PRIVATE EVALUATION Early MVP · end-to-end verification in progress
log salad.

CONSOLE V1 / IMPLEMENTED HTTP SURFACE

API reference

Versioned, bounded operations on your separately deployed private console—not this static server.

Download OpenAPI 3.1 JSON · Plain Markdown

Common protocol

JSON errors: {"error":"stable_code","message":"safe explanation"}. IDs are UUIDs; API times are epoch milliseconds. Lists return {"items":[...]}. Cookie mutations require exact Origin, X-Console-CSRF:1 and application/json (DELETE may omit content type). Bodyless POSTs still require JSON headers. Scope and role are server assigned. Source bearer tokens are permitted only on own-source ingestion and operation status. OpenAPI security entries are alternatives, not combined requirements.

All request bodies are bounded to 8 MiB. The endpoint list below is complete for the curated public API; internal detection adapters are deliberately not public agent capabilities. Response schemas are extensible partial projections, not complete generated OCSF/provider schemas. Common error status documentation does not promise every route emits every status. See authentication, queries and workflow guides for authority and reconciliation requirements.

GET /health

Health

Public state-database reachability; not end-to-end pipeline qualification.

Authority: public. Success: 200. Response: Health.

POST /api/v1/session

Sign in

Create an eight-hour opaque cookie session. Origin, CSRF and JSON required even before login.

Authority: public. Success: 200. Response: Session.

JSON request: Login

GET /api/v1/session

Current session

Resolve the server-assigned workspace and role.

Authority: session. Success: 200. Response: CurrentSession.

DELETE /api/v1/session

Sign out

Revoke this individual session; Origin and CSRF required.

Authority: session. Success: 200. Response: Status.

GET /api/v1/session/options

Evaluation registration options

Public configuration flag, not database health or production SaaS availability.

Authority: public. Success: 200. Response: SessionOptions.

POST /api/v1/session/signup

Create isolated evaluation workspace

Disabled by default; 32-workspace cap. No caller-selected tenant/role. Generic workspace_creation_unavailable on duplicate username or cap.

Authority: public. Success: 200. Response: Session.

JSON request: Signup

GET /api/v1/overview

Workspace overview

Tenant-scoped counts and observed pipeline state. Inference is disabled.

Authority: session. Success: 200. Response: Overview.

GET /api/v1/costs

Read cost snapshot

Operator only. Fixed configured snapshot, maximum 1 MiB. No provider/billing API calls; unavailable is not zero.

Authority: operator. Success: 200. Response: Costs.

GET /api/v1/sources

List sources

Saved or receiving is not provider credential verification.

Authority: session. Success: 200. Response: SourceList.

POST /api/v1/sources

Create scoped source

Persist configuration, not a connected-provider claim.

Authority: session. Success: 200. Response: Source.

JSON request: CreateSource

POST /api/v1/sources/{id}/preflight

Inspect source readiness

Schema and canary checks. Provider transports report external_worker_required and provider_verified:false.

Authority: session. Success: 200. Response: Preflight.

POST /api/v1/sources/{id}/token

Rotate source token

Operator only. Returned once; previous token revoked. This response is a secret and must not be logged.

Authority: operator. Success: 200. Response: SourceToken.

POST /api/v1/sources/{id}/ingest

Accept native records

Maximum 1000 records and 8 MiB request. HTTP 202 is durable inbox acceptance, not external sink completion. Poll operation status before acknowledging the source. CloudTrail Records wrapper is also accepted.

Authority: source. Success: 202. Response: IngestReceipt.

JSON request: Ingest

GET /api/v1/operations/{id}

Reconcile ingestion status

Source token is limited to operations belonging to its source and tenant. Acknowledge only committed, after inspecting lane receipts.

Authority: source. Success: 200. Response: Operation.

POST /api/v1/events/query

Query hot events

Typed parameterized tenant-filtered ClickHouse; 500 rows, 31 days, five-second engine limit; no raw SQL.

Authority: session. Success: 200. Response: HotQueryResult.

JSON request: HotQuery

POST /api/v1/history/query

Query historical events

Authorized PyIceberg path. Only time/source/limit filters. Dependency failure is explicit, never silently served from hot data.

Authority: session. Success: 200. Response: HistoryQueryResult.

