 type: array
 items:
 type: string
 mitre\_tactics:
 type: array
 items:
 type: string
 alert\_sources:
 type: array
 items:
 type: string
 scenario:
 type: string
 outcomes:
 type: array
 items:
 type: object
 instructions:
 type: array
 items:
 type: object
 priorities:
 type: array
 items:
 type: object
 required:
 \- title
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/FullCustomStrategy'
 description: Strategy updated successfully
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 delete:
 operationId: custom\_strategy\_destroy\_external
 description: Delete or archive a custom strategy (archives if referenced by
 investigations)
 parameters:
 \- in: path
 name: strategy\_id
 schema:
 type: string
 required: true
 tags:
 \- custom-strategies
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '204':
 description: Strategy deleted or archived successfully
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Cannot delete already archived strategy
 /app/api/v1/email/investigation/create:
 post:
 operationId: email\_investigation\_create\_create
 description: Creates a new email investigation, returning the ID. Optionally
 pass tenant\_union\_id (multi-tenant deployments) to scope the alert to a tenant
 union.
 tags:
 \- email
 requestBody:
 content:
 multipart/form-data:
 schema:
 type: object
 properties:
 email:
 type: string
 format: binary
 tenant\_union\_id:
 type: integer
 nullable: true
 default: null
 origin\_ticket\_id:
 type: string
 nullable: true
 default: null
 origin\_ticket\_id\_label:
 type: string
 nullable: true
 default: null
 origin\_ticket\_url:
 type: string
 nullable: true
 default: null
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '201':
 content:
 application/json:
 schema:
 type: object
 properties:
 id:
 type: number
 description: Creation success
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/integrations:
 get:
 operationId: list\_integration\_types
 description: Returns all integration definitions (types) available in the system.
 Does not include instance-specific configuration.
 summary: List all available integration types
 parameters:
 \- in: query
 name: categories
 schema:
 type: array
 items:
 type: string
 description: Filter by categories (can specify multiple, e.g., ?categories=siem&categories=edr)
 explode: true
 style: form
 \- in: query
 name: dz\_provided
 schema:
 type: boolean
 description: Filter by whether the integration type can be Dropzone-provided
 \- in: query
 name: group
 schema:
 type: array
 items:
 type: string
 description: Filter by integration groups (can specify multiple, e.g., ?group=security&group=cloud)
 explode: true
 style: form
 \- in: query
 name: integration\_type
 schema:
 type: string
 enum:
 \- core
 \- interviewer
 \- poller
 \- remediator
 description: Filter by integration service type (core, interviewer, poller,
 remediator)
 tags:
 \- integrations
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/IntegrationTypesListResponse'
 description: List of all available integration types/definitions
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/integrations/{slug}:
 get:
 operationId: integrations\_retrieve
 description: List all configured instances for a specific integration.
 parameters:
 \- in: path
 name: slug
 schema:
 type: string
 required: true
 \- in: query
 name: tenant\_union\_id
 schema:
 type: integer
 description: Filter by tenant union ID
 tags:
 \- integrations
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/IntegrationInstancesListResponse'
 description: List of integration instances (config\_data NOT included)
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 post:
 operationId: integrations\_create
 description: Create a new integration instance.
 parameters:
 \- in: path
 name: slug
 schema:
 type: string
 required: true
 tags:
 \- integrations
 requestBody:
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/IntegrationInstanceSerializerToCustomerCreate'
 application/x-www-form-urlencoded:
 schema:
 $ref: '#/components/schemas/IntegrationInstanceSerializerToCustomerCreate'
 multipart/form-data:
 schema:
 $ref: '#/components/schemas/IntegrationInstanceSerializerToCustomerCreate'
 required: true
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '201':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/IntegrationSlotSerializerToCustomerFull'
 description: Successfully created integration instance
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/integrations/{slug}/{slot\_uuid}:
 get:
 operationId: integrations\_retrieve\_2
 description: Get specific integration instance with full config.
 parameters:
 \- in: path
 name: slot\_uuid
 schema:
 type: string
 format: uuid
 required: true
 \- in: path
 name: slug
 schema:
 type: string
 required: true
 tags:
 \- integrations
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/IntegrationSlotSerializerToCustomerFull'
 description: Full integration instance details including masked config\_data
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 patch:
 operationId: integrations\_partial\_update
 description: Update integration instance (partial update supported).
 parameters:
 \- in: path
 name: slot\_uuid
 schema:
 type: string
 format: uuid
 required: true
 \- in: path
 name: slug
 schema:
 type: string
 required: true
 tags:
 \- integrations
 requestBody:
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/PatchedIntegrationInstanceSerializerToCustomerUpdate'
 application/x-www-form-urlencoded:
 schema:
 $ref: '#/components/schemas/PatchedIntegrationInstanceSerializerToCustomerUpdate'
 multipart/form-data:
 schema:
 $ref: '#/components/schemas/PatchedIntegrationInstanceSerializerToCustomerUpdate'
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/IntegrationSlotSerializerToCustomerFull'
 description: Updated integration instance
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 delete:
 operationId: integrations\_destroy
 description: Delete integration instance.
 parameters:
 \- in: path
 name: slot\_uuid
 schema:
 type: string
 format: uuid
 required: true
 \- in: path
 name: slug
 schema:
 type: string
 required: true
 tags:
 \- integrations
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '204':
 description: Integration instance deleted successfully
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/integrations/{slug}/test:
 post:
 operationId: integrations\_test\_create
 description: Test integration configuration without saving it. Validates the
 config and tests connectivity.
 parameters:
 \- in: path
 name: slug
 schema:
 type: string
 required: true
 tags:
 \- integrations
 requestBody:
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/IntegrationInstanceSerializerToCustomerTest'
 application/x-www-form-urlencoded:
 schema:
 $ref: '#/components/schemas/IntegrationInstanceSerializerToCustomerTest'
 multipart/form-data:
 schema:
 $ref: '#/components/schemas/IntegrationInstanceSerializerToCustomerTest'
 required: true
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 description: Test successful - returns test results
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/investigation:
 get:
 operationId: investigation\_retrieve
 description: \|
 List investigations (with optional filtering, sorting, and search)

