Armor Health API

openapi: 3.2.0
info:
  title: MDR Public Health API
  version: 1.0.0
  description: 'Comprehensive API documentation for Armor''s Managed Detection and Response (MDR) platform.


    This unified API provides access to:


    ## AI Platform (AIP)

    - AI-processed incident analysis with threat indicators and recommendations

    - Entity threat intelligence for security entities associated with incidents


    ## Microsoft Defender Integration

    - Machine/device management in Microsoft Defender for Endpoint

    - Security action execution (isolation, scans, investigations)

    - Investigation package collection and live response operations


    ## Detection Rules Management

    - Microsoft Sentinel detection rules across customer environments

    - Enriched rule metadata including MITRE ATT&CK mappings

    - Incident generation statistics


    ## JSM Middleware

    - Security incident management and tracking

    - Metrics aggregation and reporting

    - Service request management

    - Organization management


    ## Monthly Security Reports

    - Access to monthly security reports (PowerPoint, JSON, PDF)

    - Security metrics and performance indicators

    - Data ingestion analytics


    ## Threat Intelligence

    - Threat actor intelligence data

    - Customer-specific threat intelligence based on deployed products

    - OpenCTI GraphQL proxy for advanced queries


    ## Authentication

    All endpoints (except health checks) require OAuth2 Bearer token authentication.


    For authentication details, see: https://kb.armor.com/kb/sso-authentication-with-postman

    '
  contact:
    name: Armor Security Team
    url: https://armor.com
servers:
- url: https://mdr.api.secure-prod.services
  description: Production environment
- url: https://mdr.api.secure-dev.services
  description: Development environment
security:
- OAuth2BearerAuth: []
- FH-AUTH: []
tags:
- name: Health
  description: Service health and monitoring endpoints
paths:
  /aip/health:
    get:
      tags:
      - Health
      summary: AIP health check
      description: Returns the health status of the AIP Middleware service
      operationId: aipHealthCheck
      security: []
      responses:
        '200':
          description: Service is healthy and operational
          content:
            text/plain:
              schema:
                type: string
              example: OK
  /defender/health:
    get:
      tags:
      - Health
      summary: Defender health check
      description: Returns the health status of the Defender Middleware service
      operationId: defenderHealthCheck
      security: []
      responses:
        '200':
          description: Service is healthy
          content:
            text/plain:
              schema:
                type: string
                example: OK
  /rules/health:
    get:
      tags:
      - Health
      summary: Detection rules health check
      description: Returns the health status of the Detection Middleware service
      operationId: rulesHealthCheck
      security: []
      responses:
        '200':
          description: Service is healthy and operational
          content:
            text/plain:
              schema:
                type: string
                example: OK
  /incidents/health:
    get:
      tags:
      - Health
      summary: JSM health check
      description: Returns OK if the JSM Middleware service is running
      operationId: jsmHealthCheck
      security: []
      responses:
        '200':
          description: Service is healthy
          content:
            text/plain:
              schema:
                type: string
                example: OK
  /report/health:
    get:
      tags:
      - Health
      summary: Reports health check
      description: Returns health status of the Reports service
      operationId: reportsHealthCheck
      security: []
      responses:
        '200':
          description: Service is healthy and operational
          content:
            text/plain:
              schema:
                type: string
                example: OK
  /ti-middleware/health:
    get:
      tags:
      - Health
      summary: TI health check
      description: Returns the operational status of the Threat Intelligence Middleware service
      operationId: tiHealthCheck
      security: []
      responses:
        '200':
          description: Service is healthy
          content:
            text/plain:
              schema:
                type: string
                example: OK
components:
  securitySchemes:
    OAuth2BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: OAuth2
      description: 'OAuth2 Scoped Access Token authentication. An authorization header with Bearer token

        must be included with every authenticated request.


        For authentication details, see the official documentation:

        https://kb.armor.com/kb/sso-authentication-with-postman

        '
    FH-AUTH:
      type: http
      scheme: bearer
      bearerFormat: FH-AUTH
      description: 'FH-AUTH token authentication.


        ## Authentication Flow


        1. **Authorize**: POST credentials to `/auth/authorize` to receive an authorization code

        2. **Token Exchange**: Exchange the code at `/auth/token` within 2 minutes for access tokens

        3. **API Calls**: Use the access token in the `Authorization: FH-AUTH {token}` header

        4. **Refresh**: When token expires (15 minutes), refresh via `/auth/token/reissue`


        ## Security Notes


        - Authorization codes expire in 2 minutes

        - Access tokens expire in 15 minutes

        - All endpoints require HTTPS

        - Never log or persist tokens in plain text


        Include the access token in the Authorization header:

        ```

        Authorization: FH-AUTH {access_token}

        ```

        '