REST API (Beta)

Use the Panther REST API to interact with your Panther entities

Overview

The REST API is in open beta starting with Panther version 1.98, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

Panther offers a REST API to interact with certain parts of your Panther instance. Currently, you can interact with the following entities through the REST API:

• Data Models

• Globals

• Queries

• Rules

• Scheduled rules

• Simple/YAML rules

• Policies

Additional operations are available in the GraphQL API.

Discover the Panther REST API schema

OpenAPI specification

Discover the REST API schema by viewing the OpenAPI specification file. You can either:

• View the raw file directly, in the expandable block below:

Panther OpenAPI specification

openapi: 3.0.3
info:
  title: Panther REST API
  version: '1.0'
servers:
  - url: https://{api_host}
    variables:
      api_host:
        default: your-api-host
paths:
  /data-models:
    get:
      tags:
        - data model
      summary: list data models
      operationId: data model#list
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 100
            format: int64
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.ListResp'
    post:
      tags:
        - data model
      summary: create data model
      operationId: data model#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DataModelAPI.ModifyDataModel'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.DataModelcreateResponseBody'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.ExistsError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.ExistsError'
  /data-models/{id}:
    delete:
      tags:
        - data model
      summary: delete data model
      operationId: data model#delete
      parameters:
        - name: id
          in: path
          description: ID of the data model to delete
          required: true
          schema:
            type: string
            description: ID of the data model to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.ExistsError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.ExistsError'
    get:
      tags:
        - data model
      summary: get data model
      operationId: data model#get
      parameters:
        - name: id
          in: path
          description: ID of the data model to fetch
          required: true
          schema:
            type: string
            description: ID of the data model to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.DataModelcreateResponseBody'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.ExistsError'
    put:
      tags:
        - data model
      summary: put data model
      description: put creates or updates a data model
      operationId: data model#put
      parameters:
        - name: id
          in: path
          description: the id of the data model
          required: true
          schema:
            type: string
            description: the id of the data model
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DataModelAPI.ModifyDataModel'
      responses:
        '200':
          description: 200 returned if the item already existed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.DataModelcreateResponseBody'
        '201':
          description: 201 returned if the item was created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.DataModelcreateResponseBody'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataModelAPI.ExistsError'
  /globals:
    get:
      tags:
        - global
      summary: list globals
      operationId: global#list
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 100
            format: int64
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.ListResp'
    post:
      tags:
        - global
      summary: create global
      operationId: global#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GlobalAPI.CreateRequestBody'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.Global'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.ExistsError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.ExistsError'
  /globals/{id}:
    delete:
      tags:
        - global
      summary: delete global
      operationId: global#delete
      parameters:
        - name: id
          in: path
          description: ID of the global to delete
          required: true
          schema:
            type: string
            description: ID of the global to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.ExistsError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.ExistsError'
    get:
      tags:
        - global
      summary: get global
      operationId: global#get
      parameters:
        - name: id
          in: path
          description: ID of the global to fetch
          required: true
          schema:
            type: string
            description: ID of the global to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.Global'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.ExistsError'
    put:
      tags:
        - global
      summary: put global
      description: put creates or updates a global
      operationId: global#put
      parameters:
        - name: id
          in: path
          description: The id of the global
          required: true
          schema:
            type: string
            description: The id of the global
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GlobalAPI.PutRequestBody'
      responses:
        '200':
          description: 200 returned if the item already existed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.PutGlobalResp'
        '201':
          description: 201 returned if the item was created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.PutGlobalResp'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GlobalAPI.ExistsError'
  /policies:
    get:
      tags:
        - policy
      summary: list policies
      operationId: policy#list
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 100
            format: int64
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.ListResp'
    post:
      tags:
        - policy
      summary: create policy
      operationId: policy#create
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyAPI.ModifyPolicy'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.PolicycreateResponseBody'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.BadRequestWithTestResultsErr'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.ExistsError'
  /policies/{id}:
    delete:
      tags:
        - policy
      summary: delete policy
      operationId: policy#delete
      parameters:
        - name: id
          in: path
          description: ID of the policy to delete
          required: true
          schema:
            type: string
            description: ID of the policy to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.BadRequestWithTestResultsErr'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.ExistsError'
    get:
      tags:
        - policy
      summary: get policy
      operationId: policy#get
      parameters:
        - name: id
          in: path
          description: the id of the policy to fetch
          required: true
          schema:
            type: string
            description: the id of the policy to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.PolicycreateResponseBody'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.ExistsError'
    put:
      tags:
        - policy
      summary: put policy
      description: put creates or updates a policy
      operationId: policy#put
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
        - name: id
          in: path