Returns a paginated list of investigations. By default, only completed investigations
 (state='success') are returned. Use query parameters to filter by state, outcomes,
 priorities, date ranges, and more.
 parameters:
 \- in: query
 name: alert\_create\_from
 schema:
 type: string
 description: Filter by alert creation time (from). ISO 8601 format
 \- in: query
 name: alert\_create\_until
 schema:
 type: string
 description: Filter by alert creation time (until). ISO 8601 format
 \- in: query
 name: alert\_start\_from
 schema:
 type: string
 description: Filter by alert start time (from). ISO 8601 format (e.g., 2024-01-01
 or 2024-01-01T00:00:00Z)
 \- in: query
 name: alert\_start\_until
 schema:
 type: string
 description: Filter by alert start time (until). ISO 8601 format
 \- in: query
 name: alert\_tenants
 schema:
 type: array
 items:
 type: string
 description: Filter by alert tenant name (can be repeated)
 \- in: query
 name: alert\_types
 schema:
 type: array
 items:
 type: string
 description: Filter by alert type/handler key (can be repeated)
 \- in: query
 name: attack\_surfaces
 schema:
 type: array
 items:
 type: string
 enum:
 \- Active Directory
 \- Cloud Infrastructure
 \- Endpoint
 \- Identity
 \- Kubernetes
 \- Network
 \- Phishing
 \- SaaS
 description: Filter by attack surface (can be repeated)
 \- in: query
 name: containment\_action\_statuses
 schema:
 type: array
 items:
 type: string
 enum:
 \- disabled
 \- failed
 \- ready
 \- running
 \- success
 \- undo\_failed
 \- undoing
 description: Filter by latest containment action run status per investigation
 (can be repeated)
 \- in: query
 name: direct\_source\_labels
 schema:
 type: array
 items:
 type: string
 description: Filter by alert source label (can be repeated)
 \- in: query
 name: feedback\_updated\_from
 schema:
 type: string
 description: Filter by feedback last updated time (from). ISO 8601 format
 \- in: query
 name: feedback\_updated\_until
 schema:
 type: string
 description: Filter by feedback last updated time (until). ISO 8601 format
 \- in: query
 name: insight\_tag\_names
 schema:
 type: array
 items:
 type: string
 description: Filter by insight tag name (can be repeated)
 \- in: query
 name: interview\_statuses
 schema:
 type: array
 items:
 type: string
 enum:
 \- active
 \- approved
 \- canceled
 \- declined
 \- failed
 \- finished
 \- finished\_with\_referral
 \- pending
 \- timed\_out
 description: Filter by interview status (can be repeated)
 \- in: query
 name: inv\_complete\_from
 schema:
 type: string
 description: Filter by investigation completion time (from). ISO 8601 format
 \- in: query
 name: inv\_complete\_until
 schema:
 type: string
 description: Filter by investigation completion time (until). ISO 8601 format
 \- in: query
 name: investigation\_state
 schema:
 type: string
 enum:
 \- error
 \- loading
 \- not\_asked
 \- success
 description: 'Filter by investigation state. Valid values: not\_asked (queued),
 loading (running), success (complete), error (stopped). Defaults to ''success''.'
 \- in: query
 name: light
 schema:
 type: boolean
 default: false
 description: If true, returns a lightweight response with fewer fields (no
 alert, no findings)
 \- in: query
 name: limit
 schema:
 type: integer
 description: Number of results per page
 \- in: query
 name: mitre\_tactics
 schema:
 type: array
 items:
 type: string
 enum:
 \- Collection
 \- Command and Control
 \- Credential Access
 \- Defense Evasion
 \- Discovery
 \- Execution
 \- Exfiltration
 \- Impact
 \- Initial Access
 \- Lateral Movement
 \- Persistence
 \- Privilege Escalation
 description: Filter by MITRE ATT&CK tactic (can be repeated)
 \- in: query
 name: offset
 schema:
 type: integer
 description: Number of results to skip
 \- in: query
 name: outcomes
 schema:
 type: array
 items:
 type: string
 enum:
 \- COMPLETED\_BREACHED\_CONFIRMED
 \- COMPLETED\_BREACHED\_SUSPICIOUS
 \- COMPLETED\_FALSE\_ALERT
 \- IGNORED
 \- INCOMPLETE
 description: Filter by investigation outcome/conclusion (can be repeated)
 \- in: query
 name: priorities
 schema:
 type: array
 items:
 type: string
 enum:
 \- informational
 \- notable
 \- urgent
 description: Filter by investigation priority (can be repeated)
 \- in: query
 name: priority\_statuses
 schema:
 type: array
 items:
 type: string
 description: Filter by priority status (can be repeated)
 \- in: query
 name: search
 schema:
 type: string
 description: Free-text search across investigation fields
 \- in: query
 name: sort\_dir
 schema:
 type: string
 enum:
 \- asc
 \- desc
 description: Sort direction. Defaults to 'desc'.
 \- in: query
 name: sort\_type
 schema:
 type: string
 enum:
 \- activity
 \- alert\_create
 \- alert\_source
 \- alert\_title
 \- alert\_type
 \- feedback\_status
 \- investigation\_create
 \- outcome
 \- priority\_status
 \- stopped\_reason
 description: Sort field. Defaults to 'alert\_create'.
 \- in: query
 name: stopped\_reasons
 schema:
 type: array
 items:
 type: string
 enum:
 \- CANCEL\_MANUAL
 \- CANCEL\_THRESHOLD
 \- ERROR
 description: Filter by stopped reason for error/canceled investigations (can
 be repeated)
 \- in: query
 name: tenant\_id
 schema:
 type: string
 description: Filter by tenant ID
 \- in: query
 name: tenant\_integration\_key
 schema:
 type: string
 description: Filter by tenant integration key
 \- in: query
 name: user\_statuses
 schema:
 type: array
 items:
 type: string
 enum:
 \- in\_review
 \- reviewed
 description: Filter by user feedback status (can be repeated)
 tags:
 \- investigation
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/PaginatedInvestigationList'
 description: \|
 **Paginated list of investigations**

Returns a paginated list of investigations. By default, only completed investigations
 (state='success') are returned. Use query parameters to filter by state, outcomes,
 priorities, date ranges, and more.

Use `next` and `previous`
 URLs in the response for easy page navigation.

If `light=true`, returns a subset of fields (InvestigationLight schema).
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 /app/api/v1/investigation-bulk-feedback:
 patch:
 operationId: investigation\_bulk\_feedback\_partial\_update
 description: \|
 Bulk update investigation feedback

`feedback.status` options:

- In Review = `in_review`
- Reviewed = `reviewed`

`feedback.outcome` options:

- Malicious = `COMPLETED_BREACHED_CONFIRMED`
- Suspicious = `COMPLETED_BREACHED_SUSPICIOUS`
- Benign = `COMPLETED_FALSE_ALERT`
- Inconclusive = `INCOMPLETE`
- Ignored = `IGNORED`

`feedback.priority` options:

- Informational = `informational`
- Notable = `notable`
- Urgent = `urgent`

tags:
 \- investigation-feedback
 requestBody:
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/PatchedBulkInvestigationFeedbackRequest'
 application/x-www-form-urlencoded:
 schema:
 $ref: '#/components/schemas/PatchedBulkInvestigationFeedbackRequest'
 multipart/form-data:
 schema:
 $ref: '#/components/schemas/PatchedBulkInvestigationFeedbackRequest'
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 type: object
 properties:
 investigation\_id:
 type: number
 description: Feedback updated
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 validation\_error:
 type: object
 description: Field-level validation errors keyed by field name
 description: Malformed request
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/investigation-user-notes/{investigation\_id}/create:
 post:
 operationId: investigation\_user\_notes\_create\_create
 description: Add a new investigation note
 parameters:
 \- in: path
 name: investigation\_id
 schema:
 type: integer
 required: true
 tags:
 \- investigation-user-notes
 requestBody:
 content:
 application/json:
 schema:
 type: object
 properties:
 text:
 type: string
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/InvestigationNoteNested'
 description: New investigation note
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/investigation-user-notes/{investigation\_id}/list:
 get:
 operationId: investigation\_user\_notes\_list\_retrieve
 description: List user notes for an investigation
 parameters:
 \- in: path
 name: investigation\_id
 schema:
 type: integer
 required: true
 tags:
 \- investigation-user-notes
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 type: array
 items:
 $ref: '#/components/schemas/InvestigationNoteNested'
 description: Investigation user notes
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/investigation-user-notes/{investigation\_note\_id}/delete:
 delete:
 operationId: investigation\_user\_notes\_delete\_destroy
 description: Delete an investigation note
 parameters:
 \- in: path
 name: investigation\_note\_id
 schema:
 type: integer
 required: true
 tags:
 \- investigation-user-notes
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 description: Delete success
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/investigation-user-notes/{investigation\_note\_id}/update:
 patch:
 operationId: investigation\_user\_notes\_update\_partial\_update
 description: Update an investigation note
 parameters:
 \- in: path
 name: investigation\_note\_id
 schema:
 type: integer
 required: true
 tags:
 \- investigation-user-notes
 requestBody:
 content:
 application/json:
 schema:
 type: object
 properties:
 text:
 type: string
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/InvestigationNoteNested'
 description: Updated investigation note
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/investigation/{investigation\_id}:
 get:
 operationId: investigation\_retrieve\_2
 description: Returns an alert investigation
 parameters:
 \- in: path
 name: investigation\_id
 schema:
 type: string
 required: true
 \- in: query
 name: light
 schema:
 type: boolean
 default: false
 description: If true, returns a lightweight response with fewer fields (no
 alert, no findings)
 tags:
 \- investigation
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/Investigation'
 description: \|
 Investigation data object. For progress: `investigation.status=`

- `not_asked` : queued

- `loading` : running AI analyst

- `success` : AI analyst finished with result

- `error` : AI analyst finished with error
   — See `investigation.error_msg`

If `light=true`, returns a subset of fields (InvestigationLight schema).
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/investigation/{investigation\_id}/evidence-data/{evidence\_data\_id}:
 get:
 operationId: investigation\_evidence\_data\_retrieve
 description: \|
 Returns the requested evidence data for a specific investigation.
 parameters:
 \- in: path
 name: evidence\_data\_id
 schema:
 type: integer
 description: The evidence data ID
 required: true
 \- in: path
 name: investigation\_id
 schema:
 type: integer
 description: The investigation ID
 required: true
 tags:
 \- investigation
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/EvidenceData'
 description: Evidence data object
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/investigation/{investigation\_id}/feedback:
 patch:
 operationId: investigation\_feedback\_partial\_update
 description: \|
 Update feedback for a single investigation

`feedback.status` options:

- In Review = `in_review`
- Reviewed = `reviewed`

`feedback.outcome` options:

`feedback.priority` options:

- Informational = `informational`
- Notable = `notable`
- Urgent = `urgent`

parameters:
 \- in: path
 name: investigation\_id
 schema:
 type: integer
 description: The investigation ID
 required: true
 tags:
 \- investigation-feedback
 requestBody:
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/PatchedInvestigationFeedbackRequest'
 application/x-www-form-urlencoded:
 schema:
 $ref: '#/components/schemas/PatchedInvestigationFeedbackRequest'
 multipart/form-data:
 schema:
 $ref: '#/components/schemas/PatchedInvestigationFeedbackRequest'
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 type: object
 description: The updated investigation feedback
 description: Feedback updated
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 validation\_error:
 type: object
 description: Field-level validation errors keyed by field name
 description: Malformed request
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/investigation/{investigation\_id}/queue-priority:
 post:
 operationId: investigation\_queue\_priority\_create
 description: Set queue\_priority for a queued investigation. Omit queue\_priority
 from the body (or pass null) to bump to top; pass 0 to return to default queue
 order.
 parameters:
 \- in: path
 name: investigation\_id
 schema:
 type: integer
 description: The investigation ID
 required: true
 tags:
 \- investigation
 requestBody:
 content:
 application/json:
 schema:
 type: object
 properties:
 queue\_priority:
 type: number
 nullable: true
 description: Priority value. Omit or null to bump to top (server
 computes max + gap), 0 to return to default queue order.
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 type: object
 properties:
 id:
 type: integer
 description: The investigation ID
 queue\_priority:
 type: number
 description: The new queue\_priority value
 description: Priority updated
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/investigation/create:
 post:
 operationId: investigation\_create\_create
 description: \|
 Creates a new alert investigation, returning `investigation_id`