JSON request: HistoryQuery

GET /api/v1/events/{id}

Read retained evidence

Tenant-authorized OCSF and raw request bytes/provenance. Raw batch bytes can contain multiple records.

Authority: session. Success: 200. Response: Evidence.

GET /api/v1/rules

List and reconcile rules

May reconcile observed Arroyo job state. Running is required for enabled; saved is not running.

Authority: session. Success: 200. Response: RuleList.

POST /api/v1/rules/validate

Validate strict rule subset

Unsupported rule syntax returns valid:false; validation does not deploy.

Authority: session. Success: 200. Response: RuleValidation.

JSON request: RuleInput

POST /api/v1/rules

Create versioned rule

Persist validated rule; enabled:true additionally requests actual deployment.

Authority: session. Success: 200. Response: Rule.

JSON request: RuleInput

POST /api/v1/rules/{id}/enable

Enable rule pipeline

Durable intent and ambiguous-create reconciliation. Inspect status; do not blindly repeat an unknown create.

Authority: session. Success: 200. Response: Rule.

POST /api/v1/rules/{id}/disable

Checkpoint-stop rule

Pending/unknown until observed terminal job state.

Authority: session. Success: 200. Response: Rule.

GET /api/v1/alerts

List alerts

Durable rule matches, not proof of malicious activity.

Authority: session. Success: 200. Response: AlertList.

GET /api/v1/alerts/{id}

Alert narrative and evidence

Deterministic facts, citations, uncertainty and review guidance; inference disabled.

Authority: session. Success: 200. Response: Alert.

POST /api/v1/alerts/{id}/triage

Record human triage

Attribute disposition and note with audit.

Authority: session. Success: 200. Response: Alert.

JSON request: Triage

GET /api/v1/cases

List cases

Tenant-scoped local case state.

Authority: session. Success: 200. Response: CaseList.

GET /api/v1/cases/{id}

Read case revision

Read current version before editing or approving a plan.

Authority: session. Success: 200. Response: Case.

PATCH /api/v1/cases/{id}

Update case

Missing/stale expected_version returns 409. open↔investigating; open/investigating→closed; closed→open.

Authority: session. Success: 200. Response: Case.

JSON request: CasePatch

GET /api/v1/attack

Declared ATT&CK metadata

Candidate rule/alert metadata, not confirmed technique detection or full coverage.

Authority: session. Success: 200. Response: Attack.

GET /api/v1/audit

Read application audit

Append-only application behavior; production tamper resistance needs separate qualification.

Authority: session. Success: 200. Response: AuditList.

GET /api/v1/workflows

List case workflows

Local case-management workflows only.

Authority: session. Success: 200. Response: WorkflowList.

POST /api/v1/workflows

Create typed workflow

One to twenty steps; only assignment, priority and note. No scripts, network URLs or cloud containment.

Authority: session. Success: 200. Response: Workflow.

JSON request: WorkflowInput

POST /api/v1/workflows/{id}/preview

Preview exact case plan

No case effects. Plan expires in ten minutes and binds case/workflow/policy versions and digest.

Authority: session. Success: 200. Response: Action.

JSON request: Preview

GET /api/v1/actions

Reconcile action plans

Inspect persisted plan and receipt after ambiguity; there is no GET /actions/{id} endpoint.

Authority: session. Success: 200. Response: ActionList.

POST /api/v1/actions/{id}/approve

Approve exact plan

Authenticated human operator. Exact digest and case version required. Repeated identical approval does not execute twice.

Authority: operator. Success: 200. Response: Action.

JSON request: Approve

POST /api/v1/actions/{id}/reject

Reject exact plan

Operator role required; exact digest; opposite decisions conflict.

Authority: operator. Success: 200. Response: Action.

JSON request: Reject

Request & response schemas

UTF-8 byte limits are described explicitly; JSON Schema character lengths do not substitute for byte validation. Additional response fields are allowed where the implementation is extensible. Opaque dependency payloads are intentionally not fabricated into a stable schema.

