diff --git a/crowdsec_service_api/__init__.py b/crowdsec_service_api/__init__.py index 96a178c..72eadf2 100644 --- a/crowdsec_service_api/__init__.py +++ b/crowdsec_service_api/__init__.py @@ -48,7 +48,7 @@ class Server(Enum): 'BlocklistSources', 'BlocklistStats', 'BlocklistSubscriberEntity', - 'BlocklistSubscribersResponse', + 'BlocklistSubscribersCount', 'BlocklistSubscription', 'BlocklistSubscriptionRequest', 'BlocklistSubscriptionResponse', @@ -80,6 +80,7 @@ class Server(Enum): 'PageAllowlistGetItemsResponse', 'PageAllowlistGetResponse', 'PageAllowlistSubscriberEntity', + 'PageBlocklistSubscriberEntity', 'PageIntegrationGetResponse', 'PagePublicBlocklistResponse', 'Permission', diff --git a/crowdsec_service_api/__pycache__/base_model.cpython-311.pyc b/crowdsec_service_api/__pycache__/base_model.cpython-311.pyc index 539e6c5..b2ba858 100644 Binary files a/crowdsec_service_api/__pycache__/base_model.cpython-311.pyc and b/crowdsec_service_api/__pycache__/base_model.cpython-311.pyc differ diff --git a/crowdsec_service_api/__pycache__/http_client.cpython-311.pyc b/crowdsec_service_api/__pycache__/http_client.cpython-311.pyc index cf58954..c14df40 100644 Binary files a/crowdsec_service_api/__pycache__/http_client.cpython-311.pyc and b/crowdsec_service_api/__pycache__/http_client.cpython-311.pyc differ diff --git a/crowdsec_service_api/models.py b/crowdsec_service_api/models.py index 600fcd6..83c2228 100644 --- a/crowdsec_service_api/models.py +++ b/crowdsec_service_api/models.py @@ -1,6 +1,6 @@ # generated by datamodel-codegen: # filename: -# timestamp: 2025-04-01T14:11:38+00:00 +# timestamp: 2025-04-16T07:12:57+00:00 from __future__ import annotations @@ -724,7 +724,7 @@ class BlocklistsUploadBlocklistContentQueryParameters(BaseModelSdk): Optional[datetime], Field( description='Blocklist expiration', - examples='2025-04-01T14:11:16.563106+00:00', + examples='2025-04-16T07:12:36.323875+00:00', title='Expiration', ), ] = None @@ -783,6 +783,15 @@ class BlocklistsSubscribeBlocklistPathParameters(BaseModelSdk): ] +class BlocklistsGetBlocklistSubscribersQueryParameters(BaseModelSdk): + page: Annotated[ + Optional[int], Field(description='Page number', ge=1, title='Page') + ] = 1 + size: Annotated[ + Optional[int], Field(description='Page size', ge=1, le=100, title='Size') + ] = 50 + + class BlocklistsGetBlocklistSubscribersPathParameters(BaseModelSdk): blocklist_id: Annotated[ str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Blocklist Id') @@ -1185,11 +1194,11 @@ class BlocklistSubscriberEntity(BaseModelSdk): remediation: Annotated[str, Field(description='Remediation', title='Remediation')] -class BlocklistSubscribersResponse(BaseModelSdk): - subscribers: Annotated[ - List[BlocklistSubscriberEntity], - Field(description='List of subscribers', title='Subscribers'), +class BlocklistSubscribersCount(BaseModelSdk): + entity_type: Annotated[ + SubscriberEntityType, Field(description='Subscriber entity type') ] + count: Annotated[int, Field(description='Subscriber entity count', title='Count')] class BlocklistSubscriptionRequest(BaseModelSdk): @@ -1463,6 +1472,15 @@ class PageAllowlistSubscriberEntity(BaseModelSdk): links: Links +class PageBlocklistSubscriberEntity(BaseModelSdk): + items: Annotated[List[BlocklistSubscriberEntity], Field(title='Items')] + total: Annotated[Optional[Total], Field(title='Total')] = None + page: Annotated[Optional[Page], Field(title='Page')] = None + size: Annotated[Optional[Size], Field(title='Size')] = None + pages: Annotated[Optional[Pages], Field(title='Pages')] = None + links: Links + + class PageIntegrationGetResponse(BaseModelSdk): items: Annotated[List[IntegrationGetResponse], Field(title='Items')] total: Annotated[Optional[Total], Field(title='Total')] = None @@ -1536,7 +1554,7 @@ class PublicBlocklistResponse(BaseModelSdk): ), ] = None subscribers: Annotated[ - Optional[List[BlocklistSubscriberEntity]], + Optional[List[BlocklistSubscribersCount]], Field( description='List of subscribers to the blocklist. Only subscribers belonging to your organization are returned', title='Subscribers', diff --git a/crowdsec_service_api/services/__pycache__/__init__.cpython-311.pyc b/crowdsec_service_api/services/__pycache__/__init__.cpython-311.pyc index dde5e18..83e67d2 100644 Binary files a/crowdsec_service_api/services/__pycache__/__init__.cpython-311.pyc and b/crowdsec_service_api/services/__pycache__/__init__.cpython-311.pyc differ diff --git a/crowdsec_service_api/services/blocklists.py b/crowdsec_service_api/services/blocklists.py index 167efed..96c76d2 100644 --- a/crowdsec_service_api/services/blocklists.py +++ b/crowdsec_service_api/services/blocklists.py @@ -230,11 +230,17 @@ def download_blocklist_content( def get_blocklist_subscribers( self, blocklist_id: str, - )-> BlocklistSubscribersResponse: + page: int = 1, + size: int = 50, + )-> Page[BlocklistSubscriberEntity]: endpoint_url = "/blocklists/{blocklist_id}/subscribers" loc = locals() headers = {} - params = {} + params = json.loads( + BlocklistsGetBlocklistSubscribersQueryParameters(**loc).model_dump_json( + exclude_none=True + ) + ) path_params = json.loads( BlocklistsGetBlocklistSubscribersPathParameters(**loc).model_dump_json( exclude_none=True @@ -245,7 +251,7 @@ def get_blocklist_subscribers( url=endpoint_url, path_params=path_params, params=params, headers=headers ) - return BlocklistSubscribersResponse(**response.json()) + return Page[BlocklistSubscriberEntity](_client=self, **response.json()) def subscribe_blocklist( self, diff --git a/doc/Blocklists.md b/doc/Blocklists.md index 28e4936..ff18353 100644 --- a/doc/Blocklists.md +++ b/doc/Blocklists.md @@ -385,8 +385,10 @@ print(response) | Parameter | Type | Description | Required | Default | | --------- | ---- | ----------- | -------- | ------- | | blocklist_id | str | | True | | +| page | int | Page number | False | 1 | +| size | int | Page size | False | 50 | ### Returns: -[BlocklistSubscribersResponse](./Models.md#blocklistsubscribersresponse) +[Page[BlocklistSubscriberEntity]](./Models.md#page[blocklistsubscriberentity]) ### Errors: | Code | Description | | ---- | ----------- | @@ -404,6 +406,8 @@ auth = ApiKeyAuth(api_key='your_api_key') client = Blocklists(base_url=Server.production_server.value, auth=auth) response = client.get_blocklist_subscribers( blocklist_id='sample-blocklist-id', + page=1, + size=50, ) print(response) ``` diff --git a/doc/Models.md b/doc/Models.md index 98e7743..8e4c2ec 100644 --- a/doc/Models.md +++ b/doc/Models.md @@ -311,13 +311,14 @@ id, entity_type, remediation | entity_type | str | None || | remediation | str | Remediation || -# **BlocklistSubscribersResponse** +# **BlocklistSubscribersCount** ## Required: -subscribers +entity_type, count ## Properties | Property | Type | Description | Example | |----------|------|-------------|---------| -| subscribers | list[BlocklistSubscriberEntity] | List of subscribers || +| entity_type | str | None || +| count | int | Subscriber entity count || # **BlocklistSubscription** ## Required: @@ -644,6 +645,19 @@ items, total, page, size, links | pages | Optional[int] | None || | links | Links | None || +# **Page_BlocklistSubscriberEntity_** +## Required: +items, total, page, size, links +## Properties +| Property | Type | Description | Example | +|----------|------|-------------|---------| +| items | list[BlocklistSubscriberEntity] | None || +| total | Optional[int] | None || +| page | Optional[int] | None || +| size | Optional[int] | None || +| pages | Optional[int] | None || +| links | Links | None || + # **Page_IntegrationGetResponse_** ## Required: items, total, page, size, links @@ -700,7 +714,7 @@ id, created_at, updated_at, name, description, is_private, pricing_tier, source, | since | Optional[str] | Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days || | shared_with | list[Share] | List of organizations shared with || | organization_id | Optional[str] | Blocklists owner's organization id || -| subscribers | list[BlocklistSubscriberEntity] | List of subscribers to the blocklist. Only subscribers belonging to your organization are returned || +| subscribers | list[BlocklistSubscribersCount] | List of subscribers to the blocklist. Only subscribers belonging to your organization are returned || | categories | list[BlocklistCategory] | List of categories for the blocklist || # **PublicPaginatedBlocklistResponse** diff --git a/doc/README.md b/doc/README.md index 2de5084..710a069 100644 --- a/doc/README.md +++ b/doc/README.md @@ -83,7 +83,7 @@ You can find a Quickstart about this SDK, following this [documentation](https:/ [BlocklistSubscriberEntity](./Models.md#blocklistsubscriberentity) -[BlocklistSubscribersResponse](./Models.md#blocklistsubscribersresponse) +[BlocklistSubscribersCount](./Models.md#blocklistsubscriberscount) [BlocklistSubscription](./Models.md#blocklistsubscription) @@ -147,6 +147,8 @@ You can find a Quickstart about this SDK, following this [documentation](https:/ [PageAllowlistSubscriberEntity](./Models.md#pageallowlistsubscriberentity) +[PageBlocklistSubscriberEntity](./Models.md#pageblocklistsubscriberentity) + [PageIntegrationGetResponse](./Models.md#pageintegrationgetresponse) [PagePublicBlocklistResponse](./Models.md#pagepublicblocklistresponse) diff --git a/openapi.json b/openapi.json index b9faf1d..199c062 100644 --- a/openapi.json +++ b/openapi.json @@ -1 +1 @@ -{"openapi": "3.1.0", "info": {"title": "Service API", "description": "This is the API to manage Crowdsec services", "contact": {"name": "CrowdSec", "url": "https://crowdsec.net/", "email": "info@crowdsec.net"}, "version": "1.62.0"}, "paths": {"/allowlists": {"post": {"tags": ["Allowlists"], "summary": "Create Allowlist", "description": "Create a new allowlist for an organization", "operationId": "createAllowlist", "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistCreateRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistCreateResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Allowlists"], "summary": "List Allowlists", "description": "List all allowlists for an organization", "operationId": "listAllowlists", "parameters": [{"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number", "default": 1, "title": "Page"}, "description": "Page number"}, {"name": "size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 100, "minimum": 1, "description": "Page size", "default": 50, "title": "Size"}, "description": "Page size"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Page_AllowlistGetResponse_"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/allowlists/{allowlist_id}": {"get": {"tags": ["Allowlists"], "summary": "Get Allowlist", "description": "Get an allowlist by ID", "operationId": "getAllowlist", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistGetResponse"}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "patch": {"tags": ["Allowlists"], "summary": "Update Allowlist", "description": "Update an allowlist by ID", "operationId": "updateAllowlist", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistUpdateRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistUpdateResponse"}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "delete": {"tags": ["Allowlists"], "summary": "Delete Allowlist", "description": "Delete an allowlist by ID", "operationId": "deleteAllowlist", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}, {"name": "force", "in": "query", "required": false, "schema": {"type": "boolean", "description": "Force delete the allowlist, even if it has subscribers", "default": false, "title": "Force"}, "description": "Force delete the allowlist, even if it has subscribers"}], "responses": {"204": {"description": "Successful Response"}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/allowlists/{allowlist_id}/items": {"post": {"tags": ["Allowlists"], "summary": "Create Allowlist Items", "description": "Create items for an allowlist", "operationId": "createAllowlistItems", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistItemsCreateRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Allowlists"], "summary": "Get Allowlist Items", "description": "Get items in an allowlist", "operationId": "getAllowlistItems", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}, {"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number", "default": 1, "title": "Page"}, "description": "Page number"}, {"name": "size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 100, "minimum": 1, "description": "Page size", "default": 50, "title": "Size"}, "description": "Page size"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Page_AllowlistGetItemsResponse_"}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/allowlists/{allowlist_id}/items/{item_id}": {"get": {"tags": ["Allowlists"], "summary": "Get Allowlist Item", "description": "Get an allowlist item by ID", "operationId": "getAllowlistItem", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}, {"name": "item_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Item Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistGetItemsResponse"}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "patch": {"tags": ["Allowlists"], "summary": "Update Allowlist Item", "description": "Update an allowlist item by ID", "operationId": "updateAllowlistItem", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}, {"name": "item_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Item Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistItemUpdateRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistItemUpdateResponse"}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "delete": {"tags": ["Allowlists"], "summary": "Delete Allowlist Item", "description": "Delete an allowlist item by ID", "operationId": "deleteAllowlistItem", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}, {"name": "item_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Item Id"}}], "responses": {"204": {"description": "Successful Response"}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/allowlists/{allowlist_id}/subscribers": {"get": {"tags": ["Allowlists"], "summary": "Get Allowlist Subscribers", "description": "Get subscribers of an allowlist", "operationId": "getAllowlistSubscribers", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}, {"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number", "default": 1, "title": "Page"}, "description": "Page number"}, {"name": "size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 100, "minimum": 1, "description": "Page size", "default": 50, "title": "Size"}, "description": "Page size"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Page_AllowlistSubscriberEntity_"}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "post": {"tags": ["Allowlists"], "summary": "Subscribe Allowlist", "description": "Subscribe to an allowlist", "operationId": "subscribeAllowlist", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistSubscriptionRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistSubscriptionResponse"}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/allowlists/{allowlist_id}/subscribers/{entity_id}": {"delete": {"tags": ["Allowlists"], "summary": "Unsubscribe Allowlist", "description": "Unsubscribe from an allowlist", "operationId": "unsubscribeAllowlist", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}, {"name": "entity_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Entity Id"}}], "responses": {"204": {"description": "Successful Response"}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists": {"post": {"tags": ["Blocklists"], "summary": "Create Blocklist", "description": "Create a new blocklist owned by your organization. The name must be unique within your organization. The list will only be visible to your organization and organizations you shared the blocklist with. This operation is submitted to quotas", "operationId": "createBlocklist", "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistCreateRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/PublicBlocklistResponse"}}}}, "409": {"description": "Blocklist already exists"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Blocklists"], "summary": "Get Blocklists", "description": "Get multiple blocklists. Only blocklists owned by your organization, shared with your organization or public blocklists are returned. Filters and pagination are available as query parameters.", "operationId": "getBlocklists", "parameters": [{"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number", "default": 1, "title": "Page"}, "description": "Page number"}, {"name": "page_size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 1000, "description": "Page size", "default": 100, "title": "Page Size"}, "description": "Page size"}, {"name": "subscribed_only", "in": "query", "required": false, "schema": {"type": "boolean", "description": "only subscribed blocklists", "default": false, "title": "Subscribed Only"}, "description": "only subscribed blocklists"}, {"name": "exclude_subscribed", "in": "query", "required": false, "schema": {"type": "boolean", "description": "exclude subscribed blocklists", "default": false, "title": "Exclude Subscribed"}, "description": "exclude subscribed blocklists"}, {"name": "include_filter", "in": "query", "required": false, "schema": {"type": "array", "items": {"$ref": "#/components/schemas/BlocklistIncludeFilters"}, "description": "Include blocklists with the specified filters", "default": ["private", "shared"], "title": "Include Filter"}, "description": "Include blocklists with the specified filters"}, {"name": "category", "in": "query", "required": false, "schema": {"anyOf": [{"type": "array", "items": {"type": "string"}}, {"type": "null"}], "description": "Filter by category", "title": "Category"}, "description": "Filter by category"}, {"name": "size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 100, "minimum": 1, "description": "Page size", "default": 50, "title": "Size"}, "description": "Page size"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Page_PublicBlocklistResponse_"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/search": {"post": {"tags": ["Blocklists"], "summary": "Search Blocklists", "description": "Search blocklists", "operationId": "searchBlocklist", "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistSearchRequest"}}}, "required": true}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/PublicPaginatedBlocklistResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}": {"get": {"tags": ["Blocklists"], "summary": "Get Blocklist", "description": "Get the details of a blocklist by ID. The content of the blocklist is not returned.", "operationId": "getBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/PublicBlocklistResponse"}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "patch": {"tags": ["Blocklists"], "summary": "Update Blocklist", "description": "Update a blocklist's details by ID. It is not possible to update the blocklist content using this operation.", "operationId": "updateBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistUpdateRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/PublicBlocklistResponse"}}}}, "403": {"description": "Blocklist is read-only"}, "404": {"description": "Blocklist not found"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "delete": {"tags": ["Blocklists"], "summary": "Delete Blocklist", "description": "Delete a blocklist by ID. If the blocklist is shared with other organizations or it has subscriptions, the operation will fail. If you want to force delete the blocklist, you can use the force query parameter, so the blocklists will be unshared / unsubscribed.", "operationId": "deleteBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "force", "in": "query", "required": false, "schema": {"type": "boolean", "description": "Force delete the blocklist