_Returns existing id if alert already exists (unless `force_reinvestigation=True`)_

**Then:** Use `GET /app/api/v1/investigation/{investigation_id}` for updates
 tags:
 \- investigation
 requestBody:
 content:
 application/json:
 schema:
 type: object
 properties:
 schema\_key:
 type: string
 raw\_alert\_content:
 type: object
 force\_reinvestigation:
 type: boolean
 default: false
 tenant\_union\_id:
 type: number
 nullable: true
 default: null
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 type: object
 properties:
 investigation\_id:
 type: number
 description: Existing investigation found
 '201':
 content:
 application/json:
 schema:
 type: object
 properties:
 investigation\_id:
 type: number
 description: New investigation created
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 '422':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 skip\_reason:
 type: string
 description: Alert skipped due to missing data (e.g., propagation delay)
 /app/api/v1/investigation/create/custom:
 post:
 operationId: investigation\_create\_custom\_create
 description: \|
 Request body = arbitrary alert JSON to be parsed & investigated.

The system uses AI to extract metadata (title, timestamps, ticket info, etc.) from the alert JSON you provide.
 You can optionally include a `dz_metadata` object to override or supplement the AI-extracted values.

**Optional `dz_metadata` fields:**

| Field | Type | Description |
| --- | --- | --- |
| `title` | string | Override the AI-generated alert title |
| `alert_type` | string | Override the AI-detected alert type |
| `coalesce_key` | string | Key for grouping duplicate alerts (default: hash of alert content) |
| `create_time` | string (ISO 8601) | Alert creation timestamp (default: current time) |
| `start_time` | string (ISO 8601) | Alert start timestamp |
| `origin_ticket_id` | string | Ticket/alert ID from the originating system |
| `origin_ticket_url` | string | URL to the ticket/alert in the originating system |
| `force_investigate` | boolean | If true, bypass the "not a valid security alert" classification and investigate anyway |

Response = `investigation_id` if successful, `error_msg` otherwise

_Returns existing id if alert already exists (unless `?force_reinvestigation=True`)_

**Then:** Use `GET /app/api/v1/investigation/{investigation_id}` for updates
 parameters:
 \- in: query
 name: force\_reinvestigation
 schema:
 type: boolean
 description: Force reinvestigation
 \- in: query
 name: tenant\_union\_id
 schema:
 type: integer
 description: Tenant union ID
 tags:
 \- investigation
 requestBody:
 content:
 application/json:
 schema:
 type: object
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 type: object
 properties:
 investigation\_id:
 type: number
 description: Existing investigation found
 '201':
 content:
 application/json:
 schema:
 type: object
 properties:
 investigation\_id:
 type: number
 description: New investigation created
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - invalid input
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 '413':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 skip\_reason:
 type: string
 description: Content Too Large
 /app/api/v1/metrics/mttx:
 get:
 operationId: metrics\_mttx\_retrieve
 description: \|
 System-level MTTX metrics (MTTC, MTTD, MTTP, MTTI) with overall totals and per alert-source breakdowns.

Uses the same investigation filter query parameters as `GET /app/api/v1/investigation`.
 parameters:
 \- in: query
 name: alert\_create\_from
 schema:
 type: string
 description: Filter by alert creation time (from). ISO 8601 format
 \- in: query
 name: alert\_create\_until
 schema:
 type: string
 description: Filter by alert creation time (until). ISO 8601 format
 \- in: query
 name: alert\_start\_from
 schema:
 type: string
 description: Filter by alert start time (from). ISO 8601 format (e.g., 2024-01-01
 or 2024-01-01T00:00:00Z)
 \- in: query
 name: alert\_start\_until
 schema:
 type: string
 description: Filter by alert start time (until). ISO 8601 format
 \- in: query
 name: alert\_tenants
 schema:
 type: array
 items:
 type: string
 description: Filter by alert tenant name (can be repeated)
 \- in: query
 name: alert\_types
 schema:
 type: array
 items:
 type: string
 description: Filter by alert type/handler key (can be repeated)
 \- in: query
 name: attack\_surfaces
 schema:
 type: array
 items:
 type: string
 enum:
 \- Active Directory
 \- Cloud Infrastructure
 \- Endpoint
 \- Identity
 \- Kubernetes
 \- Network
 \- Phishing
 \- SaaS
 description: Filter by attack surface (can be repeated)
 \- in: query
 name: containment\_action\_statuses
 schema:
 type: array
 items:
 type: string
 enum:
 \- disabled
 \- failed
 \- ready
 \- running
 \- success
 \- undo\_failed
 \- undoing
 description: Filter by latest containment action run status per investigation
 (can be repeated)
 \- in: query
 name: direct\_source\_labels
 schema:
 type: array
 items:
 type: string
 description: Filter by alert source label (can be repeated)
 \- in: query
 name: feedback\_updated\_from
 schema:
 type: string
 description: Filter by feedback last updated time (from). ISO 8601 format
 \- in: query
 name: feedback\_updated\_until
 schema:
 type: string
 description: Filter by feedback last updated time (until). ISO 8601 format
 \- in: query
 name: insight\_tag\_names
 schema:
 type: array
 items:
 type: string
 description: Filter by insight tag name (can be repeated)
 \- in: query
 name: interview\_statuses
 schema:
 type: array
 items:
 type: string
 enum:
 \- active
 \- approved
 \- canceled
 \- declined
 \- failed
 \- finished
 \- finished\_with\_referral
 \- pending
 \- timed\_out
 description: Filter by interview status (can be repeated)
 \- in: query
 name: inv\_complete\_from
 schema:
 type: string
 description: Filter by investigation completion time (from). ISO 8601 format
 \- in: query
 name: inv\_complete\_until
 schema:
 type: string
 description: Filter by investigation completion time (until). ISO 8601 format
 \- in: query
 name: mitre\_tactics
 schema:
 type: array
 items:
 type: string
 enum:
 \- Collection
 \- Command and Control
 \- Credential Access
 \- Defense Evasion
 \- Discovery
 \- Execution
 \- Exfiltration
 \- Impact
 \- Initial Access
 \- Lateral Movement
 \- Persistence
 \- Privilege Escalation
 description: Filter by MITRE ATT&CK tactic (can be repeated)
 \- in: query
 name: outcomes
 schema:
 type: array
 items:
 type: string
 enum:
 \- COMPLETED\_BREACHED\_CONFIRMED
 \- COMPLETED\_BREACHED\_SUSPICIOUS
 \- COMPLETED\_FALSE\_ALERT
 \- IGNORED
 \- INCOMPLETE
 description: Filter by investigation outcome/conclusion (can be repeated)
 \- in: query
 name: priorities
 schema:
 type: array
 items:
 type: string
 enum:
 \- informational
 \- notable
 \- urgent
 description: Filter by investigation priority (can be repeated)
 \- in: query
 name: priority\_statuses
 schema:
 type: array
 items:
 type: string
 description: Filter by priority status (can be repeated)
 \- in: query
 name: search
 schema:
 type: string
 description: Free-text search across investigation fields
 \- in: query
 name: stopped\_reasons
 schema:
 type: array
 items:
 type: string
 enum:
 \- CANCEL\_MANUAL
 \- CANCEL\_THRESHOLD
 \- ERROR
 description: Filter by stopped reason for error/canceled investigations (can
 be repeated)
 \- in: query
 name: tenant\_id
 schema:
 type: string
 description: Filter by tenant ID
 \- in: query
 name: tenant\_integration\_key
 schema:
 type: string
 description: Filter by tenant integration key
 \- in: query
 name: user\_statuses
 schema:
 type: array
 items:
 type: string
 enum:
 \- in\_review
 \- reviewed
 description: Filter by user feedback status (can be repeated)
 tags:
 \- metrics
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/MttxResponse'
 description: MTTX aggregate metrics
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/metrics/mttx/investigations:
 get:
 operationId: metrics\_mttx\_investigations\_retrieve
 description: \|
 Per-investigation MTTD, MTTP, and MTTI in seconds (float), keyed by investigation id.

