find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/amazon-guardduty:amazon-guardduty-investigation-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Amazon GuardDuty Investigation API
  version: '2017-11-28'
  description: Generated from AWS's published Smithy model for Amazon GuardDuty. 3 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://guardduty.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Investigation
paths:
  /detector/{DetectorId}/investigation:
    post:
      operationId: CreateInvestigation
      summary: Create Investigation
      description: 'This API is currently available as a preview. During the preview, you can initiate up to 10 investigations per account per day, with a total limit of 100 investigations per account. This feature is available in the following Amazon Web Services Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Canada (Central), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Paris), Europe (Stockholm), and Asia Pacific (Tokyo). Initiates a GuardDuty investigation that automatically analyzes security findings, correlates related activity, performs account-level analysis, and produces a structured investigation summary with recommended next steps. Only the administrator account can create an investigation. Member accounts don''t have permission to create investigations from their accounts. To use this operation, the AI_ANALYST feature must be enabled on your detector. This feature uses Amazon Bedrock models that leverage Cross-Region Inference (CRIS), which automatically selects the optimal Amazon Web Services Region within your geography to process the investigation analysis and generate the investigation report. This maximizes available compute resources, model availab'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateInvestigationResponse'
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateInvestigationRequest'
      tags:
      - Investigation
  /detector/{DetectorId}/investigation/{InvestigationId}:
    get:
      operationId: GetInvestigation
      summary: Get Investigation
      description: 'This API is currently available as a preview. This feature is available in the following Amazon Web Services Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Canada (Central), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Paris), Europe (Stockholm), and Asia Pacific (Tokyo). Retrieves the results and status of a specific GuardDuty investigation. An administrator account can retrieve any investigation within the organization. Member accounts can only retrieve investigations that belong to them.'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetInvestigationResponse'
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetInvestigationRequest'
      tags:
      - Investigation
  /detector/{DetectorId}/investigation/list:
    post:
      operationId: ListInvestigations
      summary: List Investigations
      description: 'This API is currently available as a preview. This feature is available in the following Amazon Web Services Regions: US East (N. Virginia), US East (Ohio), US West (Oregon), Canada (Central), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Paris), Europe (Stockholm), and Asia Pacific (Tokyo). Returns a list of investigations associated with the specified GuardDuty detector. An administrator account sees all investigations across the organization. Member accounts see only the investigations that belong to them.'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListInvestigationsResponse'
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListInvestigationsRequest'
      tags:
      - Investigation
components:
  schemas:
    InternalServerErrorException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
    Investigation:
      type: object
      properties:
        InvestigationId:
          type: string
          description: The unique identifier of the investigation.
        Status:
          type: string
          enum:
          - RUNNING
          - COMPLETED
          - FAILED
          description: The current status of the investigation. Possible values are RUNNING, COMPLETED, and FAILED.
        TriggerPrompt:
          type: string
          description: The natural-language prompt that initiated this investigation.
        TriggeredBy:
          type: string
          description: The account that initiated the investigation.
        Metadata:
          $ref: '#/components/schemas/InvestigationMetadata'
        Cloud:
          $ref: '#/components/schemas/CloudDetails'
        RiskLevel:
          type: string
          enum:
          - Info
          - Low
          - Medium
          - High
          - Critical
          description: The assessed risk level of the investigated threat. Possible values are Info, Low, Medium, High, and Critical.
        Risk:
          type: string
          description: A human-readable description of the assessed risk.
        Confidence:
          type: string
          enum:
          - Unknown
          - Low
          - Medium
          - High
          description: The confidence level of the investigation's assessment. Possible values are Unknown, Low, Medium, and High.
        Summary:
          type: string
          description: A structured summary of the investigation findings, including affected resources, threat assessment, and recommended remediation steps.
        StartTime:
          type: string
          format: date-time
          description: The timestamp at which the investigation started.
        EndTime:
          type: string
          format: date-time
          description: The timestamp at which the investigation completed.
