Acronis Endpoint Detection and Response API
The Acronis Endpoint Detection and Response API is a comprehensive security solution that helps organizations detect and respond to cybersecurity threats in real-time.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/endpoint-detection-and-response-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
{
"openapi": "3.0.0",
"info": {
"title": "Endpoint Detection and Response (EDR) API",
"version": "1.0"
},
"paths": {
"/incidents": {
"get": {
"description": "Returns a list of incidents.\nThe endpoint is is designed for use by MDR vendors to retrieve incidents for their customers and store them on their backend for future use.\nIt is not intended for building UIs or for direct user interaction.\nUsage is quota-limited based on the size of the result set.\n",
"parameters": [
{
"name": "customer_id",
"description": "A filter by customer IDs (specific customer tenant ID(s) or customer IDs of specified partner tenant ID).\nIf not specified, the tenant ID provided in the token will be used.\n\nIf the user is authenticated in the scope of the partner tenant or above, this parameter is required.\nThe HTTP error 400 Bad Request will be returned if the parameter is missing or non-compliant.\n\nSupported operators:\n * `= value`: filters by the specified value; Only customer level tenant ID is allowed.\n * `or(value1, value2, ...)`: filters by any value in the specified set; Only customer level tenant IDs are allowed.\n * `direct_children(partner_id)`: includes all customers that are direct children of the specified partner tenant ID.\n * `descendants(partner_id)`: includes all customers that are descendant of the specified partner tenant ID.\n",
"in": "query",
"schema": {
"description": "A filter by customer IDs (specific customer tenant ID(s) or customer IDs of specified partner tenant ID).\nIf not specified, the tenant ID provided in the token will be used.\n\nIf the user is authenticated in the scope of the partner tenant or above, this parameter is required.\nThe HTTP error 400 Bad Request will be returned if the parameter is missing or non-compliant.\n\nSupported operators:\n * `= value`: filters by the specified value; Only customer level tenant ID is allowed.\n * `or(value1, value2, ...)`: filters by any value in the specified set; Only customer level tenant IDs are allowed.\n * `direct_children(partner_id)`: includes all customers that are direct children of the specified partner tenant ID.\n * `descendants(partner_id)`: includes all customers that are descendant of the specified partner tenant ID.\n",
"anyOf": [
{
"$ref": "#/components/schemas/UUID"
},
{
"type": "string"
}
]
}
},
{
"name": "incident_id",
"description": "List of incident IDs.\nCan only be used for single customer,\neither specified in customer_id parameter or\nextracted from the authentication token.\n\nSupported operators:\n * `= value`: filters by the specified value;\n * `or(value1, value2, ...)`: filters by any value in the specified set.\n",
"in": "query",
"schema": {
"description": "List of incident IDs.\nCan only be used for single customer,\neither specified in customer_id parameter or\nextracted from the authentication token.\n\nSupported operators:\n * `= value`: filters by the specified value;\n * `or(value1, value2, ...)`: filters by any value in the specified set.\n",
"anyOf": [
{
"$ref": "#/components/schemas/IncidentID"
},
{
"type": "string"
}
]
}
},
{
"name": "with_multi_workload",
"description": "Include multi-workload incidents in the response.\nIf true, for multi-workload incidents the \"workloads\" field will be present\nand root level WorkloadInfo fields will be omitted.\n",
"in": "query",
"schema": {
"description": "Include multi-workload incidents in the response.\nIf true, for multi-workload incidents the \"workloads\" field will be present\nand root level WorkloadInfo fields will be omitted.\n",
"default": false,
"type": "boolean"
}
},
{
"name": "with_transferred",
"description": "Include incidents that were transferred to another incident.",
"in": "query",
"schema": {
"description": "Include incidents that were transferred to another incident.",
"default": true,
"type": "boolean"
}
},
{
"name": "order",
"description": "Sort order of the returned items.\n\nSupported operators:\n * `asc(customer_id), asc(created_at)`: ascending order of customer and then created_at.\n",
"in": "query",
"schema": {
"description": "Sort order of the returned items.\n\nSupported operators:\n * `asc(customer_id), asc(created_at)`: ascending order of customer and then created_at.\n",
