OpenAPI Specification
openapi: 3.2.0
info:
title: IROH service Feedback API
version: 1.0.107
license:
name: All Rights Reserved
url: https://www.cisco.com
contact:
name: Cisco Security Business Group -- Advanced Threat
email: cisco-intel-api-support@cisco.com
description: IROH Feedback API
x-provenance:
method: harvested
authored_by: Cisco XDR
harvested_by: API Evangelist
harvested_on: '2026-08-19'
first_party: true
note: Published by Cisco. Retrieved unmodified except for this x-provenance block.
provider_published: true
x-evidence:
- type: source
url: https://visibility.amp.cisco.com/iroh/iroh-feedback/index.html
- type: raw
url: https://visibility.amp.cisco.com/iroh/iroh-feedback/swagger.json
servers:
- url: https://visibility.amp.cisco.com/
security:
- iroh: []
- AuthorizationHeader: []
- oauth2:
- telemetry
- integration
- private-intel
- admin
- cognitive
- profile
- inspect
- asset
- event
- feedback
- sse
- registry
- users
- investigation
- invite
- casebook
- orbital
- enrich
- oauth
- vault
- response
- notification
- global-intel:read
- webhook
- ao
tags:
- name: Feedback
description: Feedback Routes
paths:
/iroh/iroh-feedback/feedback/{id}:
get:
x-no-doc: false
tags:
- Feedback
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/Feedback'
application/x-yaml:
schema:
$ref: '#/components/schemas/Feedback'
application/edn:
schema:
$ref: '#/components/schemas/Feedback'
application/transit+json:
schema:
$ref: '#/components/schemas/Feedback'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/Feedback'
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `feedback:read`
'
parameters:
- in: path
name: id
description: ''
required: true
schema:
type: string
summary: Get a `Feedback`
/iroh/iroh-feedback/feedback:
post:
x-no-doc: false
tags:
- Feedback
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/Feedback'
application/x-yaml:
schema:
$ref: '#/components/schemas/Feedback'
application/edn:
schema:
$ref: '#/components/schemas/Feedback'
application/transit+json:
schema:
$ref: '#/components/schemas/Feedback'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/Feedback'
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `feedback:write`
'
summary: Create a `Feedback`
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/NewFeedbackParams'
application/x-yaml:
schema:
$ref: '#/components/schemas/NewFeedbackParams'
application/edn:
schema:
$ref: '#/components/schemas/NewFeedbackParams'
application/transit+json:
schema:
$ref: '#/components/schemas/NewFeedbackParams'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/NewFeedbackParams'
required: true
components:
schemas:
Feedback:
type: object
properties:
user_role:
description: User Role
type: string
org_id:
description: The organization of the user who created the Feedback
type: string
experience:
description: Experience rating from 1 to 5
type: integer
format: int64
enum:
- 1
- 4
- 3
- 2
- 5
user_email:
description: The email address to contact
type: string
bug:
description: True if the feedback describes a bug
type: boolean
source:
description: The product related to this feedback. Can be one of "threat-response", "securex", "ciscoxdr" (case-sensitive), or a different non-blank string, denoting some other product or aspect.
type: string
user_idp:
description: The IDP of the user
type: string
contact_allowed:
description: True if the user accepts to be contacted by email
type: boolean
id:
type: string
user_id:
description: The user who created the Feedback
type: string
client_id:
description: The OAuth2 client used to create the Feedback
type: string
user_name:
description: The contact name
type: string
created_at:
type: string
format: date-time
org_name:
description: The Customer Organization name
type: string
text:
description: The description of the feedback (bug, new feature)
type: string
additionalProperties: false
required:
- user_role
- org_id
- bug
- user_idp
- contact_allowed
- id
- user_id
- client_id
- created_at
- text
NewFeedbackParams:
type: object
properties:
experience:
description: Experience rating from 1 to 5
type: integer
format: int64
enum:
- 1
- 4
- 3
- 2
- 5
user_email:
description: The email address to contact
type: string
bug:
description: True if the feedback describes a bug
type: boolean
source:
description: The product related to this feedback. Can be one of "threat-response", "securex", "ciscoxdr" (case-sensitive), or a different non-blank string, denoting some other product or aspect.
type: string
contact_allowed:
description: True if the user accepts to be contacted by email
type: boolean
user_name:
description: The contact name
type: string
text:
description: The description of the feedback (bug, new feature)
type: string
additionalProperties: false
required:
- bug
- contact_allowed
- text
securitySchemes:
iroh:
type: apiKey
in: header
name: authorization
AuthorizationHeader:
type: apiKey
in: header
name: authorization
description: 'Ex: Bearer \<token\>'
oauth2:
type: oauth2
flows:
authorizationCode:
scopes:
telemetry: collect application data for analytics
integration: Manage your modules
private-intel: Access Private Intelligence
admin: Provide admin privileges
cognitive: Cognitive Integration
profile: Get your profile information
inspect: Extract Observables and data from text
asset: Access and modify your assets
event: Read IROH Events
feedback: Submit Customer Feedback
sse: SSE Integration. Manage your Devices.
registry: Manage registry entries
users: Manage users of your organisation
investigation: Perform threat analysis investigation
invite: Invite users into your organization
casebook: Access and modify your casebooks
orbital: Orbital Integration.
enrich: Query your configured modules for threat intelligence
oauth: Manage OAuth2 Clients
vault: Grants access to Module Vaults
response: List and execute response actions using configured modules
notification: Receive notifications from integrations
global-intel:read: Access AMP Global Intelligence
webhook: Manage your Webhooks
ao: AO Integration.
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token