The Cloudlock API provides data about an organization's activities, apps, incidents, and policies.
openapi: 3.0.0
info:
title: Cisco Cloudlock API
description: The Cloudlock API provides data about an organization's activities, apps, incidents, and policies.
version: 1.0.0
contact:
name: Cloud Security Developer Community
x-provenance:
method: harvested
authored_by: Cisco Umbrella
harvested_by: API Evangelist
harvested_on: '2026-08-19'
first_party: true
provider_published: true
source_host: pubhub.devnetcloud.com
note: 26 first-party OpenAPI 3.0 documents (256 operations) listed by Cisco's own docs-nav config and fetched anonymously.
Byte-identity reconfirmed 2026-08-19 by SHA-256 against the live source.
x-evidence:
- type: source
url: https://pubhub.devnetcloud.com/media/cloud-security-apis-in-eft/docs/umbrella-config.json
- type: source
url: https://developer.cisco.com/docs/cloud-security/
servers:
- url: https://api.cloudlock.com/api/v2
tags:
- name: Activities
- name: Apps
- name: Entities
- name: Incidents
- name: Incident Aggregates
- name: Incident Entities
- name: IP Libraries
- name: Policies
paths:
/activities:
get:
tags:
- Activities
summary: List Activities
description: Get the UBA (User Behavioral Analysis) activities.
operationId: listActivities
parameters:
- $ref: '#/components/parameters/eventTypeParam'
- name: ids
schema:
type: string
in: query
description: 'Filter the collection based on the event id or group of ids. Provide a comma-separated list of ID strings.
The ID strings must be url encoded.'
example: google:auth:-1595373817266362937%230,aws:CloudTrail:d891a0e2-4aaa-4cea-b237-da3d103ccbef
- $ref: '#/components/parameters/createdAfterParam'
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/ActivitiesCollection'
examples:
response:
value:
- client_ip: 86.176.87.160
client_location:
city: Harpenden
country:
code: GB
name: United Kingdom
lat: '51.8'
lng: '-0.35'
region:
code: F8
name: Hertford
created_at: '2015-06-23T15:18:09.000Z'
event_category: auth
event_id: -6285966971996490902#0
event_type: login
extra:
auth:
auth_type: ''
is_suspicious: false
operation_successful: true
origin_id: '-6285966971996490902'
raw:
actor:
email: yoni.fine@cloudlockdemo.com
profileId: '108287862377325873441'
etag: '"RU_ANZvud_qrxRGJHqK2w1PCmE4/mLe1pMbCGKexbLn4QBfOSNhifXY"'
events:
- parameters:
- name: login_type
value: google_password
- name: login_success
type: login
id:
applicationName: login
customerId: C015wxbys
time: '2015-06-23T15:18:09.000Z'
uniqueQualifier: '-6285966971996490902'
ipAddress: 86.176.87.160
kind: admin#reports#activity
user:
user_email: yoni.fine@cloudlockdemo.com
vendor_id: '108287862377325873441'
user_agent: ''
vendor:
name: google
service: auth
'400':
$ref: '#/components/responses/400Error'
'401':
$ref: '#/components/responses/401Error'
'403':
$ref: '#/components/responses/403Error'
'404':
$ref: '#/components/responses/404Error'
'500':
$ref: '#/components/responses/500Error'
/apps:
get:
tags:
- Apps
description: 'Get all of the organization''s installed applications and their current status.
To get the uninstalled applications, use the `install_state` filter.'
operationId: listApplications
summary: List Applications for the Organization
parameters:
- $ref: '#/components/parameters/limitParam'
- $ref: '#/components/parameters/offsetParam'
- name: classification
schema:
type: string
in: query
description: Filter based on the application classification
example: trusted
- name: vendor
schema:
type: string
in: query
description: Filter based on the vendor platform.
example: google
- name: app_category
schema:
type: string
in: query
description: The application category.
example: CIT
- name: detected_at_after
schema:
type: string
in: query
description: Specify a timestamp. Filter for applications detected after a given date.
example: '2021-04-21T08:22:40'
- name: detected_at_before
schema:
type: string
in: query
description: Specify a timestamp. Filter for applications detected before a given date.
example: '2021-04-21T08:22:40'
- name: app_ids
schema:
type: string
in: query
description: Filter for applications based on their id. Provide a comma-delimited string of IDs.
example: 1,2,3
- name: scope_categories
schema:
type: string
in: query
description: Filter for applications based on their scope category. Provide a comma-delimited string of scope category.
example: LACES,BINFO
- name: install_state
schema:
type: string
in: query
description: Filter for applications based on their state (installed or not installed).
example: installed
- name: count_total
schema:
type: string
in: query
description: 'Determines whether the `total` field returns a valid count of the applications.