\*\*Collection Name:\*\*
 If omitted and a file is provided, the filename (without extension) will be used. If no file is provided, collection\_name is required.\*\*Supported Formats:\*\*
 \- Single STIX JSON file (.json)
 \- Compressed tar/zip archives (.tar.gz, .tgz, .zip) containing multiple STIX files

\*\*Size Limits:\*\*
 \- File size: 100.0MB max
 tags:
 \- Custom Threat Collections
 requestBody:
 content:
 multipart/form-data:
 schema:
 type: object
 properties:
 file:
 type: string
 format: binary
 description: STIX JSON file or compressed tar archive
 collection\_name:
 type: string
 description: Collection name (optional, defaults to filename)
 example: My Threat Feed
 expires\_at:
 type: string
 format: date-time
 nullable: true
 description: Optional. When set, internal threat intel search excludes
 this collection after this date. Omit or null for no expiry.
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '201':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/ImportResult'
 description: Successfully processed
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - missing file, invalid collection name, or invalid
 MIME type
 '409':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Conflict - duplicate file (already uploaded in last 5 minutes)
 or collection limit exceeded
 '413':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: File too large - exceeds 100.0MB
 '507':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Insufficient storage space on server
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Internal server error - file processing failed or file save
 failed during async upload
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/threat-intel/collections/{collection\_id}:
 get:
 operationId: threat\_intel\_retrieve\_external
 description: Get details for a specific Custom Threat Collection.
 parameters:
 \- in: path
 name: collection\_id
 schema:
 type: string
 format: uuid
 required: true
 tags:
 \- Custom Threat Collections
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/ThreatIntelCollection'
 description: 'Collection details. The file\_info field is a dictionary keyed
 by filename. Each value is either a SingleFileInfo (for single files)
 or ArchiveFileInfo (for archives), determined by the ''type'' field. All
 file types include indicators\_skipped count. ArchiveFileInfo includes
 detailed filename tracking: files\_parsed (successfully parsed), files\_errored
 (had errors), files\_skipped (skipped entirely), and files\_warning (partial
 success - imported some indicators but also had errors or skipped indicators).'
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Resource not found
 patch:
 operationId: threat\_intel\_patch\_external
 description: Update a Custom Threat Collection
 parameters:
 \- in: path
 name: collection\_id
 schema:
 type: string
 format: uuid
 required: true
 tags:
 \- Custom Threat Collections
 requestBody:
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/PatchedThreatIntelCollectionCoreSettings'
 application/x-www-form-urlencoded:
 schema:
 $ref: '#/components/schemas/PatchedThreatIntelCollectionCoreSettings'
 multipart/form-data:
 schema:
 $ref: '#/components/schemas/PatchedThreatIntelCollectionCoreSettings'
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/ThreatIntelCollection'
 description: Updated collection
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Collection not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 delete:
 operationId: threat\_intel\_destroy\_external
 description: Delete a Custom Threat Collection
 parameters:
 \- in: path
 name: collection\_id
 schema:
 type: string
 format: uuid
 required: true
 tags:
 \- Custom Threat Collections
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '204':
 description: Collection deleted successfully
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Collection not found
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/threat-intel/collections/{collection\_id}/files:
 put:
 operationId: threat\_intel\_files\_replace\_external
 description: \|
 Replace all files in a Custom Threat Collection with a new STIX 2.x file or compressed archive.

This endpoint replaces all existing collection content with the uploaded data.

\*\*Supported Formats:\*\*
 \- Single STIX JSON file (.json)
 \- Compressed tar archives (.tar.gz, .tgz) containing multiple STIX files

\*\*Size Limits:\*\*
 \- File size: 100.0MB max
 parameters:
 \- in: path
 name: collection\_id
 schema:
 type: string
 format: uuid
 required: true
 tags:
 \- Custom Threat Collections
 requestBody:
 content:
 multipart/form-data:
 schema:
 type: object
 properties:
 file:
 type: string
 format: binary
 description: STIX JSON file or compressed tar archive
 required:
 \- file
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/ImportResult'
 description: Successfully processed
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - missing file or invalid MIME type
 '404':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Collection not found
 '413':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: File too large - exceeds 100.0MB
 '507':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Insufficient storage space on server
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Internal server error - file processing failed or file save
 failed during async upload
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
 /app/api/v1/threat-intel/collections/bulk-delete:
 post:
 operationId: threat\_intel\_bulk\_delete\_external
 description: Bulk delete Custom Threat Collections. Skips non-existent and already-deleted
 collections.
 tags:
 \- Custom Threat Collections
 requestBody:
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/BulkDeleteCollectionsRequest'
 required: true
 security:
 \- ApiKeyAuth: \[\]
 responses:
 '200':
 content:
 application/json:
 schema:
 $ref: '#/components/schemas/BulkDeleteCollectionsResponse'
 description: Bulk delete completed
 '400':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Bad request - missing or invalid collection\_ids
 '401':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: Unauthorized
 '403':
 content:
 application/json:
 schema:
 type: object
 properties:
 detail:
 type: string
 description: Access denied
 '500':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System error
 '503':
 content:
 application/json:
 schema:
 type: object
 properties:
 error\_msg:
 type: string
 description: System not ready for requests
components:
 schemas:
 BulkDeleteCollectionsRequest:
 type: object
 description: Request serializer for bulk delete collections endpoint.
 properties:
 collection\_ids:
 type: array
 items:
 type: string
 format: uuid
 description: List of collection UUIDs to delete
 minItems: 1
 required:
 \- collection\_ids
 BulkDeleteCollectionsResponse:
 type: object
 properties:
 deleted\_count:
 type: integer
 description: Number of collections successfully deleted
 required:
 \- deleted\_count
 CanceledEnum:
 enum:
 \- CANCEL\_MANUAL
 \- CANCEL\_THRESHOLD
 type: string
 description: \|-
 \\* \`CANCEL\_MANUAL\` - CANCEL\_MANUAL
 \\* \`CANCEL\_THRESHOLD\` - CANCEL\_THRESHOLD
 ChatQueryNested:
 type: object
 properties:
 id:
 type: integer
 readOnly: true
 request\_user:
 $ref: '#/components/schemas/CustomUser'
 interview:
 $ref: '#/components/schemas/Interview'
 progress\_messages:
 type: array
 items:
 $ref: '#/components/schemas/ChatQueryProgress'
 readOnly: true
 created\_at:
 type: string
 format: date-time
 readOnly: true
 updated\_at:
 type: string
 format: date-time
 readOnly: true
 request\_text:
 type: string
 request\_files: {}
 response\_text:
 type: string
 nullable: true
 response\_citations:
 nullable: true
 status:
 $ref: '#/components/schemas/ChatQueryNestedStatusEnum'
 chat\_session:
 type: string
 format: uuid
 nullable: true
 required:
 \- created\_at
 \- id
 \- interview
 \- progress\_messages
 \- request\_text
 \- request\_user
 \- updated\_at
 ChatQueryNestedStatusEnum:
 enum:
 \- pending
 \- done
 \- canceled
 type: string
 description: \|-
 \\* \`pending\` - Pending
 \\* \`done\` - Done
 \\* \`canceled\` - Canceled
 ChatQueryProgress:
 type: object
 properties:
 id:
 type: integer
 readOnly: true
 message:
 type: string
 timestamp:
 type: number
 format: double
 required:
 \- id
 \- message
 \- timestamp
 ContextMemoryItemToCustomer:
 type: object
 description: \|-
 Read-only serializer for customer-facing API endpoints.
 Exposes a safe subset of fields — no embeddings, source\_data, or internal keys.
 tenant\_union is a nested object. Write inputs use tenant\_union\_id (int) on create/update.
 properties:
 id:
 type: integer
 readOnly: true
 created\_at:
 type: string
 format: date-time
 readOnly: true
 updated\_at:
 type: string
 format: date-time
 readOnly: true
 expires\_at:
 type: string
 format: date-time
 readOnly: true
 nullable: true
 is\_archived:
 type: boolean
 readOnly: true
 content:
 type: string
 readOnly: true
 source\_type:
 allOf:
 \- $ref: '#/components/schemas/SourceTypeEnum'
 readOnly: true
 tenant\_id:
 type: string
 readOnly: true
 nullable: true
 tenant\_label:
 type: string
 readOnly: true
 nullable: true
 tenant\_union:
 allOf:
 \- $ref: '#/components/schemas/TenantUnion'
 readOnly: true
 nullable: true
 tags:
 type: array
 items:
 type: string
 readOnly: true
 required:
 \- content
 \- created\_at
 \- expires\_at
 \- id
 \- is\_archived
 \- source\_type
 \- tags
 \- tenant\_id
 \- tenant\_label
 \- tenant\_union
 \- updated\_at
 CustomInstruction:
 type: object
 properties:
 id:
 type: integer
 usage\_count:
 type: integer
 readOnly: true
 created\_at:
 type: string
 format: date-time
 readOnly: true
 content:
 type: string
 internal\_origin\_uuid:
 type: string
 format: uuid
 readOnly: true
 nullable: true
 strategy\_versions:
 type: array
 items:
 type: integer
 readOnly: true
 required:
 \- content
 \- created\_at
 \- internal\_origin\_uuid
 \- strategy\_versions
 \- usage\_count
 CustomOutcome:
 type: object
 properties:
 id:
 type: integer
 conclusions\_affected:
 type: integer
 readOnly: true
 created\_at:
 type: string
 format: date-time
 readOnly: true
 condition: {}
 outcome:
 $ref: '#/components/schemas/CustomOutcomeOutcomeEnum'
 internal\_origin\_uuid:
 type: string
 format: uuid
 readOnly: true
 nullable: true
 strategy\_versions:
 type: array
 items:
 type: integer
 readOnly: true
 required:
 \- conclusions\_affected
 \- condition
 \- created\_at
 \- internal\_origin\_uuid
 \- outcome
 \- strategy\_versions
 CustomOutcomeOutcomeEnum:
 enum:
 \- COMPLETED\_BREACHED\_CONFIRMED
 \- COMPLETED\_BREACHED\_SUSPICIOUS
 \- COMPLETED\_FALSE\_ALERT
 \- IGNORED
 type: string
 description: \|-
 \\* \`COMPLETED\_BREACHED\_CONFIRMED\` - COMPLETED\_BREACHED\_CONFIRMED
 \\* \`COMPLETED\_BREACHED\_SUSPICIOUS\` - COMPLETED\_BREACHED\_SUSPICIOUS
 \\* \`COMPLETED\_FALSE\_ALERT\` - COMPLETED\_FALSE\_ALERT
 \\* \`IGNORED\` - IGNORED
 CustomPriority:
 type: object
 properties:
 id:
 type: integer
 priorities\_affected:
 type: integer
 readOnly: true
 created\_at:
 type: string
 format: date-time
 readOnly: true
 priority:
 $ref: '#/components/schemas/PriorityEnum'
 outcomes:
 type: array
 items:
 $ref: '#/components/schemas/OutcomesEnum'
 minItems: 1
 insight\_tag\_rule:
 nullable: true
 ranking:
 type: integer
 maximum: 2147483647
 minimum: 1
 internal\_origin\_uuid:
 type: string
 format: uuid
 readOnly: true
 nullable: true
 strategy\_versions:
 type: array
 items:
 type: integer
 readOnly: true
 required:
 \- created\_at
 \- internal\_origin\_uuid
 \- priorities\_affected
 \- priority
 \- strategy\_versions
 CustomUser:
 type: object
 description: \|-
 Basic serializer to pass CustomUser details to the front end.
 Extend with any fields your app needs.
 properties:
 id:
 type: integer
 readOnly: true
 first\_name:
 type: string
 maxLength: 150
 last\_name:
 type: string
 maxLength: 150
 email:
 type: string
 format: email
 title: Email address
 maxLength: 254
 role:
 $ref: '#/components/schemas/RoleEnum'
 oidc\_user\_id:
 type: string
 nullable: true
 required:
 \- id
 EvidenceData:
 type: object
 properties:
 id:
 type: integer
 readOnly: true
 created\_at:
 type: string
 format: date-time
 readOnly: true
 updated\_at:
 type: string
 format: date-time
 readOnly: true
 data:
 type: string
 investigation:
 type: integer
 required:
 \- created\_at
 \- data
 \- id
 \- investigation
 \- updated\_at
 FileTypeEnum:
 enum:
 \- single\_file
 \- archive
 type: string
 description: \|-
 \\* \`single\_file\` - single\_file
 \\* \`archive\` - archive
 FullCustomStrategy:
 type: object
 description: A serializer for a combined strategy and one of its versions.
 properties:
 id:
 type: integer
 readOnly: true
 internal\_origin\_uuid:
 type: string
 format: uuid
 readOnly: true
 created\_at:
 type: string
 format: date-time
 readOnly: true
 updated\_at:
 type: string
 format: date-time
 readOnly: true
 title:
 type: string
 readOnly: true
 rationale:
 type: string
 readOnly: true
 nullable: true
 toggle\_guidance:
 type: string
 readOnly: true
 nullable: true
 is\_enabled:
 type: boolean
 readOnly: true
 is\_archived:
 type: boolean
 readOnly: true
 is\_protected:
 type: boolean
 readOnly: true
 version\_id:
 type: integer
 readOnly: true
 attack\_surfaces:
 type: array
 items:
 type: string
 mitre\_tactics:
 type: array
 items:
 type: string
 alert\_sources:
 type: array
 items:
 type: string
 scenario:
 type: string
 nullable: true
 outcomes:
 type: array
 items:
 $ref: '#/components/schemas/CustomOutcome'
 readOnly: true
 instructions:
 type: array
 items:
 $ref: '#/components/schemas/CustomInstruction'
 readOnly: true
 priorities:
 type: array
 items:
 $ref: '#/components/schemas/CustomPriority'
 readOnly: true
 is\_latest:
 type: boolean
 readOnly: true
 total\_usage:
 type: integer
 nullable: true
 readOnly: true
 required:
 \- created\_at
 \- id
 \- instructions
 \- internal\_origin\_uuid
 \- is\_archived
 \- is\_enabled
 \- is\_latest
 \- is\_protected
 \- outcomes
 \- priorities
 \- rationale
 \- title
 \- toggle\_guidance
 \- total\_usage
 \- updated\_at
 \- version\_id
 ImportResult:
 type: object
 description: Serializer for ImportResult dataclass from threat intelligence
 imports
 properties:
 file\_type:
 nullable: true
 description: \|-
 Type of file processed