"type": "string"
}
},
{
"name": "cursor",
"description": "The cursor that points to the next batch of records returned from the previous request.\nAll other filtering and sorting parameters MUST remain exactly the same between requests.\n",
"in": "query",
"schema": {
"description": "The cursor that points to the next batch of records returned from the previous request.\nAll other filtering and sorting parameters MUST remain exactly the same between requests.\n",
"type": "string"
}
},
{
"name": "limit",
"description": "Maximum number of items to return.",
"in": "query",
"schema": {
"description": "Maximum number of items to return.",
"default": 100,
"type": "integer",
"minimum": 1,
"maximum": 1000
}
},
{
"name": "created_at",
"description": "Filters by incident creation time range.\n\nSupported operators:\n * `range(date_from, date_to)`: filters by the specified inclusive date range;\n * `ge(date_from)`: filters by the specified date and later;\n",
"in": "query",
"schema": {
"description": "Filters by incident creation time range.\n\nSupported operators:\n * `range(date_from, date_to)`: filters by the specified inclusive date range;\n * `ge(date_from)`: filters by the specified date and later;\n",
"example": "range(2021-01-01T00:00:00Z, 2021-01-31T23:59:59Z)",
"anyOf": [
{
"type": "string",
"format": "date-time"
},
{
"type": "string"
}
]
}
},
{
"name": "updated_at",
"description": "Filters by incident update time range.\n\nSupported operators:\n * `range(date_from, date_to)`: filters by the specified inclusive date range;\n * `ge(date_from)`: filters by the specified date and later;\n",
"in": "query",
"schema": {
"description": "Filters by incident update time range.\n\nSupported operators:\n * `range(date_from, date_to)`: filters by the specified inclusive date range;\n * `ge(date_from)`: filters by the specified date and later;\n",
"example": "ge(2021-01-01T00:00:00Z)",
"anyOf": [
{
"type": "string",
"format": "date-time"
},
{
"type": "string"
}
]
}
},
{
"name": "is_mitigated",
"description": "Filters by threat status (mitigation status).",
"in": "query",
"schema": {
"description": "Filters by threat status (mitigation status).",
"type": "boolean"
}
},
{
"name": "mitigation_state",
"description": "Filters by mitigation state.\n\nSupported operators:\n * `= value`: filters by the specified value;\n * `or(value1, value2, ...)`: filters by any value in the specified set.\n",
"in": "query",
"schema": {
"description": "Filters by mitigation state.\n\nSupported operators:\n * `= value`: filters by the specified value;\n * `or(value1, value2, ...)`: filters by any value in the specified set.\n",
"example": "MITIGATED",
"anyOf": [
{
"$ref": "#/components/schemas/MitigationState"
},
{
"type": "string"
}
]
}
},
{
"name": "state",
"description": "Filters by investigation state.\n\nSupported operators:\n * `= value`: filters by the specified value;\n * `or(value1, value2, ...)`: filters by any value in the specified set.\n",
"in": "query",
"schema": {
"description": "Filters by investigation state.\n\nSupported operators:\n * `= value`: filters by the specified value;\n * `or(value1, value2, ...)`: filters by any value in the specified set.\n",
"example": "or(INVESTIGATING, NOT_STARTED)",
"anyOf": [
{
"$ref": "#/components/schemas/InvestigationState"
},
{
"type": "string"
}
]
}
},
{
"name": "severity",
"description": "Filters by incident severity.\n\nSupported operators:\n * `= value`: filters by the specified value;\n * `or(value1, value2, ...)`: filters by any value in the specified set.\n",
"in": "query",
"schema": {
"description": "Filters by incident severity.\n\nSupported operators:\n * `= value`: filters by the specified value;\n * `or(value1, value2, ...)`: filters by any value in the specified set.\n",
"example": "HIGH",
"anyOf": [
{
"$ref": "#/components/schemas/Severity"
},
{
"type": "string"
}
]
}
},
{
"name": "positivity",
"description": "Filters by positivity.\n\nSupported operators:\n * `range(min_value, max_value)`: filters by the specified inclusive range;\n",
"in": "query",
"schema": {
"description": "Filters by positivity.\n\nSupported operators:\n * `range(min_value, max_value)`: filters by the specified inclusive range;\n",
"example": "range(5, 7.5)",
"anyOf": [
{
"$ref": "#/components/schemas/PositivityLevel"
},
{
"type": "string"
}
]
}
},
{
"name": "verdict",
"description": "Filters by verdict.",
"in": "query",
"schema": {