Error
{
  "type": "object",
  "properties": {
    "error": {
      "type": "string"
    },
    "message": {
      "type": "string"
    }
  },
  "additionalProperties": true,
  "required": [
    "error",
    "message"
  ]
}
User
{
  "type": "object",
  "properties": {
    "name": {
      "type": "string"
    },
    "role": {
      "type": "string"
    },
    "tenant_id": {
      "type": "string"
    },
    "workspace_name": {
      "type": "string"
    }
  },
  "additionalProperties": true,
  "required": [
    "name",
    "role",
    "tenant_id",
    "workspace_name"
  ]
}
Login
{
  "type": "object",
  "properties": {
    "username": {
      "type": "string"
    },
    "password": {
      "type": "string",
      "writeOnly": true
    }
  },
  "additionalProperties": true,
  "required": [
    "username",
    "password"
  ]
}
Signup
{
  "type": "object",
  "properties": {
    "workspace_name": {
      "type": "string",
      "minLength": 1,
      "description": "Nonblank; no control characters; maximum 128 UTF-8 bytes. Names need not be unique."
    },
    "username": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_.@+\\-]{3,64}$",
      "description": "ASCII, globally unique, normalized to lowercase; no email verification."
    },
    "password": {
      "type": "string",
      "writeOnly": true,
      "description": "12–128 UTF-8 bytes (not characters)."
    },
    "password_confirmation": {
      "type": "string",
      "writeOnly": true
    }
  },
  "additionalProperties": false,
  "required": [
    "workspace_name",
    "username",
    "password"
  ]
}
Session
{
  "type": "object",
  "properties": {
    "user": {
      "$ref": "#/components/schemas/User"
    },
    "expires_at": {
      "type": "integer",
      "format": "int64",
      "description": "Unix epoch milliseconds"
    }
  },
  "additionalProperties": true,
  "required": [
    "user",
    "expires_at"
  ]
}
CurrentSession
{
  "type": "object",
  "properties": {
    "user": {
      "$ref": "#/components/schemas/User"
    }
  },
  "additionalProperties": true,
  "required": [
    "user"
  ]
}
SessionOptions
{
  "type": "object",
  "properties": {
    "signup_enabled": {
      "type": "boolean"
    },
    "mode": {
      "enum": [
        "evaluation_workspace",
        "disabled"
      ]
    }
  },
  "additionalProperties": true,
  "required": [
    "signup_enabled",
    "mode"
  ]
}
Status
{
  "type": "object",
  "properties": {
    "status": {
      "type": "string"
    }
  },
  "additionalProperties": true,
  "required": [
    "status"
  ]
}
Health
{
  "type": "object",
  "properties": {
    "status": {
      "enum": [
        "ok",
        "state_unavailable"
      ]
    },
    "inference": {
      "const": "disabled"
    }
  },
  "additionalProperties": true,
  "required": [
    "status"
  ]
}
SourceConfig
{
  "type": "object",
  "properties": {
    "transport": {
      "enum": [
        "manual",
        "aws_cloudwatch",
        "aws_sqs_cloudtrail",
        "google_workspace"
      ]
    },
    "log_groups": {
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "description": "Maximum 512 UTF-8 bytes"
      },
      "minItems": 1,
      "maxItems": 10
    },
    "queue_url": {
      "type": "string"
    },
    "application": {
      "enum": [
        "login",
        "drive",
        "admin"
      ]
    },
    "credential_reference": {
      "type": "string"
    }
  },
  "additionalProperties": false,
  "description": "Transport must match source kind. CloudWatch requires log_groups even for manual import. Credential references are non-secret; do not submit credentials. Admin application selection does not imply admin event mapping coverage."
}
CreateSource
{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Nonempty; maximum 128 UTF-8 bytes"
    },
    "kind": {
      "enum": [
        "aws_cloudtrail",
        "google_workspace",
        "cloudwatch_sample_service"
      ]
    },
    "account_id": {
      "type": "string",
      "description": "Source identity scope; maximum 256 UTF-8 bytes"
    },
    "region": {
      "type": "string",
      "description": "Source scope; maximum 128 UTF-8 bytes"
    },
    "config": {
      "$ref": "#/components/schemas/SourceConfig"
    }
  },
  "additionalProperties": true,
  "required": [
    "name",
    "kind",
    "account_id",
    "region"
  ]
}
SourceToken
{
  "type": "object",
  "properties": {
    "source_id": {
      "type": "string",
      "format": "uuid"
    },
    "ingestion_token": {
      "type": "string",
      "writeOnly": false
    },
    "scope": {
      "const": "source_ingest_and_operation_status"
    },
    "shown_once": {
      "const": true
    }
  },
  "additionalProperties": true,
  "required": [
    "source_id",
    "ingestion_token",
    "scope",
    "shown_once"
  ]
}