Use the `count_total` value with the `offset` parameter to paginate the results.
Default value is `false`. Set to `true` to return a valid apps count.'
example: 'true'
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/AppsCollection'
examples:
response:
value:
- admins_count: 0
app:
category: ''
id: RkJx2JxK2O
install_type: user
is_revokable: true
name: Cloudlock
origin_id: 144711811583-2ra0eotmtsb3p7f48eie68d4rfeghl7q.apps.googleusercontent.com
trust_rating: ''
vendor:
name: google
classification:
method: ''
reason: ''
type: unclassified
updated_at: ''
detected_at: '2016-02-19T08:22:40.382224+00:00'
id: RkJx2JxK2O
scope_categories:
- category_id: BINFO
title: Basic information
users_count: 3
'400':
$ref: '#/components/responses/400Error'
'401':
$ref: '#/components/responses/401Error'
'403':
$ref: '#/components/responses/403Error'
'404':
$ref: '#/components/responses/404Error'
'500':
$ref: '#/components/responses/500Error'
/apps/{id}/access_scopes:
get:
tags:
- Apps
description: Get all of the access scopes for a given application.
operationId: listApplicationAccessScopes
summary: List Application Access Scopes
parameters:
- description: The ID of the app.
example: G8qz0A239V
in: path
name: id
required: true
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/AccessScope'
examples:
response:
value:
- category:
id: BINFO
title: Basic Information
description: View your email address
friendly_name: Userinfo - Email
id: 1gk4vvW4Mq
url: https://www.googleapis.com/auth/userinfo.email
- category:
id: LACES
title: Limited Access to Data and Files
description: Insert moments to a Google+ profile.
friendly_name: 'Google+ API: Moments'
id: ZkL4dryz1o
url: https://www.googleapis.com/auth/plus.moments.write
'400':
$ref: '#/components/responses/400Error'
'401':
$ref: '#/components/responses/401Error'
'403':
$ref: '#/components/responses/403Error'
'404':
$ref: '#/components/responses/404Error'
'500':
$ref: '#/components/responses/500Error'
/apps/{id}/classification:
post:
tags:
- Apps
description: Update the application's classification.
summary: Update Classification for Application
operationId: updateAppsClassification
parameters:
- description: The ID of the incident.
example: Aj54oPkx8m
in: path
name: id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
example:
other_reason: Other Custom Reason
reason_id: 4
type: trusted
properties:
other_reason:
type: string
reason_id:
type: number
type:
type: string
type: object
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/AppsCollection'
examples:
response:
value:
- app1: null
app:
category: ''
id: Aj54oPkx8m
install_type: user
is_revokable: true
name: CloudLock Collaboration Security
origin_id: 150079143025-d1lebr0q2pdf3i9vp2o3gb9dhm6nahq1.apps.googleusercontent.com
vendor:
name: google
classification:
method: manual
other_reason: Other Custom Reason
reason: Internal reason
reason_id: 4
type: trusted
updated_at: '2016-01-17T20:43:08.465267+00:00'
detected_at: '2015-04-13T11:54:47.403000+00:00'
id: Aj54oPkx8m
scope_categories:
- category_id: BINFO
users_count: 1
'400':
$ref: '#/components/responses/400Error'
'401':
$ref: '#/components/responses/401Error'
'403':
$ref: '#/components/responses/403Error'
'404':
$ref: '#/components/responses/404Error'
'500':
$ref: '#/components/responses/500Error'
/apps/{id}/installs:
get:
tags:
- Apps
description: List the application's installations.
operationId: listApplicationInstallations
summary: List Installations of Application
parameters:
- description: The ID of the app.