          description: the id of the policy
          required: true
          schema:
            type: string
            description: the id of the policy
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyAPI.ModifyPolicy'
      responses:
        '200':
          description: 200 returned if the item already existed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.PolicycreateResponseBody'
        '201':
          description: 201 returned if the item was created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.PolicycreateResponseBody'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyAPI.BadRequestWithTestResultsErr'
  /queries:
    get:
      tags:
        - query
      summary: list queries
      operationId: query#list
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 100
            format: int64
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.ListResp'
    post:
      tags:
        - query
      summary: create query
      operationId: query#create
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/QueryAPI.CreateRequestBody'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.Query'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.ExistsError'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.ExistsError'
  /queries/{id}:
    delete:
      tags:
        - query
      summary: delete query
      operationId: query#delete
      parameters:
        - name: id
          in: path
          description: ID of the query to delete
          required: true
          schema:
            type: string
            description: ID of the query to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.ExistsError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.ExistsError'
    get:
      tags:
        - query
      summary: get query
      operationId: query#get
      parameters:
        - name: id
          in: path
          description: ID of the query to fetch
          required: true
          schema:
            type: string
            description: ID of the query to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.Query'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.ExistsError'
    post:
      tags:
        - query
      summary: update query
      description: put creates or updates a query
      operationId: query#update
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/QueryAPI.CreateRequestBody'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.Query'
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.ExistsError'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAPI.ExistsError'
  /rules:
    get:
      tags:
        - rule
      summary: list rules
      operationId: rule#list
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 100
            format: int64
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.ListResp'
    post:
      tags:
        - rule
      summary: create rule
      operationId: rule#create
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RuleAPI.ModifyRule'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.RulecreateResponseBody'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.BadRequestWithTestResultsErr'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.ExistsError'
  /rules/{id}:
    delete:
      tags:
        - rule
      summary: delete rule
      operationId: rule#delete
      parameters:
        - name: id
          in: path
          description: ID of the rule to delete
          required: true
          schema:
            type: string
            description: ID of the rule to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.BadRequestWithTestResultsErr'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.ExistsError'
    get:
      tags:
        - rule
      summary: get rule
      operationId: rule#get
      parameters:
        - name: id
          in: path
          description: ID of the rule to fetch
          required: true
          schema:
            type: string
            description: ID of the rule to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.RulecreateResponseBody'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.ExistsError'
    put:
      tags:
        - rule
      summary: put rule
      description: put creates or updates a rule
      operationId: rule#put
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
        - name: id
          in: path
          description: the id of the rule
          required: true
          schema:
            type: string
            description: the id of the rule
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RuleAPI.ModifyRule'
      responses:
        '200':
          description: 200 returned if the item already existed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.RulecreateResponseBody'
        '201':
          description: 201 returned if the item was created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.RulecreateResponseBody'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleAPI.BadRequestWithTestResultsErr'
  /scheduled-rules:
    get:
      tags:
        - scheduled rule
      summary: list scheduled rules
      operationId: scheduled rule#list
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 100
            format: int64
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.ListResp'
    post:
      tags:
        - scheduled rule
      summary: create scheduled rule
      operationId: scheduled rule#create
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScheduledRuleAPI.ModifyRule'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.ScheduledRulecreateResponseBody'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.BadRequestWithTestResultsErr'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.ExistsError'
  /scheduled-rules/{id}:
    delete:
      tags:
        - scheduled rule
      summary: delete scheduled rule
      operationId: scheduled rule#delete
      parameters:
        - name: id
          in: path
          description: ID of the rule to delete
          required: true
          schema:
            type: string
            description: ID of the rule to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.BadRequestWithTestResultsErr'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.ExistsError'
    get:
      tags:
        - scheduled rule
      summary: get scheduled rule
      operationId: scheduled rule#get
      parameters:
        - name: id
          in: path
          description: ID of the rule to fetch
          required: true
          schema:
            type: string
            description: ID of the rule to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.ScheduledRulecreateResponseBody'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.ExistsError'
    put:
      tags:
        - scheduled rule
      summary: put scheduled rule
      description: put creates or updates a scheduled rule
      operationId: scheduled rule#put
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
        - name: id
          in: path
          description: the id of the scheduled rule
          required: true
          schema:
            type: string
            description: the id of the scheduled rule
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScheduledRuleAPI.ModifyRule'
      responses:
        '200':
          description: 200 returned if the item already existed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.ScheduledRulecreateResponseBody'
        '201':
          description: 201 returned if the item was created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.ScheduledRulecreateResponseBody'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScheduledRuleAPI.BadRequestWithTestResultsErr'
