> For the complete documentation index, see [llms.txt](https://docs.dropzone.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dropzone.ai/api/investigation.md). # Investigation ## GET /app/api/v1/investigation > List investigations (with optional filtering, sorting, and search)\ > \ > Returns a paginated list of investigations. By default, only completed investigations\ > (state='success') are returned. Use query parameters to filter by state, outcomes,\ > priorities, date ranges, and more.
```json {"openapi":"3.0.3","info":{"title":"Dropzone AI","version":"0.1.0"},"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"in":"header","name":"Authorization","type":"apiKey"}},"schemas":{"PaginatedInvestigationList":{"properties":{"count":{"description":"Total number of investigations","type":"integer"},"next":{"description":"URL to next page of results","format":"uri","nullable":true,"type":"string"},"previous":{"description":"URL to previous page of results","format":"uri","nullable":true,"type":"string"},"results":{"items":{"$ref":"#/components/schemas/ScriptVarSerializer_Investigation"},"type":"array"}},"required":["count","next","previous","results"],"type":"object"},"ScriptVarSerializer_Investigation":{"properties":{"alert":{"$ref":"#/components/schemas/ScriptVarSerializer_Alert"},"alert_summary":{"nullable":true,"type":"string"},"attack_surface":{"nullable":true,"type":"string"},"canceled":{"nullable":true,"oneOf":[{"$ref":"#/components/schemas/CanceledEnum"},{"$ref":"#/components/schemas/NullEnum"}]},"conclusion":{"readOnly":true,"type":"string"},"conclusion_summary":{"nullable":true,"type":"string"},"created_at":{"format":"date-time","readOnly":true,"type":"string"},"custom_outcome":{"additionalProperties":{},"nullable":true,"readOnly":true,"type":"object"},"error_msg":{"nullable":true,"type":"string"},"exec_summary":{"nullable":true,"type":"string"},"feedback":{"$ref":"#/components/schemas/ScriptVarSerializer_InvestigationFeedback"},"findings":{"additionalProperties":{},"type":"object"},"findings_ranking":{"additionalProperties":{},"type":"object"},"generated_time":{"format":"date-time","nullable":true,"type":"string"},"id":{"readOnly":true,"type":"integer"},"ignored_for_investigation_id":{"nullable":true,"readOnly":true,"type":"integer"},"insight_tags":{"additionalProperties":{},"type":"object"},"interview_proposals":{"additionalProperties":{},"type":"object"},"inv_url":{"readOnly":true,"type":"string"},"key_findings":{"additionalProperties":{},"type":"object"},"mitre_tactic":{"nullable":true,"type":"string"},"outcome":{"nullable":true,"oneOf":[{"$ref":"#/components/schemas/Outcome05cEnum"},{"$ref":"#/components/schemas/NullEnum"}]},"priority":{"nullable":true,"oneOf":[{"$ref":"#/components/schemas/PriorityEnum"},{"$ref":"#/components/schemas/NullEnum"}]},"recommended_remediations":{"additionalProperties":{},"type":"object"},"remediation_action_runs":{"items":{"$ref":"#/components/schemas/ScriptVarSerializer_RemediationActionRun"},"readOnly":true,"type":"array"},"start_time":{"format":"date-time","nullable":true,"type":"string"},"status":{"$ref":"#/components/schemas/StatusF08Enum"},"updated_at":{"format":"date-time","readOnly":true,"type":"string"}},"required":["alert","conclusion","created_at","custom_outcome","feedback","id","ignored_for_investigation_id","inv_url","remediation_action_runs","updated_at"],"type":"object"},"ScriptVarSerializer_Alert":{"properties":{"alert_type":{"type":"string"},"assets":{"additionalProperties":{},"type":"object"},"coalesce_key":{"nullable":true,"type":"string"},"create_time":{"format":"date-time","type":"string"},"created_at":{"format":"date-time","readOnly":true,"type":"string"},"direct_source_label":{"type":"string"},"entities":{"additionalProperties":{},"type":"object"},"id":{"readOnly":true,"type":"integer"},"origin_integration":{"nullable":true,"type":"string"},"origin_ticket_id":{"nullable":true,"type":"string"},"origin_ticket_id_label":{"nullable":true,"type":"string"},"origin_ticket_url":{"nullable":true,"type":"string"},"original_title":{"type":"string"},"proxy_source_label":{"nullable":true,"type":"string"},"raw_alert_content":{"type":"string"},"schema_key":{"type":"string"},"severity":{"nullable":true,"type":"string"},"start_time":{"format":"date-time","nullable":true,"type":"string"},"tenant_id