example: G8qz0A239V
in: path
name: id
required: true
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/AppsCollection'
examples:
response:
value:
- response:
app:
id: rNP3DKdzBy
install_type: user
name: Balsamiq Mockups 3 for Google Drive
origin_id: 199991064517-4p9fkqt42jbsg361b4lu8fsuob161vhn.apps.googleusercontent.com
access_risk: 2
is_revokable: true
category: ''
client_type: not_native
risk_level: 1
trust_rating: 100
vendor:
name: google
detection_date: '2015-04-07T07:42:11.452682+00:00'
domain: cloudlockplus.com
family_name: Admin
given_name: Admin
scope_id: 15926475
scope_type: user
scope_value: admin@cloudlockplus.com
state: not_installed
'400':
$ref: '#/components/responses/400Error'
'401':
$ref: '#/components/responses/401Error'
'403':
$ref: '#/components/responses/403Error'
'404':
$ref: '#/components/responses/404Error'
'500':
$ref: '#/components/responses/500Error'
/entities:
get:
tags:
- Entities
description: Get the data for the asset list page and asset list exports. This endpoint requires the Entity Cache feature.
If you do not have this feature enabled, refer to the incident entitites endpoint as an alternative.
operationId: listEntities
summary: List Entities
parameters:
- name: platform
schema:
type: string
in: query
description: The application supplying the underlying data.
example: google_document,google_site
- name: owners
in: query
schema:
type: string
description: comma delimited list of owner email addresses
- name: exposure
schema:
type: string
in: query
description: exposure level of the document
example: public, externally shared, organization-wide, internally shared, private
- name: asset_type
schema:
type: string
in: query
description: 'google_document, google_spreadsheet, google_presentation, google_form,
google_drawing, google_site, google_plus_post (future),
google_non_native_file, pdf, folder'
- name: mime_type
schema:
type: string
in: query
description: 'spreadsheet (.xlsx, application/vnd-google-apps.spreadsheet), document
(.docx, application/vnd-google-apps.document)'
- name: updated_before
schema:
type: string
description: Filters assets updated before the specified timestamp.
in: query
- name: updated_after
in: query
description: Filters assets updated after the specified timestamp.
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/EntitiesCollection'
examples:
response:
value:
- asset_type: google_document
collaborators:
- name: Admin Admin
role: writer
type: user
value: admin@testcloudlockdev9.com
collaborators_count: 1
created_at: '2016-03-15T14:27:33.013000+00:00'
direct_url: https://docs.google.com/a/testcloudlockdev5.com/document/d/15RvNK8Ahz_kiszqfs3oLopxZyBRi5_yAIyo5ans/edit?usp=drivesdk
exposure: organization_wide
id: MxylKdo1b4
mime_type: application/vnd.google-apps.document
name: Domain-wide Share 3/15/16
origin_id: 15RvNK8Ahz_kiszqfs3oLopOAGUxZyBRi5_yAIyo5ans
origin_type: document
owners:
- type: user
role: writer
vaue: admin@testcloudlockdev9.com
'400':
$ref: '#/components/responses/400Error'
'401':
$ref: '#/components/responses/401Error'
'403':
$ref: '#/components/responses/403Error'
'404':
$ref: '#/components/responses/404Error'
'500':
$ref: '#/components/responses/500Error'
/incident_entities/{id}:
get:
tags:
- Incident Entities
description: 'Get the detailed entity information for an entity involved in an incident.
There is a limit of up to 100 ACL''s and the data is reflective of the last time we scanned the
document (not when the incident was created).
Usage:
First get an incident/incidents. Then take the id value from the entity
object within the incident and call the incident_entities endpoint using
that entitys id (not the incident id).
Example:
You have an incident which has an ID of 528815. Lookup the entity id for
this incident, then use this entity id to get the entity information.'
operationId: listIncidentEntities
summary: List Incident Entities
parameters:
- description: The ID of the entity in the incident.
example: 513266
in: path
name: id
required: true
schema:
type: integer
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/IncidentEntity'
examples:
response:
value:
id: '513266'
name: Logins for EC2 Instances.xlsx
user: ''
owner_name: ''
owner_vendor_id: ''
acl:
- created_on: '2021-02-27 20:18:38.799158'
id: '2823'
origin_id: ''
role: viewer
status: ACTIVE
type: public_with_link
value: public_with_link
vendor:
name: box
'400':
$ref: '#/components/responses/400Error'
'401':
$ref: '#/components/responses/401Error'
'403':
$ref: '#/components/responses/403Error'
'404':
$ref: '#/components/responses/404Error'
'500':
$ref: '#/components/responses/500Error'
/incidents:
get:
tags:
- Incidents
description: 'Incidents are a key resource in CloudLock. Incidents are
triggered by the CloudLock policy engine when a policy''s detection
criteria results in a match in object (document, field, folder, post, or
file).