  /simple-rules:
    get:
      tags:
        - simple rule
      summary: list simple rules
      operationId: simple rule#list
      parameters:
        - name: cursor
          in: query
          description: the pagination token
          allowEmptyValue: true
          schema:
            type: string
            description: the pagination token
        - name: limit
          in: query
          description: the maximum results to return
          allowEmptyValue: true
          schema:
            type: integer
            description: the maximum results to return
            default: 100
            format: int64
        - name: include-python
          in: query
          description: determines if associated python for the generated rule is returned
          allowEmptyValue: true
          schema:
            type: boolean
            description: determines if associated python for the generated rule is returned
            default: false
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.ListResp'
    post:
      tags:
        - simple rule
      summary: create simple rule
      operationId: simple rule#create
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SimpleRuleAPI.ModifyRule'
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.SimpleRulecreateResponseBody'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.BadRequestWithTestResultsErr'
        '409':
          description: 'exists: Conflict response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.ExistsError'
  /simple-rules/{id}:
    delete:
      tags:
        - simple rule
      summary: delete simple rule
      operationId: simple rule#delete
      parameters:
        - name: id
          in: path
          description: ID of the simple rule to delete
          required: true
          schema:
            type: string
            description: ID of the simple rule to delete
      responses:
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.BadRequestWithTestResultsErr'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.ExistsError'
    get:
      tags:
        - simple rule
      summary: get a simple rule
      operationId: simple rule#get
      parameters:
        - name: include-python
          in: query
          description: determines if associated python for the generated rule is returned
          allowEmptyValue: true
          schema:
            type: boolean
            description: determines if associated python for the generated rule is returned
            default: false
        - name: id
          in: path
          description: ID of the rule to fetch
          required: true
          schema:
            type: string
            description: ID of the rule to fetch
      responses:
        '200':
          description: OK response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.SimpleRulecreateResponseBody'
        '404':
          description: 'not_found: Not Found response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.ExistsError'
    put:
      tags:
        - simple rule
      summary: put simple rule
      description: put creates or updates a rule
      operationId: simple rule#put
      parameters:
        - name: run-tests-first
          in: query
          description: set this field to false to exclude running tests prior to saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to false to exclude running tests prior to saving
            default: true
        - name: run-tests-only
          in: query
          description: set this field to true if you want to run tests without saving
          allowEmptyValue: true
          schema:
            type: boolean
            description: set this field to true if you want to run tests without saving
            default: false
        - name: id
          in: path
          description: the id of the rule
          required: true
          schema:
            type: string
            description: the id of the rule
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SimpleRuleAPI.ModifyRule'
      responses:
        '200':
          description: 200 returned if the item already existed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.SimpleRulecreateResponseBody'
        '201':
          description: 201 returned if the item was created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.SimpleRulecreateResponseBody'
        '204':
          description: No Content response.
        '400':
          description: 'bad_request: Bad Request response.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SimpleRuleAPI.BadRequestWithTestResultsErr'
components:
  schemas:
    DataModelAPI.DataModel:
      type: object
      properties:
        body:
          type: string
          description: The python body of the data model
        createdAt:
          type: string
        description:
          type: string
          description: The description of the data model
        displayName:
          type: string
          description: The name used for the data model
        enabled:
          type: boolean
          description: enables/disables a data model
        id:
          type: string
          description: The id of the data model
        lastModified:
          type: string
        logTypes:
          type: array
          items:
            type: string
          description: 'The log type this data model should associate to. NOTE: only one data model can be assigned to a log type'
        mappings:
          type: array
          items:
            $ref: '#/components/schemas/DataModelAPI.DataModelMapping'
    DataModelAPI.DataModelMapping:
      type: object
      properties:
        method:
          type: string
          description: the python function name that should be called
        name:
          type: string
          description: the name of the mapping
        path:
          type: string
          description: the json path
      required:
        - name
    DataModelAPI.DataModelcreateResponseBody:
      $ref: '#/components/schemas/DataModelAPI.DataModel'
    DataModelAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    DataModelAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/DataModelAPI.DataModelcreateResponseBody'
    DataModelAPI.ModifyDataModel:
      type: object
      properties:
        body:
          type: string
          description: The python body of the data model
        description:
          type: string
          description: The description of the data model
        displayName:
          type: string
          description: The name used for the data model
        enabled:
          type: boolean
          description: enables/disables a data model
        id:
          type: string
          description: The id of the data model
        logTypes:
          type: array
          items:
            type: string
          description: 'The log type this data model should associate to. NOTE: only one data model can be assigned to a log type'
        mappings:
          type: array
          items:
            $ref: '#/components/schemas/DataModelAPI.DataModelMapping'
      required:
        - id
    GlobalAPI.CreateRequestBody:
      type: object
      properties:
        body:
          type: string
          description: The python body of the global
        description:
          type: string
          description: The description of the global
        id:
          type: string
          description: The id of the global
        tags:
          type: array
          items:
            type: string
          description: The tags for the global
      required:
        - id