Preflight
{
  "type": "object",
  "properties": {
    "status": {
      "type": "string"
    },
    "checks": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string"
          },
          "status": {
            "type": "string"
          },
          "message": {
            "type": "string"
          }
        },
        "additionalProperties": true,
        "required": [
          "name",
          "status",
          "message"
        ]
      }
    },
    "provider_verified": {
      "const": false
    },
    "mapping_scope": {
      "type": "string"
    },
    "transport": {
      "type": "string"
    }
  },
  "additionalProperties": true,
  "required": [
    "status",
    "checks",
    "provider_verified"
  ]
}
Ingest
{
  "type": "object",
  "properties": {
    "records": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": true
      },
      "minItems": 1,
      "maxItems": 1000
    }
  },
  "additionalProperties": true,
  "required": [
    "records"
  ]
}
IngestReceipt
{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "format": "uuid"
    },
    "operation_id": {
      "type": "string",
      "format": "uuid"
    },
    "source_id": {
      "type": "string",
      "format": "uuid"
    },
    "batch_id": {
      "type": "string",
      "format": "uuid"
    },
    "accepted": {
      "type": "integer",
      "minimum": 0
    },
    "replayed": {
      "type": "integer",
      "minimum": 0
    },
    "quarantined": {
      "type": "integer",
      "minimum": 0
    },
    "status": {
      "const": "accepted"
    },
    "disposition": {
      "const": "durable_inbox"
    },
    "created_at": {
      "type": "integer",
      "format": "int64",
      "description": "Unix epoch milliseconds"
    }
  },
  "additionalProperties": true,
  "required": [
    "operation_id",
    "accepted",
    "replayed",
    "quarantined",
    "status"
  ]
}
Operation
{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "format": "uuid"
    },
    "operation_id": {
      "type": "string",
      "format": "uuid"
    },
    "source_id": {
      "type": "string",
      "format": "uuid"
    },
    "batch_id": {
      "type": "string",
      "format": "uuid"
    },
    "accepted": {
      "type": "integer",
      "minimum": 0
    },
    "replayed": {
      "type": "integer",
      "minimum": 0
    },
    "quarantined": {
      "type": "integer",
      "minimum": 0
    },
    "status": {
      "enum": [
        "pending",
        "committed"
      ]
    },
    "lanes": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "event_id": {
            "type": "string",
            "format": "uuid"
          },
          "lane": {
            "type": "string"
          },
          "status": {
            "type": "string"
          },
          "attempts": {
            "type": "integer",
            "minimum": 0
          },
          "last_error": {
            "type": [
              "string",
              "null"
            ]
          },
          "receipt": {
            "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
          }
        },
        "additionalProperties": true,
        "required": [
          "event_id",
          "lane",
          "status",
          "attempts"
        ]
      }
    },
    "quarantine_disposition": {
      "const": "durable_postgresql_raw_batch_and_quarantine"
    },
    "created_at": {
      "type": "integer",
      "format": "int64",
      "description": "Unix epoch milliseconds"
    }
  },
  "additionalProperties": true,
  "required": [
    "operation_id",
    "status",
    "lanes"
  ]
}
HotQuery
{
  "type": "object",
  "properties": {
    "start_time_ms": {
      "type": "integer",
      "format": "int64",
      "description": "Unix epoch milliseconds",
      "minimum": 0
    },
    "end_time_ms": {
      "type": "integer",
      "format": "int64",
      "description": "Unix epoch milliseconds",
      "minimum": 0
    },
    "source_id": {
      "type": "string",
      "format": "uuid"
    },
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 500,
      "default": 100
    },
    "class_uid": {
      "type": "integer",
      "format": "int32"
    },
    "status_id": {
      "type": "integer",
      "format": "int32"
    },
    "text": {
      "type": "string",
      "description": "Maximum 256 UTF-8 bytes; case-insensitive substring of activity_name or actor only."
    }
  },
  "additionalProperties": false,
  "description": "31-day maximum range; default last 24 hours. Reject unknown keys including sql."
}
HistoryQuery
{
  "type": "object",
  "properties": {
    "start_time_ms": {
      "type": "integer",
      "format": "int64",
      "description": "Unix epoch milliseconds",
      "minimum": 0
    },
    "end_time_ms": {
      "type": "integer",
      "format": "int64",