":{"nullable":true,"type":"string"},"tenant_integration_key":{"nullable":true,"type":"string"},"tenant_label":{"nullable":true,"type":"string"},"tenant_union":{"$ref":"#/components/schemas/ScriptVarSerializer_TenantUnion"},"title":{"type":"string"},"updated_at":{"format":"date-time","readOnly":true,"type":"string"}},"required":["alert_type","create_time","created_at","direct_source_label","id","raw_alert_content","schema_key","tenant_union","title","updated_at"],"type":"object"},"ScriptVarSerializer_TenantUnion":{"properties":{"created_at":{"format":"date-time","readOnly":true,"type":"string"},"display_name":{"type":"string"},"id":{"readOnly":true,"type":"integer"},"lookup_dict":{"additionalProperties":{},"type":"object"},"updated_at":{"format":"date-time","readOnly":true,"type":"string"}},"required":["created_at","display_name","id","updated_at"],"type":"object"},"CanceledEnum":{"description":"* `CANCEL_MANUAL` - CANCEL_MANUAL\n* `CANCEL_THRESHOLD` - CANCEL_THRESHOLD","enum":["CANCEL_MANUAL","CANCEL_THRESHOLD"],"type":"string"},"NullEnum":{"enum":[null]},"ScriptVarSerializer_InvestigationFeedback":{"properties":{"conclusion":{"readOnly":true,"type":"string"},"conclusion_summary":{"nullable":true,"type":"string"},"created_at":{"format":"date-time","readOnly":true,"type":"string"},"findings":{"additionalProperties":{},"type":"object"},"findings_ranking":{"additionalProperties":{},"nullable":true,"type":"object"},"id":{"readOnly":true,"type":"integer"},"insight_tags":{"additionalProperties":{},"nullable":true,"type":"object"},"key_findings":{"additionalProperties":{},"nullable":true,"type":"object"},"outcome":{"nullable":true,"oneOf":[{"$ref":"#/components/schemas/Outcome05cEnum"},{"$ref":"#/components/schemas/NullEnum"}]},"outcome_note":{"nullable":true,"type":"string"},"priority":{"nullable":true,"oneOf":[{"$ref":"#/components/schemas/PriorityEnum"},{"$ref":"#/components/schemas/NullEnum"}]},"remediations_done":{"additionalProperties":{},"type":"object"},"status":{"$ref":"#/components/schemas/ScriptVarSerializerInvestigationFeedbackStatusEnum"},"updated_at":{"format":"date-time","readOnly":true,"type":"string"}},"required":["conclusion","created_at","id","updated_at"],"type":"object"},"Outcome05cEnum":{"description":"* `COMPLETED_BREACHED_CONFIRMED` - COMPLETED_BREACHED_CONFIRMED\n* `COMPLETED_BREACHED_SUSPICIOUS` - COMPLETED_BREACHED_SUSPICIOUS\n* `COMPLETED_FALSE_ALERT` - COMPLETED_FALSE_ALERT\n* `INCOMPLETE` - INCOMPLETE\n* `IGNORED` - IGNORED","enum":["COMPLETED_BREACHED_CONFIRMED","COMPLETED_BREACHED_SUSPICIOUS","COMPLETED_FALSE_ALERT","INCOMPLETE","IGNORED"],"type":"string"},"PriorityEnum":{"description":"* `informational` - Informational\n* `notable` - Notable\n* `urgent` - Urgent","enum":["informational","notable","urgent"],"type":"string"},"ScriptVarSerializerInvestigationFeedbackStatusEnum":{"description":"* `in_review` - In Review\n* `reviewed` - Reviewed","enum":["in_review","reviewed"],"type":"string"},"ScriptVarSerializer_RemediationActionRun":{"properties":{"entity":{"type":"string"},"remediation_action":{"$ref":"#/components/schemas/ScriptVarSerializer_RemediationAction"}},"required":["remediation_action"],"type":"object"},"ScriptVarSerializer_RemediationAction":{"properties":{"name":{"type":"string"}},"required":["name"],"type":"object"},"StatusF08Enum":{"description":"* `not_asked` - not_asked\n* `loading` - loading\n* `success` - success\n* `error` - error","enum":["not_asked","loading","success","error"],"type":"string"}}},"paths":{"/app/api/v1/investigation":{"get":{"description":"List investigations (with optional filtering, sorting, and search)\n\nReturns a paginated list of investigations. By default, only completed investigations\n(state='success') are returned. Use query parameters to filter by state, outcomes,\npriorities, date ranges, and more.