        - body
    GlobalAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    GlobalAPI.Global:
      type: object
      properties:
        body:
          type: string
          description: The python body of the global
        createdAt:
          type: string
        description:
          type: string
          description: The description of the global
        id:
          type: string
          description: The id of the global
        lastModified:
          type: string
        tags:
          type: array
          items:
            type: string
          description: The tags for the global
    GlobalAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/GlobalAPI.Global'
    GlobalAPI.PutGlobalResp:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/GlobalAPI.Global'
    GlobalAPI.PutRequestBody:
      type: object
      properties:
        body:
          type: string
          description: The python body of the global
        description:
          type: string
          description: The description of the global
        tags:
          type: array
          items:
            type: string
          description: The tags for the global
      required:
        - body
    PolicyAPI.BadRequestWithTestResultsErr:
      type: object
      properties:
        message:
          type: string
        testResults:
          type: array
          items:
            $ref: '#/components/schemas/PolicyAPI.TestDetectionRecord'
      required:
        - message
    PolicyAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    PolicyAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/PolicyAPI.PolicycreateResponseBody'
    PolicyAPI.ModifyPolicy:
      type: object
      properties:
        body:
          type: string
          description: The python body of the policy
        description:
          type: string
          description: The description of the policy
        displayName:
          type: string
          description: The display name of the policy
        enabled:
          type: boolean
          description: Determines whether or not the policy is active
        id:
          type: string
          description: The id of the policy
        managed:
          type: boolean
          description: Determines if the policy is managed by panther
        reports:
          type: object
          description: Reports
          additionalProperties:
            items:
              type: string
            type: array
        resourceTypes:
          type: array
          items:
            type: string
          description: Resource types
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        suppressions:
          type: array
          items:
            type: string
          description: Resources to ignore via a pattern that matches the resource id
          example:
            - aws::s3::*
        tags:
          type: array
          items:
            type: string
          description: The tags for the policy
        tests:
          type: array
          items:
            $ref: '#/components/schemas/PolicyAPI.UnitTest'
          description: Unit tests for the Policy. Best practice is to include a positive and negative case
      required:
        - id
        - body
        - severity
    PolicyAPI.Policy:
      type: object
      properties:
        body:
          type: string
          description: The python body of the policy
        createdAt:
          type: string
        description:
          type: string
          description: The description of the policy
        displayName:
          type: string
          description: The display name of the policy
        enabled:
          type: boolean
          description: Determines whether or not the policy is active
        id:
          type: string
          description: The id of the policy
        lastModified:
          type: string
        managed:
          type: boolean
          description: Determines if the policy is managed by panther
        reports:
          type: object
          description: Reports
          additionalProperties:
            items:
              type: string
            type: array
        resourceTypes:
          type: array
          items:
            type: string
          description: Resource types
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        suppressions:
          type: array
          items:
            type: string
          description: Resources to ignore via a pattern that matches the resource id
          example:
            - aws::s3::*
        tags:
          type: array
          items:
            type: string
          description: The tags for the policy
        tests:
          type: array
          items:
            $ref: '#/components/schemas/PolicyAPI.UnitTest'
          description: Unit tests for the Policy. Best practice is to include a positive and negative case
    PolicyAPI.PolicycreateResponseBody:
      $ref: '#/components/schemas/PolicyAPI.Policy'
    PolicyAPI.TestDetectionRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/PolicyAPI.TestErr'
        errored:
          type: boolean
        functions:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionRecordFunctions'
        name:
          type: string
        passed:
          type: boolean
        triggerAlert:
          type: boolean
    PolicyAPI.TestDetectionRecordFunctions:
      type: object
      properties:
        alertContext:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        dedup:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        description:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        destinations:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        detection:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        reference:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        runbook:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        severity:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
        title:
          $ref: '#/components/schemas/PolicyAPI.TestDetectionSubRecord'
    PolicyAPI.TestDetectionSubRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/PolicyAPI.TestErr'
        output:
          type: string
    PolicyAPI.TestErr:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
    PolicyAPI.UnitTest:
      type: object
      properties:
        expectedResult:
          type: boolean
          description: The expected result
        mocks:
          type: array
          items:
            type: object
            additionalProperties:
              type: string
          description: mocks
        name:
          type: string
          description: name
        resource:
          type: string
          description: resource
      required:
        - name
        - resource
        - expectedResult
    QueryAPI.CreateRequestBody:
      type: object
      properties:
        description:
          type: string
          description: The description of the query
        name:
          type: string
          description: The name of the query
        schedule:
          $ref: '#/components/schemas/QueryAPI.Schedule'
        sql:
          type: string
          description: The raw sql of the query
      required:
        - sql
        - name
    QueryAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    QueryAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: Pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/QueryAPI.Query'
    QueryAPI.Query:
      type: object
      properties:
        createdAt:
          type: string
        description:
          type: string
          description: The description of the query
