The LOGIN API from Cisco XDR — 4 operation(s) for login.
0 of 4 operations are conformant: apis.io called them with no credentials and the responses matched this contract; 1 more answered but could not be checked against a schema. Checked 2026-11-12. how this works · status file
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/cisco-xdr:cisco-xdr-login-api"curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: IROH-Auth LOGIN API
version: 1.0.107
license:
name: All Rights Reserved
url: https://www.cisco.com
contact:
name: Cisco Security Business Group -- Advanced Threat
email: cisco-intel-api-support@cisco.com
description: API Handling Logins
x-provenance:
method: harvested
authored_by: Cisco XDR
harvested_by: API Evangelist
harvested_on: '2026-08-19'
first_party: true
note: Published by Cisco. Retrieved unmodified except for this x-provenance block.
provider_published: true
x-evidence:
- type: source
url: https://visibility.amp.cisco.com/iroh/iroh-auth/index.html
- type: raw
url: https://visibility.amp.cisco.com/iroh/iroh-auth/swagger.json
servers:
- url: https://visibility.amp.cisco.com/
security:
- iroh: []
- AuthorizationHeader: []
- oauth2:
- telemetry
- integration
- private-intel
- admin
- cognitive
- profile
- inspect
- asset
- event
- feedback
- sse
- registry
- users
- investigation
- invite
- casebook
- orbital
- enrich
- oauth
- vault
- response
- notification
- global-intel:read
- webhook
- ao
tags:
- name: Login
paths:
/iroh/iroh-auth/login/{idp}/answer:
get:
x-no-doc: false
parameters:
- in: path
name: idp
description: ''
required: true
schema:
type: string
- in: query
name: error
description: ''
required: false
allowEmptyValue: true
schema:
type: string
- in: query
name: error_description
description: ''
required: false
allowEmptyValue: true
schema:
type: string
- in: query
name: expires_in
description: ''
required: false
allowEmptyValue: true
schema:
type: integer
format: int64
- in: query
name: code
description: ''
required: false
allowEmptyValue: true
schema:
type: string
- in: query
name: state
description: ''
required: true
schema:
type: string
tags:
- Login
summary: Answer from the user
x-cors-credentials?: true
description: '*Requires credentials on cross-origin requests (emits `Access-Control-Allow-Credentials: true`).*'
responses:
default:
description: ''
operationId: getIrohIrohAuthLoginByIdpAnswer
x-operation-id-source: derived
/iroh/iroh-auth/login/{idp}:
get:
x-no-doc: false
parameters:
- in: path
name: idp
description: ''
required: true
schema:
type: string
- in: query
name: show_tenant_selector
description: Force redirect to the Registration UI page.
required: false
allowEmptyValue: true
schema:
type: boolean
- in: query
name: tab_id
description: Tab identifier for session binding. tab-id is optional at session creation time but mandatory for validation if a hash was stored.
required: false
allowEmptyValue: true
schema:
type: string
- in: query
name: create_org
description: Registration UI enables the creation of Orgs
required: false
allowEmptyValue: true
schema:
type: boolean
- in: query
name: user_id
description: ''
required: false
allowEmptyValue: true
schema:
type: string
- in: query
name: org_id
description: ''
required: false
allowEmptyValue: true
schema:
type: string
- in: query
name: invite_id
description: ''
required: false
allowEmptyValue: true
schema:
type: string
- in: query
name: origin
description: ''
required: true
schema:
type: string
- in: query
name: use_session_cookie_auth
description: When true, use session cookie auth instead of iroh-code
required: false
allowEmptyValue: true
schema:
type: boolean
tags:
- Login
summary: Login redirect
responses:
default:
description: ''
operationId: getIrohIrohAuthLoginByIdp
x-operation-id-source: derived
/iroh/iroh-auth/logins:
get:
x-no-doc: false
tags:
- Login
summary: Login redirect
responses:
default:
description: ''
operationId: getIrohIrohAuthLogins
x-operation-id-source: derived
/iroh/iroh-auth/code:
post:
x-no-doc: false
tags:
- Login
summary: Retrieve Access and Refresh Tokens from a `code`
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/TokenResponse'
application/x-yaml:
schema:
$ref: '#/components/schemas/TokenResponse'
application/edn:
schema:
$ref: '#/components/schemas/TokenResponse'
application/transit+json:
schema:
$ref: '#/components/schemas/TokenResponse'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/TokenResponse'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CodeBody'
application/x-yaml:
schema:
$ref: '#/components/schemas/CodeBody'
application/edn:
schema:
$ref: '#/components/schemas/CodeBody'
application/transit+json:
schema:
$ref: '#/components/schemas/CodeBody'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/CodeBody'
required: true
operationId: postIrohIrohAuthCode
x-operation-id-source: derived
components:
schemas:
CodeBody:
type: object
properties:
code:
description: The code from the query parameter of the URL the user is redirected to after a successful login
type: string
access-token-lifetime-in-sec:
description: You can optionally reduce the lifetime of access tokens returned. This parameter will set the lifetime to your preferred choice but you will not be allowed to make the lifetime longer than the configured value. If you try to put a longer lifetime, it will silently returns the token with the configured lifetime.
type: integer
format: int64
additionalProperties: false
required:
- code
TokenResponse:
type: object
properties:
access_token:
type: string
refresh_token:
type: string
token_type:
type: string
enum:
- bearer
expires_in:
type: integer
format: int64
additionalProperties: {}
required:
- access_token
- token_type
securitySchemes:
iroh:
type: apiKey
in: header
name: authorization
AuthorizationHeader:
type: apiKey
in: header
name: authorization
description: 'Ex: Bearer \<token\>'
oauth2:
type: oauth2
flows:
authorizationCode:
scopes:
telemetry: collect application data for analytics
integration: Manage your modules
private-intel: Access Private Intelligence
admin: Provide admin privileges
cognitive: Cognitive Integration
profile: Get your profile information
inspect: Extract Observables and data from text
asset: Access and modify your assets
event: Read IROH Events
feedback: Submit Customer Feedback
sse: SSE Integration. Manage your Devices.
registry: Manage registry entries
users: Manage users of your organisation
investigation: Perform threat analysis investigation
invite: Invite users into your organization
casebook: Access and modify your casebooks
orbital: Orbital Integration.
enrich: Query your configured modules for threat intelligence
oauth: Manage OAuth2 Clients
vault: Grants access to Module Vaults
response: List and execute response actions using configured modules
notification: Receive notifications from integrations
global-intel:read: Access AMP Global Intelligence
webhook: Manage your Webhooks
ao: AO Integration.
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token