\\* \`single\_file\` - single\_file
 \\* \`archive\` - archive
 oneOf:
 \- $ref: '#/components/schemas/FileTypeEnum'
 \- $ref: '#/components/schemas/NullEnum'
 collection\_id:
 type: string
 nullable: true
 description: UUID of the collection
 collection\_name:
 type: string
 nullable: true
 description: Name of the collection
 file\_name:
 type: string
 nullable: true
 description: Name of the uploaded file
 file\_hash:
 type: string
 nullable: true
 description: SHA-256 hash of the uploaded file
 files\_processed:
 type: integer
 description: Number of files processed (0 for single files)
 files\_succeeded:
 type: integer
 description: Number of files that succeeded (0 for single files)
 files\_failed:
 type: integer
 description: Number of files that failed (0 for single files)
 files\_parsed:
 type: array
 items:
 type: string
 description: List of filenames that were successfully parsed (empty for
 single files)
 files\_errored:
 type: array
 items:
 type: string
 description: List of filenames that had errors (empty for single files)
 files\_skipped:
 type: array
 items:
 type: object
 additionalProperties: {}
 description: List of skipped files with reasons. Each entry has 'filename'
 and 'reason' keys. (empty for single files)
 total\_objects:
 type: integer
 description: Total STIX objects processed
 indicators:
 allOf:
 \- $ref: '#/components/schemas/ObjectCounts'
 description: Indicator counts
 domain\_objects:
 allOf:
 \- $ref: '#/components/schemas/ObjectCounts'
 description: Domain object counts
 relationships:
 allOf:
 \- $ref: '#/components/schemas/ObjectCounts'
 description: Relationship counts
 sightings:
 allOf:
 \- $ref: '#/components/schemas/ObjectCounts'
 description: Sighting counts
 error\_count:
 type: integer
 description: Total number of errors
 readOnly: true
 required:
 \- domain\_objects
 \- error\_count
 \- files\_errored
 \- files\_failed
 \- files\_parsed
 \- files\_processed
 \- files\_skipped
 \- files\_succeeded
 \- indicators
 \- relationships
 \- sightings
 \- total\_objects
 IntegrationDefinitionSerializerToCustomer:
 type: object
 description: \|-
 Serializer for integration definitions/types in customer API.
 Used for GET /api/v1/system/integration-definitions.