\n","operationId":"investigation_retrieve","parameters":[{"description":"Filter by alert creation time (from). ISO 8601 format","in":"query","name":"alert_create_from","schema":{"type":"string"}},{"description":"Filter by alert creation time (until). ISO 8601 format","in":"query","name":"alert_create_until","schema":{"type":"string"}},{"description":"Filter by alert start time (from). ISO 8601 format (e.g., 2024-01-01 or 2024-01-01T00:00:00Z)","in":"query","name":"alert_start_from","schema":{"type":"string"}},{"description":"Filter by alert start time (until). ISO 8601 format","in":"query","name":"alert_start_until","schema":{"type":"string"}},{"description":"Filter by alert tenant name (can be repeated)","in":"query","name":"alert_tenants","schema":{"items":{"type":"string"},"type":"array"}},{"description":"Filter by alert type/handler key (can be repeated)","in":"query","name":"alert_types","schema":{"items":{"type":"string"},"type":"array"}},{"description":"Filter by attack surface (can be repeated)","in":"query","name":"attack_surfaces","schema":{"items":{"enum":["Cloud Infrastructure","Endpoint","Identity","Kubernetes","Network","Phishing","SaaS"],"type":"string"},"type":"array"}},{"description":"Filter by alert source label (can be repeated)","in":"query","name":"direct_source_labels","schema":{"items":{"type":"string"},"type":"array"}},{"description":"Filter by feedback last updated time (from). ISO 8601 format","in":"query","name":"feedback_updated_from","schema":{"type":"string"}},{"description":"Filter by feedback last updated time (until). ISO 8601 format","in":"query","name":"feedback_updated_until","schema":{"type":"string"}},{"description":"Filter by insight tag name (can be repeated)","in":"query","name":"insight_tag_names","schema":{"items":{"type":"string"},"type":"array"}},{"description":"Filter by interview status (can be repeated)","in":"query","name":"interview_statuses","schema":{"items":{"enum":["active","approved","canceled","declined","failed","finished","finished_with_referral","pending","timed_out"],"type":"string"},"type":"array"}},{"description":"Filter by investigation completion time (from). ISO 8601 format","in":"query","name":"inv_complete_from","schema":{"type":"string"}},{"description":"Filter by investigation completion time (until). ISO 8601 format","in":"query","name":"inv_complete_until","schema":{"type":"string"}},{"description":"Filter by investigation state. Valid values: not_asked (queued), loading (running), success (complete), error (stopped). Defaults to 'success'.","in":"query","name":"investigation_state","schema":{"enum":["error","loading","not_asked","success"],"type":"string"}},{"description":"Number of results per page","in":"query","name":"limit","schema":{"type":"integer"}},{"description":"Filter by MITRE ATT&CK tactic (can be repeated)","in":"query","name":"mitre_tactics","schema":{"items":{"enum":["Collection","Command and Control","Credential Access","Defense Evasion","Discovery","Execution","Exfiltration","Impact","Initial Access","Lateral Movement","Persistence","Privilege Escalation"],"type":"string"},"type":"array"}},{"description":"Number of results to skip","in":"query","name":"offset","schema":{"type":"integer"}},{"description":"Filter by investigation outcome/conclusion (can be repeated)","in":"query","name":"outcomes","schema":{"items":{"enum":["COMPLETED_BREACHED_CONFIRMED","COMPLETED_BREACHED_SUSPICIOUS","COMPLETED_FALSE_ALERT","IGNORED","INCOMPLETE"],"type":"string"},"type":"array"}},{"description":"Filter by investigation priority (can be repeated)","in":"query","name":"priorities","schema":{"items":{"enum":["informational","notable","urgent"],"type":"string"},"type":"array"}},{"description":"Filter by priority status (can be repeated)","in":"query","name":"priority_statuses","schema":{"items":{"type":"string"},"type":"array"}},{"description":"Free-text search across investigation fields","in":"query","name":"search","schema":{"type":"string"}},{"description":"Sort direction. Defaults to 'desc'.","in":"query","name":"sort_dir","schema":{"enum":["asc","desc"],"type":"string"}},{"description":"Sort field. Defaults to 'alert_create'.","in":"query","name":"sort_type","schema":{"enum":["activity","alert_create","alert_source","alert_title","alert_type","feedback_status","investigation_create","outcome","priority_status","stopped_reason"],"type":"string"}},{"description":"Filter by stopped reason for error/canceled investigations (can be repeated)","in":"query","name":"stopped_reasons","schema":{"items":{"type":"string"},"type":"array"}},{"description":"Filter by tenant ID","in":"query","name":"tenant_id","schema":{"type":"string"}},{"description":"Filter by tenant integration key","in":"query","name":"tenant_integration_key","schema":{"type":"string"}},{"description":"Filter by user feedback status (can be repeated)","in":"query","name":"user_statuses","schema":{"items":{"enum":["in_review","reviewed"],"type":"string"},"type":"array"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaginatedInvestigationList"}}},"description":"Paginated list of investigations\n