        id:
          type: string
          description: The generated ID of the query
        managed:
          type: boolean
          description: Determines if the query is managed by panther
        name:
          type: string
          description: The name of the query
        schedule:
          $ref: '#/components/schemas/QueryAPI.Schedule'
        sql:
          type: string
          description: The raw sql of the query
        updatedAt:
          type: string
    QueryAPI.Schedule:
      type: object
      properties:
        cron:
          type: string
          description: The cron expression
        disabled:
          type: boolean
          description: Disable the schedule
        rateMinutes:
          type: integer
          format: int64
        timeoutMinutes:
          type: integer
          format: int64
    RuleAPI.BadRequestWithTestResultsErr:
      type: object
      properties:
        message:
          type: string
        testResults:
          type: array
          items:
            $ref: '#/components/schemas/RuleAPI.TestDetectionRecord'
      required:
        - message
    RuleAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    RuleAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/RuleAPI.RulecreateResponseBody'
    RuleAPI.ModifyRule:
      type: object
      properties:
        body:
          type: string
          description: The python body of the rule
        dedupPeriodMinutes:
          type: integer
          description: The amount of time in minutes for grouping alerts
          default: 60
          minimum: 1
        description:
          type: string
          description: The description of the rule
        displayName:
          type: string
          description: The display name of the rule
        enabled:
          type: boolean
          description: Determines whether or not the rule is active
        id:
          type: string
          description: The id of the rule
        inlineFilters:
          type: string
          description: The filter for the rule represented in YAML
        logTypes:
          type: array
          items:
            type: string
          description: log types
        managed:
          type: boolean
          description: Determines if the rule is managed by panther
        reports:
          type: object
          description: reports
          additionalProperties:
            items:
              type: string
            type: array
        runbook:
          type: string
          description: How to handle the generated alert
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        summaryAttributes:
          type: array
          items:
            type: string
          description: A list of fields in the event to create top 5 summaries for
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule
        tests:
          type: array
          items:
            $ref: '#/components/schemas/RuleAPI.UnitTest'
          description: Unit tests for the Rule. Best practice is to include a positive and negative case
        threshold:
          type: integer
          description: the number of events that must match before an alert is triggered
          default: 1
          minimum: 1
      required:
        - id
        - body
        - severity
    RuleAPI.Rule:
      type: object
      properties:
        body:
          type: string
          description: The python body of the rule
        createdAt:
          type: string
        dedupPeriodMinutes:
          type: integer
          description: The amount of time in minutes for grouping alerts
          default: 60
          minimum: 1
        description:
          type: string
          description: The description of the rule
        displayName:
          type: string
          description: The display name of the rule
        enabled:
          type: boolean
          description: Determines whether or not the rule is active
        id:
          type: string
          description: The id of the rule
        inlineFilters:
          type: string
          description: The filter for the rule represented in YAML
        lastModified:
          type: string
        logTypes:
          type: array
          items:
            type: string
          description: log types
        managed:
          type: boolean
          description: Determines if the rule is managed by panther
        reports:
          type: object
          description: reports
          additionalProperties:
            items:
              type: string
            type: array
        runbook:
          type: string
          description: How to handle the generated alert
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        summaryAttributes:
          type: array
          items:
            type: string
          description: A list of fields in the event to create top 5 summaries for
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule
        tests:
          type: array
          items:
            $ref: '#/components/schemas/RuleAPI.UnitTest'
          description: Unit tests for the Rule. Best practice is to include a positive and negative case
        threshold:
          type: integer
          description: the number of events that must match before an alert is triggered
          default: 1
          minimum: 1
    RuleAPI.RulecreateResponseBody:
      $ref: '#/components/schemas/RuleAPI.Rule'
    RuleAPI.TestDetectionRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/RuleAPI.TestErr'
        errored:
          type: boolean
        functions:
          $ref: '#/components/schemas/RuleAPI.TestDetectionRecordFunctions'
        name:
          type: string
        passed:
          type: boolean
        triggerAlert:
          type: boolean
    RuleAPI.TestDetectionRecordFunctions:
      type: object
      properties:
        alertContext:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        dedup:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        description:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        destinations:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        detection:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        reference:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        runbook:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        severity:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
        title:
          $ref: '#/components/schemas/RuleAPI.TestDetectionSubRecord'
    RuleAPI.TestDetectionSubRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/RuleAPI.TestErr'
        output:
          type: string
    RuleAPI.TestErr:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
    RuleAPI.UnitTest:
      type: object
      properties:
        expectedResult:
          type: boolean
          description: The expected result
        mocks:
          type: array
          items:
            type: object
            additionalProperties:
              type: string
          description: mocks
        name:
          type: string
          description: name
        resource:
          type: string
          description: resource
      required:
        - name
        - resource
        - expectedResult
    ScheduledRuleAPI.BadRequestWithTestResultsErr:
      type: object
      properties:
        message:
          type: string
        testResults:
          type: array
          items:
            $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionRecord'
      required:
        - message
    ScheduledRuleAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    ScheduledRuleAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/ScheduledRuleAPI.ScheduledRulecreateResponseBody'
    ScheduledRuleAPI.ModifyRule:
      type: object
      properties:
        body:
          type: string
          description: The python body of the scheduled rule
        dedupPeriodMinutes:
          type: integer
          description: The amount of time in minutes for grouping alerts
          default: 60
          minimum: 1
        description:
          type: string
          description: The description of the scheduled rule
        displayName:
          type: string
          description: The display name of the scheduled rule
        enabled:
          type: boolean
          description: Determines whether or not the scheduled rule is active
        id:
          type: string
          description: The id of the scheduled rule
        managed:
          type: boolean
          description: Determines if the scheduled rule is managed by panther
        reports:
          type: object
          description: reports
          additionalProperties:
            items:
              type: string
            type: array
        runbook:
          type: string
          description: How to handle the generated alert
        scheduledQueries:
          type: array
          items:
            type: string
          description: the queries that this scheduled rule utilizes
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        summaryAttributes:
          type: array
          items:
            type: string
          description: A list of fields in the event to create top 5 summaries for
        tags:
          type: array
          items:
            type: string
          description: The tags for the scheduled rule
        tests:
          type: array
          items:
            $ref: '#/components/schemas/ScheduledRuleAPI.UnitTest'
          description: Unit tests for the Rule. Best practice is to include a positive and negative case
        threshold:
          type: integer
          description: the number of events that must match before an alert is triggered
          default: 1
          minimum: 1
      required:
        - id
        - body
        - severity
    ScheduledRuleAPI.ScheduledRule:
      type: object
      properties:
        body:
          type: string
          description: The python body of the scheduled rule
        createdAt:
          type: string
        dedupPeriodMinutes:
          type: integer
          description: The amount of time in minutes for grouping alerts
          default: 60
          minimum: 1
        description:
          type: string
          description: The description of the scheduled rule
        displayName:
          type: string
          description: The display name of the scheduled rule
        enabled:
          type: boolean
          description: Determines whether or not the scheduled rule is active
        id:
          type: string
          description: The id of the scheduled rule
        lastModified:
          type: string
        managed:
          type: boolean
          description: Determines if the scheduled rule is managed by panther
        reports:
          type: object
          description: reports
          additionalProperties:
            items:
              type: string
            type: array
        runbook:
          type: string
          description: How to handle the generated alert
        scheduledQueries:
          type: array
          items:
            type: string
          description: the queries that this scheduled rule utilizes
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        summaryAttributes:
          type: array
          items:
            type: string
          description: A list of fields in the event to create top 5 summaries for
        tags:
          type: array
          items:
            type: string
          description: The tags for the scheduled rule
        tests:
          type: array
          items:
            $ref: '#/components/schemas/ScheduledRuleAPI.UnitTest'
          description: Unit tests for the Rule. Best practice is to include a positive and negative case
        threshold:
          type: integer
          description: the number of events that must match before an alert is triggered
          default: 1
          minimum: 1
    ScheduledRuleAPI.ScheduledRulecreateResponseBody:
      $ref: '#/components/schemas/ScheduledRuleAPI.ScheduledRule'
    ScheduledRuleAPI.TestDetectionRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestErr'
        errored:
          type: boolean
        functions:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionRecordFunctions'
        name:
          type: string
        passed:
          type: boolean
        triggerAlert:
          type: boolean
    ScheduledRuleAPI.TestDetectionRecordFunctions:
      type: object
      properties:
        alertContext:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        dedup:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        description:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        destinations:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        detection:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        reference:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        runbook:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        severity:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
        title:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestDetectionSubRecord'
    ScheduledRuleAPI.TestDetectionSubRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/ScheduledRuleAPI.TestErr'
        output:
          type: string
    ScheduledRuleAPI.TestErr:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
    ScheduledRuleAPI.UnitTest:
      type: object
      properties:
        expectedResult:
          type: boolean
          description: The expected result
        mocks:
          type: array
          items:
            type: object
            additionalProperties:
              type: string
          description: mocks
        name:
          type: string
          description: name
        resource:
          type: string
          description: resource
      required:
        - name
        - resource
        - expectedResult
    SimpleRuleAPI.BadRequestWithTestResultsErr:
      type: object
      properties:
        message:
          type: string
        testResults:
          type: array
          items:
            $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionRecord'
      required:
        - message
    SimpleRuleAPI.ExistsError:
      type: object
      properties:
        message:
          type: string
      required:
        - message
    SimpleRuleAPI.ListResp:
      type: object
      properties:
        next:
          type: string
          description: pagination token for the next page of results
        results:
          type: array
          items:
            $ref: '#/components/schemas/SimpleRuleAPI.SimpleRulecreateResponseBody'
    SimpleRuleAPI.ModifyRule:
      type: object
      properties:
        alertContext:
          type: string
          description: The alert context represented in YAML
        alertTitle:
          type: string
          description: The alert title represented in YAML
        dedupPeriodMinutes:
          type: integer
          description: The amount of time in minutes for grouping alerts
          default: 60
          minimum: 1
        description:
          type: string
          description: The description of the rule