Returns the blueprint for each integration type including its configuration schema.
 Use this to discover what integrations are available and what config fields they require.
 properties:
 slug:
 type: string
 readOnly: true
 description: Unique slug for the integration (e.g., 'crowdstrike')
 display\_name:
 type: string
 readOnly: true
 description: Human-readable integration name
 description:
 type: string
 readOnly: true
 nullable: true
 description: Description of the integration's capabilities
 docs\_url:
 type: string
 readOnly: true
 nullable: true
 description: URL to integration documentation
 group:
 type: string
 readOnly: true
 description: 'Integration group: ''cloud'', ''prem'', or ''saas'''
 categories:
 type: array
 items:
 type: string
 readOnly: true
 description: Categories (e.g., \['EDR'\], \['Identity'\])
 config\_schema:
 readOnly: true
 description: JSON Schema defining required and optional configuration fields
 for this integration
 connector\_support:
 type: string
 readOnly: true
 description: 'Connector requirement: ''no\_connector'', ''optional\_connector'',
 or ''required\_connector'''
 has\_scanner:
 type: string
 readOnly: true
 description: 'Scanner capability: ''no\_scan'', ''optional\_scan'', or ''required\_scan'''
 allows\_multi\_slot:
 type: boolean
 readOnly: true
 description: Whether multiple instances of this integration can be configured
 (e.g., multiple AWS accounts)
 dz\_provided:
 type: boolean
 description: Whether this integration type can be Dropzone-provided (configured
 with Dropzone-managed keys)
 readOnly: true
 required:
 \- allows\_multi\_slot
 \- categories
 \- config\_schema
 \- connector\_support
 \- description
 \- display\_name
 \- docs\_url
 \- dz\_provided
 \- group
 \- has\_scanner
 \- slug
 IntegrationInstanceSerializerToCustomerCreate:
 type: object
 description: \|-
 Serializer for creating integration instances via customer API.
 Used for POST /api/v1/integrations/{slug}.
 properties:
 config\_data:
 description: Configuration data matching the integration's config\_schema.
 Include all required fields.
 tenant\_union\_id:
 type: integer
 nullable: true
 description: (Optional) Tenant union ID for multi-tenant integrations. Only
 use if you need separate integration configs per tenant union.
 connector\_slug:
 type: string
 nullable: true
 description: (Optional) Connector slug for on-premises integrations requiring
 a connector. Only needed if the integration requires a connector.
 is\_enabled:
 type: boolean
 default: true
 description: 'Whether to enable the integration immediately (default: true)'
 required:
 \- config\_data
 IntegrationInstanceSerializerToCustomerLight:
 type: object
 description: \|-
 Lightweight serializer for listing integration instances in customer API.
 Does NOT include config\_data - use GET /api/v1/integrations/{slug}/{uuid} for full details.
 properties:
 slug:
 type: string
 readOnly: true
 description: Unique slug for the integration type (e.g., 'crowdstrike',
 'aws')
 display\_name:
 type: string
 readOnly: true
 description: Human-readable name of the integration
 description:
 type: string
 readOnly: true
 nullable: true
 description: Description of the integration
 group:
 type: string
 readOnly: true
 nullable: true
 description: 'Integration group: ''cloud'', ''prem'', or ''saas'''
 categories:
 type: array
 items:
 type: string
 readOnly: true
 description: Categories this integration belongs to (e.g., \['EDR'\])
 slot\_uuid:
 type: string
 format: uuid
 readOnly: true
 description: Unique identifier for this specific instance
 tenant\_union:
 allOf:
 \- $ref: '#/components/schemas/TenantUnion'
 readOnly: true
 nullable: true
 description: Tenant union for this integration instance (if applicable)
 is\_enabled:
 type: boolean
 readOnly: true
 description: Whether the integration is enabled
 status:
 type: string
 readOnly: true
 description: 'Connection status: ''connected'', ''disconnected'', ''error'',
 ''pending'', ''disabled'', or ''never\_connected'''
 dz\_provided:
 type: boolean
 readOnly: true
 description: Whether this is a Dropzone-provided integration (vs customer-configured)
 created\_at:
 type: string
 format: date-time
 readOnly: true
 description: When this integration instance was created
 updated\_at:
 type: string
 format: date-time
 readOnly: true
 description: When this integration instance was last updated
 required:
 \- categories
 \- created\_at
 \- description
 \- display\_name
 \- dz\_provided
 \- group
 \- is\_enabled
 \- slot\_uuid
 \- slug
 \- status
 \- tenant\_union
 \- updated\_at
 IntegrationInstanceSerializerToCustomerTest:
 type: object
 description: \|-
 Serializer for testing integration configuration via customer API.
 Used for POST /api/v1/integrations/{slug}/test.
 properties:
 config\_data:
 description: Configuration data to test (does not modify the saved configuration)
 tenant\_union\_id:
 type: integer
 nullable: true
 description: (Optional) Tenant union ID to use for testing. Only use if
 testing multi-tenant integration configs.
 connector\_slug:
 type: string
 nullable: true
 description: (Optional) Connector slug to use for testing. Only needed if
 testing integrations that require a connector.
 required:
 \- config\_data
 IntegrationInstancesListResponse:
 type: object
 properties:
 instances:
 type: array
 items:
 $ref: '#/components/schemas/IntegrationInstanceSerializerToCustomerLight'
 required:
 \- instances
 IntegrationSlotSerializerToCustomerFull:
 type: object
 description: \|-
 Full serializer for integration instances in customer API.
 Used for GET /api/v1/integrations/{slug}/{uuid} - includes config\_data.

This returns complete details including configuration data (with passwords masked).
 For listing many instances without config, use GET /api/v1/integrations/{slug} instead.
 properties:
 slug:
 type: string
 readOnly: true
 description: Integration type slug (e.g., 'crowdstrike')
 display\_name:
 type: string
 readOnly: true
 description: Human-readable integration name
 description:
 type: string
 readOnly: true
 nullable: true
 description: Integration description
 docs\_url:
 type: string
 readOnly: true
 nullable: true
 description: URL to integration documentation
 group:
 type: string
 readOnly: true
 description: 'Integration group: ''cloud'', ''prem'', or ''saas'''
 categories:
 type: array
 items:
 type: string
 readOnly: true
 description: Categories (e.g., \['EDR'\])
 config\_schema:
 readOnly: true
 nullable: true
 description: JSON Schema for configuration fields - describes what config\_data
 should contain
 connector\_support:
 type: string
 readOnly: true
 description: Connector requirement level for this integration
 has\_scanner:
 type: string
 readOnly: true
 description: Scanner capability level for this integration
 allows\_multi\_slot:
 type: boolean
 readOnly: true
 description: Whether multiple instances can be configured
 slot\_uuid:
 type: string
 format: uuid
 readOnly: true
 description: Unique identifier for this specific instance
 tenant\_union:
 allOf:
 \- $ref: '#/components/schemas/TenantUnion'
 readOnly: true
 nullable: true
 description: Tenant union for this integration instance (if applicable)
 config\_data:
 readOnly: true
 nullable: true
 description: Configuration data for this integration instance (passwords
 are masked with asterisks)
 is\_enabled:
 type: boolean
 readOnly: true
 description: Whether the integration is enabled
 status:
 type: string
 readOnly: true
 description: 'Connection status: ''connected'', ''disconnected'', ''error'',
 ''pending'', etc.'
 dz\_provided:
 type: boolean
 readOnly: true
 description: Whether this is a Dropzone-managed integration (vs customer-configured)
 created\_at:
 type: string
 format: date-time
 readOnly: true
 description: When this integration instance was created
 updated\_at:
 type: string
 format: date-time
 readOnly: true
 description: When this integration instance was last updated
 private\_public\_data:
 type: array
 items:
 type: object
 additionalProperties: {}
 nullable: true
 description: Dropzone-provided configuration data (ARNs, service account
 emails, etc.) that customers need but cannot modify
 readOnly: true
 required:
 \- allows\_multi\_slot
 \- categories
 \- config\_data
 \- config\_schema
 \- connector\_support
 \- created\_at
 \- description
 \- display\_name
 \- docs\_url
 \- dz\_provided
 \- group
 \- has\_scanner
 \- is\_enabled
 \- private\_public\_data
 \- slot\_uuid
 \- slug
 \- status
 \- tenant\_union
 \- updated\_at
 IntegrationTypesListResponse:
 type: object
 properties:
 integrations:
 type: array
 items:
 $ref: '#/components/schemas/IntegrationDefinitionSerializerToCustomer'
 required:
 \- integrations
 Interview:
 type: object
 properties:
 id:
 type: integer
 readOnly: true
 summary:
 type: string
 created\_at:
 type: string
 format: date-time
 readOnly: true
 started\_at:
 type: string
 format: date-time
 readOnly: true
 nullable: true
 updated\_at:
 type: string
 format: date-time
 readOnly: true
 completed\_at:
 type: string
 format: date-time
 nullable: true
 status:
 $ref: '#/components/schemas/InterviewStatusEnum'
 auto\_approved:
 type: boolean
 interviewee\_email:
 type: string
 question:
 type: string
 context:
 type: string
 nullable: true
 chat\_history: {}
 error\_msg:
 type: string
 nullable: true
 communicator:
 type: string
 nullable: true
 investigation:
 type: integer
 nullable: true
 required:
 \- created\_at
 \- id
 \- interviewee\_email
 \- question
 \- started\_at
 \- summary
 \- updated\_at
 InterviewStatusEnum:
 enum:
 \- pending
 \- approved
 \- active
 \- finished
 \- finished\_with\_referral
 \- declined
 \- failed
 \- timed\_out
 \- canceled
 type: string
 description: \|-
 \\* \`pending\` - pending
 \\* \`approved\` - approved
 \\* \`active\` - active
 \\* \`finished\` - finished
 \\* \`finished\_with\_referral\` - finished\_with\_referral
 \\* \`declined\` - declined
 \\* \`failed\` - failed
 \\* \`timed\_out\` - timed\_out
 \\* \`canceled\` - canceled
 Investigation:
 oneOf:
 \- $ref: '#/components/schemas/InvestigationFull'
 \- $ref: '#/components/schemas/InvestigationLight'
 InvestigationFeedbackPatch:
 type: object
 description: \|-
 Validates the \`feedback\` patch object accepted by the external feedback
 endpoints (single and bulk). Every field is optional so callers can patch
 any subset of the feedback.
 properties:
 status:
 $ref: '#/components/schemas/Status8faEnum'
 outcome:
 $ref: '#/components/schemas/Outcome4acEnum'
 priority:
 $ref: '#/components/schemas/PriorityEnum'
 outcome\_note:
 type: string
 exclude\_learning:
 type: boolean
 description: Set true to exclude from context memory generation
 InvestigationFull:
 type: object
 properties:
 id:
 type: integer
 readOnly: true
 inv\_url:
 type: string
 readOnly: true
 created\_at:
 type: string
 format: date-time
 readOnly: true
 updated\_at:
 type: string
 format: date-time
 readOnly: true
 alert:
 $ref: '#/components/schemas/ScriptVarSerializer\_Alert'
 start\_time:
 type: string
 format: date-time
 nullable: true
 status:
 $ref: '#/components/schemas/StatusE6aEnum'
 canceled:
 nullable: true
 oneOf:
 \- $ref: '#/components/schemas/CanceledEnum'
 \- $ref: '#/components/schemas/NullEnum'
 error\_msg:
 type: string
 nullable: true
 generated\_time:
 type: string
 format: date-time
 nullable: true
 exec\_summary:
 type: string
 nullable: true
 alert\_summary:
 type: string
 nullable: true
 attack\_surface:
 type: string
 nullable: true
 mitre\_tactic:
 type: string
 nullable: true
 priority:
 nullable: true
 oneOf:
 \- $ref: '#/components/schemas/PriorityEnum'
 \- $ref: '#/components/schemas/NullEnum'
 outcome:
 nullable: true
 oneOf:
 \- $ref: '#/components/schemas/Outcome982Enum'
 \- $ref: '#/components/schemas/NullEnum'
 conclusion:
 type: string
 readOnly: true
 conclusion\_summary:
 type: string
 nullable: true
 insight\_tags: {}
 findings: {}
 key\_findings: {}
 findings\_ranking: {}
 recommended\_remediations: {}
 related\_alert\_hypothesis:
 nullable: true
 interview\_proposals: {}
 custom\_outcome:
 type: object
 additionalProperties: {}
 nullable: true
 readOnly: true
 feedback:
 $ref: '#/components/schemas/ScriptVarSerializer\_InvestigationFeedback'
 remediation\_action\_runs:
 type: array
 items:
 $ref: '#/components/schemas/ScriptVarSerializer\_RemediationActionRun'
 readOnly: true
 ignored\_for\_investigation\_id:
 type: integer
 nullable: true
 readOnly: true
 required:
 \- alert
 \- conclusion
 \- created\_at
 \- custom\_outcome
 \- feedback
 \- id
 \- ignored\_for\_investigation\_id
 \- inv\_url
 \- remediation\_action\_runs
 \- updated\_at
 InvestigationLight:
 type: object
 description: \|-
 A lightweight investigation serializer that only picks up certain fields.