"description": "Filters by verdict.",
"enum": [
"SUSPICIOUS",
"MALICIOUS"
],
"type": "string"
}
},
{
"name": "incident_category",
"description": "Filters by Incident category.\n\n Supported operators:\n * `= value`: filters by the specified value;\n * `or(value1, value2, ...)`: filters by any value in the specified set.\n",
"in": "query",
"schema": {
"description": "Filters by Incident category.\n\n Supported operators:\n * `= value`: filters by the specified value;\n * `or(value1, value2, ...)`: filters by any value in the specified set.\n",
"example": "or(MALWARE_DETECTED, URL_BLOCKED)",
"anyOf": [
{
"$ref": "#/components/schemas/ThreatCategory"
},
{
"type": "string"
}
]
}
},
{
"name": "workload_id",
"description": "Filters by workload IDs.\n\nSupported operators:\n * `= value`: filters by the specified value;\n * `or(value1, value2, ...)`: filters by any value in the specified set.\n",
"in": "query",
"schema": {
"description": "Filters by workload IDs.\n\nSupported operators:\n * `= value`: filters by the specified value;\n * `or(value1, value2, ...)`: filters by any value in the specified set.\n",
"example": "or(WORKLOAD_ID_1, WORKLOAD_ID_2)",
"anyOf": [
{
"$ref": "#/components/schemas/WorkloadID"
},
{
"type": "string"
}
]
}
},
{
"name": "analytics_source",
"description": "Name of a component that use the API or a vendor name, used for API usage analytics only.\n",
"in": "query",
"schema": {
"description": "Name of a component that use the API or a vendor name, used for API usage analytics only.\n",
"type": "string"
}
}
],
"responses": {
"200": {
"description": "List of incidents.",
"content": {
"application/json": {
"schema": {
"type": "object",
"required": [
"items"
],
"properties": {
"items": {
"type": "array",
"items": {
"$ref": "#/components/schemas/IncidentBrief"
}
},
"cursor": {
"description": "This is the cursor that points to the next batch of records.\nAbsent if there are no more records to return.\n",
"type": "string"
}
}
}
}
}
},
"400": {
"description": "* Invalid input data.\n* Assignee is not valid user.\n* Workload ID is not valid or missing.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"401": {
"description": "Unauthorized request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"403": {
"description": "Access denied due to insufficient permissions.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"429": {
"description": "Results quota exceeded.",
"headers": {
"Retry-After": {
"description": "The time in seconds after which the client can retry the request.\n",
"required": true,
"schema": {
"description": "The time in seconds after which the client can retry the request.\n",
"type": "integer",
"minimum": 1,
"maximum": 3600
}
}
},
"content": {}
},
"500": {
"description": "Unexpected server error.\nError can be raised by network infrastructure (for example, by Nginx).\nIn this case, the response can contain any body.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
}
},
"security": [
{
"security_schemes.oauth2": [
"edr_mgmtsvc::incidents_viewer"
]
}
]
}
},
"/incidents/investigation_state": {
"post": {
"description": "Post update for an investigation state accompanied with comment or post a new comment for multiple incidents by MDR vendor.",
"parameters": [
{
"name": "workflow_id",
"description": "Workflow ID in case if executed by workflow.\nRequires \"edr_mgmtsvc automation\" scope.\nHeaders `X-Apigw-Session-User-Id`, `X-Apigw-Session-Login?` might be omitted.\n",
"in": "query",
"schema": {
"description": "Workflow ID in case if executed by workflow.\nRequires \"edr_mgmtsvc automation\" scope.\nHeaders `X-Apigw-Session-User-Id`, `X-Apigw-Session-Login?` might be omitted.\n",
"type": "string",
"pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
}
},
{
"name": "customer_id",
"description": "Customer ID, if it isn't provided tenant_id from the authentication token is used.\nMust be specified if the request is not authenticated with customer scoped token, i.e. partner level or root level.\n",
"in": "query",
"schema": {
"description": "Customer ID, if it isn't provided tenant_id from the authentication token is used.\nMust be specified if the request is not authenticated with customer scoped token, i.e. partner level or root level.\n",
"type": "string",
"pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
}
},
{
"name": "analytics_source",
"description": "Name of a component that use the API or a vendor name, used for API usage analytics only.\n",
"in": "query",
"schema": {