if it is shared or subscribed", "default": false, "title": "Force"}, "description": "Force delete the blocklist if it is shared or subscribed"}], "responses": {"204": {"description": "Successful Response"}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/upload": {"post": {"tags": ["Blocklists"], "summary": "Upload Blocklist Content", "description": "Upload a blocklist. The file must be in txt format with one IP per line. This operation will overwrite the existing blocklist content.", "operationId": "uploadBlocklistContent", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "expiration", "in": "query", "required": false, "schema": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "description": "Blocklist expiration", "examples": "2025-04-01T14:11:16.563106+00:00", "title": "Expiration"}, "description": "Blocklist expiration"}, {"name": "ignore_invalid_ips", "in": "query", "required": false, "schema": {"anyOf": [{"type": "boolean"}, {"type": "null"}], "description": "Ignore invalid IPs", "default": false, "title": "Ignore Invalid Ips"}, "description": "Ignore invalid IPs"}], "requestBody": {"required": true, "content": {"multipart/form-data": {"schema": {"$ref": "#/components/schemas/Body_uploadBlocklistContent"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "400": {"description": "Invalid IP in blocklist file content"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/ips": {"post": {"tags": ["Blocklists"], "summary": "Add Ips To Blocklist", "description": "Add IPs to a blocklist. If an IP is already in the blocklist, its expiration will be updated with the new expiration.", "operationId": "addIpsToBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistAddIPsRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "403": {"description": "Blocklist is read-only"}, "404": {"description": "Blocklist not found"}, "412": {"description": "Payload too large for one operation, limit is 20000 IPs per request"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/ips/delete": {"post": {"tags": ["Blocklists"], "summary": "Delete Ips From Blocklist", "description": "Delete IPs from a blocklist", "operationId": "deleteIpsFromBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistDeleteIPsRequest"}}}}, "responses": {"204": {"description": "Successful Response"}, "403": {"description": "Blocklist is read-only"}, "404": {"description": "Blocklist not found"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/download": {"get": {"tags": ["Blocklists"], "summary": "Download Blocklist Content", "description": "Download blocklist content as a list of ips as plain text separated by new lines. The response will include the ETag header for cache control. If_Modified_Since and If_None_Match cache control headers are supported for conditional requests.", "operationId": "downloadBlocklistContent", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "if-modified-since", "in": "header", "required": false, "schema": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "If_Modified_Since cache control header", "title": "If-Modified-Since"}, "description": "If_Modified_Since cache control header"}, {"name": "if-none-match", "in": "header", "required": false, "schema": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "If_None_Match cache control header", "title": "If-None-Match"}, "description": "If_None_Match cache control header"}], "responses": {"200": {"description": "Successful Response", "content": {"text/plain": {"schema": {"type": "string"}}}}, "404": {"description": "Blocklist not found"}, "204": {"description": "Blocklist is empty"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/subscribers": {"post": {"tags": ["Blocklists"], "summary": "Subscribe Blocklist", "description": "Subscribe to a blocklist with a remediation type. If the entity type is the full organization or a Tag, all the engines belonging to the organization or the Tag will be subscribed and new engines that will join the organization or the Tag will also be automatically subscribed. If the subscription has been done on an organization or Tag you cannot unsubscribe individual engines. In case of errors for some subscribers, the operation will still succeed for the entities that were successfully subscribed and you'll have the list of errors in the operation's result. This operation is submitted to quotas.", "operationId": "subscribeBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistSubscriptionRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistSubscriptionResponse"}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Blocklists"], "summary": "Get Blocklist Subscribers", "description": "Get blocklist subscribers within your organization.", "operationId": "getBlocklistSubscribers", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistSubscribersResponse"}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/subscribers/{entity_id}": {"delete": {"tags": ["Blocklists"], "summary": "Unsubscribe Blocklist", "description": "Unsubscribe from a blocklist. You cannot unsubscribe individual engines if the subscription has been done on an organization or Tag.", "operationId": "unsubscribeBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "entity_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Entity Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/shares": {"post": {"tags": ["Blocklists"], "summary": "Share Blocklist", "description": "Share a blocklist with other organizations given their IDs. The blocklist must be owned by your organization. You can give read-only access or read-write access to the blocklist. Sharing a blocklist will not automatically subscribe the shared organizations to the blocklist.", "operationId": "shareBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistShareRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Blocklist not found"}, "409": {"description": "Blocklist is not private"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/shares/{unshare_organization_id}": {"delete": {"tags": ["Blocklists"], "summary": "Unshare Blocklist", "description": "Unshare a blocklist with other organizations. If the blocklist is subscribed by the organization, the operation will fail.Use force query parameter to unshare a blocklist even if subscriptions exists.", "operationId": "unshareBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "unshare_organization_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Unshare Organization Id"}}], "responses": {"204": {"description": "Successful Response"}, "404": {"description": "Blocklist not found"}, "409": {"description": "Blocklist is not private"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations": {"post": {"tags": ["Integrations"], "summary": "Create Integration", "description": "Create an integration to a firewall or remediation component, owned by your organization. The name should be unique within the organization. This operation is submitted to quotas.", "operationId": "createIntegration", "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationCreateRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationCreateResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Integrations"], "summary": "Get Integrations", "description": "Get integrations owned by your organization", "operationId": "getIntegrations", "parameters": [{"name": "tag", "in": "query", "required": false, "schema": {"anyOf": [{"type": "array", "items": {"type": "string"}}, {"type": "null"}], "description": "List of tags associated with the integrations (any of)", "title": "Tag"}, "description": "List of tags associated with the integrations (any of)"}, {"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number", "default": 1, "title": "Page"}, "description": "Page number"}, {"name": "size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 100, "minimum": 1, "description": "Page size", "default": 50, "title": "Size"}, "description": "Page size"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Page_IntegrationGetResponse_"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations/{integration_id}": {"get": {"tags": ["Integrations"], "summary": "Get Integration", "description": "Get an integration by ID", "operationId": "getIntegration", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Integration Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationGetResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "patch": {"tags": ["Integrations"], "summary": "Update Integration", "description": "Update the integration details", "operationId": "updateIntegration", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Integration Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationUpdateRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationUpdateResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "delete": {"tags": ["Integrations"], "summary": "Delete Integration", "description": "Delete the integration by ID", "operationId": "deleteIntegration", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Integration Id"}}], "responses": {"204": {"description": "Successful Response"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations/{integration_id}/content": {"head": {"tags": ["Integrations"], "summary": "Head Integration Content", "description": "Check if the integration has content", "operationId": "headIntegrationContent", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Integration Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Integration not found"}, "204": {"description": "Integration has no subscribed blocklists or no content available"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Integrations"], "summary": "Get Integration Content", "description": "Get the ips associated to the integration in plain text format. The content can be paginated to accomodate limits in firewalls.", "operationId": "getIntegrationContent", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Integration Id"}}, {"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number to return", "default": 1, "title": "Page"}, "description": "Page number to return"}, {"name": "page_size", "in": "query", "required": false, "schema": {"anyOf": [{"type": "integer", "minimum": 10000}, {"type": "null"}], "description": "Maximum number of items to return, 0 means no limit (default), should be greater than 10000", "title": "Page Size"}, "description": "Maximum number of items to return, 0 means no limit (default), should be greater than 10000"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Integration not found"}, "204": {"description": "Integration has no subscribed blocklists or no content available"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations/{integration_id}/v1/decisions/stream": {"get": {"tags": ["Integrations"], "summary": "Get Integration Content Stream", "description": "Get the ips associated to the integration in a format compatible with a remediation component. As for the remediation components, you can fetch the full content with startup=true or only the changes since the last pull", "operationId": "getIntegrationContentStream", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Integration Id"}}, {"name": "startup", "in": "query", "required": false, "schema": {"type": "boolean", "description": "Set to true if it's the first run to fetch all the content, otherwise only changes since the last pull.", "default": false, "title": "Startup"}, "description": "Set to true if it's the first run to fetch all the content, otherwise only changes since the last pull."}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Integration not found"}, "204": {"description": "Integration has no subscribed blocklists or no content available"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/info": {"get": {"tags": ["Info"], "summary": "Get Me Info", "description": "Get the current user and organization informations", "operationId": "getInfo", "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/InfoResponse"}}}}}}}, "/metrics/remediation": {"get": {"tags": ["Metrics"], "summary": "Get Metrics Remediation", "description": "Get remediation metrics", "operationId": "getMetricsRemediation", "parameters": [{"name": "start_date", "in": "query", "required": false, "schema": {"type": "string", "format": "date-time", "description": "Start date of the metrics, default to last day", "title": "Start Date"}, "description": "Start date of the metrics, default to last day"}, {"name": "end_date", "in": "query", "required": false, "schema": {"type": "string", "format": "date-time", "description": "End date of the metrics", "title": "End Date"}, "description": "End date of the metrics"}, {"name": "engine_ids", "in": "query", "required": false, "schema": {"type": "array", "items": {"type": "string"}, "description": "List of engine ids", "default": [], "title": "Engine Ids"}, "description": "List of engine ids"}, {"name": "tags", "in": "query", "required": false, "schema": {"type": "array", "items": {"type": "string"}, "description": "List of tags", "default": [], "title": "Tags"}, "description": "List of tags"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/GetRemediationMetricsResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/hub/index/{tenant}/{branch}/.index.json": {"get": {"description": "Get a (minimized) index file for 'cscli hub update'. May or may not include unused fields\n(content, long descriptions, labels...) or redundant ones (author, name).", "operationId": "getIndex", "parameters": [{"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}, {"description": "Include content in the index", "in": "query", "name": "with_content", "required": false, "schema": {"default": false, "description": "Include content in the index", "title": "With Content", "type": "boolean"}}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/Index"}}}, "description": "Successful Response"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Get a minimized index file (crowdsec only)", "tags": ["Hub"]}, "head": {"description": "This endpoint returns cache-related headers for the index file without the full content.\nIt is useful for validating cache, checking resource freshness, and managing client-side\ncache expiration policies. No body content is returned.", "operationId": "headIndex", "parameters": [{"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}, {"description": "Include content in the index", "in": "query", "name": "with_content", "required": false, "schema": {"default": false, "description": "Include content in the index", "title": "With Content", "type": "boolean"}}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/Index"}}}, "description": "Successful Response"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Check cache control headers for the index file", "tags": ["Hub"]}}, "/hub/index/{tenant}/{branch}/{item_path}": {"get": {"description": "Get an item's content from its path. This is usually a YAML file.", "operationId": "getItemContent", "parameters": [{"in": "path", "name": "item_path", "required": true, "schema": {"title": "Item Path", "type": "string"}}, {"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}], "responses": {"200": {"content": {"application/json": {"schema": {}}}, "description": "Successful Response"}, "404": {"description": "No content field"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Get an item's content (crowdsec only)", "tags": ["Hub"]}, "head": {"description": "This endpoint returns cache-related headers for an item's content. It is useful for validating\ncache, checking resource freshness, and managing client-side cache expiration policies. No body\ncontent is returned.", "operationId": "headItemContent", "parameters": [{"in": "path", "name": "item_path", "required": true, "schema": {"title": "Item Path", "type": "string"}}, {"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}], "responses": {"200": {"content": {"application/json": {"schema": {}}}, "description": "Successful Response"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Check cache control headers for an item's content", "tags": ["Hub"]}}}, "components": {"schemas": {"AllowlistCreateRequest": {"properties": {"name": {"type": "string", "maxLength": 200, "minLength": 1, "title": "Name", "description": "Name of the allowlist"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Description", "description": "Description of the allowlist"}}, "additionalProperties": false, "type": "object", "required": ["name"], "title": "AllowlistCreateRequest"}, "AllowlistCreateResponse": {"properties": {"id": {"type": "string", "format": "ObjectId", "title": "Id", "description": "ID of the allowlist", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "name": {"type": "string", "title": "Name", "description": "Name of the allowlist"}, "description": {"type": "string", "title": "Description", "description": "Description of the allowlist"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the allowlist was created"}, "updated_at": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Updated At", "description": "Time the allowlist was updated"}, "from_cti_query": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "From Cti Query", "description": "CTI query from which the blocklist was created"}, "since": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}, "total_items": {"type": "integer", "title": "Total Items", "description": "Number of items in the allowlist"}}, "type": "object", "required": ["id", "organization_id", "name", "created_at", "total_items"], "title": "AllowlistCreateResponse"}, "AllowlistGetItemsResponse": {"properties": {"id": {"type": "string", "format": "ObjectId", "title": "Id", "description": "ID of the allowlist entry", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "allowlist_id": {"type": "string", "format": "ObjectId", "title": "Allowlist Id", "description": "ID of the allowlist", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "Description of the allowlist entry"}, "scope": {"$ref": "#/components/schemas/AllowlistScope", "description": "Scope of the allowlist entry"}, "value": {"anyOf": [{"type": "string", "format": "ipvanyaddress"}, {"type": "string", "format": "ipvanynetwork"}], "title": "Value", "description": "Value of the allowlist entry"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the allowlist entry was created"}, "updated_at": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Updated At", "description": "Time the allowlist entry was updated"}, "created_by": {"$ref": "#/components/schemas/SourceInfo", "description": "The source user who created the allowlist entry"}, "updated_by": {"anyOf": [{"$ref": "#/components/schemas/SourceInfo"}, {"type": "null"}], "description": "The source user who updated the allowlist entry"}, "expiration": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Expiration", "description": "Time the allowlist entry will expire"}}, "type": "object", "required": ["id", "allowlist_id", "description", "scope", "value", "created_at", "created_by"], "title": "AllowlistGetItemsResponse"}, "AllowlistGetResponse": {"properties": {"id": {"type": "string", "format": "ObjectId", "title": "Id", "description": "ID of the allowlist", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "name": {"type": "string", "title": "Name", "description": "Name of the allowlist"}, "description": {"type": "string", "title": "Description", "description": "Description of the allowlist"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the allowlist was created"}, "updated_at": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Updated At", "description": "Time the allowlist was updated"}, "from_cti_query": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "From Cti Query", "description": "CTI query from which the blocklist was created"}, "since": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}, "total_items": {"type": "integer", "title": "Total