OpenAPI Specification
openapi: 3.2.0
info:
title: Web Service Inspect API
version: 1.0.107
license:
name: All Rights Reserved
url: https://www.cisco.com
contact:
name: Cisco Security Business Group -- Advanced Threat
email: cisco-intel-api-support@cisco.com
description: Extract Observables from text
x-provenance:
method: harvested
authored_by: Cisco XDR
harvested_by: API Evangelist
harvested_on: '2026-08-19'
first_party: true
note: Published by Cisco. Retrieved unmodified except for this x-provenance block.
provider_published: true
x-evidence:
- type: source
url: https://visibility.amp.cisco.com/iroh/iroh-inspect/index.html
- type: raw
url: https://visibility.amp.cisco.com/iroh/iroh-inspect/swagger.json
servers:
- url: https://visibility.amp.cisco.com/
security:
- iroh: []
- AuthorizationHeader: []
- oauth2:
- telemetry
- integration
- private-intel
- admin
- cognitive
- profile
- inspect
- asset
- event
- feedback
- sse
- registry
- users
- investigation
- invite
- casebook
- orbital
- enrich
- oauth
- vault
- response
- notification
- global-intel:read
- webhook
- ao
tags:
- name: Inspect
description: Inspect related routes
paths:
/iroh/iroh-inspect/inspect:
post:
x-no-doc: false
tags:
- Inspect
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `inspect:read`
Detects and returns observables from plain text.'
responses:
'200':
description: Success
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/Observable'
uniqueItems: true
application/x-yaml:
schema:
type: array
items:
$ref: '#/components/schemas/Observable'
uniqueItems: true
application/edn:
schema:
type: array
items:
$ref: '#/components/schemas/Observable'
uniqueItems: true
application/transit+json:
schema:
type: array
items:
$ref: '#/components/schemas/Observable'
uniqueItems: true
application/transit+msgpack:
schema:
type: array
items:
$ref: '#/components/schemas/Observable'
uniqueItems: true
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/400'
application/x-yaml:
schema:
$ref: '#/components/schemas/400'
application/edn:
schema:
$ref: '#/components/schemas/400'
application/transit+json:
schema:
$ref: '#/components/schemas/400'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/400'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/401'
application/x-yaml:
schema:
$ref: '#/components/schemas/401'
application/edn:
schema:
$ref: '#/components/schemas/401'
application/transit+json:
schema:
$ref: '#/components/schemas/401'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/401'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/403'
application/x-yaml:
schema:
$ref: '#/components/schemas/403'
application/edn:
schema:
$ref: '#/components/schemas/403'
application/transit+json:
schema:
$ref: '#/components/schemas/403'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/403'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/500'
application/x-yaml:
schema:
$ref: '#/components/schemas/500'
application/edn:
schema:
$ref: '#/components/schemas/500'
application/transit+json:
schema:
$ref: '#/components/schemas/500'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/500'
summary: Find Observables
operationId: findObservables
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/StrContent'
application/x-yaml:
schema:
$ref: '#/components/schemas/StrContent'
application/edn:
schema:
$ref: '#/components/schemas/StrContent'
application/transit+json:
schema:
$ref: '#/components/schemas/StrContent'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/StrContent'
required: true
components:
schemas:
'400':
description: An object containing the offending parameters.
example:
content: missing-required-key
type: object
properties:
content:
type: string
additionalProperties: false
required:
- content
StrContent:
type: object
properties:
content:
description: Text to inspect for observables.
example: 1.2.3.4 foo bar xyz.com www.xyz.com
type: string
additionalProperties: false
required:
- content
'500':
description: The error string.
example:
error: unknown-exception
error_description: This exception has been logged for further inspection.
trace_id: 5755e17e-992f-4892-b2f6-db59b2bf480c
type: object
properties:
error:
type: string
error_description:
type: string
trace_id:
type: string
additionalProperties: false
required:
- error
'401':
description: An object describing the problem.
example:
error: invalid_request
error_description: No JWT found in HTTP Authorization header
type: object
properties:
error:
type: string
exception_message:
type: string
level:
type: string
token:
type: string
error_description:
type: string
trace_id:
type: string
additionalProperties: false
required:
- error
Observable:
example:
value: 1.2.3.4
type: ip
description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature. This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains. These do not exist as objects within the CTIA storage model, so you never create an observable.
type: object
properties:
value:
example: 1.2.3.4
description: The value of the observable.
type: string
type:
example: ip
description: The type of observable.
type: string
enum:
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
additionalProperties: false
required:
- value
- type
'403':
description: An object describing the problem.
example:
missing-scopes:
- inspect:read
required-scopes:
- inspect:read
scopes: []
user-id: user1
org-id: org1
trace_id: ctx-43eb882f-75d6-41cf-817a-34bb3dbf71ab
error: missing_scope
error_description: You do not have the required credentials to access this route.
type: object
properties:
error:
type: string
error_description:
type: string
missing-scopes:
type: array
items:
type: string
required-scopes:
type: array
items:
type: string
scopes:
type: array
items:
type: string
trace_id:
type: string
user-id:
type: string
org-id:
type: string
additionalProperties: false
required:
- error
securitySchemes:
iroh:
type: apiKey
in: header
name: authorization
AuthorizationHeader:
type: apiKey
in: header
name: authorization
description: 'Ex: Bearer \<token\>'
oauth2:
type: oauth2
flows:
authorizationCode:
scopes:
telemetry: collect application data for analytics
integration: Manage your modules
private-intel: Access Private Intelligence
admin: Provide admin privileges
cognitive: Cognitive Integration
profile: Get your profile information
inspect: Extract Observables and data from text
asset: Access and modify your assets
event: Read IROH Events
feedback: Submit Customer Feedback
sse: SSE Integration. Manage your Devices.
registry: Manage registry entries
users: Manage users of your organisation
investigation: Perform threat analysis investigation
invite: Invite users into your organization
casebook: Access and modify your casebooks
orbital: Orbital Integration.
enrich: Query your configured modules for threat intelligence
oauth: Manage OAuth2 Clients
vault: Grants access to Module Vaults
response: List and execute response actions using configured modules
notification: Receive notifications from integrations
global-intel:read: Access AMP Global Intelligence
webhook: Manage your Webhooks
ao: AO Integration.
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token