        detection:
          type: string
          description: The yaml representation of the rule
        displayName:
          type: string
          description: The display name of the rule
        dynamicSeverities:
          type: string
          description: The dynamic severity represented in YAML
        enabled:
          type: boolean
          description: Determines whether or not the rule is active
        groupBy:
          type: string
          description: The key on an event to group by represented in YAML
        id:
          type: string
          description: The id of the rule
        inlineFilters:
          type: string
          description: The filter for the rule represented in YAML
        logTypes:
          type: array
          items:
            type: string
          description: log types
        managed:
          type: boolean
          description: Determines if the simple rule is managed by panther
        pythonBody:
          type: string
          description: The python body of the rule
        reports:
          type: object
          description: reports
          additionalProperties:
            items:
              type: string
            type: array
        runbook:
          type: string
          description: How to handle the generated alert
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        summaryAttributes:
          type: array
          items:
            type: string
          description: A list of fields in the event to create top 5 summaries for
        tags:
          type: array
          items:
            type: string
          description: The tags for the simple rule
        tests:
          type: array
          items:
            $ref: '#/components/schemas/SimpleRuleAPI.UnitTest'
          description: Unit tests for the Rule. Best practice is to include a positive and negative case
        threshold:
          type: integer
          description: the number of events that must match before an alert is triggered
          default: 1
          minimum: 1
      required:
        - id
        - detection
        - severity
    SimpleRuleAPI.SimpleRule:
      type: object
      properties:
        alertContext:
          type: string
          description: The alert context represented in YAML
        alertTitle:
          type: string
          description: The alert title represented in YAML
        createdAt:
          type: string
        dedupPeriodMinutes:
          type: integer
          description: The amount of time in minutes for grouping alerts
          default: 60
          minimum: 1
        description:
          type: string
          description: The description of the rule
        detection:
          type: string
          description: The yaml representation of the rule
        displayName:
          type: string
          description: The display name of the rule
        dynamicSeverities:
          type: string
          description: The dynamic severity represented in YAML
        enabled:
          type: boolean
          description: Determines whether or not the rule is active
        groupBy:
          type: string
          description: The key on an event to group by represented in YAML
        id:
          type: string
          description: The id of the rule
        inlineFilters:
          type: string
          description: The filter for the rule represented in YAML
        lastModified:
          type: string
        logTypes:
          type: array
          items:
            type: string
          description: log types
        managed:
          type: boolean
          description: Determines if the simple rule is managed by panther
        pythonBody:
          type: string
          description: The python body of the rule
        reports:
          type: object
          description: reports
          additionalProperties:
            items:
              type: string
            type: array
        runbook:
          type: string
          description: How to handle the generated alert
        severity:
          type: string
          enum:
            - INFO
            - LOW
            - MEDIUM
            - HIGH
            - CRITICAL
        summaryAttributes:
          type: array
          items:
            type: string
          description: A list of fields in the event to create top 5 summaries for
        tags:
          type: array
          items:
            type: string
          description: The tags for the simple rule
        tests:
          type: array
          items:
            $ref: '#/components/schemas/SimpleRuleAPI.UnitTest'
          description: Unit tests for the Rule. Best practice is to include a positive and negative case
        threshold:
          type: integer
          description: the number of events that must match before an alert is triggered
          default: 1
          minimum: 1
    SimpleRuleAPI.SimpleRulecreateResponseBody:
      $ref: '#/components/schemas/SimpleRuleAPI.SimpleRule'
    SimpleRuleAPI.TestDetectionRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/SimpleRuleAPI.TestErr'
        errored:
          type: boolean
        functions:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionRecordFunctions'
        name:
          type: string
        passed:
          type: boolean
        triggerAlert:
          type: boolean
    SimpleRuleAPI.TestDetectionRecordFunctions:
      type: object
      properties:
        alertContext:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        dedup:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        description:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        destinations:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        detection:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        reference:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        runbook:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        severity:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
        title:
          $ref: '#/components/schemas/SimpleRuleAPI.TestDetectionSubRecord'
    SimpleRuleAPI.TestDetectionSubRecord:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/SimpleRuleAPI.TestErr'
        output:
          type: string
    SimpleRuleAPI.TestErr:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
    SimpleRuleAPI.UnitTest:
      type: object
      properties:
        expectedResult:
          type: boolean
          description: The expected result
        mocks:
          type: array
          items:
            type: object
            additionalProperties:
              type: string
          description: mocks
        name:
          type: string
          description: name
        resource:
          type: string
          description: resource
      required:
        - name
        - resource
        - expectedResult
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      name: X-API-Key
      in: header
tags:
  - name: data model
    description: The data model api handles all operations for data models
  - name: global
    description: The global api handles all operations for globals
  - name: policy
    description: The policy api handles all operations for policies
  - name: query
    description: The query api handles operations for queries
  - name: rule
    description: The rule api handles all operations for rules
  - name: scheduled rule
    description: The scheduled rule api handles all operations for scheduled rules
  - name: simple rule
    description: The simple rule api handles all operations for simple rules
security:
  - ApiKeyAuth: []