Items", "description": "Number of items in the allowlist"}, "subscribers": {"items": {"$ref": "#/components/schemas/AllowlistSubscribersCount"}, "type": "array", "title": "Subscribers", "description": "List of subscribers count by entity type", "default": []}}, "type": "object", "required": ["id", "organization_id", "name", "created_at", "total_items"], "title": "AllowlistGetResponse"}, "AllowlistItemUpdateRequest": {"properties": {"description": {"type": "string", "title": "Description", "description": "Description of the allowlist entry"}, "expiration": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Expiration", "description": "Time the allowlist entry will expire"}}, "additionalProperties": false, "type": "object", "title": "AllowlistItemUpdateRequest"}, "AllowlistItemUpdateResponse": {"properties": {"id": {"type": "string", "format": "ObjectId", "title": "Id", "description": "ID of the allowlist entry", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "allowlist_id": {"type": "string", "format": "ObjectId", "title": "Allowlist Id", "description": "ID of the allowlist", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "Description of the allowlist entry"}, "scope": {"$ref": "#/components/schemas/AllowlistScope", "description": "Scope of the allowlist entry"}, "value": {"anyOf": [{"type": "string", "format": "ipvanyaddress"}, {"type": "string", "format": "ipvanynetwork"}], "title": "Value", "description": "Value of the allowlist entry"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the allowlist entry was created"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Time the allowlist entry was updated"}, "created_by": {"$ref": "#/components/schemas/SourceInfo", "description": "The source user who created the allowlist entry"}, "updated_by": {"$ref": "#/components/schemas/SourceInfo", "description": "The source user who updated the allowlist entry"}, "expiration": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Expiration", "description": "Time the allowlist entry will expire"}}, "type": "object", "required": ["id", "allowlist_id", "description", "scope", "value", "created_at", "updated_at", "created_by", "updated_by"], "title": "AllowlistItemUpdateResponse"}, "AllowlistItemsCreateRequest": {"properties": {"items": {"items": {"anyOf": [{"type": "string", "format": "ipvanyaddress"}, {"type": "string", "format": "ipvanynetwork"}]}, "type": "array", "title": "Items", "description": "List of values to add to the allowlist"}, "description": {"type": "string", "title": "Description", "description": "Description of the allowlist entry"}, "expiration": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Expiration", "description": "Time the allowlist entry will expire"}}, "additionalProperties": false, "type": "object", "required": ["items", "description"], "title": "AllowlistItemsCreateRequest"}, "AllowlistScope": {"type": "string", "enum": ["ip", "range"], "title": "AllowlistScope"}, "AllowlistSubscriberEntity": {"properties": {"id": {"type": "string", "title": "Id", "description": "Subscriber entity id"}, "entity_type": {"$ref": "#/components/schemas/SubscriberEntityType"}}, "type": "object", "required": ["id", "entity_type"], "title": "AllowlistSubscriberEntity"}, "AllowlistSubscribersCount": {"properties": {"entity_type": {"$ref": "#/components/schemas/SubscriberEntityType", "description": "Subscriber entity type"}, "count": {"type": "integer", "title": "Count", "description": "Subscriber entity count"}}, "type": "object", "required": ["entity_type", "count"], "title": "AllowlistSubscribersCount"}, "AllowlistSubscriptionRequest": {"properties": {"ids": {"items": {"type": "string"}, "type": "array", "title": "Ids", "description": "List of subscriber entity id"}, "entity_type": {"$ref": "#/components/schemas/EntityType"}}, "additionalProperties": false, "type": "object", "required": ["entity_type"], "title": "AllowlistSubscriptionRequest"}, "AllowlistSubscriptionResponse": {"properties": {"updated": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "title": "Updated", "description": "List of updated allowlist ids", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "errors": {"anyOf": [{"items": {"additionalProperties": {"type": "string"}, "type": "object"}, "type": "array"}, {"type": "null"}], "title": "Errors", "description": "List of errors if any", "examples": [{"5f9d88b9e5c4f5b9a3d3e8b1": "error message"}]}}, "type": "object", "required": ["updated", "errors"], "title": "AllowlistSubscriptionResponse"}, "AllowlistUpdateRequest": {"properties": {"name": {"anyOf": [{"type": "string", "maxLength": 200, "minLength": 1}, {"type": "null"}], "title": "Name", "description": "Name of the allowlist"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Description", "description": "Description of the allowlist"}}, "additionalProperties": false, "type": "object", "title": "AllowlistUpdateRequest"}, "AllowlistUpdateResponse": {"properties": {"id": {"type": "string", "format": "ObjectId", "title": "Id", "description": "ID of the allowlist", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "name": {"type": "string", "title": "Name", "description": "Name of the allowlist"}, "description": {"type": "string", "title": "Description", "description": "Description of the allowlist"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the allowlist was created"}, "updated_at": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Updated At", "description": "Time the allowlist was updated"}, "from_cti_query": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "From Cti Query", "description": "CTI query from which the blocklist was created"}, "since": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}, "total_items": {"type": "integer", "title": "Total Items", "description": "Number of items in the allowlist"}, "subscribers": {"items": {"$ref": "#/components/schemas/AllowlistSubscribersCount"}, "type": "array", "title": "Subscribers", "description": "List of subscribers count by entity type", "default": []}}, "type": "object", "required": ["id", "organization_id", "name", "created_at", "total_items"], "title": "AllowlistUpdateResponse"}, "ApiKeyCredentials": {"properties": {"api_key": {"type": "string", "title": "Api Key", "description": "API key for the integration"}}, "type": "object", "required": ["api_key"], "title": "ApiKeyCredentials"}, "AttacksMetrics": {"properties": {"total": {"anyOf": [{"type": "integer"}, {"type": "number"}], "title": "Total", "description": "Total value of the metric"}, "label": {"type": "string", "title": "Label", "description": "Label of the metric which is the attack type"}, "progression": {"anyOf": [{"type": "integer"}, {"type": "null"}], "title": "Progression", "description": "Progression of the metric value from the previous period"}, "data": {"items": {"$ref": "#/components/schemas/RemediationMetricsData"}, "type": "array", "title": "Data", "description": "Data points"}}, "type": "object", "required": ["total", "label", "progression", "data"], "title": "AttacksMetrics"}, "BasicAuthCredentials": {"properties": {"username": {"type": "string", "title": "Username", "description": "Basic auth username for the integration"}, "password": {"type": "string", "title": "Password", "description": "Basic auth password for the integration"}}, "type": "object", "required": ["username", "password"], "title": "BasicAuthCredentials"}, "BlocklistAddIPsRequest": {"properties": {"ips": {"items": {"type": "string"}, "type": "array", "title": "Ips", "description": "List of IPs or networks"}, "expiration": {"type": "string", "format": "date-time", "title": "Expiration", "description": "Expiration date"}}, "additionalProperties": false, "type": "object", "required": ["ips"], "title": "BlocklistAddIPsRequest"}, "BlocklistCategory": {"properties": {"name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}, "description": {"type": "string", "title": "Description"}, "priority": {"type": "integer", "title": "Priority"}}, "type": "object", "required": ["name", "label", "description", "priority"], "title": "BlocklistCategory"}, "BlocklistContentStats": {"properties": {"total_seen": {"type": "integer", "title": "Total Seen", "default": 0}, "total_fire": {"type": "integer", "title": "Total Fire", "default": 0}, "total_seen_1m": {"type": "integer", "title": "Total Seen 1M", "default": 0}, "total_in_other_lists": {"type": "integer", "title": "Total In Other Lists", "default": 0}, "total_false_positive": {"type": "integer", "title": "Total False Positive", "default": 0}, "false_positive_removed_by_crowdsec": {"type": "integer", "title": "False Positive Removed By Crowdsec", "default": 0}, "most_present_behaviors": {"items": {"$ref": "#/components/schemas/CtiBehavior"}, "type": "array", "title": "Most Present Behaviors", "default": []}, "most_present_categories": {"items": {"$ref": "#/components/schemas/CtiCategory"}, "type": "array", "title": "Most Present Categories", "default": []}, "most_present_scenarios": {"items": {"$ref": "#/components/schemas/CtiScenario"}, "type": "array", "title": "Most Present Scenarios", "default": []}, "top_as": {"items": {"$ref": "#/components/schemas/CtiAs"}, "type": "array", "title": "Top As", "default": []}, "top_attacking_countries": {"items": {"$ref": "#/components/schemas/CtiCountry"}, "type": "array", "title": "Top Attacking Countries", "default": []}, "top_ips": {"items": {"$ref": "#/components/schemas/CtiIp"}, "type": "array", "title": "Top Ips", "default": []}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At"}}, "additionalProperties": true, "type": "object", "title": "BlocklistContentStats"}, "BlocklistCreateRequest": {"properties": {"name": {"type": "string", "maxLength": 200, "minLength": 1, "title": "Name", "description": "Blocklist name, must be unique within the organization"}, "label": {"type": "string", "title": "Label", "description": "Blocklist human readable name (Default: name)"}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Useful references on the list's origins", "default": []}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Classification tags", "default": []}}, "additionalProperties": false, "type": "object", "required": ["name", "description"], "title": "BlocklistCreateRequest"}, "BlocklistDeleteIPsRequest": {"properties": {"ips": {"items": {"type": "string"}, "type": "array", "title": "Ips", "description": "List of IPs or networks"}}, "additionalProperties": false, "type": "object", "required": ["ips"], "title": "BlocklistDeleteIPsRequest"}, "BlocklistIncludeFilters": {"type": "string", "enum": ["public", "private", "shared", "all"], "title": "BlocklistIncludeFilters"}, "BlocklistOrigin": {"properties": {"label": {"type": "string", "title": "Label", "description": "Label of the blocklist"}, "id": {"type": "string", "title": "Id", "description": "ID of the blocklist"}, "pricing_tier": {"$ref": "#/components/schemas/PricingTiers", "description": "Pricing tier of the blocklist"}}, "type": "object", "required": ["label", "id", "pricing_tier"], "title": "BlocklistOrigin"}, "BlocklistSearchRequest": {"properties": {"page": {"type": "integer", "minimum": 1.0, "title": "Page", "description": "Page number", "default": 1}, "page_size": {"type": "integer", "maximum": 1000.0, "title": "Page Size", "description": "Page size", "default": 100}, "pricing_tiers": {"items": {"$ref": "#/components/schemas/PricingTiers"}, "type": "array", "title": "Pricing Tiers", "description": "Pricing tiers", "default": []}, "query": {"type": "string", "title": "Query", "description": "Search query", "default": ""}, "targeted_countries": {"items": {"type": "string"}, "type": "array", "title": "Targeted Countries", "description": "Targeted countries", "default": []}, "classifications": {"items": {"type": "string"}, "type": "array", "title": "Classifications", "description": "Classifications", "default": []}, "behaviors": {"items": {"type": "string"}, "type": "array", "title": "Behaviors", "description": "Behaviors", "default": []}, "min_ips": {"type": "integer", "minimum": 0.0, "title": "Min Ips", "description": "Minimum number of IPs", "default": 0}, "sources": {"items": {"$ref": "#/components/schemas/BlocklistSources"}, "type": "array", "title": "Sources", "description": "Sources", "default": []}, "categories": {"items": {"type": "string"}, "type": "array", "title": "Categories", "description": "Categories", "default": []}, "is_private": {"anyOf": [{"type": "boolean"}, {"type": "null"}], "title": "Is Private", "description": "Private blocklist"}, "is_subscribed": {"anyOf": [{"type": "boolean"}, {"type": "null"}], "title": "Is Subscribed", "description": "Subscribed blocklist (None: all)"}}, "additionalProperties": false, "type": "object", "title": "BlocklistSearchRequest"}, "BlocklistShareRequest": {"properties": {"organizations": {"items": {"$ref": "#/components/schemas/Share"}, "type": "array", "title": "Organizations", "description": "List of organizations to share the blocklist"}}, "additionalProperties": false, "type": "object", "required": ["organizations"], "title": "BlocklistShareRequest"}, "BlocklistSources": {"type": "string", "enum": ["crowdsec", "third_party", "custom"], "title": "BlocklistSources"}, "BlocklistStats": {"properties": {"content_stats": {"$ref": "#/components/schemas/BlocklistContentStats", "default": {"total_seen": 0, "total_fire": 0, "total_seen_1m": 0, "total_in_other_lists": 0, "total_false_positive": 0, "false_positive_removed_by_crowdsec": 0, "most_present_behaviors": [], "most_present_categories": [], "most_present_scenarios": [], "top_as": [], "top_attacking_countries": [], "top_ips": []}}, "usage_stats": {"anyOf": [{"$ref": "#/components/schemas/BlocklistUsageStats"}, {"type": "null"}], "default": {"engines_subscribed_directly": 0, "engines_subscribed_through_org": 0, "engines_subscribed_through_tag": 0, "total_subscribed_engines": 0, "total_subscribed_organizations": 0}}, "addition_2days": {"type": "integer", "title": "Addition 2Days", "default": 0}, "addition_month": {"type": "integer", "title": "Addition Month", "default": 0}, "suppression_2days": {"type": "integer", "title": "Suppression 2Days", "default": 0}, "suppression_month": {"type": "integer", "title": "Suppression Month", "default": 0}, "change_2days_percentage": {"type": "number", "title": "Change 2Days Percentage", "default": 0.0}, "change_month_percentage": {"type": "number", "title": "Change Month Percentage", "default": 0.0}, "count": {"type": "integer", "title": "Count", "default": 0}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At"}}, "additionalProperties": true, "type": "object", "title": "BlocklistStats"}, "BlocklistSubscriberEntity": {"properties": {"id": {"type": "string", "title": "Id", "description": "Subscriber entity id"}, "entity_type": {"$ref": "#/components/schemas/SubscriberEntityType"}, "remediation": {"type": "string", "title": "Remediation", "description": "Remediation"}}, "type": "object", "required": ["id", "entity_type", "remediation"], "title": "BlocklistSubscriberEntity"}, "BlocklistSubscribersResponse": {"properties": {"subscribers": {"items": {"$ref": "#/components/schemas/BlocklistSubscriberEntity"}, "type": "array", "title": "Subscribers", "description": "List of subscribers"}}, "type": "object", "required": ["subscribers"], "title": "BlocklistSubscribersResponse"}, "BlocklistSubscription": {"properties": {"id": {"type": "string", "title": "Id"}, "remediation": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Remediation"}, "name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}}, "type": "object", "required": ["id", "name", "label"], "title": "BlocklistSubscription"}, "BlocklistSubscriptionRequest": {"properties": {"ids": {"items": {"type": "string"}, "type": "array", "title": "Ids", "description": "List of subscriber entity id"}, "entity_type": {"$ref": "#/components/schemas/SubscriberEntityType"}, "remediation": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Remediation", "description": "Remediation"}}, "additionalProperties": false, "type": "object", "required": ["entity_type"], "title": "BlocklistSubscriptionRequest"}, "BlocklistSubscriptionResponse": {"properties": {"updated": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "title": "Updated", "description": "List of updated blocklist ids", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "errors": {"anyOf": [{"items": {"additionalProperties": {"type": "string"}, "type": "object"}, "type": "array"}, {"type": "null"}], "title": "Errors", "description": "List of errors if any", "examples": [{"5f9d88b9e5c4f5b9a3d3e8b1": "error message"}]}}, "type": "object", "required": ["updated", "errors"], "title": "BlocklistSubscriptionResponse"}, "BlocklistUpdateRequest": {"properties": {"label": {"type": "string", "title": "Label", "description": "Blocklist human readable name"}, "description": {"type": "string", "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Blocklist references"}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Blocklist tags"}, "from_cti_query": {"type": "string", "title": "From Cti Query", "description": "CTI query (doc link available soon)"}, "since": {"type": "string", "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}}, "additionalProperties": false, "type": "object", "title": "BlocklistUpdateRequest"}, "BlocklistUsageStats": {"properties": {"engines_subscribed_directly": {"type": "integer", "title": "Engines Subscribed Directly", "default": 0}, "engines_subscribed_through_org": {"type": "integer", "title": "Engines Subscribed Through Org", "default": 0}, "engines_subscribed_through_tag": {"type": "integer", "title": "Engines Subscribed Through Tag", "default": 0}, "total_subscribed_engines": {"type": "integer", "title": "Total Subscribed Engines", "default": 0}, "total_subscribed_organizations": {"type": "integer", "title": "Total Subscribed Organizations", "default": 0}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At"}}, "additionalProperties": true, "type": "object", "title": "BlocklistUsageStats"}, "Body_uploadBlocklistContent": {"properties": {"file": {"type": "string", "format": "binary", "title": "File", "description": "Blocklist file in txt format"}}, "type": "object", "required": ["file"], "title": "Body_uploadBlocklistContent"}, "ComputedMetrics": {"properties": {"saved": {"$ref": "#/components/schemas/ComputedSavedMetrics", "description": "estimated saved metrics"}, "dropped": {"items": {"$ref": "#/components/schemas/RemediationMetrics"}, "type": "array", "title": "Dropped", "description": "estimated dropped metrics", "default": []}, "prevented": {"items": {"$ref": "#/components/schemas/AttacksMetrics"}, "type": "array", "title": "Prevented", "description": "prevented attacks metrics", "default": []}}, "type": "object", "required": ["saved"], "title": "ComputedMetrics"}, "ComputedSavedMetrics": {"properties": {"log_lines": {"items": {"$ref": "#/components/schemas/RemediationMetrics"}, "type": "array", "title": "Log Lines", "description": "estimated log lines saved", "default": []}, "storage": {"items": {"$ref": "#/components/schemas/RemediationMetrics"}, "type": "array", "title": "Storage", "description": "estimated storage saved", "default": []}, "egress_traffic": {"items": {"$ref": "#/components/schemas/RemediationMetrics"}, "type": "array", "title": "Egress Traffic", "description": "estimated egress traffic saved", "default": []}}, "type": "object", "title": "ComputedSavedMetrics"}, "CtiAs": {"properties": {"as_num": {"type": "string", "title": "As Num"}, "as_name": {"type": "string", "title": "As