"description": "Name of a component that use the API or a vendor name, used for API usage analytics only.\n",
"type": "string"
}
},
{
"name": "Idempotency-Key",
"description": "Idempotent APIs enable clients to safely retry operations without worrying about the side-effects that the operation can cause.\nFor example, a client can safely **retry** an idempotent request in the event of a network connection error.\nMore information as defined in RFC 7231 can be found [here](https://tools.ietf.org/html/rfc7231#section-4.2.2).\n\nTo make a request idempotent, the client adds the header `Idempotency-Key` with unique data. It is RECOMMENDED to use `UUID v4` data.\nThe service is supposed to keep a cache of all the `Idempotency-Key` it has received in past requests to detect a duplicate requests from clients.\nThe cache can be cleared periodically and is at the discretion of the service but should be preserved for at least 3 hours.\n\nIf the server receives a request with the same Idempotency-Key, it returns the same response as for the original request.\nIf the original request is still being processed, the server waits for its completion before responding.\nThe server does not store the request if it fails initial validation.\n",
"in": "header",
"schema": {
"description": "Idempotent APIs enable clients to safely retry operations without worrying about the side-effects that the operation can cause.\nFor example, a client can safely **retry** an idempotent request in the event of a network connection error.\nMore information as defined in RFC 7231 can be found [here](https://tools.ietf.org/html/rfc7231#section-4.2.2).\n\nTo make a request idempotent, the client adds the header `Idempotency-Key` with unique data. It is RECOMMENDED to use `UUID v4` data.\nThe service is supposed to keep a cache of all the `Idempotency-Key` it has received in past requests to detect a duplicate requests from clients.\nThe cache can be cleared periodically and is at the discretion of the service but should be preserved for at least 3 hours.\n\nIf the server receives a request with the same Idempotency-Key, it returns the same response as for the original request.\nIf the original request is still being processed, the server waits for its completion before responding.\nThe server does not store the request if it fails initial validation.\n",
"type": "string"
}
}
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"type": "object",
"required": [
"update"
],
"properties": {
"incident_ids": {
"description": "Array of incident IDs.\nMay only be used when the customer_id matches tenant_id provided in the authentication token.\n",
"type": "array",
"items": {
"$ref": "#/components/schemas/IncidentID"
}
},
"customer_incident_ids": {
"description": "Array of customer and incident id pairs.\n",
"type": "array",
"items": {
"type": "object",
"required": [
"customer_id",
"incident_id"
],
"properties": {
"customer_id": {
"$ref": "#/components/schemas/UUID"
},
"incident_id": {
"$ref": "#/components/schemas/IncidentID"
}
}
}
},
"update": {
"$ref": "#/components/schemas/UpdateInvestigationState"
}
}
}
}
}
},
"responses": {
"200": {
"description": "Invocation with the same Idempotency-Key has been already processed and resulted in 201 status.\nResponse body is the same as for the original request.\n",
"content": {}
},
"207": {
"description": "Incident investigation state success per incident.",
"content": {
"application/json": {
"schema": {
"description": "The response contains a list of incident ids along with their status.\nOnly incidents that were not succesfully update are included.\n",
"example": {
"total_items": 3,
"success_items": 2,
"failure_items": 1,
"items": [
{
"item": {
"incident_id": "UUID_OF_MISSING_INCIDENT"
},
"status": 404
}
]
},
"type": "object",
"required": [
"failure_items",
"success_items",
"total_items",
"items"
],
"properties": {
"failure_items": {
"type": "integer"
},
"success_items": {
"type": "integer"
},
"total_items": {
"description": "total items processed by service",
"type": "integer"
},
"items": {
"type": "array",
"items": {
"type": "object",
"required": [
"item",
"status"
],
"properties": {
"item": {
"description": "domain model or href to the resource",
"type": "object"
},
"status": {
"description": "should be HTTP status code applicable for the item",
"example": 404,
"type": "integer"
},
"error": {
"description": "optional error object providing details",
"type": "object",
"required": [
"code",
"domain"
],
"properties": {
"reason": {
