Investigation

get

Returns an alert investigation

Authorizations

ApiKeyAuth

Path parameters

investigation_idstringRequired

Responses

200

Investigation data object. For progress: investigation.status=

application/json

400

Malformed request

application/json

403

Access denied

application/json

404

No investigation found for ID

application/json

500

System error

application/json

get

/app/api/v1/investigation/{investigation_id}

HTTPcURLJavaScriptPython

GET /app/api/v1/investigation/{investigation_id} HTTP/1.1
Host: 
Authorization: YOUR_API_KEY
Accept: */*

{
  "id": 1,
  "findings": [
    {
      "headline": "text",
      "finding": "text",
      "outcome": "COMPLETED_BREACHED_CONFIRMED",
      "artifacts": [
        "text"
      ],
      "evidences": [
        {
          "evidence_type": "text",
          "tag": "text",
          "data": "text"
        }
      ]
    }
  ],
  "recommended_remediations": [
    "text"
  ],
  "alert": {
    "id": 1,
    "entities": [
      {
        "type": "text",
        "value": "text"
      }
    ],
    "origin_integration_display_name": "text",
    "original_title": "text",
    "created_at": "2025-11-02T15:12:38.164Z",
    "updated_at": "2025-11-02T15:12:38.164Z",
    "handler_version": "v1",
    "schema_key": "text",
    "coalesce_key": "text",
    "direct_source_label": "text",
    "proxy_source_label": "text",
    "origin_ticket_id": "text",
    "origin_ticket_id_label": "text",
    "origin_ticket_url": "text",
    "start_time": "2025-11-02T15:12:38.164Z",
    "create_time": "2025-11-02T15:12:38.164Z",
    "severity": "text",
    "alert_type": "text",
    "title": "text",
    "assets": {
      "ANY_ADDITIONAL_PROPERTY": "anything"
    },
    "raw_alert_content": "text",
    "tenant_id": "text",
    "tenant_label": "text",
    "tenant_integration_key": "text",
    "enrich_result": {
      "ANY_ADDITIONAL_PROPERTY": "anything"
    },
    "origin_integration": "text",
    "tenant_union": 1
  },
  "conclusion": "text",
  "inv_url": "text",
  "created_at": "2025-11-02T15:12:38.164Z",
  "updated_at": "2025-11-02T15:12:38.164Z",
  "start_time": "2025-11-02T15:12:38.164Z",
  "status": "not_asked",
  "ready": true,
  "canceled": "CANCEL_MANUAL",
  "error_msg": "text",
  "generated_time": "2025-11-02T15:12:38.164Z",
  "is_retried": true,
  "exec_summary": "text",
  "alert_summary": "text",
  "attack_surface": "text",
  "mitre_tactic": "text",
  "conclusion_summary": "text",
  "outcome": "COMPLETED_BREACHED_CONFIRMED",
  "priority": "informational",
  "insight_tags": {
    "ANY_ADDITIONAL_PROPERTY": "anything"
  },
  "key_findings": {
    "ANY_ADDITIONAL_PROPERTY": "anything"
  },
  "findings_ranking": {
    "ANY_ADDITIONAL_PROPERTY": "anything"
  },
  "related_alert_hypothesis": {
    "ANY_ADDITIONAL_PROPERTY": "anything"
  },
  "interview_proposals": {
    "ANY_ADDITIONAL_PROPERTY": "anything"
  },
  "email_screenshot": "text",
  "backfill": 1,
  "ignored_for": 1
}

post

Creates a new alert investigation, returning investigation_id Returns existing id if alert already exists (unless force_reinvestigation=True) Then: Use GET /app/api/v1/investigation/{investigation_id} for updates

Authorizations

ApiKeyAuth

Body

application/json

schema_keystringOptional

raw_alert_contentobjectOptional

force_reinvestigationbooleanOptionalDefault: false

tenant_union_idnumber | nullableOptionalDefault: null

Responses

200

Existing investigation found

application/json

201

New investigation created

application/json

400

Malformed request

application/json

403

Access denied

application/json

422

Alert skipped due to missing data (e.g., propagation delay)

application/json

500

System error

application/json

503

System not ready for requests

application/json

post

/app/api/v1/investigation/create

HTTPcURLJavaScriptPython

POST /app/api/v1/investigation/create HTTP/1.1
Host: 
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 94

{
  "schema_key": "text",
  "raw_alert_content": {},
  "force_reinvestigation": false,
  "tenant_union_id": 1
}

{
  "investigation_id": 1
}

post

Request body = arbitrary alert JSON to be parsed & investigated Response = investigation_id if successful, error_msg otherwise Returns existing id if alert already exists (unless ?force_reinvestigation=True) Then: Use GET /app/api/v1/investigation/{investigation_id} for updates

Authorizations

ApiKeyAuth

Query parameters

force_reinvestigationbooleanOptional

Force reinvestigation

Body

application/json

objectOptional

Responses

200

Existing investigation found

application/json

201

New investigation created

application/json

400

Malformed request

application/json

403

Access denied

application/json

413

Content Too Large

application/json

500

System error

application/json

503

System not ready for requests

application/json

post

/app/api/v1/investigation/create/custom

HTTPcURLJavaScriptPython

POST /app/api/v1/investigation/create/custom HTTP/1.1
Host: 
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

{
  "investigation_id": 1
}