Name"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["as_num", "as_name", "total_ips"], "title": "CtiAs"}, "CtiBehavior": {"properties": {"name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}, "description": {"type": "string", "title": "Description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["name", "label", "description", "references", "total_ips"], "title": "CtiBehavior"}, "CtiCategory": {"properties": {"name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}, "description": {"type": "string", "title": "Description"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["name", "label", "description", "total_ips"], "title": "CtiCategory"}, "CtiCountry": {"properties": {"country_short": {"type": "string", "title": "Country Short"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["country_short", "total_ips"], "title": "CtiCountry"}, "CtiIp": {"properties": {"ip": {"type": "string", "title": "Ip"}, "total_signals_1m": {"type": "integer", "title": "Total Signals 1M"}, "reputation": {"type": "string", "title": "Reputation", "default": "unknown"}}, "additionalProperties": true, "type": "object", "required": ["ip", "total_signals_1m"], "title": "CtiIp"}, "CtiScenario": {"properties": {"name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}, "description": {"type": "string", "title": "Description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["name", "label", "description", "references", "total_ips"], "title": "CtiScenario"}, "EntityType": {"type": "string", "enum": ["org", "tag", "engine", "firewall_integration", "remediation_component_integration", "remediation_component", "log_processor"], "title": "EntityType"}, "GetRemediationMetricsResponse": {"properties": {"raw": {"$ref": "#/components/schemas/RawMetrics", "description": "Raw metrics data"}, "computed": {"$ref": "#/components/schemas/ComputedMetrics", "description": "Computed metrics data"}}, "type": "object", "required": ["raw", "computed"], "title": "GetRemediationMetricsResponse"}, "HTTPValidationError": {"properties": {"detail": {"items": {"$ref": "#/components/schemas/ValidationError"}, "title": "Detail", "type": "array"}}, "title": "HTTPValidationError", "type": "object"}, "InfoResponse": {"properties": {"organization_id": {"type": "string", "title": "Organization Id", "description": "The organization ID"}, "subscription_type": {"type": "string", "title": "Subscription Type", "description": "The organization subscription type"}, "api_key_name": {"type": "string", "title": "Api Key Name", "description": "The API key name that is used"}}, "type": "object", "required": ["organization_id", "subscription_type", "api_key_name"], "title": "InfoResponse"}, "IntegrationCreateRequest": {"properties": {"name": {"type": "string", "minLength": 1, "title": "Name", "description": "Name of the integration"}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "Description of the integration"}, "entity_type": {"$ref": "#/components/schemas/IntegrationType", "description": "Type of the integration"}, "output_format": {"$ref": "#/components/schemas/OutputFormat", "description": "Output format of the integration"}}, "additionalProperties": false, "type": "object", "required": ["name", "entity_type", "output_format"], "title": "IntegrationCreateRequest"}, "IntegrationCreateResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "ID of the integration"}, "name": {"type": "string", "title": "Name", "description": "Name of the integration. Should be unique within the organization"}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "description": {"type": "string", "title": "Description", "description": "Description of the integration"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the integration was created"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Last time the integration was updated"}, "entity_type": {"$ref": "#/components/schemas/IntegrationType", "description": "Type of the integration"}, "output_format": {"$ref": "#/components/schemas/OutputFormat", "description": "Output format of the integration"}, "last_pull": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Last Pull", "description": "Last time the integration pulled blocklists"}, "blocklists": {"items": {"$ref": "#/components/schemas/BlocklistSubscription"}, "type": "array", "title": "Blocklists", "description": "Blocklists that are subscribed by the integration"}, "endpoint": {"type": "string", "maxLength": 2083, "minLength": 1, "format": "uri", "title": "Endpoint", "description": "Url that should be used by the firewall or the remediation component to fetch the integration's content"}, "stats": {"$ref": "#/components/schemas/Stats", "description": "Stats of the integration", "default": {"count": 0}}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Tags associated with the integration", "default": []}, "credentials": {"anyOf": [{"$ref": "#/components/schemas/ApiKeyCredentials"}, {"$ref": "#/components/schemas/BasicAuthCredentials"}], "title": "Credentials", "description": "Credentials that were generated for the integration"}}, "type": "object", "required": ["id", "name", "organization_id", "created_at", "updated_at", "entity_type", "output_format", "blocklists", "endpoint", "credentials"], "title": "IntegrationCreateResponse"}, "IntegrationGetResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "ID of the integration"}, "name": {"type": "string", "title": "Name", "description": "Name of the integration. Should be unique within the organization"}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "description": {"type": "string", "title": "Description", "description": "Description of the integration"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the integration was created"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Last time the integration was updated"}, "entity_type": {"$ref": "#/components/schemas/IntegrationType", "description": "Type of the integration"}, "output_format": {"$ref": "#/components/schemas/OutputFormat", "description": "Output format of the integration"}, "last_pull": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Last Pull", "description": "Last time the integration pulled blocklists"}, "blocklists": {"items": {"$ref": "#/components/schemas/BlocklistSubscription"}, "type": "array", "title": "Blocklists", "description": "Blocklists that are subscribed by the integration"}, "endpoint": {"type": "string", "maxLength": 2083, "minLength": 1, "format": "uri", "title": "Endpoint", "description": "Url that should be used by the firewall or the remediation component to fetch the integration's content"}, "stats": {"$ref": "#/components/schemas/Stats", "description": "Stats of the integration", "default": {"count": 0}}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Tags associated with the integration", "default": []}}, "type": "object", "required": ["id", "name", "organization_id", "created_at", "updated_at", "entity_type", "output_format", "blocklists", "endpoint"], "title": "IntegrationGetResponse"}, "IntegrationType": {"type": "string", "enum": ["firewall_integration", "remediation_component_integration"], "title": "IntegrationType"}, "IntegrationUpdateRequest": {"properties": {"name": {"type": "string", "minLength": 1, "title": "Name", "description": "New name"}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "New description"}, "output_format": {"$ref": "#/components/schemas/OutputFormat", "description": "New output format"}, "regenerate_credentials": {"type": "boolean", "title": "Regenerate Credentials", "description": "Regenerate credentials for the integration"}}, "additionalProperties": false, "type": "object", "title": "IntegrationUpdateRequest"}, "IntegrationUpdateResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "ID of the integration"}, "name": {"type": "string", "title": "Name", "description": "Name of the integration. Should be unique within the organization"}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "description": {"type": "string", "title": "Description", "description": "Description of the integration"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the integration was created"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Last time the integration was updated"}, "entity_type": {"$ref": "#/components/schemas/IntegrationType", "description": "Type of the integration"}, "output_format": {"$ref": "#/components/schemas/OutputFormat", "description": "Output format of the integration"}, "last_pull": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Last Pull", "description": "Last time the integration pulled blocklists"}, "blocklists": {"items": {"$ref": "#/components/schemas/BlocklistSubscription"}, "type": "array", "title": "Blocklists", "description": "Blocklists that are subscribed by the integration"}, "endpoint": {"type": "string", "maxLength": 2083, "minLength": 1, "format": "uri", "title": "Endpoint", "description": "Url that should be used by the firewall or the remediation component to fetch the integration's content"}, "stats": {"$ref": "#/components/schemas/Stats", "description": "Stats of the integration", "default": {"count": 0}}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Tags associated with the integration", "default": []}, "credentials": {"anyOf": [{"$ref": "#/components/schemas/ApiKeyCredentials"}, {"$ref": "#/components/schemas/BasicAuthCredentials"}, {"type": "null"}], "title": "Credentials", "description": "Credentials for the integration"}}, "type": "object", "required": ["id", "name", "organization_id", "created_at", "updated_at", "entity_type", "output_format", "blocklists", "endpoint"], "title": "IntegrationUpdateResponse"}, "Links": {"properties": {"first": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "First", "examples": ["/api/v1/users?limit=1&offset1"]}, "last": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Last", "examples": ["/api/v1/users?limit=1&offset1"]}, "self": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Self", "examples": ["/api/v1/users?limit=1&offset1"]}, "next": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Next", "examples": ["/api/v1/users?limit=1&offset1"]}, "prev": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Prev", "examples": ["/api/v1/users?limit=1&offset1"]}}, "type": "object", "required": ["first", "last", "self", "next", "prev"], "title": "Links"}, "MetricUnits": {"type": "string", "enum": ["byte", "packet", "request", "ip", "line"], "title": "MetricUnits"}, "OriginMetrics": {"properties": {"origin": {"anyOf": [{"$ref": "#/components/schemas/BlocklistOrigin"}, {"type": "string"}, {"type": "null"}], "title": "Origin", "description": "Origin of the metric"}, "data": {"items": {"$ref": "#/components/schemas/RemediationMetricsData"}, "type": "array", "title": "Data", "description": "Data points"}}, "type": "object", "required": ["origin", "data"], "title": "OriginMetrics"}, "OutputFormat": {"type": "string", "enum": ["plain_text", "f5", "remediation_component", "fortigate", "paloalto", "checkpoint", "cisco", "juniper", "mikrotik", "pfsense", "opnsense", "sophos"], "title": "OutputFormat"}, "Page_AllowlistGetItemsResponse_": {"properties": {"items": {"items": {"$ref": "#/components/schemas/AllowlistGetItemsResponse"}, "type": "array", "title": "Items"}, "total": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Total"}, "page": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Page"}, "size": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Size"}, "pages": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Pages"}, "links": {"$ref": "#/components/schemas/Links"}}, "type": "object", "required": ["items", "total", "page", "size", "links"], "title": "Page[AllowlistGetItemsResponse]"}, "Page_AllowlistGetResponse_": {"properties": {"items": {"items": {"$ref": "#/components/schemas/AllowlistGetResponse"}, "type": "array", "title": "Items"}, "total": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Total"}, "page": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Page"}, "size": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Size"}, "pages": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Pages"}, "links": {"$ref": "#/components/schemas/Links"}}, "type": "object", "required": ["items", "total", "page", "size", "links"], "title": "Page[AllowlistGetResponse]"}, "Page_AllowlistSubscriberEntity_": {"properties": {"items": {"items": {"$ref": "#/components/schemas/AllowlistSubscriberEntity"}, "type": "array", "title": "Items"}, "total": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Total"}, "page": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Page"}, "size": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Size"}, "pages": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Pages"}, "links": {"$ref": "#/components/schemas/Links"}}, "type": "object", "required": ["items", "total", "page", "size", "links"], "title": "Page[AllowlistSubscriberEntity]"}, "Page_IntegrationGetResponse_": {"properties": {"items": {"items": {"$ref": "#/components/schemas/IntegrationGetResponse"}, "type": "array", "title": "Items"}, "total": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Total"}, "page": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Page"}, "size": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Size"}, "pages": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Pages"}, "links": {"$ref": "#/components/schemas/Links"}}, "type": "object", "required": ["items", "total", "page", "size", "links"], "title": "Page[IntegrationGetResponse]"}, "Page_PublicBlocklistResponse_": {"properties": {"items": {"items": {"$ref": "#/components/schemas/PublicBlocklistResponse"}, "type": "array", "title": "Items"}, "total": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Total"}, "page": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Page"}, "size": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Size"}, "pages": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Pages"}, "links": {"$ref": "#/components/schemas/Links"}}, "type": "object", "required": ["items", "total", "page", "size", "links"], "title": "Page[PublicBlocklistResponse]"}, "Permission": {"type": "string", "enum": ["read", "write"], "title": "Permission"}, "PricingTiers": {"type": "string", "enum": ["free", "premium", "platinum"], "title": "PricingTiers"}, "PublicBlocklistResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "Blocklist id"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Blocklist creation date"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Blocklist update date"}, "name": {"type": "string", "title": "Name", "description": "Blocklist name, unique within the organization"}, "label": {"type": "string", "title": "Label", "description": "Blocklist human readable name"}, "description": {"type": "string", "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Blocklist references", "default": []}, "is_private": {"type": "boolean", "title": "Is Private", "description": "Private blocklist if True or public if False"}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Classification tags", "default": []}, "pricing_tier": {"$ref": "#/components/schemas/PricingTiers", "description": "Pricing tier for Crowdsec blocklists only"}, "source": {"$ref": "#/components/schemas/BlocklistSources", "description": "Blocklist source"}, "stats": {"$ref": "#/components/schemas/BlocklistStats", "description": "Blocklist stats"}, "from_cti_query": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "From Cti Query", "description": "CTI query from which the blocklist was created"}, "since": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}, "shared_with": {"items": {"$ref": "#/components/schemas/Share"}, "type": "array", "title": "Shared With", "description": "List of organizations shared with", "default": []}, "organization_id": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Organization Id", "description": "Blocklists owner's organization id"}, "subscribers": {"items": {"$ref": "#/components/schemas/BlocklistSubscriberEntity"}, "type": "array", "title": "Subscribers", "description": "List of subscribers to the blocklist. Only subscribers belonging to your organization are returned", "default": []}, "categories": {"items": {"$ref": "#/components/schemas/BlocklistCategory"}, "type": "array", "title": "Categories", "description": "List of categories for the blocklist", "default": []}}, "type": "object", "required": ["id", "created_at", "updated_at", "name", "description", "is_private", "pricing_tier", "source", "stats"], "title": "PublicBlocklistResponse"}, "PublicPaginatedBlocklistResponse": {"properties": {"items": {"items": {"$ref": "#/components/schemas/PublicBlocklistResponse"}, "type": "array", "title": "Items", "description": "List of blocklists"}, "page": {"type": "integer", "title": "Page", "description": "Page number"}, "total": {"type": "integer", "title": "Total", "description": "Total number of blocklists"}, "size": {"type": "integer", "title": "Size", "description": "Page size"}, "pages": {"type": "integer", "title": "Pages", "description": "Total number of pages"}}, "type": "object", "required": ["items", "page", "total", "size", "pages"], "title": "PublicPaginatedBlocklistResponse"}, "RawMetrics": {"properties": {"dropped": {"items": {"$ref": "#/components/schemas/RemediationMetrics"}, "type": "array", "title": "Dropped", "description": "dropped metrics", "default": []}, "processed": {"items": {"$ref": "#/components/schemas/RemediationMetrics"}, "type": "array", "title": "Processed", "description": "processed metrics", "default": []}}, "type": "object", "title": "RawMetrics"}, "RemediationMetrics": {"properties": {"total": {"anyOf": [{"type": "integer"}, {"type": "number"}], "title": "Total", "description": "Total value of the metric"}, "unit": {"$ref": "#/components/schemas/MetricUnits", "description": "Unit of the metric"}, "progression": {"anyOf": [{"type": "integer"}, {"type": "null"}], "title": "Progression", "description": "Progression of the metric value from the previous period"}, "data": {"items": {"$ref": "#/components/schemas/OriginMetrics"}, "type": "array", "title": "Data", "description": "Data points per origin"}}, "type": "object", "required": ["total", "unit", "progression", "data"], "title": "RemediationMetrics"}, "RemediationMetricsData": {"properties": {"value": {"anyOf": [{"type": "integer"}, {"type": "number"}], "title": "Value", "description": "Value of the metric"}, "timestamp": {"type": "string", "format": "date-time", "title": "Timestamp", "description": "Timestamp of the metric"}}, "type": "object", "required": ["value", "timestamp"], "title": "RemediationMetricsData"}, "Share": {"properties": {"organization_id": {"type": "string", "title": "Organization Id"}, "permission": {"$ref": "#/components/schemas/Permission"}}, "type": "object", "required": ["organization_id", "permission"], "title": "Share"}, "SourceInfo": {"properties": {"source_type": {"$ref": "#/components/schemas/SourceType", "description": "The source type that created the allowlist entry"}, "identifier": {"type": "string", "title": "Identifier", "description": "The source identifier that created the allowlist entry"}}, "type": "object", "required": ["source_type", "identifier"], "title": "SourceInfo"}, "SourceType": {"type": "string", "enum": ["user", "apikey"], "title": "SourceType"}, "Stats": {"properties": {"count": {"type": "integer", "title": "Count", "description": "Number of total blocklists items the integration will pull"}}, "type": "object", "required": ["count"], "title": "Stats"}, "SubscriberEntityType": {"type": "string", "enum": ["org", "tag", "engine", "firewall_integration", "remediation_component_integration"], "title": "SubscriberEntityType"}, "ValidationError": {"properties": {"loc": {"items": {"anyOf": [{"type": "string"}, {"type": "integer"}]}, "title": "Location", "type": "array"}, "msg": {"title": "Message", "type": "string"}, "type": {"title": "Error