Incidents can be changed manually by a
user (by updating incidents fields such as status or severity) or
automatically as objects or events are reevaluated by the policy
engine. Depending on the incident type, different incident information may be
available.
Key information about an incident:
Summary - Basic incident information and
status
Details - Information about the relevant object(s) associated with this incident
Entity - Information about the object related
to the incident
Matches - Matches represent the actual hits
within the content (for content type policies)'
operationId: listIncidents
summary: List Incidents
parameters:
- $ref: '#/components/parameters/limitParam'
- $ref: '#/components/parameters/offsetParam'
- name: incident_type
schema:
type: string
in: query
description: Filter based on the incident type.
example: COMPLIANCE
- name: severity
schema:
type: string
in: query
description: Filter based on the incident severity.
example: CRITICAL
- name: policy_id
schema:
type: string
in: query
description: Filter based on the policy ID.
example: rNP3Dd3By0
- $ref: '#/components/parameters/createdBeforeParam'
- $ref: '#/components/parameters/createdAfterParam'
- name: updated_before
in: query
schema:
type: string
description: Filter based on incidents updated before a given date.
example: 2021-01-18T16:55
- name: updated_after
in: query
schema:
type: string
description: Filter based on incidents updated after a given date.
example: 2021-01-18T16:55
- name: incident_status
schema:
type: string
in: query
description: Filter based on the incident status.
example: RESOLVED
- name: vendor
schema:
type: string
in: query
description: 'Filter based on the platform (for example: google, salesforce)'
example: salesforce
- name: customer_key
schema:
type: string
in: query
description: Filter based on the customer_key field.
example: 123 abc
- name: fields
schema:
type: string
in: query
description: 'Return only the selected parent fields. For example: id and entity fields.
Provide a comma-delimited list of parent fields.'
example: id,entity
- name: order
schema:
type: string
in: query
description: Sort by the date when the incident was created (A dash (`-`) denotes descending order).
example: created_at
- name: flat
schema:
type: string
in: query
description: If set to `true`, flatten the output to simplify ingestion of data by tabular systems.
example: 'true'
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/IncidentsCollection'
examples:
response:
value:
- created_at: '2014-08-08T05:09:53.218594+00:00'
customer_key: ''
entity:
direct_url: https://na15.salesforce.com/00Qi00000088wrBEAQ
extra:
origin_type_label: Lead
origin_type_label_plural: Leads
id: GM46KpY7xO
mime_type: ''
name: Gautum Trentson
origin_id: 00Qi00000088wrBEAQ
origin_type: document
owner_email: jennifer@cloudlock.com
owner_name: Jennifer McClain
vendor:
name: salesforce
id: '320831601'
incident_status: IN PROGRESS
match_count: 1
matches:
- created_at: '2014-08-08T05:09:53.218594+00:00'
ctx_after: can we use this on the up
ctx_before: ard number on an old invoice
field_name: Description
text: XXXXXXXXXXXX6966
policy:
id: eyaznBzYKv
name: PCI
severity: WARNING
updated_at: '2014-08-08T05:09:52.930752+00:00'
'400':
$ref: '#/components/responses/400Error'
'401':
$ref: '#/components/responses/401Error'
'403':
$ref: '#/components/responses/403Error'
'404':
$ref: '#/components/responses/404Error'
'500':
$ref: '#/components/responses/500Error'
/incidents/aggregates/policies:
get:
tags:
- Incident Aggregates
description: Get the aggregations (by policies/users/status) for the incidents.