      "description": "Unix epoch milliseconds",
      "minimum": 0
    },
    "source_id": {
      "type": "string",
      "format": "uuid"
    },
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 500,
      "default": 100
    }
  },
  "additionalProperties": false,
  "description": "31-day maximum range. Same bounds as hot query, but class_uid/status_id/text are rejected. No hot fallback."
}
Event
{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "format": "uuid"
    },
    "source_id": {
      "type": "string",
      "format": "uuid"
    },
    "source_key": {
      "type": "string"
    },
    "event_time_ms": {
      "type": "integer",
      "format": "int64",
      "description": "Unix epoch milliseconds"
    },
    "class_uid": {
      "type": "integer"
    },
    "status_id": {
      "type": "integer"
    },
    "activity_name": {
      "type": "string"
    },
    "actor": {
      "type": "string"
    },
    "ocsf": {
      "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
    },
    "raw_reference": {
      "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
    }
  },
  "additionalProperties": true,
  "required": [
    "id",
    "source_id",
    "event_time_ms",
    "ocsf"
  ]
}
Evidence
{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "format": "uuid"
    },
    "ocsf": {
      "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
    },
    "raw_reference": {
      "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
    },
    "raw_base64": {
      "type": "string",
      "contentEncoding": "base64",
      "description": "Exact retained request batch; use record ordinal/provenance to locate the native record."
    },
    "raw_digest": {
      "type": "string"
    },
    "batch_id": {
      "type": "string",
      "format": "uuid"
    }
  },
  "additionalProperties": true,
  "required": [
    "id",
    "ocsf",
    "raw_base64",
    "raw_digest"
  ]
}
HotQueryResult
{
  "type": "object",
  "properties": {
    "items": {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/Event"
      },
      "maxItems": 500
    },
    "query": {
      "type": "object",
      "properties": {
        "sql": {
          "type": "string"
        },
        "rows": {
          "type": "integer",
          "minimum": 0
        },
        "elapsed_ms": {
          "type": "integer",
          "minimum": 0
        }
      },
      "additionalProperties": true,
      "required": [
        "sql",
        "rows",
        "elapsed_ms"
      ]
    },
    "scope": {
      "const": "hot"
    }
  },
  "additionalProperties": true,
  "required": [
    "items",
    "query",
    "scope"
  ]
}
HistoryQueryResult
{
  "type": "object",
  "properties": {
    "items": {
      "type": "array",
      "items": {
        "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
      },
      "maxItems": 500
    },
    "scope": {
      "const": "historical"
    }
  },
  "additionalProperties": true,
  "required": [
    "items",
    "scope"
  ]
}
RuleInput
{
  "type": "object",
  "properties": {
    "yaml": {
      "type": "string",
      "description": "Maximum 64 KiB UTF-8; strict stateless subset only."
    },
    "enabled": {
      "type": "boolean"
    }
  },
  "additionalProperties": true,
  "required": [
    "yaml"
  ]
}
RuleValidation
{
  "type": "object",
  "properties": {
    "valid": {
      "type": "boolean"
    },
    "errors": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "compiled_sql": {
      "type": "string"
    },
    "supported_features": {
      "type": "array",
      "items": {
        "type": "string"
      }
    }
  },
  "additionalProperties": true,
  "required": [
    "valid",
    "errors",
    "supported_features"
  ]
}
Rule
{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "format": "uuid"
    },
    "title": {
      "type": "string"
    },
    "severity": {
      "type": "string"
    },
    "enabled": {
      "type": "boolean"
    },
    "version": {
      "type": "string"
    },
    "attack_tags": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "yaml": {
      "type": "string"
    },
    "pipeline_id": {
      "type": [
        "string",
        "null"
      ]
    },
    "status": {
      "type": "string"
    },
    "last_error": {
      "type": [
        "string",
        "null"
      ]
    }
  },
  "additionalProperties": true,
  "required": [
    "id",
    "title",
    "enabled",
    "version",
    "status"
  ]
}
Narrative
{
  "type": "object",
  "properties": {
    "summary": {
      "type": "string"
    },
    "observed_facts": {
      "type": "array",
      "items": {
        "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
      }
    },
    "citations": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "uuid"
      }
    },
    "timeline": {
      "type": "array",