Type", "type": "string"}}, "required": ["loc", "msg", "type"], "title": "ValidationError", "type": "object"}, "AppsecConfigIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "title": "AppsecConfigIndex", "type": "object"}, "AppsecRuleIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "title": "AppsecRuleIndex", "type": "object"}, "CollectionIndex": {"properties": {"appsec-configs": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of appsec-configs", "title": "Appsec-Configs"}, "appsec-rules": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of appsec-rules", "title": "Appsec-Rules"}, "collections": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of collections", "title": "Collections"}, "content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "contexts": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of contexts", "title": "Contexts"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "parsers": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of parsers", "title": "Parsers"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "postoverflows": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of postoverflows", "title": "Postoverflows"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "scenarios": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of scenarios", "title": "Scenarios"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "title": "CollectionIndex", "type": "object"}, "ContextIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "title": "ContextIndex", "type": "object"}, "Index": {"description": "Index document served to crowdsec/cscli.", "properties": {"appsec-configs": {"additionalProperties": {"$ref": "#/components/schemas/AppsecConfigIndex"}, "title": "Appsec-Configs", "type": "object"}, "appsec-rules": {"additionalProperties": {"$ref": "#/components/schemas/AppsecRuleIndex"}, "title": "Appsec-Rules", "type": "object"}, "collections": {"additionalProperties": {"$ref": "#/components/schemas/CollectionIndex"}, "title": "Collections", "type": "object"}, "contexts": {"additionalProperties": {"$ref": "#/components/schemas/ContextIndex"}, "title": "Contexts", "type": "object"}, "parsers": {"additionalProperties": {"$ref": "#/components/schemas/ParserIndex"}, "title": "Parsers", "type": "object"}, "postoverflows": {"additionalProperties": {"$ref": "#/components/schemas/PostoverflowIndex"}, "title": "Postoverflows", "type": "object"}, "scenarios": {"additionalProperties": {"$ref": "#/components/schemas/ScenarioIndex"}, "title": "Scenarios", "type": "object"}}, "title": "Index", "type": "object"}, "ParserIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "stage": {"description": "The stage of the parser", "title": "Stage", "type": "string"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "required": ["stage"], "title": "ParserIndex", "type": "object"}, "PostoverflowIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "stage": {"description": "The stage of the postoverflow", "title": "Stage", "type": "string"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "required": ["stage"], "title": "PostoverflowIndex", "type": "object"}, "ScenarioIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "title": "ScenarioIndex", "type": "object"}, "VersionDetail": {"properties": {"deprecated": {"anyOf": [{"type": "boolean"}, {"type": "null"}], "default": false, "description": "Indicates whether this version is deprecated.", "title": "Deprecated"}, "digest": {"description": "The SHA256 digest of the versioned file.", "examples": ["Detect FTP bruteforce (vsftpd)"], "title": "Digest", "type": "string"}}, "required": ["digest"], "title": "VersionDetail", "type": "object"}}, "securitySchemes": {"ApiKeyAuth": {"type": "apiKey", "in": "header", "name": "x-api-key", "description": "If integration key is provided, can also work to get integration content"}, "BasicAuth": {"type": "http", "scheme": "basic", "description": "Basic Auth for integration content endpoint only"}}}, "security": [{"ApiKeyAuth": []}, {"BasicAuth": []}], "servers": [{"url": "https://admin.api.crowdsec.net/v1/", "description": "Production server"}]} \ No newline at end of file +{"openapi": "3.1.0", "info": {"title": "Service API", "description": "This is the API to manage Crowdsec services", "contact": {"name": "CrowdSec", "url": "https://crowdsec.net/", "email": "info@crowdsec.net"}, "version": "1.63.0"}, "paths": {"/allowlists": {"post": {"tags": ["Allowlists"], "summary": "Create Allowlist", "description": "Create a new allowlist for an organization", "operationId": "createAllowlist", "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistCreateRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistCreateResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Allowlists"], "summary": "List Allowlists", "description": "List all allowlists for an organization", "operationId": "listAllowlists", "parameters": [{"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number", "default": 1, "title": "Page"}, "description": "Page number"}, {"name": "size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 100, "minimum": 1, "description": "Page size", "default": 50, "title": "Size"}, "description": "Page size"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Page_AllowlistGetResponse_"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/allowlists/{allowlist_id}": {"get": {"tags": ["Allowlists"], "summary": "Get Allowlist", "description": "Get an allowlist by ID", "operationId": "getAllowlist", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistGetResponse"}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "patch": {"tags": ["Allowlists"], "summary": "Update Allowlist", "description": "Update an allowlist by ID", "operationId": "updateAllowlist", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistUpdateRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistUpdateResponse"}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "delete": {"tags": ["Allowlists"], "summary": "Delete Allowlist", "description": "Delete an allowlist by ID", "operationId": "deleteAllowlist", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}, {"name": "force", "in": "query", "required": false, "schema": {"type": "boolean", "description": "Force delete the allowlist, even if it has subscribers", "default": false, "title": "Force"}, "description": "Force delete the allowlist, even if it has subscribers"}], "responses": {"204": {"description": "Successful Response"}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/allowlists/{allowlist_id}/items": {"post": {"tags": ["Allowlists"], "summary": "Create Allowlist Items", "description": "Create items for an allowlist", "operationId": "createAllowlistItems", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistItemsCreateRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Allowlists"], "summary": "Get Allowlist Items", "description": "Get items in an allowlist", "operationId": "getAllowlistItems", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}, {"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number", "default": 1, "title": "Page"}, "description": "Page number"}, {"name": "size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 100, "minimum": 1, "description": "Page size", "default": 50, "title": "Size"}, "description": "Page size"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Page_AllowlistGetItemsResponse_"}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/allowlists/{allowlist_id}/items/{item_id}": {"get": {"tags": ["Allowlists"], "summary": "Get Allowlist Item", "description": "Get an allowlist item by ID", "operationId": "getAllowlistItem", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}, {"name": "item_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Item Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistGetItemsResponse"}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "patch": {"tags": ["Allowlists"], "summary": "Update Allowlist Item", "description": "Update an allowlist item by ID", "operationId": "updateAllowlistItem", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}, {"name": "item_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Item Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistItemUpdateRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistItemUpdateResponse"}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "delete": {"tags": ["Allowlists"], "summary": "Delete Allowlist Item", "description": "Delete an allowlist item by ID", "operationId": "deleteAllowlistItem", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}, {"name": "item_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Item Id"}}], "responses": {"204": {"description": "Successful Response"}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/allowlists/{allowlist_id}/subscribers": {"get": {"tags": ["Allowlists"], "summary": "Get Allowlist Subscribers", "description": "Get subscribers of an allowlist", "operationId": "getAllowlistSubscribers", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}, {"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number", "default": 1, "title": "Page"}, "description": "Page number"}, {"name": "size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 100, "minimum": 1, "description": "Page size", "default": 50, "title": "Size"}, "description": "Page size"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Page_AllowlistSubscriberEntity_"}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "post": {"tags": ["Allowlists"], "summary": "Subscribe Allowlist", "description": "Subscribe to an allowlist", "operationId": "subscribeAllowlist", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistSubscriptionRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/AllowlistSubscriptionResponse"}}}}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/allowlists/{allowlist_id}/subscribers/{entity_id}": {"delete": {"tags": ["Allowlists"], "summary": "Unsubscribe Allowlist", "description": "Unsubscribe from an allowlist", "operationId": "unsubscribeAllowlist", "parameters": [{"name": "allowlist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Allowlist Id"}}, {"name": "entity_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Entity Id"}}], "responses": {"204": {"description": "Successful Response"}, "404": {"description": "Allowlist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists": {"post": {"tags": ["Blocklists"], "summary": "Create Blocklist", "description": "Create a new blocklist owned by your organization. The name must be unique within your organization. The list will only be visible to your organization and organizations you shared the blocklist with. This operation is submitted to quotas", "operationId": "createBlocklist", "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistCreateRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/PublicBlocklistResponse"}}}}, "409": {"description": "Blocklist already exists"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Blocklists"], "summary": "Get Blocklists", "description": "Get multiple blocklists. Only blocklists owned by your organization, shared with your organization or public blocklists are returned. Filters and pagination are available as query parameters.", "operationId": "getBlocklists", "parameters": [{"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number", "default": 1, "title": "Page"}, "description": "Page number"}, {"name": "page_size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 1000, "description": "Page size", "default": 100, "title": "Page Size"}, "description": "Page size"}, {"name": "subscribed_only", "in": "query", "required": false, "schema": {"type": "boolean", "description": "only subscribed blocklists", "default": false, "title": "Subscribed Only"}, "description": "only subscribed blocklists"}, {"name": "exclude_subscribed", "in": "query", "required": false, "schema": {"type": "boolean", "description": "exclude subscribed blocklists", "default": false, "title": "Exclude Subscribed"}, "description": "exclude subscribed blocklists"}, {"name": "include_filter", "in": "query", "required": false, "schema": {"type": "array", "items": {"$ref": "#/components/schemas/BlocklistIncludeFilters"}, "description": "Include blocklists with the specified filters", "default": ["private", "shared"], "title": "Include Filter"}, "description": "Include blocklists with the specified filters"}, {"name": "category", "in": "query", "required": false, "schema": {"anyOf": [{"type": "array", "items": {"type": "string"}}, {"type": "null"}], "description": "Filter by category", "title": "Category"}, "description": "Filter by category"}, {"name": "size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 100, "minimum": 1, "description": "Page size", "default": 50, "title": "Size"}, "description": "Page size"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Page_PublicBlocklistResponse_"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/search": {"post": {"tags": ["Blocklists"], "summary": "Search Blocklists", "description": "Search blocklists", "operationId": "searchBlocklist", "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistSearchRequest"}}}, "required": true}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/PublicPaginatedBlocklistResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}": {"get": {"tags": ["Blocklists"], "summary": "Get Blocklist", "description": "Get the details of a blocklist by ID. The content of the blocklist is not returned.", "operationId": "getBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/PublicBlocklistResponse"}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "patch": {"tags": ["Blocklists"], "summary": "Update Blocklist", "description": "Update a blocklist's details by ID. It is not possible to update the blocklist content using this operation.", "operationId": "updateBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistUpdateRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/PublicBlocklistResponse"}}}}, "403": {"description": "Blocklist is read-only"}, "404": {"description": "Blocklist not found"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "delete": {"tags": ["Blocklists"], "summary": "Delete Blocklist", "description": "Delete a blocklist by ID. If the blocklist is shared with other organizations or it has subscriptions, the operation will fail. If you want to force delete the blocklist, you can use the force query parameter, so the blocklists will be unshared / unsubscribed.", "operationId": "deleteBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "force", "in": "query", "required": false, "schema": {"type": "boolean", "description": "Force delete the blocklist if it is shared or subscribed", "default": false, "title": "Force"}, "description": "Force delete the blocklist if it is shared or subscribed"}], "responses": {"204": {"description": "Successful Response"}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/upload": {"post": {"tags": ["Blocklists"], "summary": "Upload Blocklist Content", "description": "Upload a blocklist. The file must be in txt format with one IP per line. This operation will overwrite the existing blocklist content.", "operationId": "uploadBlocklistContent", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "expiration", "in": "query", "required": false, "schema": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "description": "Blocklist expiration", "examples": "2025-04-16T07:12:36.323875+00:00", "title": "Expiration"}, "description": "Blocklist expiration"}, {"name": "ignore_invalid_ips", "in": "query", "required": false, "schema": {"anyOf": [{"type": "boolean"}, {"type": "null"}], "description": "Ignore invalid IPs", "default": false, "title": "Ignore Invalid Ips"}, "description": "Ignore invalid IPs"}], "requestBody": {"required": true, "content": {"multipart/form-data": {"schema": {"$ref": "#/components/schemas/Body_uploadBlocklistContent"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "400": {"description": "Invalid IP in blocklist file content"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/ips": {"post": {"tags": ["Blocklists"], "summary": "Add Ips To Blocklist", "description": "Add IPs to a blocklist. If an IP is already in the blocklist, its expiration will be updated with the new expiration.", "operationId": "addIpsToBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistAddIPsRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "403": {"description": "Blocklist is read-only"}, "404": {"description": "Blocklist not found"}, "412": {"description": "Payload too large for one operation, limit is 20000 IPs per request"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/ips/delete": {"post": {"tags": ["Blocklists"], "summary": "Delete Ips From Blocklist", "description": "Delete IPs from a blocklist", "operationId": "deleteIpsFromBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistDeleteIPsRequest"}}}}, "responses": {"204": {"description": "Successful Response"}, "403": {"description": "Blocklist is read-only"}, "404": {"description": "Blocklist not found"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/download": {"get": {"tags": ["Blocklists"], "summary": "Download Blocklist Content", "description": "Download blocklist content as a list of ips as plain text separated by new lines. The response will include the ETag header for cache control. If_Modified_Since and If_None_Match cache control headers are supported for conditional requests.", "operationId": "downloadBlocklistContent", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "if-modified-since", "in": "header", "required": false, "schema": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "If_Modified_Since cache control header", "title": "If-Modified-Since"}, "description": "If_Modified_Since cache control header"}, {"name": "if-none-match", "in": "header", "required": false, "schema": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "If_None_Match cache control header", "title": "If-None-Match"}, "description": "If_None_Match cache control header"}], "responses": {"200": {"description": "Successful Response", "content": {"text/plain": {"schema": {"type": "string"}}}}, "404": {"description": "Blocklist not found"}, "204": {"description": "Blocklist is empty"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/subscribers": {"post": {"tags": ["Blocklists"], "summary": "Subscribe Blocklist", "description": "Subscribe to a blocklist with a remediation type. If the entity type is the full organization or a Tag, all the engines belonging to the organization or the Tag will be subscribed and new engines that will join the organization or the Tag will also be automatically subscribed. If the subscription has been done on an organization or Tag you cannot unsubscribe individual engines. In case of errors for some subscribers, the operation will still succeed for the entities that were successfully subscribed and you'll have the list of errors in the operation's result. This operation is submitted to quotas.", "operationId": "subscribeBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistSubscriptionRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistSubscriptionResponse"}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Blocklists"], "summary": "Get Blocklist Subscribers", "description": "Get blocklist subscribers within your organization.", "operationId": "getBlocklistSubscribers", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number", "default": 1, "title": "Page"}, "description": "Page number"}, {"name": "size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 100, "minimum": 1, "description": "Page size", "default": 50, "title": "Size"}, "description": "Page size"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Page_BlocklistSubscriberEntity_"}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/subscribers/{entity_id}": {"delete": {"tags": ["Blocklists"], "summary": "Unsubscribe