\nReturns a paginated list of investigations. By default, only completed investigations\n(state='success') are returned. Use query parameters to filter by state, outcomes,\npriorities, date ranges, and more.\n

\nUse next and previous\nURLs in the response for easy page navigation.\n

\n"},"400":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"Bad request - invalid input"},"401":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"properties":{"detail":{"type":"string"}},"type":"object"}}},"description":"Access denied"},"500":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"System error"},"503":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"System not ready for requests"}},"tags":["investigation"]}}}} ``` ## POST /app/api/v1/investigation/create > Creates a new alert investigation, returning \investigation\_id\\ > \
\
\ > \Returns existing id if alert already exists (unless \force\_reinvestigation=True\)\\ > \
\
\ > \Then:\ Use \GET /app/api/v1/investigation/{investigation\_id}\ for updates
```json {"openapi":"3.0.3","info":{"title":"Dropzone AI","version":"0.1.0"},"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"in":"header","name":"Authorization","type":"apiKey"}}},"paths":{"/app/api/v1/investigation/create":{"post":{"description":"Creates a new alert investigation, returning investigation_id\n

\nReturns existing id if alert already exists (unless force_reinvestigation=True)\n

\nThen: Use GET /app/api/v1/investigation/{investigation_id} for updates\n","operationId":"investigation_create_create","requestBody":{"content":{"application/json":{"schema":{"properties":{"force_reinvestigation":{"default":false,"type":"boolean"},"raw_alert_content":{"type":"object"},"schema_key":{"type":"string"},"tenant_union_id":{"default":null,"nullable":true,"type":"number"}},"type":"object"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"investigation_id":{"type":"number"}},"type":"object"}}},"description":"Existing investigation found"},"201":{"content":{"application/json":{"schema":{"properties":{"investigation_id":{"type":"number"}},"type":"object"}}},"description":"New investigation created"},"400":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"Bad request - invalid input"},"401":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"properties":{"detail":{"type":"string"}},"type":"object"}}},"description":"Access denied"},"422":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"},"skip_reason":{"type":"string"}},"type":"object"}}},"description":"Alert skipped due to missing data (e.g., propagation delay)"},"500":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"System error"},"503":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"System not ready for requests"}},"tags":["investigation"]}}}} ``` ## POST /app/api/v1/investigation/create/custom > Request body = arbitrary alert JSON to be parsed & investigated\ > \
\
\ > Response = \investigation\_id\ if successful, \error\_msg\ otherwise\ > \
\
\ > \Returns existing id if alert already exists (unless \?force\_reinvestigation=True\)\\ > \
\
\ > \Then:\ Use \GET /app/api/v1/investigation/{investigation\_id}\ for updates
```json {"openapi":"3.0.3","info":{"title":"Dropzone AI","version":"0.1.0"},"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"in":"header","name":"Authorization","type":"apiKey"}}},"paths":{"/app/api/v1/investigation/create/custom":{"post":{"description":"Request body = arbitrary alert JSON to be parsed & investigated\n

\nResponse = investigation_id if successful, error_msg otherwise\n

\nReturns existing id if alert already exists (unless ?force_reinvestigation=True)\n