      "items": {
        "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
      }
    },
    "uncertainty": {
      "type": "string"
    },
    "suggested_review": {
      "type": "string"
    },
    "inference": {
      "type": "object",
      "properties": {
        "status": {
          "const": "disabled"
        },
        "delivery_independent": {
          "const": true
        }
      },
      "additionalProperties": true
    }
  },
  "additionalProperties": true
}
Alert
{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "format": "uuid"
    },
    "title": {
      "type": "string"
    },
    "severity": {
      "type": "string"
    },
    "status": {
      "type": "string"
    },
    "rule_id": {
      "type": "string",
      "format": "uuid"
    },
    "rule_version": {
      "type": "string"
    },
    "case_id": {
      "type": "string",
      "format": "uuid"
    },
    "created_at": {
      "type": "integer",
      "format": "int64",
      "description": "Unix epoch milliseconds"
    },
    "attack_tags": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "narrative": {
      "$ref": "#/components/schemas/Narrative"
    },
    "triage_status": {
      "type": "string"
    },
    "evidence_ids": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "uuid"
      }
    },
    "evidence": {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/Evidence"
      }
    }
  },
  "additionalProperties": true,
  "required": [
    "id",
    "rule_id",
    "rule_version",
    "case_id",
    "narrative",
    "evidence_ids"
  ]
}
Triage
{
  "type": "object",
  "properties": {
    "disposition": {
      "enum": [
        "new",
        "investigating",
        "true_positive",
        "false_positive",
        "benign",
        "insufficient_evidence",
        "closed"
      ]
    },
    "note": {
      "type": "string"
    }
  },
  "additionalProperties": true,
  "required": [
    "disposition",
    "note"
  ]
}
Case
{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "format": "uuid"
    },
    "title": {
      "type": "string"
    },
    "status": {
      "enum": [
        "open",
        "investigating",
        "closed"
      ]
    },
    "priority": {
      "type": "string",
      "enum": [
        "low",
        "medium",
        "high",
        "critical"
      ]
    },
    "assignee": {
      "type": [
        "string",
        "null"
      ]
    },
    "notes": {
      "type": "array",
      "items": {
        "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
      }
    },
    "alert_ids": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "uuid"
      }
    },
    "evidence_ids": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "uuid"
      }
    },
    "version": {
      "type": "integer"
    },
    "created_at": {
      "type": "integer",
      "format": "int64",
      "description": "Unix epoch milliseconds"
    },
    "updated_at": {
      "type": "integer",
      "format": "int64",
      "description": "Unix epoch milliseconds"
    }
  },
  "additionalProperties": true,
  "required": [
    "id",
    "title",
    "status",
    "version"
  ]
}
CasePatch
{
  "type": "object",
  "properties": {
    "expected_version": {
      "type": "integer"
    },
    "title": {
      "type": "string"
    },
    "status": {
      "enum": [
        "open",
        "investigating",
        "closed"
      ]
    },
    "assignee": {
      "type": "string"
    },
    "priority": {
      "type": "string",
      "enum": [
        "low",
        "medium",
        "high",
        "critical"
      ]
    },
    "note": {
      "type": "string"
    }
  },
  "additionalProperties": false,
  "required": [
    "expected_version"
  ]
}
Definition
{
  "type": "object",
  "properties": {
    "steps": {
      "type": "array",
      "items": {
        "oneOf": [
          {
            "type": "object",
            "properties": {
              "action": {
                "const": "case.assign"
              },
              "parameters": {
                "type": "object",
                "properties": {
                  "assignee": {
                    "type": "string",
                    "minLength": 1,
                    "description": "At most 128 UTF-8 bytes"
                  }
                },
                "additionalProperties": false,
                "required": [
                  "assignee"
                ]
              }
            },
            "additionalProperties": false,
            "required": [
              "action",
              "parameters"
            ]
          },
          {
            "type": "object",
            "properties": {
              "action": {
                "const": "case.set_priority"
              },
              "parameters": {
                "type": "object",