Notably, we exclude:
 \- no alert
 \- no feedback
 \- no findings

On the contrary, we \*include\* custom\_outcome via annotation
 properties:
 id:
 type: integer
 readOnly: true
 status:
 $ref: '#/components/schemas/StatusE6aEnum'
 error\_msg:
 type: string
 nullable: true
 alert\_summary:
 type: string
 nullable: true
 attack\_surface:
 type: string
 nullable: true
 mitre\_tactic:
 type: string
 nullable: true
 priority:
 nullable: true
 oneOf:
 \- $ref: '#/components/schemas/PriorityEnum'
 \- $ref: '#/components/schemas/NullEnum'
 conclusion:
 type: string
 readOnly: true
 conclusion\_summary:
 type: string
 nullable: true
 insight\_tags: {}
 key\_findings: {}
 recommended\_remediations: {}
 inv\_url:
 type: string
 readOnly: true
 custom\_outcome:
 type: object
 additionalProperties: {}
 nullable: true
 readOnly: true
 detection\_objective:
 type: string
 nullable: true
 required:
 \- conclusion
 \- custom\_outcome
 \- id
 \- inv\_url
 InvestigationNoteNested:
 type: object
 properties:
 id:
 type: integer
 readOnly: true
 user:
 $ref: '#/components/schemas/CustomUser'
 created\_at:
 type: string
 format: date-time
 readOnly: true
 updated\_at:
 type: string
 format: date-time
 readOnly: true
 text:
 type: string
 investigation:
 type: integer
 required:
 \- created\_at
 \- id
 \- investigation
 \- updated\_at
 \- user
 InvestigationThreshold:
 type: object
 properties:
 id:
 type: integer
 readOnly: true
 max\_invs:
 type: integer
 minimum: 0
 description: Maximum investigations per time window (0 = block all)
 time\_unit:
 allOf:
 \- $ref: '#/components/schemas/TimeUnitEnum'
 description: \|-
 Valid: \['hour', 'day', 'week', 'month'\]

\\* \`hour\` - Hour
 \\* \`day\` - Day
 \\* \`week\` - Week
 \\* \`month\` - Month
 max\_by\_alert\_source:
 type: object
 description: 'Per-source limits (0 = block). Valid keys: \[''Check Point'',\
 ''Check Point Harmony Email & Collaboration'', ''Gem'', ''Panther'', ''CrowdStrike''\]...'
 additionalProperties:
 type: integer
 minimum: 0
 example:
 CrowdStrike: 50
 created\_at:
 type: string
 format: date-time
 readOnly: true
 updated\_at:
 type: string
 format: date-time
 readOnly: true
 is\_enabled:
 type: boolean
 last\_exceeded\_window\_start:
 readOnly: true
 required:
 \- created\_at
 \- id
 \- last\_exceeded\_window\_start
 \- max\_by\_alert\_source
 \- max\_invs
 \- time\_unit
 \- updated\_at
 MttxBreakdownStats:
 type: object
 description: Mean, median, p95 for one MTTX bucket (total or per source).
 properties:
 item\_count:
 type: integer
 nullable: true
 mean:
 type: number
 format: double
 median:
 type: number
 format: double
 p95:
 type: number
 format: double
 required:
 \- mean
 \- median
 \- p95
 MttxContainer:
 type: object
 description: Aggregate stats plus per alert-source breakdown.
 properties:
 total:
 $ref: '#/components/schemas/MttxBreakdownStats'
 by\_source:
 type: object
 additionalProperties:
 $ref: '#/components/schemas/MttxBreakdownStats'
 description: Keyed by alert direct source label
 required:
 \- by\_source
 \- total
 MttxPerInvestigationResponse:
 type: object
 description: Per-investigation MTTD, MTTP, MTTI in seconds (float), keyed by
 investigation id.
 properties:
 mttd:
 type: object
 additionalProperties:
 type: number
 format: double
 description: Investigation id (string key) to seconds
 mttp:
 type: object
 additionalProperties:
 type: number
 format: double
 description: Investigation id (string key) to seconds
 mtti:
 type: object
 additionalProperties:
 type: number
 format: double
 description: Investigation id (string key) to seconds
 required:
 \- mttd
 \- mtti
 \- mttp
 MttxResponse:
 type: object
 description: 'System-level MTTX: MTTC, MTTD, MTTP, MTTI with totals and by\_source.'
 properties:
 mttc:
 $ref: '#/components/schemas/MttxContainer'
 mttd:
 $ref: '#/components/schemas/MttxContainer'
 mttp:
 $ref: '#/components/schemas/MttxContainer'
 mtti:
 $ref: '#/components/schemas/MttxContainer'
 required:
 \- mttc
 \- mttd
 \- mtti
 \- mttp
 NullEnum:
 enum:
 \- null
 ObjectCounts:
 type: object
 description: Serializer for ObjectCounts dataclass
 properties:
 found:
 type: integer
 description: Number of objects found
 created:
 type: integer
 description: Number of objects created
 updated:
 type: integer
 description: Number of objects updated
 skipped:
 type: integer
 description: Number of objects skipped
 required:
 \- created
 \- found
 \- skipped
 \- updated
 Outcome4acEnum:
 enum:
 \- COMPLETED\_BREACHED\_CONFIRMED
 \- COMPLETED\_BREACHED\_SUSPICIOUS
 \- COMPLETED\_FALSE\_ALERT
 \- INCOMPLETE
 \- IGNORED
 type: string
 description: \|-
 \\* \`COMPLETED\_BREACHED\_CONFIRMED\` - Malicious
 \\* \`COMPLETED\_BREACHED\_SUSPICIOUS\` - Suspicious
 \\* \`COMPLETED\_FALSE\_ALERT\` - Benign
 \\* \`INCOMPLETE\` - Inconclusive
 \\* \`IGNORED\` - Ignored
 Outcome982Enum:
 enum:
 \- COMPLETED\_BREACHED\_CONFIRMED
 \- COMPLETED\_BREACHED\_SUSPICIOUS
 \- COMPLETED\_FALSE\_ALERT
 \- INCOMPLETE
 \- IGNORED
 type: string
 description: \|-
 \\* \`COMPLETED\_BREACHED\_CONFIRMED\` - COMPLETED\_BREACHED\_CONFIRMED
 \\* \`COMPLETED\_BREACHED\_SUSPICIOUS\` - COMPLETED\_BREACHED\_SUSPICIOUS
 \\* \`COMPLETED\_FALSE\_ALERT\` - COMPLETED\_FALSE\_ALERT
 \\* \`INCOMPLETE\` - INCOMPLETE
 \\* \`IGNORED\` - IGNORED
 OutcomesEnum:
 enum:
 \- COMPLETED\_BREACHED\_CONFIRMED
 \- COMPLETED\_BREACHED\_SUSPICIOUS
 \- COMPLETED\_FALSE\_ALERT
 \- INCOMPLETE
 \- IGNORED
 type: string
 description: \|-
 \\* \`COMPLETED\_BREACHED\_CONFIRMED\` - COMPLETED\_BREACHED\_CONFIRMED
 \\* \`COMPLETED\_BREACHED\_SUSPICIOUS\` - COMPLETED\_BREACHED\_SUSPICIOUS
 \\* \`COMPLETED\_FALSE\_ALERT\` - COMPLETED\_FALSE\_ALERT
 \\* \`INCOMPLETE\` - INCOMPLETE
 \\* \`IGNORED\` - IGNORED
 PaginatedContextMemoryList:
 type: object
 properties:
 count:
 type: integer
 description: Total number of matching items
 next:
 type: string
 format: uri
 nullable: true
 description: URL to next page
 previous:
 type: string
 format: uri
 nullable: true
 description: URL to previous page
 results:
 type: array
 items:
 $ref: '#/components/schemas/ContextMemoryItemToCustomer'
 required:
 \- count
 \- next
 \- previous
 \- results
 PaginatedInvestigationList:
 type: object
 properties:
 count:
 type: integer
 description: Total number of investigations
 next:
 type: string
 format: uri
 nullable: true
 description: URL to next page of results
 previous:
 type: string
 format: uri
 nullable: true
 description: URL to previous page of results
 results:
 type: array
 items:
 $ref: '#/components/schemas/Investigation'
 required:
 \- count
 \- next
 \- previous
 \- results
 PatchedBulkInvestigationFeedbackRequest:
 type: object
 description: Request body for updating feedback on multiple investigations at
 once.
 properties:
 investigation\_ids:
 type: array
 items:
 type: integer
 feedback:
 $ref: '#/components/schemas/InvestigationFeedbackPatch'
 PatchedIntegrationInstanceSerializerToCustomerUpdate:
 type: object
 description: \|-
 Serializer for updating integration instances via customer API.
 Used for PATCH /api/v1/integrations/{slug}/{uuid}.
 properties:
 config\_data:
 description: New configuration data (must include all required fields from
 config\_schema)
 tenant\_union\_id:
 type: integer
 nullable: true
 description: (Optional) Update the tenant union for this integration. Only
 use if you need separate integration configs per tenant union.
 connector\_slug:
 type: string
 nullable: true
 description: (Optional) Update the connector for this integration. Only
 needed if the integration requires a connector.
 is\_enabled:
 type: boolean
 description: Enable or disable the integration
 PatchedInvestigationFeedbackRequest:
 type: object
 description: Request body for updating feedback on a single investigation.
 properties:
 feedback:
 $ref: '#/components/schemas/InvestigationFeedbackPatch'
 PatchedInvestigationThreshold:
 type: object
 properties:
 id:
 type: integer
 readOnly: true
 max\_invs:
 type: integer
 minimum: 0
 description: Maximum investigations per time window (0 = block all)
 time\_unit:
 allOf:
 \- $ref: '#/components/schemas/TimeUnitEnum'
 description: \|-
 Valid: \['hour', 'day', 'week', 'month'\]