• Download the file by clicking the link below:

75KB

panther_open_api_v3_spec.yaml

API Playground

You can discover the API schema by browsing the API Playground in your Panther Console. Learn more on API Playground.

How to use the Panther REST API

Step 1: Identify your Panther REST API URL

To locate your REST API URL:

• In the upper-right corner of your Panther Console, click the gear icon, then API Tokens. At the top of the page, see the API URL.

  • If you are running a SaaS deployment of Panther, your REST URL will be the portion shown below:

  

  • If you are running a Cloud Connected or self-hosted deployment of Panther, the URL will be the portion shown below (inclusive of /v1):

  

Note that all REST URLs exclude /public/graphql from the end of the value.

Step 2: Generate an API token

• See these instructions on how to create an API token. You can find required permissions for each REST API operation on each entity's page (nested under this one).

Step 3: Invoke the Panther REST API

In addition to testing with the API Playground in the Console, you can invoke the REST API using Swagger, Postman, or this documentation:

Swagger

Using Swagger to access the REST API

1. In a web browser, navigate to the Swagger Editor.

2. In the code editor on the left-hand side, paste in the Panther REST OpenAPI specification file found above, in Discover the Panther REST API schema.

3. On the right-hand side, under Server variables, in api_host, enter your Panther REST API URL without the protocol (i.e., excluding https://).
4. Click Authorize.
5. In the Available authorizations modal:

   1. Under Value, enter your API token value.

   2. Click Authorize.

   3. Click Close.
6. You can now try invoking the API:

   1. Choose an endpoint, and expand it by clicking the arrow pointing down.

   2. Click Try it out.
   3. Click Execute.

Postman

Using Postman to access the REST API

You will import the Panther Postman collection, create a new environment with URL and API variables, then try making a request.

1. Download the Panther_REST_API_postman_collection.json file at the bottom of this tab.

2. In your Postman application, click File > Import.

3. Choose the Panther_REST_API_postman_collection.json file.

   • Under Collections, there will now be a Panther Rest API collection.

4. Click Environments, then click the plus sign (+).
5. Enter a name for your environment—e.g., "Panther."

6. In the table on the right-hand side, enter the following two variables:

   • restHost: For the Current value, enter your full Panther REST API URL.

     • You can find this value by following the instructions in Step 1: Identify your Panther REST API URL.

   • restApiToken: For the Current value, enter your Panther API token. In the Type column, select secret.

     
7. In the upper-right corner, click Save.

8. You can now try making a request:

   1. In the upper-right hand corner, click the environment dropdown, and select the one you created in the previous step.
   2. Click Collections.

   3. Expand the Panther Rest API collection, then select a request.

   4. Click Send.

31KB

Panther Rest API.postman_collection.json

This documentation

Using the Panther documentation to access the REST API

1. Navigate to one of the REST API entity pages (nested under this page), and locate the operation you'd like to perform.

2. In the bottom-right corner of the operation's Request tile, click ▶Test it.

   
3. In the modal that pops up, within the Variables section:

   1. If the operation has required path variables, such as {id}, provide value(s) in the VALUE column.

   2. Click + Variable, then create the following variable:

      • key: Enter api_host.

      • value: Enter the REST API URL you identified in Step 1, without the protocol (i.e., excluding https://).
4. Within the Headers section, click + Headers.

5. In the table, create the following header:

   • key: Enter X-API-Key.

   • value: Enter the API token you generated in Step 2.

6. If there are values in the Query Parameters section, if you would like them to apply to this invocation, click their checkboxes in the right-hand column.
7. If a request body is required for your request, add content within Body.

8. Click Send Request.