                "properties": {
                  "priority": {
                    "type": "string",
                    "enum": [
                      "low",
                      "medium",
                      "high",
                      "critical"
                    ]
                  }
                },
                "additionalProperties": false,
                "required": [
                  "priority"
                ]
              }
            },
            "additionalProperties": false,
            "required": [
              "action",
              "parameters"
            ]
          },
          {
            "type": "object",
            "properties": {
              "action": {
                "const": "case.add_note"
              },
              "parameters": {
                "type": "object",
                "properties": {
                  "note": {
                    "type": "string",
                    "minLength": 1,
                    "description": "At most 4096 UTF-8 bytes"
                  }
                },
                "additionalProperties": false,
                "required": [
                  "note"
                ]
              }
            },
            "additionalProperties": false,
            "required": [
              "action",
              "parameters"
            ]
          }
        ]
      },
      "minItems": 1,
      "maxItems": 20
    }
  },
  "additionalProperties": false,
  "required": [
    "steps"
  ]
}
WorkflowInput
{
  "type": "object",
  "properties": {
    "name": {
      "type": "string"
    },
    "definition": {
      "$ref": "#/components/schemas/Definition"
    }
  },
  "additionalProperties": true,
  "required": [
    "name",
    "definition"
  ]
}
Workflow
{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "format": "uuid"
    },
    "name": {
      "type": "string"
    },
    "definition": {
      "$ref": "#/components/schemas/Definition"
    },
    "version": {
      "type": "integer"
    },
    "created_at": {
      "type": "integer",
      "format": "int64",
      "description": "Unix epoch milliseconds"
    }
  },
  "additionalProperties": true,
  "required": [
    "id",
    "name",
    "definition",
    "version"
  ]
}
Preview
{
  "type": "object",
  "properties": {
    "case_id": {
      "type": "string",
      "format": "uuid"
    }
  },
  "additionalProperties": true,
  "required": [
    "case_id"
  ]
}
Approve
{
  "type": "object",
  "properties": {
    "digest": {
      "type": "string"
    },
    "expected_version": {
      "type": "integer"
    }
  },
  "additionalProperties": true,
  "required": [
    "digest",
    "expected_version"
  ]
}
Reject
{
  "type": "object",
  "properties": {
    "digest": {
      "type": "string"
    }
  },
  "additionalProperties": true,
  "required": [
    "digest"
  ]
}
Action
{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "format": "uuid"
    },
    "plan_id": {
      "type": "string",
      "format": "uuid"
    },
    "case_id": {
      "type": "string",
      "format": "uuid"
    },
    "workflow_id": {
      "type": "string",
      "format": "uuid"
    },
    "workflow_version": {
      "type": "integer"
    },
    "case_version": {
      "type": "integer"
    },
    "policy_version": {
      "const": "case-actions-v1"
    },
    "digest": {
      "type": "string"
    },
    "steps": {
      "type": "array",
      "items": {
        "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
      }
    },
    "expires_at": {
      "type": "integer",
      "format": "int64",
      "description": "Unix epoch milliseconds"
    },
    "status": {
      "enum": [
        "awaiting_approval",
        "verified",
        "rejected"
      ]
    },
    "receipt": {
      "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
    },
    "requested_by": {
      "type": "string"
    },
    "decided_by": {
      "type": "string"
    }
  },
  "additionalProperties": true,
  "required": [
    "id",
    "digest",
    "case_version",
    "expires_at",
    "status"
  ]
}
Audit
{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "format": "uuid"
    },
    "actor": {
      "type": "string"
    },
    "operation": {
      "type": "string"
    },
    "entity_type": {
      "type": "string"
    },
    "entity_id": {
      "type": "string",
      "format": "uuid"
    },
    "before": {
      "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
    },
    "after": {
      "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
    },
    "created_at": {
      "type": "integer",
      "format": "int64",
      "description": "Unix epoch milliseconds"
    }
  },
  "additionalProperties": true,
  "required": [
    "id",
    "actor",
    "operation",
    "created_at"
  ]
}
Attack
{