\\* \`parsing\` - Parsing
 \\* \`active\` - Active
 \\* \`deleted\` - Deleted
 \\* \`error\` - Error
 created\_at:
 type: string
 format: date-time
 readOnly: true
 updated\_at:
 type: string
 format: date-time
 readOnly: true
 created\_by:
 type: integer
 nullable: true
 description: User ID who created the collection. None indicates System user.
 readOnly: true
 updated\_by:
 type: integer
 nullable: true
 description: User ID who last updated the collection. None indicates System
 user.
 readOnly: true
 file\_info:
 type: object
 additionalProperties:
 type: object
 properties:
 type:
 type: string
 enum:
 \- single\_file
 \- archive
 description: 'File type: ''single\_file'' for individual JSON files,
 ''archive'' for ZIP/TAR archives'
 hash:
 type: string
 description: SHA-256 hash of the uploaded file or archive
 imported\_at:
 type: string
 description: ISO 8601 timestamp when file was imported
 indicators\_created:
 type: integer
 description: Number of indicators created from this file or archive
 indicators\_updated:
 type: integer
 description: Number of indicators updated from this file or archive
 total\_objects:
 type: integer
 description: Total STIX objects processed from this file or archive
 files\_processed:
 type: integer
 description: Number of files processed from the archive (only present
 for archives)
 files\_succeeded:
 type: integer
 description: Number of files that succeeded (only present for archives)
 files\_failed:
 type: integer
 description: Number of files that failed (only present for archives)
 files\_parsed:
 type: array
 items:
 type: string
 description: List of filenames that were successfully parsed (only
 present for archives)
 files\_errored:
 type: array
 items:
 type: string
 description: List of filenames that had errors (only present for archives)
 files\_skipped:
 type: array
 items:
 type: object
 properties:
 filename:
 type: string
 reason:
 type: string
 required:
 \- filename
 \- reason
 description: List of skipped files with reasons (only present for
 archives)
 required:
 \- type
 \- hash
 \- imported\_at
 \- indicators\_created
 \- indicators\_updated
 \- total\_objects
 example:
 threat\_intel\_bundle.json:
 type: single\_file
 hash: a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456
 imported\_at: '2024-01-15T10:30:00Z'
 indicators\_created: 150
 indicators\_updated: 25
 total\_objects: 200
 threat\_feeds\_archive.tar.gz:
 type: archive
 hash: b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef1234567890
 imported\_at: '2024-01-15T10:30:00Z'
 files\_processed: 10
 files\_succeeded: 8
 files\_failed: 1
 files\_parsed:
 \- threat\_feed\_1.json
 \- threat\_feed\_2.json
 \- threat\_feed\_3.json
 \- threat\_feed\_4.json
 \- threat\_feed\_5.json
 \- threat\_feed\_6.json
 \- threat\_feed\_7.json
 \- threat\_feed\_8.json
 files\_errored:
 \- invalid\_file.json
 files\_skipped:
 \- filename: \_\_MACOSX/.DS\_Store
 reason: hidden\_file
 \- filename: readme.txt
 reason: not\_json
 indicators\_created: 500
 indicators\_updated: 100
 total\_objects: 750
 description: Dictionary keyed by filename containing file metadata. Each
 entry contains common fields (type, hash, imported\_at, indicators\_created,
 indicators\_updated, total\_objects). Archive entries (type='archive') additionally
 include files\_processed, files\_succeeded, files\_failed, files\_parsed,
 files\_errored, and files\_skipped fields for detailed filename tracking.
 readOnly: true
 indicators\_count:
 type: integer
 description: Get the count of indicators in this collection
 readOnly: true
 dz\_owned:
 type: boolean
 readOnly: true
 default: false
 description: Flag to mark Dropzone-owned collections (e.g., auto-loaded
 threat intel)
 expires\_at:
 type: string
 format: date-time
 readOnly: true
 nullable: true
 description: When set, internal threat intel search excludes this collection
 at and after this date.
 required:
 \- created\_at
 \- created\_by
 \- dz\_owned
 \- expires\_at
 \- file\_info
 \- id
 \- indicators\_count
 \- name
 \- status
 \- updated\_at
 \- updated\_by
 ThreatIntelCollectionList:
 type: object
 properties:
 collections:
 type: array
 items:
 $ref: '#/components/schemas/ThreatIntelCollection'
 description: Array of collections
 count:
 type: integer
 description: Total number of collections returned
 required:
 \- collections
 \- count
 ThreatIntelCollectionStatusEnum:
 enum:
 \- parsing
 \- active
 \- deleted
 \- error
 type: string
 description: \|-
 \\* \`parsing\` - Parsing
 \\* \`active\` - Active
 \\* \`deleted\` - Deleted
 \\* \`error\` - Error
 TimeUnitEnum:
 enum:
 \- hour
 \- day
 \- week
 \- month
 type: string
 description: \|-
 \\* \`hour\` - Hour
 \\* \`day\` - Day
 \\* \`week\` - Week
 \\* \`month\` - Month
 securitySchemes:
 ApiKeyAuth:
 type: apiKey
 in: header
 name: Authorization