Blocklist", "description": "Unsubscribe from a blocklist. You cannot unsubscribe individual engines if the subscription has been done on an organization or Tag.", "operationId": "unsubscribeBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "entity_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Entity Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/shares": {"post": {"tags": ["Blocklists"], "summary": "Share Blocklist", "description": "Share a blocklist with other organizations given their IDs. The blocklist must be owned by your organization. You can give read-only access or read-write access to the blocklist. Sharing a blocklist will not automatically subscribe the shared organizations to the blocklist.", "operationId": "shareBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistShareRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Blocklist not found"}, "409": {"description": "Blocklist is not private"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/shares/{unshare_organization_id}": {"delete": {"tags": ["Blocklists"], "summary": "Unshare Blocklist", "description": "Unshare a blocklist with other organizations. If the blocklist is subscribed by the organization, the operation will fail.Use force query parameter to unshare a blocklist even if subscriptions exists.", "operationId": "unshareBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "unshare_organization_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Unshare Organization Id"}}], "responses": {"204": {"description": "Successful Response"}, "404": {"description": "Blocklist not found"}, "409": {"description": "Blocklist is not private"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations": {"post": {"tags": ["Integrations"], "summary": "Create Integration", "description": "Create an integration to a firewall or remediation component, owned by your organization. The name should be unique within the organization. This operation is submitted to quotas.", "operationId": "createIntegration", "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationCreateRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationCreateResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Integrations"], "summary": "Get Integrations", "description": "Get integrations owned by your organization", "operationId": "getIntegrations", "parameters": [{"name": "tag", "in": "query", "required": false, "schema": {"anyOf": [{"type": "array", "items": {"type": "string"}}, {"type": "null"}], "description": "List of tags associated with the integrations (any of)", "title": "Tag"}, "description": "List of tags associated with the integrations (any of)"}, {"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number", "default": 1, "title": "Page"}, "description": "Page number"}, {"name": "size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 100, "minimum": 1, "description": "Page size", "default": 50, "title": "Size"}, "description": "Page size"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Page_IntegrationGetResponse_"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations/{integration_id}": {"get": {"tags": ["Integrations"], "summary": "Get Integration", "description": "Get an integration by ID", "operationId": "getIntegration", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Integration Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationGetResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "patch": {"tags": ["Integrations"], "summary": "Update Integration", "description": "Update the integration details", "operationId": "updateIntegration", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Integration Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationUpdateRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationUpdateResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "delete": {"tags": ["Integrations"], "summary": "Delete Integration", "description": "Delete the integration by ID", "operationId": "deleteIntegration", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Integration Id"}}], "responses": {"204": {"description": "Successful Response"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations/{integration_id}/content": {"head": {"tags": ["Integrations"], "summary": "Head Integration Content", "description": "Check if the integration has content", "operationId": "headIntegrationContent", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Integration Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Integration not found"}, "204": {"description": "Integration has no subscribed blocklists or no content available"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Integrations"], "summary": "Get Integration Content", "description": "Get the ips associated to the integration in plain text format. The content can be paginated to accomodate limits in firewalls.", "operationId": "getIntegrationContent", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Integration Id"}}, {"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number to return", "default": 1, "title": "Page"}, "description": "Page number to return"}, {"name": "page_size", "in": "query", "required": false, "schema": {"anyOf": [{"type": "integer", "minimum": 10000}, {"type": "null"}], "description": "Maximum number of items to return, 0 means no limit (default), should be greater than 10000", "title": "Page Size"}, "description": "Maximum number of items to return, 0 means no limit (default), should be greater than 10000"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Integration not found"}, "204": {"description": "Integration has no subscribed blocklists or no content available"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations/{integration_id}/v1/decisions/stream": {"get": {"tags": ["Integrations"], "summary": "Get Integration Content Stream", "description": "Get the ips associated to the integration in a format compatible with a remediation component. As for the remediation components, you can fetch the full content with startup=true or only the changes since the last pull", "operationId": "getIntegrationContentStream", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Integration Id"}}, {"name": "startup", "in": "query", "required": false, "schema": {"type": "boolean", "description": "Set to true if it's the first run to fetch all the content, otherwise only changes since the last pull.", "default": false, "title": "Startup"}, "description": "Set to true if it's the first run to fetch all the content, otherwise only changes since the last pull."}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Integration not found"}, "204": {"description": "Integration has no subscribed blocklists or no content available"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/info": {"get": {"tags": ["Info"], "summary": "Get Me Info", "description": "Get the current user and organization informations", "operationId": "getInfo", "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/InfoResponse"}}}}}}}, "/metrics/remediation": {"get": {"tags": ["Metrics"], "summary": "Get Metrics Remediation", "description": "Get remediation metrics", "operationId": "getMetricsRemediation", "parameters": [{"name": "start_date", "in": "query", "required": false, "schema": {"type": "string", "format": "date-time", "description": "Start date of the metrics, default to last day", "title": "Start Date"}, "description": "Start date of the metrics, default to last day"}, {"name": "end_date", "in": "query", "required": false, "schema": {"type": "string", "format": "date-time", "description": "End date of the metrics", "title": "End Date"}, "description": "End date of the metrics"}, {"name": "engine_ids", "in": "query", "required": false, "schema": {"type": "array", "items": {"type": "string"}, "description": "List of engine ids", "default": [], "title": "Engine Ids"}, "description": "List of engine ids"}, {"name": "tags", "in": "query", "required": false, "schema": {"type": "array", "items": {"type": "string"}, "description": "List of tags", "default": [], "title": "Tags"}, "description": "List of tags"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/GetRemediationMetricsResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/hub/index/{tenant}/{branch}/.index.json": {"get": {"description": "Get a (minimized) index file for 'cscli hub update'. May or may not include unused fields\n(content, long descriptions, labels...) or redundant ones (author, name).", "operationId": "getIndex", "parameters": [{"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}, {"description": "Include content in the index", "in": "query", "name": "with_content", "required": false, "schema": {"default": false, "description": "Include content in the index", "title": "With Content", "type": "boolean"}}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/Index"}}}, "description": "Successful Response"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Get a minimized index file (crowdsec only)", "tags": ["Hub"]}, "head": {"description": "This endpoint returns cache-related headers for the index file without the full content.\nIt is useful for validating cache, checking resource freshness, and managing client-side\ncache expiration policies. No body content is returned.", "operationId": "headIndex", "parameters": [{"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}, {"description": "Include content in the index", "in": "query", "name": "with_content", "required": false, "schema": {"default": false, "description": "Include content in the index", "title": "With Content", "type": "boolean"}}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/Index"}}}, "description": "Successful Response"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Check cache control headers for the index file", "tags": ["Hub"]}}, "/hub/index/{tenant}/{branch}/{item_path}": {"get": {"description": "Get an item's content from its path. This is usually a YAML file.", "operationId": "getItemContent", "parameters": [{"in": "path", "name": "item_path", "required": true, "schema": {"title": "Item Path", "type": "string"}}, {"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}], "responses": {"200": {"content": {"application/json": {"schema": {}}}, "description": "Successful Response"}, "404": {"description": "No content field"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Get an item's content (crowdsec only)", "tags": ["Hub"]}, "head": {"description": "This endpoint returns cache-related headers for an item's content. It is useful for validating\ncache, checking resource freshness, and managing client-side cache expiration policies. No body\ncontent is returned.", "operationId": "headItemContent", "parameters": [{"in": "path", "name": "item_path", "required": true, "schema": {"title": "Item Path", "type": "string"}}, {"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}], "responses": {"200": {"content": {"application/json": {"schema": {}}}, "description": "Successful Response"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Check cache control headers for an item's content", "tags": ["Hub"]}}}, "components": {"schemas": {"AllowlistCreateRequest": {"properties": {"name": {"type": "string", "maxLength": 200, "minLength": 1, "title": "Name", "description": "Name of the allowlist"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Description", "description": "Description of the allowlist"}}, "additionalProperties": false, "type": "object", "required": ["name"], "title": "AllowlistCreateRequest"}, "AllowlistCreateResponse": {"properties": {"id": {"type": "string", "format": "ObjectId", "title": "Id", "description": "ID of the allowlist", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "name": {"type": "string", "title": "Name", "description": "Name of the allowlist"}, "description": {"type": "string", "title": "Description", "description": "Description of the allowlist"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the allowlist was created"}, "updated_at": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Updated At", "description": "Time the allowlist was updated"}, "from_cti_query": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "From Cti Query", "description": "CTI query from which the blocklist was created"}, "since": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}, "total_items": {"type": "integer", "title": "Total Items", "description": "Number of items in the allowlist"}}, "type": "object", "required": ["id", "organization_id", "name", "created_at", "total_items"], "title": "AllowlistCreateResponse"}, "AllowlistGetItemsResponse": {"properties": {"id": {"type": "string", "format": "ObjectId", "title": "Id", "description": "ID of the allowlist entry", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "allowlist_id": {"type": "string", "format": "ObjectId", "title": "Allowlist Id", "description": "ID of the allowlist", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "Description of the allowlist entry"}, "scope": {"$ref": "#/components/schemas/AllowlistScope", "description": "Scope of the allowlist entry"}, "value": {"anyOf": [{"type": "string", "format": "ipvanyaddress"}, {"type": "string", "format": "ipvanynetwork"}], "title": "Value", "description": "Value of the allowlist entry"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the allowlist entry was created"}, "updated_at": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Updated At", "description": "Time the allowlist entry was updated"}, "created_by": {"$ref": "#/components/schemas/SourceInfo", "description": "The source user who created the allowlist entry"}, "updated_by": {"anyOf": [{"$ref": "#/components/schemas/SourceInfo"}, {"type": "null"}], "description": "The source user who updated the allowlist entry"}, "expiration": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Expiration", "description": "Time the allowlist entry will expire"}}, "type": "object", "required": ["id", "allowlist_id", "description", "scope", "value", "created_at", "created_by"], "title": "AllowlistGetItemsResponse"}, "AllowlistGetResponse": {"properties": {"id": {"type": "string", "format": "ObjectId", "title": "Id", "description": "ID of the allowlist", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "name": {"type": "string", "title": "Name", "description": "Name of the allowlist"}, "description": {"type": "string", "title": "Description", "description": "Description of the allowlist"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the allowlist was created"}, "updated_at": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Updated At", "description": "Time the allowlist was updated"}, "from_cti_query": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "From Cti Query", "description": "CTI query from which the blocklist was created"}, "since": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}, "total_items": {"type": "integer", "title": "Total Items", "description": "Number of items in the allowlist"}, "subscribers": {"items": {"$ref": "#/components/schemas/AllowlistSubscribersCount"}, "type": "array", "title": "Subscribers", "description": "List of subscribers count by entity type", "default": []}}, "type": "object", "required": ["id", "organization_id", "name", "created_at", "total_items"], "title": "AllowlistGetResponse"}, "AllowlistItemUpdateRequest": {"properties": {"description": {"type": "string", "title": "Description", "description": "Description of the allowlist entry"}, "expiration": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Expiration", "description": "Time the allowlist entry will expire"}}, "additionalProperties": false, "type": "object", "title": "AllowlistItemUpdateRequest"}, "AllowlistItemUpdateResponse": {"properties": {"id": {"type": "string", "format": "ObjectId", "title": "Id", "description": "ID of the allowlist entry", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "allowlist_id": {"type": "string", "format": "ObjectId", "title": "Allowlist Id", "description": "ID of the allowlist", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "Description of the allowlist entry"}, "scope": {"$ref": "#/components/schemas/AllowlistScope", "description": "Scope of the allowlist entry"}, "value": {"anyOf": [{"type": "string", "format": "ipvanyaddress"}, {"type": "string", "format": "ipvanynetwork"}], "title": "Value", "description": "Value of the allowlist entry"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the allowlist entry was created"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Time the allowlist entry was updated"}, "created_by": {"$ref": "#/components/schemas/SourceInfo", "description": "The source user who created the allowlist entry"}, "updated_by": {"$ref": "#/components/schemas/SourceInfo", "description": "The source user who updated the allowlist entry"}, "expiration": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Expiration", "description": "Time the allowlist entry will expire"}}, "type": "object", "required": ["id", "allowlist_id", "description", "scope", "value", "created_at", "updated_at", "created_by", "updated_by"], "title": "AllowlistItemUpdateResponse"}, "AllowlistItemsCreateRequest": {"properties": {"items": {"items": {"anyOf": [{"type": "string", "format": "ipvanyaddress"}, {"type": "string", "format": "ipvanynetwork"}]}, "type": "array", "title": "Items", "description": "List of values to add to the allowlist"}, "description": {"type": "string", "title": "Description", "description": "Description of the allowlist entry"}, "expiration": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Expiration", "description": "Time the allowlist entry will expire"}}, "additionalProperties": false, "type": "object", "required": ["items", "description"], "title": "AllowlistItemsCreateRequest"}, "AllowlistScope": {"type": "string", "enum": ["ip", "range"], "title": "AllowlistScope"}, "AllowlistSubscriberEntity": {"properties": {"id": {"type": "string", "title": "Id", "description": "Subscriber entity id"}, "entity_type": {"$ref": "#/components/schemas/SubscriberEntityType"}}, "type": "object", "required": ["id", "entity_type"], "title": "AllowlistSubscriberEntity"}, "AllowlistSubscribersCount": {"properties": {"entity_type": {"$ref": "#/components/schemas/SubscriberEntityType", "description": "Subscriber entity type"}, "count": {"type": "integer", "title": "Count", "description": "Subscriber entity count"}}, "type": "object", "required": ["entity_type", "count"], "title": "AllowlistSubscribersCount"}, "AllowlistSubscriptionRequest": {"properties": {"ids": {"items": {"type": "string"}, "type": "array", "title": "Ids", "description": "List of subscriber entity id"}, "entity_type": {"$ref": "#/components/schemas/EntityType"}}, "additionalProperties": false, "type": "object", "required": ["entity_type"], "title": "AllowlistSubscriptionRequest"}, "AllowlistSubscriptionResponse": {"properties": {"updated": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "title": "Updated", "description": "List of updated allowlist ids", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "errors": {"anyOf": [{"items": {"additionalProperties": {"type": "string"}, "type": "object"}, "type": "array"}, {"type": "null"}], "title": "Errors", "description": "List of errors if any", "examples": [{"5f9d88b9e5c4f5b9a3d3e8b1": "error message"}]}}, "type": "object", "required": ["updated", "errors"], "title": "AllowlistSubscriptionResponse"}, "AllowlistUpdateRequest": {"properties": {"name": {"anyOf": [{"type": "string", "maxLength": 200, "minLength": 1}, {"type": "null"}], "title": "Name", "description": "Name of the allowlist"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Description", "description": "Description of the