  "type": "object",
  "properties": {
    "items": {
      "type": "array",
      "items": {
        "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
      }
    },
    "scope": {
      "const": "declared_rule_metadata_not_full_attack_coverage"
    }
  },
  "additionalProperties": true,
  "required": [
    "items",
    "scope"
  ]
}
Overview
{
  "type": "object",
  "properties": {
    "events": {
      "type": "integer",
      "minimum": 0
    },
    "alerts": {
      "type": "integer",
      "minimum": 0
    },
    "open_cases": {
      "type": "integer",
      "minimum": 0
    },
    "sources": {
      "type": "integer",
      "minimum": 0
    },
    "quarantine": {
      "type": "integer",
      "minimum": 0
    },
    "pipeline": {
      "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
    },
    "detection_delivery": {
      "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
    },
    "inference": {
      "type": "object",
      "properties": {
        "status": {
          "const": "disabled"
        },
        "delivery_independent": {
          "const": true
        }
      },
      "additionalProperties": true
    },
    "version": {
      "type": "string"
    },
    "profile": {
      "const": "bounded_private_evaluation"
    }
  },
  "additionalProperties": true,
  "required": [
    "events",
    "alerts",
    "open_cases",
    "sources",
    "quarantine",
    "inference"
  ]
}
Costs
{
  "type": "object",
  "properties": {
    "schema_version": {
      "const": "log-salad-cost-inventory-v1"
    },
    "as_of": {
      "type": [
        "string",
        "integer",
        "null"
      ]
    },
    "clusters": {
      "type": "array",
      "items": {
        "description": "Provider-native or version-dependent JSON; not a generated complete OCSF schema."
      }
    },
    "summary": {
      "type": "object",
      "properties": {
        "status": {
          "type": "string"
        }
      },
      "additionalProperties": true
    },
    "limitations": {
      "type": "array",
      "items": {
        "type": "string"
      }
    }
  },
  "additionalProperties": true,
  "required": [
    "schema_version",
    "clusters",
    "summary"
  ]
}
Source
{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Nonempty; maximum 128 UTF-8 bytes"
    },
    "kind": {
      "enum": [
        "aws_cloudtrail",
        "google_workspace",
        "cloudwatch_sample_service"
      ]
    },
    "account_id": {
      "type": "string",
      "description": "Source identity scope; maximum 256 UTF-8 bytes"
    },
    "region": {
      "type": "string",
      "description": "Source scope; maximum 128 UTF-8 bytes"
    },
    "config": {
      "$ref": "#/components/schemas/SourceConfig"
    },
    "id": {
      "type": "string",
      "format": "uuid"
    },
    "status": {
      "type": "string"
    },
    "last_event_at": {
      "type": [
        "integer",
        "null"
      ]
    },
    "event_count": {
      "type": "integer",
      "minimum": 0
    },
    "last_error": {
      "type": [
        "string",
        "null"
      ]
    },
    "created_at": {
      "type": "integer",
      "format": "int64",
      "description": "Unix epoch milliseconds"
    }
  },
  "additionalProperties": true,
  "required": [
    "id",
    "name",
    "kind",
    "status"
  ]
}
SourceList
{
  "type": "object",
  "properties": {
    "items": {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/Source"
      }
    }
  },
  "additionalProperties": true,
  "required": [
    "items"
  ]
}
RuleList
{
  "type": "object",
  "properties": {
    "items": {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/Rule"
      }
    }
  },
  "additionalProperties": true,
  "required": [
    "items"
  ]
}
AlertList
{
  "type": "object",
  "properties": {
    "items": {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/Alert"
      }
    }
  },
  "additionalProperties": true,
  "required": [
    "items"
  ]
}
CaseList
{
  "type": "object",
  "properties": {
    "items": {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/Case"
      }
    }
  },
  "additionalProperties": true,
  "required": [
    "items"
  ]
}
WorkflowList
{
  "type": "object",
  "properties": {
    "items": {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/Workflow"
      }
    }
  },
  "additionalProperties": true,
  "required": [
    "items"
  ]
}
ActionList
{
  "type": "object",
  "properties": {
    "items": {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/Action"
      }
    }
  },
  "additionalProperties": true,
  "required": [
    "items"
  ]
}
AuditList
{
  "type": "object",
  "properties": {
    "items": {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/Audit"
      }
    }
  },
  "additionalProperties": true,
  "required": [
    "items"
  ]
}