"description": "Obsolete. Error id or code, unique in the domain. Same as in 'code' field",
"type": "string"
},
"context": {
"description": "Error context dictionary",
"type": "object"
},
"code": {
"description": "Error id or code, unique in the domain. Same as in 'reason' field",
"type": "string"
},
"domain": {
"description": "Error type or category. Can be ['Licensing','Access'] or name of service (for example 'PolicyManager' or 'VaultManager')",
"type": "string"
},
"debug": {
"$ref": "#/components/schemas/debugInfo"
},
"kb_link": {
"$ref": "#/components/schemas/kbLinkInfo"
},
"message": {
"description": "human-readable message, describing the error.",
"type": "string"
}
}
}
}
}
}
}
}
}
}
},
"400": {
"description": "Request that failed initial validation would not to be stored for the future Idempotency checks.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"401": {
"description": "Unauthorized request.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"403": {
"description": "Access denied due to insufficient permissions.",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"429": {
"description": "Too many requests from the same IP.",
"headers": {
"Retry-After": {
"description": "The time in seconds after which the client can retry the request.\n",
"required": true,
"schema": {
"description": "The time in seconds after which the client can retry the request.\n",
"type": "integer",
"minimum": 1,
"maximum": 600
}
}
},
"content": {}
},
"500": {
"description": "Unexpected server error.\nError can be raised by network infrastructure (for example, by Nginx).\nIn this case, the response can contain any body.\n",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
}
},
"security": [
{
"security_schemes.oauth2": [
"edr_mgmtsvc::security_analyst",
"edr_mgmtsvc::automation"
]
}
]
}
},
"/incidents/{incident_id}": {
"get": {
"description": "Returns incident detailed info.",
"parameters": [
{
"name": "analytics_source",
"description": "Name of a component that use the API or a vendor name, used for API usage analytics only.\n",
"in": "query",
"schema": {
"description": "Name of a component that use the API or a vendor name, used for API usage analytics only.\n",
"type": "string"
}
},
{
"name": "customer_id",
"description": "Customer ID, if it isn't provided tenant_id from the authentication token is used.\nMust be specified if the request is not authenticated with customer scoped token, i.e. partner level or root level.\n",
"in": "query",
"schema": {
"description": "Customer ID, if it isn't provided tenant_id from the authentication token is used.\nMust be specified if the request is not authenticated with customer scoped token, i.e. partner level or root level.\n",
"type": "string",
"pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
}
},
{
"name": "with_incident_actions",
"description": "Include response actions in the response.",
"in": "query",
"schema": {
"description": "Include response actions in the response.",
"default": false,
"type": "boolean"
}
},
{
"name": "with_detection_per_type_limit",
"description": "Limit the number of detections per detection type in the response.\nIf not provided, all detections are returned.\n\nNote: for internal use only.\n",
"in": "query",
"schema": {
"description": "Limit the number of detections per detection type in the response.\nIf not provided, all detections are returned.\n\nNote: for internal use only.\n",
"type": "integer",
"minimum": 1,
"maximum": 1000
}
},
{
"name": "with_detections",
"description": "Include detections in the response.",
"in": "query",
"schema": {
"description": "Include detections in the response.",
"default": true,
"type": "boolean"
}
},
{
"name": "updated_since",
"description": "Hint that permits skipping parts of the response (including detections and activities items)\nthat were NOT updated since supplied value.\n",
"in": "query",
"schema": {
"description": "Hint that permits skipping parts of the response (including detections and activities items)\nthat were NOT updated since supplied value.\n",
"type": "string",
"format": "date-time"
}
},
{
"name": "with_activities",
"description": "Include activities in the response.",
"in": "query",
"schema": {
"description": "Include activities in the response.",
"default": true,
"type": "boolean"
}
},
{
"name": "incident_id",
"required": true,
"in": "pat
# --- truncated at 32 KB (97 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/acronis/refs/heads/main/openapi/_original/acronis-mdr-v1-openapi.json