allowlist"}}, "additionalProperties": false, "type": "object", "title": "AllowlistUpdateRequest"}, "AllowlistUpdateResponse": {"properties": {"id": {"type": "string", "format": "ObjectId", "title": "Id", "description": "ID of the allowlist", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "name": {"type": "string", "title": "Name", "description": "Name of the allowlist"}, "description": {"type": "string", "title": "Description", "description": "Description of the allowlist"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the allowlist was created"}, "updated_at": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Updated At", "description": "Time the allowlist was updated"}, "from_cti_query": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "From Cti Query", "description": "CTI query from which the blocklist was created"}, "since": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}, "total_items": {"type": "integer", "title": "Total Items", "description": "Number of items in the allowlist"}, "subscribers": {"items": {"$ref": "#/components/schemas/AllowlistSubscribersCount"}, "type": "array", "title": "Subscribers", "description": "List of subscribers count by entity type", "default": []}}, "type": "object", "required": ["id", "organization_id", "name", "created_at", "total_items"], "title": "AllowlistUpdateResponse"}, "ApiKeyCredentials": {"properties": {"api_key": {"type": "string", "title": "Api Key", "description": "API key for the integration"}}, "type": "object", "required": ["api_key"], "title": "ApiKeyCredentials"}, "AttacksMetrics": {"properties": {"total": {"anyOf": [{"type": "integer"}, {"type": "number"}], "title": "Total", "description": "Total value of the metric"}, "label": {"type": "string", "title": "Label", "description": "Label of the metric which is the attack type"}, "progression": {"anyOf": [{"type": "integer"}, {"type": "null"}], "title": "Progression", "description": "Progression of the metric value from the previous period"}, "data": {"items": {"$ref": "#/components/schemas/RemediationMetricsData"}, "type": "array", "title": "Data", "description": "Data points"}}, "type": "object", "required": ["total", "label", "progression", "data"], "title": "AttacksMetrics"}, "BasicAuthCredentials": {"properties": {"username": {"type": "string", "title": "Username", "description": "Basic auth username for the integration"}, "password": {"type": "string", "title": "Password", "description": "Basic auth password for the integration"}}, "type": "object", "required": ["username", "password"], "title": "BasicAuthCredentials"}, "BlocklistAddIPsRequest": {"properties": {"ips": {"items": {"type": "string"}, "type": "array", "title": "Ips", "description": "List of IPs or networks"}, "expiration": {"type": "string", "format": "date-time", "title": "Expiration", "description": "Expiration date"}}, "additionalProperties": false, "type": "object", "required": ["ips"], "title": "BlocklistAddIPsRequest"}, "BlocklistCategory": {"properties": {"name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}, "description": {"type": "string", "title": "Description"}, "priority": {"type": "integer", "title": "Priority"}}, "type": "object", "required": ["name", "label", "description", "priority"], "title": "BlocklistCategory"}, "BlocklistContentStats": {"properties": {"total_seen": {"type": "integer", "title": "Total Seen", "default": 0}, "total_fire": {"type": "integer", "title": "Total Fire", "default": 0}, "total_seen_1m": {"type": "integer", "title": "Total Seen 1M", "default": 0}, "total_in_other_lists": {"type": "integer", "title": "Total In Other Lists", "default": 0}, "total_false_positive": {"type": "integer", "title": "Total False Positive", "default": 0}, "false_positive_removed_by_crowdsec": {"type": "integer", "title": "False Positive Removed By Crowdsec", "default": 0}, "most_present_behaviors": {"items": {"$ref": "#/components/schemas/CtiBehavior"}, "type": "array", "title": "Most Present Behaviors", "default": []}, "most_present_categories": {"items": {"$ref": "#/components/schemas/CtiCategory"}, "type": "array", "title": "Most Present Categories", "default": []}, "most_present_scenarios": {"items": {"$ref": "#/components/schemas/CtiScenario"}, "type": "array", "title": "Most Present Scenarios", "default": []}, "top_as": {"items": {"$ref": "#/components/schemas/CtiAs"}, "type": "array", "title": "Top As", "default": []}, "top_attacking_countries": {"items": {"$ref": "#/components/schemas/CtiCountry"}, "type": "array", "title": "Top Attacking Countries", "default": []}, "top_ips": {"items": {"$ref": "#/components/schemas/CtiIp"}, "type": "array", "title": "Top Ips", "default": []}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At"}}, "additionalProperties": true, "type": "object", "title": "BlocklistContentStats"}, "BlocklistCreateRequest": {"properties": {"name": {"type": "string", "maxLength": 200, "minLength": 1, "title": "Name", "description": "Blocklist name, must be unique within the organization"}, "label": {"type": "string", "title": "Label", "description": "Blocklist human readable name (Default: name)"}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Useful references on the list's origins", "default": []}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Classification tags", "default": []}}, "additionalProperties": false, "type": "object", "required": ["name", "description"], "title": "BlocklistCreateRequest"}, "BlocklistDeleteIPsRequest": {"properties": {"ips": {"items": {"type": "string"}, "type": "array", "title": "Ips", "description": "List of IPs or networks"}}, "additionalProperties": false, "type": "object", "required": ["ips"], "title": "BlocklistDeleteIPsRequest"}, "BlocklistIncludeFilters": {"type": "string", "enum": ["public", "private", "shared", "all"], "title": "BlocklistIncludeFilters"}, "BlocklistOrigin": {"properties": {"label": {"type": "string", "title": "Label", "description": "Label of the blocklist"}, "id": {"type": "string", "title": "Id", "description": "ID of the blocklist"}, "pricing_tier": {"$ref": "#/components/schemas/PricingTiers", "description": "Pricing tier of the blocklist"}}, "type": "object", "required": ["label", "id", "pricing_tier"], "title": "BlocklistOrigin"}, "BlocklistSearchRequest": {"properties": {"page": {"type": "integer", "minimum": 1.0, "title": "Page", "description": "Page number", "default": 1}, "page_size": {"type": "integer", "maximum": 1000.0, "title": "Page Size", "description": "Page size", "default": 100}, "pricing_tiers": {"items": {"$ref": "#/components/schemas/PricingTiers"}, "type": "array", "title": "Pricing Tiers", "description": "Pricing tiers", "default": []}, "query": {"type": "string", "title": "Query", "description": "Search query", "default": ""}, "targeted_countries": {"items": {"type": "string"}, "type": "array", "title": "Targeted Countries", "description": "Targeted countries", "default": []}, "classifications": {"items": {"type": "string"}, "type": "array", "title": "Classifications", "description": "Classifications", "default": []}, "behaviors": {"items": {"type": "string"}, "type": "array", "title": "Behaviors", "description": "Behaviors", "default": []}, "min_ips": {"type": "integer", "minimum": 0.0, "title": "Min Ips", "description": "Minimum number of IPs", "default": 0}, "sources": {"items": {"$ref": "#/components/schemas/BlocklistSources"}, "type": "array", "title": "Sources", "description": "Sources", "default": []}, "categories": {"items": {"type": "string"}, "type": "array", "title": "Categories", "description": "Categories", "default": []}, "is_private": {"anyOf": [{"type": "boolean"}, {"type": "null"}], "title": "Is Private", "description": "Private blocklist"}, "is_subscribed": {"anyOf": [{"type": "boolean"}, {"type": "null"}], "title": "Is Subscribed", "description": "Subscribed blocklist (None: all)"}}, "additionalProperties": false, "type": "object", "title": "BlocklistSearchRequest"}, "BlocklistShareRequest": {"properties": {"organizations": {"items": {"$ref": "#/components/schemas/Share"}, "type": "array", "title": "Organizations", "description": "List of organizations to share the blocklist"}}, "additionalProperties": false, "type": "object", "required": ["organizations"], "title": "BlocklistShareRequest"}, "BlocklistSources": {"type": "string", "enum": ["crowdsec", "third_party", "custom"], "title": "BlocklistSources"}, "BlocklistStats": {"properties": {"content_stats": {"$ref": "#/components/schemas/BlocklistContentStats", "default": {"total_seen": 0, "total_fire": 0, "total_seen_1m": 0, "total_in_other_lists": 0, "total_false_positive": 0, "false_positive_removed_by_crowdsec": 0, "most_present_behaviors": [], "most_present_categories": [], "most_present_scenarios": [], "top_as": [], "top_attacking_countries": [], "top_ips": []}}, "usage_stats": {"anyOf": [{"$ref": "#/components/schemas/BlocklistUsageStats"}, {"type": "null"}], "default": {"engines_subscribed_directly": 0, "engines_subscribed_through_org": 0, "engines_subscribed_through_tag": 0, "total_subscribed_engines": 0, "total_subscribed_organizations": 0}}, "addition_2days": {"type": "integer", "title": "Addition 2Days", "default": 0}, "addition_month": {"type": "integer", "title": "Addition Month", "default": 0}, "suppression_2days": {"type": "integer", "title": "Suppression 2Days", "default": 0}, "suppression_month": {"type": "integer", "title": "Suppression Month", "default": 0}, "change_2days_percentage": {"type": "number", "title": "Change 2Days Percentage", "default": 0.0}, "change_month_percentage": {"type": "number", "title": "Change Month Percentage", "default": 0.0}, "count": {"type": "integer", "title": "Count", "default": 0}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At"}}, "additionalProperties": true, "type": "object", "title": "BlocklistStats"}, "BlocklistSubscriberEntity": {"properties": {"id": {"type": "string", "title": "Id", "description": "Subscriber entity id"}, "entity_type": {"$ref": "#/components/schemas/SubscriberEntityType"}, "remediation": {"type": "string", "title": "Remediation", "description": "Remediation"}}, "type": "object", "required": ["id", "entity_type", "remediation"], "title": "BlocklistSubscriberEntity"}, "BlocklistSubscribersCount": {"properties": {"entity_type": {"$ref": "#/components/schemas/SubscriberEntityType", "description": "Subscriber entity type"}, "count": {"type": "integer", "title": "Count", "description": "Subscriber entity count"}}, "type": "object", "required": ["entity_type", "count"], "title": "BlocklistSubscribersCount"}, "BlocklistSubscription": {"properties": {"id": {"type": "string", "title": "Id"}, "remediation": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Remediation"}, "name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}}, "type": "object", "required": ["id", "name", "label"], "title": "BlocklistSubscription"}, "BlocklistSubscriptionRequest": {"properties": {"ids": {"items": {"type": "string"}, "type": "array", "title": "Ids", "description": "List of subscriber entity id"}, "entity_type": {"$ref": "#/components/schemas/SubscriberEntityType"}, "remediation": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Remediation", "description": "Remediation"}}, "additionalProperties": false, "type": "object", "required": ["entity_type"], "title": "BlocklistSubscriptionRequest"}, "BlocklistSubscriptionResponse": {"properties": {"updated": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "title": "Updated", "description": "List of updated blocklist ids", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "errors": {"anyOf": [{"items": {"additionalProperties": {"type": "string"}, "type": "object"}, "type": "array"}, {"type": "null"}], "title": "Errors", "description": "List of errors if any", "examples": [{"5f9d88b9e5c4f5b9a3d3e8b1": "error message"}]}}, "type": "object", "required": ["updated", "errors"], "title": "BlocklistSubscriptionResponse"}, "BlocklistUpdateRequest": {"properties": {"label": {"type": "string", "title": "Label", "description": "Blocklist human readable name"}, "description": {"type": "string", "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Blocklist references"}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Blocklist tags"}, "from_cti_query": {"type": "string", "title": "From Cti Query", "description": "CTI query (doc link available soon)"}, "since": {"type": "string", "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}}, "additionalProperties": false, "type": "object", "title": "BlocklistUpdateRequest"}, "BlocklistUsageStats": {"properties": {"engines_subscribed_directly": {"type": "integer", "title": "Engines Subscribed Directly", "default": 0}, "engines_subscribed_through_org": {"type": "integer", "title": "Engines Subscribed Through Org", "default": 0}, "engines_subscribed_through_tag": {"type": "integer", "title": "Engines Subscribed Through Tag", "default": 0}, "total_subscribed_engines": {"type": "integer", "title": "Total Subscribed Engines", "default": 0}, "total_subscribed_organizations": {"type": "integer", "title": "Total Subscribed Organizations", "default": 0}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At"}}, "additionalProperties": true, "type": "object", "title": "BlocklistUsageStats"}, "Body_uploadBlocklistContent": {"properties": {"file": {"type": "string", "format": "binary", "title": "File", "description": "Blocklist file in txt format"}}, "type": "object", "required": ["file"], "title": "Body_uploadBlocklistContent"}, "ComputedMetrics": {"properties": {"saved": {"$ref": "#/components/schemas/ComputedSavedMetrics", "description": "estimated saved metrics"}, "dropped": {"items": {"$ref": "#/components/schemas/RemediationMetrics"}, "type": "array", "title": "Dropped", "description": "estimated dropped metrics", "default": []}, "prevented": {"items": {"$ref": "#/components/schemas/AttacksMetrics"}, "type": "array", "title": "Prevented", "description": "prevented attacks metrics", "default": []}}, "type": "object", "required": ["saved"], "title": "ComputedMetrics"}, "ComputedSavedMetrics": {"properties": {"log_lines": {"items": {"$ref": "#/components/schemas/RemediationMetrics"}, "type": "array", "title": "Log Lines", "description": "estimated log lines saved", "default": []}, "storage": {"items": {"$ref": "#/components/schemas/RemediationMetrics"}, "type": "array", "title": "Storage", "description": "estimated storage saved", "default": []}, "egress_traffic": {"items": {"$ref": "#/components/schemas/RemediationMetrics"}, "type": "array", "title": "Egress Traffic", "description": "estimated egress traffic saved", "default": []}}, "type": "object", "title": "ComputedSavedMetrics"}, "CtiAs": {"properties": {"as_num": {"type": "string", "title": "As Num"}, "as_name": {"type": "string", "title": "As Name"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["as_num", "as_name", "total_ips"], "title": "CtiAs"}, "CtiBehavior": {"properties": {"name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}, "description": {"type": "string", "title": "Description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["name", "label", "description", "references", "total_ips"], "title": "CtiBehavior"}, "CtiCategory": {"properties": {"name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}, "description": {"type": "string", "title": "Description"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["name", "label", "description", "total_ips"], "title": "CtiCategory"}, "CtiCountry": {"properties": {"country_short": {"type": "string", "title": "Country Short"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["country_short", "total_ips"], "title": "CtiCountry"}, "CtiIp": {"properties": {"ip": {"type": "string", "title": "Ip"}, "total_signals_1m": {"type": "integer", "title": "Total Signals 1M"}, "reputation": {"type": "string", "title": "Reputation", "default": "unknown"}}, "additionalProperties": true, "type": "object", "required": ["ip", "total_signals_1m"], "title": "CtiIp"}, "CtiScenario": {"properties": {"name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}, "description": {"type": "string", "title": "Description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["name", "label", "description", "references", "total_ips"], "title": "CtiScenario"}, "EntityType": {"type": "string", "enum": ["org", "tag", "engine", "firewall_integration", "remediation_component_integration", "remediation_component", "log_processor"], "title": "EntityType"}, "GetRemediationMetricsResponse": {"properties": {"raw": {"$ref": "#/components/schemas/RawMetrics", "description": "Raw metrics data"}, "computed": {"$ref": "#/components/schemas/ComputedMetrics", "description": "Computed metrics data"}}, "type": "object", "required": ["raw", "computed"], "title": "GetRemediationMetricsResponse"}, "HTTPValidationError": {"properties": {"detail": {"items": {"$ref": "#/components/schemas/ValidationError"}, "title": "Detail", "type": "array"}}, "title": "HTTPValidationError", "type": "object"}, "InfoResponse": {"properties": {"organization_id": {"type": "string", "title": "Organization Id", "description": "The organization ID"}, "subscription_type": {"type": "string", "title": "Subscription Type", "description": "The organization subscription type"}, "api_key_name": {"type": "string", "title": "Api Key Name", "description": "The API key name that is used"}}, "type": "object", "required": ["organization_id", "subscription_type", "api_key_name"], "title": "InfoResponse"}, "IntegrationCreateRequest": {"properties": {"name": {"type": "string", "minLength": 1, "title": "Name", "description": "Name of the integration"}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "Description of the integration"}, "entity_type": {"$ref": "#/components/schemas/IntegrationType", "description": "Type of the integration"}, "output_format": {"$ref": "#/components/schemas/OutputFormat", "description": "Output format of the integration"}}, "additionalProperties": false, "type": "object", "required": ["name", "entity_type", "output_format"], "title": "IntegrationCreateRequest"}, "IntegrationCreateResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "ID of the integration"}, "name": {"type": "string", "title": "Name", "description": "Name of the integration. Should be unique within the organization"}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "description": {"type": "string", "title": "Description", "description": "Description of the integration"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the integration was created"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Last time the integration was updated"}, "entity_type": {"$ref": "#/components/schemas/IntegrationType", "description": "Type of the integration"}, "output_format": {"$ref": "#/components/schemas/OutputFormat", "description": "Output format of the integration"}, "last_pull": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Last Pull", "description": "Last time the integration pulled blocklists"}, "blocklists": {"items": {"$ref": "#/components/schemas/BlocklistSubscription"}, "type": "array", "title": "Blocklists", "description": "Blocklists that are subscribed by the integration"}, "endpoint": {"type": "string", "maxLength": 2083, "minLength": 1, "format": "uri", "title": "Endpoint", "description": "Url that should be used by the firewall or the remediation component to fetch the integration's content"}, "stats": {"$ref": "#/components/schemas/Stats", "description": "Stats of the integration", "default": {"count": 0}}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Tags associated with the integration", "default": []}, "credentials": {"anyOf": [{"$ref": "#/components/schemas/ApiKeyCredentials"}, {"$ref": "#/components/schemas/BasicAuthCredentials"}], "title": "Credentials", "description": "Credentials that were generated for the