\nThen: Use GET /app/api/v1/investigation/{investigation_id} for updates\n","operationId":"investigation_create_custom_create","parameters":[{"description":"Force reinvestigation","in":"query","name":"force_reinvestigation","schema":{"type":"boolean"}},{"description":"Tenant union ID","in":"query","name":"tenant_union_id","schema":{"type":"integer"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"investigation_id":{"type":"number"}},"type":"object"}}},"description":"Existing investigation found"},"201":{"content":{"application/json":{"schema":{"properties":{"investigation_id":{"type":"number"}},"type":"object"}}},"description":"New investigation created"},"400":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"Bad request - invalid input"},"401":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"properties":{"detail":{"type":"string"}},"type":"object"}}},"description":"Access denied"},"413":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"},"skip_reason":{"type":"string"}},"type":"object"}}},"description":"Content Too Large"},"500":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"System error"},"503":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"System not ready for requests"}},"tags":["investigation"]}}}} ``` ## GET /app/api/v1/investigation/{investigation\_id} > Returns an alert investigation ```json {"openapi":"3.0.3","info":{"title":"Dropzone AI","version":"0.1.0"},"security":[{"ApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"in":"header","name":"Authorization","type":"apiKey"}},"schemas":{"Investigation":{"description":"For customers (api_external, ...and also core /investigation_contextual_chat)\n- no feedback\n- no outcome_tip\n- yes alert.raw_alert_content","properties":{"alert":{"$ref":"#/components/schemas/FullAlert"},"alert_summary":{"nullable":true,"type":"string"},"attack_surface":{"nullable":true,"type":"string"},"backfill":{"nullable":true,"type":"integer"},"canceled":{"nullable":true,"oneOf":[{"$ref":"#/components/schemas/CanceledEnum"},{"$ref":"#/components/schemas/NullEnum"}]},"conclusion":{"readOnly":true,"type":"string"},"conclusion_summary":{"nullable":true,"type":"string"},"created_at":{"format":"date-time","readOnly":true,"type":"string"},"email_screenshot":{"nullable":true,"type":"string"},"error_msg":{"nullable":true,"type":"string"},"exec_summary":{"nullable":true,"type":"string"},"findings":{"items":{"properties":{"artifacts":{"items":{"type":"string"},"type":"array"},"evidences":{"items":{"properties":{"data":{"oneOf":[{"type":"string"},{"type":"object"},{"type":"array"}]},"evidence_type":{"type":"string"},"tag":{"nullable":true,"type":"string"}},"type":"object"},"type":"array"},"finding":{"type":"string"},"headline":{"type":"string"},"outcome":{"enum":["COMPLETED_BREACHED_CONFIRMED","COMPLETED_BREACHED_SUSPICIOUS","COMPLETED_FALSE_ALERT","COMPLETED_ACTION_INFO","INCOMPLETE"],"type":"string"}},"type":"object"},"type":"array"},"findings_ranking":{"additionalProperties":{},"type":"object"},"generated_time":{"format":"date-time","nullable":true,"type":"string"},"id":{"readOnly":true,"type":"integer"},"ignored_for":{"nullable":true,"type":"integer"},"insight_tags":{"additionalProperties":{},"type":"object"},"interview_proposals":{"additionalProperties":{},"type":"object"},"inv_url":{"readOnly":true,"type":"string"},"is_retried":{"type":"boolean"},"key_findings":{"additionalProperties":{},"type":"object"},"mitre_tactic":{"nullable":true,"type":"string"},"outcome":{"nullable":true,"oneOf":[{"$ref":"#/components/schemas/Outcome05cEnum"},{"$ref":"#/components/schemas/NullEnum"}]},"priority":{"nullable":true,"oneOf":[{"$ref":"#/components/schemas/PriorityEnum"},{"$ref":"#/components/schemas/NullEnum"}]},"ready":{"type":"boolean"},"recommended_remediations":{"items":{"type":"string"},"type":"array"},"related_alert_hypothesis":{"additionalProperties":{},"nullable":true,"type":"object"},"start_time":{"format":"date-time","nullable":true,"type":"string"},"status":{"$ref":"#/components/schemas/StatusF08Enum"},"updated_at":{"format":"date-time","readOnly":true,"type":"string"}},"required":["alert","conclusion","created_at","id","inv_url","updated_at"],"type":"object"},"FullAlert":{"properties":{"alert_type":{"type":"string"},"assets":{"additionalProperties":{},"type":"object"},"coalesce_key":{"nullable":true,"type":"string"},"create_time":{"format":"date-time","type":"string"},"created_at":{"format":"date-time","readOnly":true,"type":"string"},"direct_source_label":{"type":"string"},"enrich_result":{"additionalProperties":{},"nullable":true,"type":"object"},"entities":{"items":{"properties":{"type":{"type":"string"},"value":{"type":"string"}},"type":"object"},"type":"array"},"handler