Amazon GuardDuty

Amazon GuardDuty Guardduty Ipset API

The Guardduty Ipset API from Amazon GuardDuty — 2 operation(s) for guardduty ipset.

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 5

POST /detector/{DetectorId}/ipset Create IPSet #
GET /detector/{DetectorId}/ipset List IPSets #
DELETE /detector/{DetectorId}/ipset/{IpSetId} Delete IPSet #
GET /detector/{DetectorId}/ipset/{IpSetId} Get IPSet #
POST /detector/{DetectorId}/ipset/{IpSetId} Update IPSet #

Specifications

⚙
OpenAPI
https://artifacts.apis.io/amazon-guardduty/openapi/amazon-guardduty-ipset-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/amazon-guardduty:amazon-guardduty-ipset-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

amazon-guardduty-ipset-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Amazon GuardDuty Ipset API
  version: '2017-11-28'
  description: Generated from AWS's published Smithy model for Amazon GuardDuty. 5 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://guardduty.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Ipset
paths:
  /detector/{DetectorId}/ipset:
    post:
      operationId: CreateIPSet
      summary: Create IPSet
      description: Creates a new IPSet, which is called a trusted IP list in the console user interface. An IPSet is a list of IP addresses that are trusted for secure communication with Amazon Web Services infrastructure and applications. GuardDuty doesn't generate findings for IP addresses that are included in IPSets. Only users from the administrator account can use this operation.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateIPSetResponse'
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateIPSetRequest'
      tags:
      - Ipset
    get:
      operationId: ListIPSets
      summary: List IPSets
      description: Lists the IPSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the IPSets returned are the IPSets from the associated administrator account.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListIPSetsResponse'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListIPSetsRequest'
      tags:
      - Ipset
  /detector/{DetectorId}/ipset/{IpSetId}:
    delete:
      operationId: DeleteIPSet
      summary: Delete IPSet
      description: Deletes the IPSet specified by the ipSetId. IPSets are called trusted IP lists in the console user interface.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteIPSetResponse'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteIPSetRequest'
      tags:
      - Ipset
    get:
      operationId: GetIPSet
      summary: Get IPSet
      description: Retrieves the IPSet specified by the ipSetId.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetIPSetResponse'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetIPSetRequest'
      tags:
      - Ipset
    post:
      operationId: UpdateIPSet
      summary: Update IPSet
      description: Updates the IPSet specified by the IPSet ID.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateIPSetResponse'
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '400':
          description: BadRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestException'
        '500':
          description: InternalServerErrorException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateIPSetRequest'
      tags:
      - Ipset
components:
  schemas:
    InternalServerErrorException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
    DeleteIPSetResponse:
      type: object
      properties: {}
    DeleteIPSetRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the detector associated with the IPSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        IpSetId:
          type: string
          description: The unique ID of the IPSet to delete.
      required:
      - DetectorId
      - IpSetId
    ListIPSetsResponse:
      type: object
      properties:
        IpSetIds:
          type: array
          items:
            type: string
          description: The IDs of the IPSet resources.
        NextToken:
          type: string
          description: The pagination parameter to be used on the next list operation to retrieve more items.
      required:
      - IpSetIds
    AccessDeniedException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
    CreateIPSetResponse:
      type: object
      properties:
        IpSetId:
          type: string
          description: The ID of the IPSet resource.
      required:
      - IpSetId
    GetIPSetRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the detector that is associated with the IPSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        IpSetId:
          type: string
          description: The unique ID of the IPSet to retrieve.
      required:
      - DetectorId
      - IpSetId
    UpdateIPSetRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The detectorID that specifies the GuardDuty service whose IPSet you want to update. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        IpSetId:
          type: string
          description: The unique ID that specifies the IPSet that you want to update.
        Name:
          type: string
          description: The unique ID that specifies the IPSet that you want to update.
        Location:
          type: string
          description: The updated URI of the file that contains the IPSet.
        Activate:
          type: boolean
          description: The updated Boolean value that specifies whether the IPSet is active or not.
        ExpectedBucketOwner:
          type: string
          description: The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter.
      required:
      - DetectorId
      - IpSetId
    UpdateIPSetResponse:
      type: object
      properties: {}
    GetIPSetResponse:
      type: object
      properties:
        Name:
          type: string
          description: The user-friendly name for the IPSet.
        Format:
          type: string
          enum:
          - TXT
          - STIX
          - OTX_CSV
          - ALIEN_VAULT
          - PROOF_POINT
          - FIRE_EYE
          description: The format of the file that contains the IPSet.
        Location:
          type: string
          description: The URI of the file that contains the IPSet.
        Status:
          type: string
          enum:
          - INACTIVE
          - ACTIVATING
          - ACTIVE
          - DEACTIVATING
          - ERROR
          - DELETE_PENDING
          - DELETED
          description: The status of IPSet file that was uploaded.
        Tags:
          type: object
          additionalProperties:
            type: string
          description: The tags of the IPSet resource.
        ExpectedBucketOwner:
          type: string
          description: The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter. This field appears in the response only if it was provided during IPSet creation or update.
      required:
      - Name
      - Format
      - Location
      - Status
    BadRequestException:
      type: object
      properties:
        Message:
          type: string
          description: The error message.
        Type:
          type: string
          description: The error type.
    CreateIPSetRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the detector of the GuardDuty account for which you want to create an IPSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        Name:
          type: string
          description: The user-friendly name to identify the IPSet. Allowed characters are alphanumeric, whitespace, dash (-), and underscores (_).
        Format:
          type: string
          enum:
          - TXT
          - STIX
          - OTX_CSV
          - ALIEN_VAULT
          - PROOF_POINT
          - FIRE_EYE
          description: The format of the file that contains the IPSet.
        Location:
          type: string
          description: The URI of the file that contains the IPSet.
        Activate:
          type: boolean
          description: A Boolean value that indicates whether GuardDuty is to start using the uploaded IPSet.
        ClientToken:
          type: string
          description: The idempotency token for the create request.
        Tags:
          type: object
          additionalProperties:
            type: string
          description: The tags to be added to a new IP set resource.
        ExpectedBucketOwner:
          type: string
          description: The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter.
      required:
      - DetectorId
      - Name
      - Format
      - Location
      - Activate
    ListIPSetsRequest:
      type: object
      properties:
        DetectorId:
          type: string
          description: The unique ID of the detector that is associated with IPSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
        MaxResults:
          type: integer
          description: You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50. The maximum value is 50.
        NextToken:
          type: string
          description: You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.
      required:
      - DetectorId
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: guardduty
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/guardduty/service/2017-11-28/guardduty-2017-11-28.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)