        Error:
          type: string
          description: Details about the error if the investigation status is FAILED.
      required:
      - InvestigationId
      - Status
      - TriggerPrompt
      - TriggeredBy
    ResourceNotFoundException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
    GetInvestigationResponse:
      type: object
      properties:
        Investigation:
          $ref: '#/components/schemas/Investigation'
      required:
      - Investigation
    InvestigationMetadata:
      type: object
      properties:
        Version:
          type: string
          description: The version of the investigation engine that produced the results.
        Product:
          $ref: '#/components/schemas/Product'
      required:
      - Version
      - Product
    AccessDeniedException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
    CreateInvestigationRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the GuardDuty detector for the account in which the investigation is created. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        TriggerPrompt:
          type: string
          description: 'A natural-language description of what to investigate. For example: "Investigate finding 1ab2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 in account 123456789012" "Analyze findings in account with id 123456789012" "Analyze findings in my organization"'
        ClientToken:
          type: string
          description: The idempotency token for the create request.
      required:
      - DetectorId
      - TriggerPrompt
    Product:
      type: object
      properties:
        Name:
          type: string
          description: The name of the product.
        Feature:
          type: string
          description: The specific feature within the product that produced the investigation.
      required:
      - Name
    ListInvestigationsResponse:
      type: object
      properties:
        Investigations:
          type: array
          items:
            $ref: '#/components/schemas/InvestigationSummary'
          description: A list of investigation summaries associated with the specified detector.
        NextToken:
          type: string
          description: The pagination parameter to be used on the next list operation to retrieve more items.
      required:
      - Investigations
    CreateInvestigationResponse:
      type: object
      properties:
        InvestigationId:
          type: string
          description: The unique identifier of the newly created investigation.
      required:
      - InvestigationId
    InvestigationSortCriteria:
      type: object
      properties:
        AttributeName:
          type: string
          enum:
          - START_TIME
          - END_TIME
          - STATUS
          - RISK_LEVEL
          - CONFIDENCE
          description: The attribute by which to sort investigations.
        OrderBy:
          type: string
          enum:
          - ASC
          - DESC
          description: The order in which the sorted results are to be displayed.
    InvestigationSummary:
      type: object
      properties:
        InvestigationId:
          type: string
          description: The unique identifier of the investigation.
        Status:
          type: string
          enum:
          - RUNNING
          - COMPLETED
          - FAILED
          description: The current status of the investigation.
        TriggerPrompt:
          type: string
          description: The natural-language prompt that initiated this investigation.
        RiskLevel:
          type: string
          enum:
          - Info
          - Low
          - Medium
          - High
          - Critical
          description: The assessed risk level of the investigated threat.
        Confidence:
          type: string
          enum:
          - Unknown
          - Low
          - Medium
          - High
          description: The confidence level of the investigation's assessment.
        Title:
          type: string
          description: A short title summarizing the investigation.
        AccountId:
          type: string
          description: The Amazon Web Services account ID associated with the investigation.
        StartTime:
          type: string
          format: date-time
          description: The timestamp at which the investigation started.
        EndTime:
          type: string
          format: date-time
          description: The timestamp at which the investigation completed.
    CloudDetails:
      type: object
      properties:
        Provider:
          type: string
          enum:
          - AWS
          description: The cloud provider. Currently, only AWS is supported.
        Region:
          type: string
          description: The Amazon Web Services Region in which the investigated resource resides.
        Account:
          type: string
          description: The Amazon Web Services account ID of the investigated resource.
      required:
      - Provider
      - Region
      - Account
    BadRequestException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
    ListInvestigationsRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the GuardDuty detector whose investigations you want to list. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        SortCriteria:
          $ref: '#/components/schemas/InvestigationSortCriteria'
        MaxResults:
          type: integer
          description: You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50.
        NextToken:
          type: string
          description: You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.
      required:
      - DetectorId
    GetInvestigationRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the GuardDuty detector associated with the investigation. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        InvestigationId:
          type: string
          description: The unique identifier of the investigation to retrieve.
      required:
      - DetectorId
      - InvestigationId
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: guardduty
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/guardduty/service/2017-11-28/guardduty-2017-11-28.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)