_version":{"$ref":"#/components/schemas/HandlerVersionEnum"},"id":{"readOnly":true,"type":"integer"},"origin_integration":{"nullable":true,"type":"string"},"origin_integration_display_name":{"readOnly":true,"type":"string"},"origin_ticket_id":{"nullable":true,"type":"string"},"origin_ticket_id_label":{"nullable":true,"type":"string"},"origin_ticket_url":{"nullable":true,"type":"string"},"original_title":{"type":"string"},"proxy_source_label":{"nullable":true,"type":"string"},"raw_alert_content":{"type":"string"},"schema_key":{"type":"string"},"severity":{"nullable":true,"type":"string"},"start_time":{"format":"date-time","nullable":true,"type":"string"},"tenant_id":{"nullable":true,"type":"string"},"tenant_integration_key":{"nullable":true,"type":"string"},"tenant_label":{"nullable":true,"type":"string"},"tenant_union":{"allOf":[{"$ref":"#/components/schemas/TenantUnion"}],"nullable":true},"title":{"type":"string"},"updated_at":{"format":"date-time","readOnly":true,"type":"string"}},"required":["alert_type","create_time","created_at","direct_source_label","id","origin_integration_display_name","raw_alert_content","schema_key","title","updated_at"],"type":"object"},"HandlerVersionEnum":{"description":"* `v1` - v1\n* `v2` - v2","enum":["v1","v2"],"type":"string"},"TenantUnion":{"description":"Adds update nested feature","properties":{"created_at":{"format":"date-time","readOnly":true,"type":"string"},"display_name":{"type":"string"},"id":{"readOnly":true,"type":"integer"},"last_modified_by":{"allOf":[{"$ref":"#/components/schemas/CustomUser"}],"nullable":true},"lookup_dict":{"additionalProperties":{},"type":"object"},"updated_at":{"format":"date-time","readOnly":true,"type":"string"}},"required":["created_at","display_name","id","updated_at"],"type":"object"},"CustomUser":{"description":"Basic serializer to pass CustomUser details to the front end.\nExtend with any fields your app needs.","properties":{"email":{"format":"email","maxLength":254,"title":"Email address","type":"string"},"first_name":{"maxLength":150,"type":"string"},"id":{"readOnly":true,"type":"integer"},"last_name":{"maxLength":150,"type":"string"},"oidc_user_id":{"nullable":true,"type":"string"},"role":{"$ref":"#/components/schemas/RoleEnum"}},"required":["id"],"type":"object"},"RoleEnum":{"description":"* `admin` - Admin\n* `member` - Member\n* `restricted-read-only` - RRO","enum":["admin","member","restricted-read-only"],"type":"string"},"CanceledEnum":{"description":"* `CANCEL_MANUAL` - CANCEL_MANUAL\n* `CANCEL_THRESHOLD` - CANCEL_THRESHOLD","enum":["CANCEL_MANUAL","CANCEL_THRESHOLD"],"type":"string"},"NullEnum":{"enum":[null]},"Outcome05cEnum":{"description":"* `COMPLETED_BREACHED_CONFIRMED` - COMPLETED_BREACHED_CONFIRMED\n* `COMPLETED_BREACHED_SUSPICIOUS` - COMPLETED_BREACHED_SUSPICIOUS\n* `COMPLETED_FALSE_ALERT` - COMPLETED_FALSE_ALERT\n* `INCOMPLETE` - INCOMPLETE\n* `IGNORED` - IGNORED","enum":["COMPLETED_BREACHED_CONFIRMED","COMPLETED_BREACHED_SUSPICIOUS","COMPLETED_FALSE_ALERT","INCOMPLETE","IGNORED"],"type":"string"},"PriorityEnum":{"description":"* `informational` - Informational\n* `notable` - Notable\n* `urgent` - Urgent","enum":["informational","notable","urgent"],"type":"string"},"StatusF08Enum":{"description":"* `not_asked` - not_asked\n* `loading` - loading\n* `success` - success\n* `error` - error","enum":["not_asked","loading","success","error"],"type":"string"}}},"paths":{"/app/api/v1/investigation/{investigation_id}":{"get":{"description":"Returns an alert investigation","operationId":"investigation_retrieve_2","parameters":[{"in":"path","name":"investigation_id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Investigation"}}},"description":"Investigation data object. For progress: investigation.status=\n\n"},"401":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"Unauthorized"},"403":{"content":{"application/json":{"schema":{"properties":{"detail":{"type":"string"}},"type":"object"}}},"description":"Access denied"},"404":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"Resource not found"},"500":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"System error"},"503":{"content":{"application/json":{"schema":{"properties":{"error_msg":{"type":"string"}},"type":"object"}}},"description":"System not ready for requests"}},"tags":["investigation"]}}}} ```