Amazon GuardDuty Guardduty Filter API
The Guardduty Filter API from Amazon GuardDuty — 2 operation(s) for guardduty filter.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/amazon-guardduty:amazon-guardduty-filter-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Amazon GuardDuty Filter API
version: '2017-11-28'
description: Generated from AWS's published Smithy model for Amazon GuardDuty. 5 operation(s).
contact:
name: Amazon Web Services
url: https://aws.amazon.com/contact-us/
license:
name: Apache 2.0
identifier: Apache-2.0
url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://guardduty.{region}.amazonaws.com
variables:
region:
default: us-east-1
security:
- sigv4: []
tags:
- name: Filter
paths:
/detector/{DetectorId}/filter:
post:
operationId: CreateFilter
summary: Create Filter
description: Creates a filter using the specified finding criteria. The maximum number of saved filters per Amazon Web Services account per Region is 100. For more information, see Quotas for GuardDuty.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/CreateFilterResponse'
'400':
description: BadRequestException
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestException'
'500':
description: InternalServerErrorException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalServerErrorException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CreateFilterRequest'
tags:
- Filter
get:
operationId: ListFilters
summary: List Filters
description: Returns a paginated list of the current filters.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/ListFiltersResponse'
'400':
description: BadRequestException
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestException'
'500':
description: InternalServerErrorException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalServerErrorException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/ListFiltersRequest'
tags:
- Filter
/detector/{DetectorId}/filter/{FilterName}:
delete:
operationId: DeleteFilter
summary: Delete Filter
description: Deletes the filter specified by the filter name.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/DeleteFilterResponse'
'400':
description: BadRequestException
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestException'
'500':
description: InternalServerErrorException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalServerErrorException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/DeleteFilterRequest'
tags:
- Filter
get:
operationId: GetFilter
summary: Get Filter
description: Returns the details of the filter specified by the filter name.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/GetFilterResponse'
'400':
description: BadRequestException
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestException'
'500':
description: InternalServerErrorException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalServerErrorException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/GetFilterRequest'
tags:
- Filter
post:
operationId: UpdateFilter
summary: Update Filter
description: Updates the filter specified by the filter name.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateFilterResponse'
'400':
description: BadRequestException
content:
application/json:
schema:
$ref: '#/components/schemas/BadRequestException'
'500':
description: InternalServerErrorException
content:
application/json:
schema:
$ref: '#/components/schemas/InternalServerErrorException'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateFilterRequest'
tags:
- Filter
components:
schemas:
DeleteFilterResponse:
type: object
properties: {}
InternalServerErrorException:
type: object
properties:
Message:
type: string
description: The error message.
Type:
type: string
description: The error type.
GetFilterResponse:
type: object
properties:
Name:
type: string
description: The name of the filter.
Description:
type: string
description: The description of the filter.
Action:
type: string
enum:
- NOOP
- ARCHIVE
description: Specifies the action that is to be applied to the findings that match the filter.
Rank:
type: integer
description: Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings.
FindingCriteria:
$ref: '#/components/schemas/FindingCriteria'
Tags:
type: object
additionalProperties:
type: string
description: The tags of the filter resource.
CreatedAt:
type: string
format: date-time
description: The timestamp when the filter was created. This field is not available for filters that were created before the lifecycle metadata feature was enabled (legacy filters).
UpdatedAt:
type: string
format: date-time
description: The timestamp when the filter was last updated. For legacy filters, this field is present only after the filter has been updated at least once since the lifecycle metadata feature was enabled.
Version:
type: integer
description: The version of the filter. Every time the filter is updated, the version increments by 1. This field is not available for legacy filters that were created before the lifecycle metadata feature was enabled.
required:
- Name
- Action
- FindingCriteria
UpdateFilterResponse:
type: object
properties:
Name:
type: string
description: The name of the filter.
required:
- Name
DeleteFilterRequest:
type: object
properties:
DetectorId:
type: string
description: The unique ID of the detector that is associated with the filter. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
FilterName:
type: string
description: The name of the filter that you want to delete.
required:
- DetectorId
- FilterName
ListFiltersRequest:
type: object
properties:
DetectorId:
type: string
description: The unique ID of the detector that is associated with the filter. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
MaxResults:
type: integer
description: You can use this parameter to indicate the maximum number of items that you want in the response. The default value is 50. The maximum value is 50.
NextToken:
type: string
description: You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.
required:
- DetectorId
GetFilterRequest:
type: object
properties:
DetectorId:
type: string
description: The unique ID of the detector that is associated with this filter. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
FilterName:
type: string
description: The name of the filter you want to get.
required:
- DetectorId
- FilterName
UpdateFilterRequest:
type: object
properties:
DetectorId:
type: string
description: The unique ID of the detector that specifies the GuardDuty service where you want to update a filter. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
FilterName:
type: string
description: The name of the filter.