operationId: listIncidentAggregatesPolicies
summary: List Incident Aggregates Policies
parameters:
- $ref: '#/components/parameters/createdAfterParam'
- name: vendor
schema:
type: string
in: query
description: 'Filter based on the platform (for example: google, salesforce)'
example: google
- name: order
schema:
type: string
in: query
description: Order based on the severity. Only descending severity is supported.
example: -severity
- name: policies
in: query
schema:
type: string
description: Return aggregates by policies
- name: users
schema:
type: string
in: query
description: Return aggregates by users
- name: status
schema:
type: string
in: query
description: Return aggregates by status
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/IncidentAggregates'
examples:
response:
value:
- agg:
info: 34
alert: 443
critical: 770
total: 1247
warning: 0
id: G8qz0vb49V
name: Social Security Number
- agg:
info: 2549
alert: 0
critical: 0
total: 2549
warning: 0
id: GbO4Q6lxLp
name: Custom Regex
'400':
$ref: '#/components/responses/400Error'
'401':
$ref: '#/components/responses/401Error'
'403':
$ref: '#/components/responses/403Error'
'404':
$ref: '#/components/responses/404Error'
'500':
$ref: '#/components/responses/500Error'
/incidents/aggregates/status:
get:
tags:
- Incident Aggregates
description: List the status information for the incident aggregates.
operationId: listIncidentAggregatesStatus
summary: List Status for Incident Aggregates
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/IncidentAggregates'
examples:
response:
value:
- agg:
info: 1433
alert: 0
critical: 0
total: 1433
warning: 0
id: IN PROGRESS
name: IN PROGRESS
'400':
$ref: '#/components/responses/400Error'
'401':
$ref: '#/components/responses/401Error'
'403':
$ref: '#/components/responses/403Error'
'404':
$ref: '#/components/responses/404Error'
'500':
$ref: '#/components/responses/500Error'
/incidents/aggregates/users:
get:
tags:
- Incident Aggregates
description: List the status information and users for the incident aggregates.
operationId: listIncidentAggregatesUsers
summary: List Status and Users for Incident Aggregates
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/IncidentAggregates'
examples:
response:
value:
- agg:
info: 134
alert: 0
critical: 2
total: 2049
warning: 1913
id: administrator@testcloudlockprimary1.com
name: administrator@testcloudlockprimary1.com
'400':
$ref: '#/components/responses/400Error'
'401':
$ref: '#/components/responses/401Error'
'403':
$ref: '#/components/responses/403Error'
'404':
$ref: '#/components/responses/404Error'
'500':
$ref: '#/components/responses/500Error'
/incidents/{id}:
get:
tags:
- Incidents
description: Get the information about a specific incident.
operationId: getIncident
summary: Get Incident
parameters:
- description: The ID of the incident.
example: 320831601
in: path
name: id
required: true
schema:
type: integer
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/IncidentsCollection'
examples:
response:
value:
created_at: '2014-08-08T05:09:58.861954+00:00'
customer_key: ''
entity:
direct_url: https://na15.salesforce.com/0D5i000000jY0GvCAK
extra:
origin_type_label: Feed Item
origin_type_label_plural: Feed Items
id: vXxjnWAexL
mime_type: ''
name: Feed Item by John Demo
origin_id: 0D5i000000jY0GvCAK
origin_type: document
owner_email: demoUser@cloudlockdemo.com
owner_name: John Demo
vendor:
name: salesforce
id: '320831601'
incident_status: IN PROGRESS
match_count: 1
matches:
- created_at: '2014-08-08T05:09:58.861954+00:00'
ctx_after: 638 1
ctx_before: 'UPS Tracking Number: 1Z W18'
field_name: Body
policy_criteria:
id: '23'
text: XXX XX 7502
policy:
id: Bdb475zMDK
name: SSN
severity: WARNING
updated_at: '2014-08-08T05:09:58.572845+00:00'
'400':
$ref: '#/components/responses/400Error'
'401':
$ref: '#/components/responses/401Error'
'403':
$ref: '#/components/responses/403Error'
'404':
$ref: '#/components/responses/404Error'
'500':
$ref: '#/components/responses/500Error'
put:
tags:
- Incidents
description: Update a specific incident.
operat
# --- truncated at 32 KB (63 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-umbrella/refs/heads/main/openapi/cisco-umbrella-cloudlock-cloudlock-openapi.yml