integration"}}, "type": "object", "required": ["id", "name", "organization_id", "created_at", "updated_at", "entity_type", "output_format", "blocklists", "endpoint", "credentials"], "title": "IntegrationCreateResponse"}, "IntegrationGetResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "ID of the integration"}, "name": {"type": "string", "title": "Name", "description": "Name of the integration. Should be unique within the organization"}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "description": {"type": "string", "title": "Description", "description": "Description of the integration"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the integration was created"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Last time the integration was updated"}, "entity_type": {"$ref": "#/components/schemas/IntegrationType", "description": "Type of the integration"}, "output_format": {"$ref": "#/components/schemas/OutputFormat", "description": "Output format of the integration"}, "last_pull": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Last Pull", "description": "Last time the integration pulled blocklists"}, "blocklists": {"items": {"$ref": "#/components/schemas/BlocklistSubscription"}, "type": "array", "title": "Blocklists", "description": "Blocklists that are subscribed by the integration"}, "endpoint": {"type": "string", "maxLength": 2083, "minLength": 1, "format": "uri", "title": "Endpoint", "description": "Url that should be used by the firewall or the remediation component to fetch the integration's content"}, "stats": {"$ref": "#/components/schemas/Stats", "description": "Stats of the integration", "default": {"count": 0}}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Tags associated with the integration", "default": []}}, "type": "object", "required": ["id", "name", "organization_id", "created_at", "updated_at", "entity_type", "output_format", "blocklists", "endpoint"], "title": "IntegrationGetResponse"}, "IntegrationType": {"type": "string", "enum": ["firewall_integration", "remediation_component_integration"], "title": "IntegrationType"}, "IntegrationUpdateRequest": {"properties": {"name": {"type": "string", "minLength": 1, "title": "Name", "description": "New name"}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "New description"}, "output_format": {"$ref": "#/components/schemas/OutputFormat", "description": "New output format"}, "regenerate_credentials": {"type": "boolean", "title": "Regenerate Credentials", "description": "Regenerate credentials for the integration"}}, "additionalProperties": false, "type": "object", "title": "IntegrationUpdateRequest"}, "IntegrationUpdateResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "ID of the integration"}, "name": {"type": "string", "title": "Name", "description": "Name of the integration. Should be unique within the organization"}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "description": {"type": "string", "title": "Description", "description": "Description of the integration"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the integration was created"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Last time the integration was updated"}, "entity_type": {"$ref": "#/components/schemas/IntegrationType", "description": "Type of the integration"}, "output_format": {"$ref": "#/components/schemas/OutputFormat", "description": "Output format of the integration"}, "last_pull": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "title": "Last Pull", "description": "Last time the integration pulled blocklists"}, "blocklists": {"items": {"$ref": "#/components/schemas/BlocklistSubscription"}, "type": "array", "title": "Blocklists", "description": "Blocklists that are subscribed by the integration"}, "endpoint": {"type": "string", "maxLength": 2083, "minLength": 1, "format": "uri", "title": "Endpoint", "description": "Url that should be used by the firewall or the remediation component to fetch the integration's content"}, "stats": {"$ref": "#/components/schemas/Stats", "description": "Stats of the integration", "default": {"count": 0}}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Tags associated with the integration", "default": []}, "credentials": {"anyOf": [{"$ref": "#/components/schemas/ApiKeyCredentials"}, {"$ref": "#/components/schemas/BasicAuthCredentials"}, {"type": "null"}], "title": "Credentials", "description": "Credentials for the integration"}}, "type": "object", "required": ["id", "name", "organization_id", "created_at", "updated_at", "entity_type", "output_format", "blocklists", "endpoint"], "title": "IntegrationUpdateResponse"}, "Links": {"properties": {"first": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "First", "examples": ["/api/v1/users?limit=1&offset1"]}, "last": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Last", "examples": ["/api/v1/users?limit=1&offset1"]}, "self": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Self", "examples": ["/api/v1/users?limit=1&offset1"]}, "next": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Next", "examples": ["/api/v1/users?limit=1&offset1"]}, "prev": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Prev", "examples": ["/api/v1/users?limit=1&offset1"]}}, "type": "object", "required": ["first", "last", "self", "next", "prev"], "title": "Links"}, "MetricUnits": {"type": "string", "enum": ["byte", "packet", "request", "ip", "line"], "title": "MetricUnits"}, "OriginMetrics": {"properties": {"origin": {"anyOf": [{"$ref": "#/components/schemas/BlocklistOrigin"}, {"type": "string"}, {"type": "null"}], "title": "Origin", "description": "Origin of the metric"}, "data": {"items": {"$ref": "#/components/schemas/RemediationMetricsData"}, "type": "array", "title": "Data", "description": "Data points"}}, "type": "object", "required": ["origin", "data"], "title": "OriginMetrics"}, "OutputFormat": {"type": "string", "enum": ["plain_text", "f5", "remediation_component", "fortigate", "paloalto", "checkpoint", "cisco", "juniper", "mikrotik", "pfsense", "opnsense", "sophos"], "title": "OutputFormat"}, "Page_AllowlistGetItemsResponse_": {"properties": {"items": {"items": {"$ref": "#/components/schemas/AllowlistGetItemsResponse"}, "type": "array", "title": "Items"}, "total": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Total"}, "page": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Page"}, "size": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Size"}, "pages": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Pages"}, "links": {"$ref": "#/components/schemas/Links"}}, "type": "object", "required": ["items", "total", "page", "size", "links"], "title": "Page[AllowlistGetItemsResponse]"}, "Page_AllowlistGetResponse_": {"properties": {"items": {"items": {"$ref": "#/components/schemas/AllowlistGetResponse"}, "type": "array", "title": "Items"}, "total": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Total"}, "page": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Page"}, "size": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Size"}, "pages": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Pages"}, "links": {"$ref": "#/components/schemas/Links"}}, "type": "object", "required": ["items", "total", "page", "size", "links"], "title": "Page[AllowlistGetResponse]"}, "Page_AllowlistSubscriberEntity_": {"properties": {"items": {"items": {"$ref": "#/components/schemas/AllowlistSubscriberEntity"}, "type": "array", "title": "Items"}, "total": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Total"}, "page": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Page"}, "size": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Size"}, "pages": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Pages"}, "links": {"$ref": "#/components/schemas/Links"}}, "type": "object", "required": ["items", "total", "page", "size", "links"], "title": "Page[AllowlistSubscriberEntity]"}, "Page_BlocklistSubscriberEntity_": {"properties": {"items": {"items": {"$ref": "#/components/schemas/BlocklistSubscriberEntity"}, "type": "array", "title": "Items"}, "total": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Total"}, "page": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Page"}, "size": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Size"}, "pages": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Pages"}, "links": {"$ref": "#/components/schemas/Links"}}, "type": "object", "required": ["items", "total", "page", "size", "links"], "title": "Page[BlocklistSubscriberEntity]"}, "Page_IntegrationGetResponse_": {"properties": {"items": {"items": {"$ref": "#/components/schemas/IntegrationGetResponse"}, "type": "array", "title": "Items"}, "total": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Total"}, "page": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Page"}, "size": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Size"}, "pages": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Pages"}, "links": {"$ref": "#/components/schemas/Links"}}, "type": "object", "required": ["items", "total", "page", "size", "links"], "title": "Page[IntegrationGetResponse]"}, "Page_PublicBlocklistResponse_": {"properties": {"items": {"items": {"$ref": "#/components/schemas/PublicBlocklistResponse"}, "type": "array", "title": "Items"}, "total": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Total"}, "page": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Page"}, "size": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Size"}, "pages": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Pages"}, "links": {"$ref": "#/components/schemas/Links"}}, "type": "object", "required": ["items", "total", "page", "size", "links"], "title": "Page[PublicBlocklistResponse]"}, "Permission": {"type": "string", "enum": ["read", "write"], "title": "Permission"}, "PricingTiers": {"type": "string", "enum": ["free", "premium", "platinum"], "title": "PricingTiers"}, "PublicBlocklistResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "Blocklist id"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Blocklist creation date"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Blocklist update date"}, "name": {"type": "string", "title": "Name", "description": "Blocklist name, unique within the organization"}, "label": {"type": "string", "title": "Label", "description": "Blocklist human readable name"}, "description": {"type": "string", "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Blocklist references", "default": []}, "is_private": {"type": "boolean", "title": "Is Private", "description": "Private blocklist if True or public if False"}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Classification tags", "default": []}, "pricing_tier": {"$ref": "#/components/schemas/PricingTiers", "description": "Pricing tier for Crowdsec blocklists only"}, "source": {"$ref": "#/components/schemas/BlocklistSources", "description": "Blocklist source"}, "stats": {"$ref": "#/components/schemas/BlocklistStats", "description": "Blocklist stats"}, "from_cti_query": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "From Cti Query", "description": "CTI query from which the blocklist was created"}, "since": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}, "shared_with": {"items": {"$ref": "#/components/schemas/Share"}, "type": "array", "title": "Shared With", "description": "List of organizations shared with", "default": []}, "organization_id": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Organization Id", "description": "Blocklists owner's organization id"}, "subscribers": {"items": {"$ref": "#/components/schemas/BlocklistSubscribersCount"}, "type": "array", "title": "Subscribers", "description": "List of subscribers to the blocklist. Only subscribers belonging to your organization are returned", "default": []}, "categories": {"items": {"$ref": "#/components/schemas/BlocklistCategory"}, "type": "array", "title": "Categories", "description": "List of categories for the blocklist", "default": []}}, "type": "object", "required": ["id", "created_at", "updated_at", "name", "description", "is_private", "pricing_tier", "source", "stats"], "title": "PublicBlocklistResponse"}, "PublicPaginatedBlocklistResponse": {"properties": {"items": {"items": {"$ref": "#/components/schemas/PublicBlocklistResponse"}, "type": "array", "title": "Items", "description": "List of blocklists"}, "page": {"type": "integer", "title": "Page", "description": "Page number"}, "total": {"type": "integer", "title": "Total", "description": "Total number of blocklists"}, "size": {"type": "integer", "title": "Size", "description": "Page size"}, "pages": {"type": "integer", "title": "Pages", "description": "Total number of pages"}}, "type": "object", "required": ["items", "page", "total", "size", "pages"], "title": "PublicPaginatedBlocklistResponse"}, "RawMetrics": {"properties": {"dropped": {"items": {"$ref": "#/components/schemas/RemediationMetrics"}, "type": "array", "title": "Dropped", "description": "dropped metrics", "default": []}, "processed": {"items": {"$ref": "#/components/schemas/RemediationMetrics"}, "type": "array", "title": "Processed", "description": "processed metrics", "default": []}}, "type": "object", "title": "RawMetrics"}, "RemediationMetrics": {"properties": {"total": {"anyOf": [{"type": "integer"}, {"type": "number"}], "title": "Total", "description": "Total value of the metric"}, "unit": {"$ref": "#/components/schemas/MetricUnits", "description": "Unit of the metric"}, "progression": {"anyOf": [{"type": "integer"}, {"type": "null"}], "title": "Progression", "description": "Progression of the metric value from the previous period"}, "data": {"items": {"$ref": "#/components/schemas/OriginMetrics"}, "type": "array", "title": "Data", "description": "Data points per origin"}}, "type": "object", "required": ["total", "unit", "progression", "data"], "title": "RemediationMetrics"}, "RemediationMetricsData": {"properties": {"value": {"anyOf": [{"type": "integer"}, {"type": "number"}], "title": "Value", "description": "Value of the metric"}, "timestamp": {"type": "string", "format": "date-time", "title": "Timestamp", "description": "Timestamp of the metric"}}, "type": "object", "required": ["value", "timestamp"], "title": "RemediationMetricsData"}, "Share": {"properties": {"organization_id": {"type": "string", "title": "Organization Id"}, "permission": {"$ref": "#/components/schemas/Permission"}}, "type": "object", "required": ["organization_id", "permission"], "title": "Share"}, "SourceInfo": {"properties": {"source_type": {"$ref": "#/components/schemas/SourceType", "description": "The source type that created the allowlist entry"}, "identifier": {"type": "string", "title": "Identifier", "description": "The source identifier that created the allowlist entry"}}, "type": "object", "required": ["source_type", "identifier"], "title": "SourceInfo"}, "SourceType": {"type": "string", "enum": ["user", "apikey"], "title": "SourceType"}, "Stats": {"properties": {"count": {"type": "integer", "title": "Count", "description": "Number of total blocklists items the integration will pull"}}, "type": "object", "required": ["count"], "title": "Stats"}, "SubscriberEntityType": {"type": "string", "enum": ["org", "tag", "engine", "firewall_integration", "remediation_component_integration"], "title": "SubscriberEntityType"}, "ValidationError": {"properties": {"loc": {"items": {"anyOf": [{"type": "string"}, {"type": "integer"}]}, "title": "Location", "type": "array"}, "msg": {"title": "Message", "type": "string"}, "type": {"title": "Error Type", "type": "string"}}, "required": ["loc", "msg", "type"], "title": "ValidationError", "type": "object"}, "AppsecConfigIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "title": "AppsecConfigIndex", "type": "object"}, "AppsecRuleIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "title": "AppsecRuleIndex", "type": "object"}, "CollectionIndex": {"properties": {"appsec-configs": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of appsec-configs", "title": "Appsec-Configs"}, "appsec-rules": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of appsec-rules", "title": "Appsec-Rules"}, "collections": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of collections", "title": "Collections"}, "content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "contexts": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of contexts", "title": "Contexts"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "parsers": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of parsers", "title": "Parsers"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "postoverflows": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of postoverflows", "title": "Postoverflows"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "scenarios": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of scenarios", "title": "Scenarios"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "title": "CollectionIndex", "type": "object"}, "ContextIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "title": "ContextIndex", "type": "object"}, "Index": {"description": "Index document served to crowdsec/cscli.", "properties": {"appsec-configs": {"additionalProperties": {"$ref": "#/components/schemas/AppsecConfigIndex"}, "title": "Appsec-Configs", "type": "object"}, "appsec-rules": {"additionalProperties": {"$ref": "#/components/schemas/AppsecRuleIndex"}, "title": "Appsec-Rules", "type": "object"}, "collections": {"additionalProperties": {"$ref": "#/components/schemas/CollectionIndex"}, "title": "Collections", "type": "object"}, "contexts": {"additionalProperties": {"$ref": "#/components/schemas/ContextIndex"}, "title": "Contexts", "type": "object"}, "parsers": {"additionalProperties": {"$ref": "#/components/schemas/ParserIndex"}, "title": "Parsers", "type": "object"}, "postoverflows": {"additionalProperties": {"$ref": "#/components/schemas/PostoverflowIndex"}, "title": "Postoverflows", "type": "object"}, "scenarios": {"additionalProperties": {"$ref": "#/components/schemas/ScenarioIndex"}, "title": "Scenarios", "type": "object"}}, "title": "Index", "type": "object"}, "ParserIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "stage": {"description": "The stage of the parser", "title": "Stage", "type": "string"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "required": ["stage"], "title": "ParserIndex", "type": "object"}, "PostoverflowIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "stage": {"description": "The stage of the postoverflow", "title": "Stage", "type": "string"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "required": ["stage"], "title": "PostoverflowIndex", "type": "object"}, "ScenarioIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "title": "ScenarioIndex", "type": "object"}, "VersionDetail": {"properties": {"deprecated": {"anyOf": [{"type": "boolean"}, {"type": "null"}], "default": false, "description": "Indicates whether this version is deprecated.", "title": "Deprecated"}, "digest": {"description": "The SHA256 digest of the versioned file.", "examples": ["Detect FTP bruteforce (vsftpd)"], "title": "Digest", "type": "string"}}, "required": ["digest"], "title": "VersionDetail", "type": "object"}}, "securitySchemes": {"ApiKeyAuth": {"type": "apiKey", "in": "header", "name": "x-api-key", "description": "If integration key is provided, can also work to get integration content"}, "BasicAuth": {"type": "http", "scheme": "basic", "description": "Basic Auth for integration content endpoint only"}}}, "security": [{"ApiKeyAuth": []}, {"BasicAuth": []}], "servers": [{"url": "https://admin.api.crowdsec.net/v1/", "description": "Production server"}]} \ No newline at end of file diff --git a/pyproject.toml b/pyproject.toml index 7462a8e..f461759 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "crowdsec_service_api" -version = "1.62.0" +version = "1.63.0" license = { text = "MIT" } authors = [ { name="crowdsec", email="info@crowdsec.net" }