Description:
type: string
description: The description of the filter. Valid characters include alphanumeric characters, and special characters such as hyphen, period, colon, underscore, parentheses ({ }, [ ], and ( )), forward slash, horizontal tab, vertical tab, newline, form feed, return, and whitespace.
Action:
type: string
enum:
- NOOP
- ARCHIVE
description: 'Specifies the action that is to be applied to the findings that match the filter. Default: NOOP'
Rank:
type: integer
description: Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings.
FindingCriteria:
$ref: '#/components/schemas/FindingCriteria'
required:
- DetectorId
- FilterName
CreateFilterRequest:
type: object
properties:
DetectorId:
type: string
description: The detector ID associated with the GuardDuty account for which you want to create a filter. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
Name:
type: string
description: The name of the filter. Valid characters include period (.), underscore (_), dash (-), and alphanumeric characters. A whitespace is considered to be an invalid character.
Description:
type: string
description: The description of the filter. Valid characters include alphanumeric characters, and special characters such as hyphen, period, colon, underscore, parentheses ({ }, [ ], and ( )), forward slash, horizontal tab, vertical tab, newline, form feed, return, and whitespace.
Action:
type: string
enum:
- NOOP
- ARCHIVE
description: 'Specifies the action that is to be applied to the findings that match the filter. Default: NOOP'
Rank:
type: integer
description: Specifies the position of the filter in the list of current filters. Also specifies the order in which this filter is applied to the findings.
FindingCriteria:
$ref: '#/components/schemas/FindingCriteria'
ClientToken:
type: string
description: The idempotency token for the create request.
Tags:
type: object
additionalProperties:
type: string
description: The tags to be added to a new filter resource.
required:
- DetectorId
- Name
- FindingCriteria
ListFiltersResponse:
type: object
properties:
FilterNames:
type: array
items:
type: string
description: A list of filter names.
NextToken:
type: string
description: The pagination parameter to be used on the next list operation to retrieve more items.
required:
- FilterNames
Condition:
type: object
properties:
Eq:
type: array
items:
type: string
description: 'Represents the equal condition to be applied to a single field when querying for findings. Max values: 50'
Neq:
type: array
items:
type: string
description: 'Represents the not equal condition to be applied to a single field when querying for findings. Max values: 50'
Gt:
type: integer
description: Represents a greater than condition to be applied to a single field when querying for findings.
Gte:
type: integer
description: Represents a greater than or equal condition to be applied to a single field when querying for findings.
Lt:
type: integer
description: Represents a less than condition to be applied to a single field when querying for findings.
Lte:
type: integer
description: Represents a less than or equal condition to be applied to a single field when querying for findings.
Equals:
type: array
items:
type: string
description: 'Represents an equal condition to be applied to a single field when querying for findings. Max values: 50'
NotEquals:
type: array
items:
type: string
description: 'Represents a not equal condition to be applied to a single field when querying for findings. Max values: 50'
GreaterThan:
type: integer
description: Represents a greater than condition to be applied to a single field when querying for findings.
GreaterThanOrEqual:
type: integer
description: Represents a greater than or equal condition to be applied to a single field when querying for findings.
LessThan:
type: integer
description: Represents a less than condition to be applied to a single field when querying for findings.
LessThanOrEqual:
type: integer
description: Represents a less than or equal condition to be applied to a single field when querying for findings.
Matches:
type: array
items:
type: string
description: Represents the match condition to be applied to a single field when querying for findings. The matches condition is available only for create-filter and update-filter APIs.
NotMatches:
type: array
items:
type: string
description: Represents the not match condition to be applied to a single field when querying for findings. The not-matches condition is available only for create-filter and update-filter APIs.
BadRequestException:
type: object
properties:
Message:
type: string
description: The error message.
Type:
type: string
description: The error type.
FindingCriteria:
type: object
properties:
Criterion:
type: object
additionalProperties:
$ref: '#/components/schemas/Condition'
description: Represents a map of finding properties that match specified conditions and values when querying findings.
CreateFilterResponse:
type: object
properties:
Name:
type: string
description: The name of the successfully created filter.
required:
- Name
securitySchemes:
sigv4:
type: apiKey
in: header
name: Authorization
description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
x-aws-sigv4:
signingName: guardduty
x-provenance:
method: harvested
publisher: Amazon Web Services
source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/guardduty/service/2017-11-28/guardduty-2017-11-28.json
note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)