Cisco XDR Schemas API
The Schemas API from Cisco XDR — 2 operation(s) for schemas.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/cisco-xdr-schemas-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: REST API. Schemas API
version: 1.0.0
x-provenance:
method: harvested
authored_by: Cisco XDR
harvested_by: API Evangelist
harvested_on: '2026-08-19'
first_party: true
provider_published: true
source_host: visibility.amp.cisco.com
note: Anonymously fetchable Swagger 2.0 for nine IROH services plus the CTIA threat-intelligence API. The host returns real 404s on invented paths, so the 200s are genuine.
x-evidence:
- type: source
url: https://visibility.amp.cisco.com/iroh/iroh-int/swagger.json
- type: source
url: https://private.intel.amp.cisco.com/swagger.json
servers:
- url: https://automate.us.security.cisco.com/{basePath}
variables:
basePath:
default: api
security:
- oAuth2:
- integration:read
- private-intel:read
- profile:read
- inspect:read
- users:read
- invite:read
- enrich:read
- oauth:read
- response:read
- global-intel:read
- ao:read
- playbook:read
tags:
- name: Schemas
paths:
/v1/schemas:
get:
tags:
- Schemas
summary: Handler returning information about all Schemas.
description: 'Allowed Role(s): admin, user, sat'
operationId: getAllSchemaQueryParams
parameters:
- name: base_type
in: query
description: Base type of Schema.
required: true
schema:
type: string
x-go-name: BaseType
x-go-name: BaseType
- name: schema_type
in: query
description: Type of Schema.
required: true
schema:
type: string
x-go-name: SchemaType
x-go-name: SchemaType
- name: detailed
in: query
description: detailed Schema.
schema:
type: boolean
x-go-name: Detailed
x-go-name: Detailed
- name: variable_type
in: query
description: variable_type of data_type schema.
schema:
type: boolean
x-go-name: VariableType
x-go-name: VariableType
- name: is_internal
in: query
description: internal Schemas.
schema:
type: boolean
x-go-name: IsInternal
x-go-name: IsInternal
responses:
'200':
description: 'An GetSchemaAllResponse response model
# This is used for returning a response of schema as a body'
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/Schema'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
post:
tags:
- Schemas
summary: Handler to create a schema template for all base_types.
description: 'Allowed Role(s): admin'
operationId: schemaCreateRequest
requestBody:
description: The schema to submit.
content:
application/json:
schema:
$ref: '#/components/schemas/SchemaNewPostRequest'
required: true
x-go-name: RequestBody
responses:
'201':
description: 'An SchemaPostResponse response model
# This is used for returning a response of schema as body'
content:
application/json:
schema:
$ref: '#/components/schemas/SchemaNewPostResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'409':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
x-codegen-request-body-name: request_body
/v1/schemas/{type_or_id}:
get:
tags:
- Schemas
summary: Handler returning information about Template.
description: 'Allowed Role(s): admin, user, sat'
operationId: getSchemaById
parameters:
- name: type_or_id
in: path
description: The type or Id of Schema
required: true
schema:
type: string
x-go-name: TypeORID
x-go-name: TypeORID
- name: schema_type
in: query
description: Type of Schema. It can be "data" or "view".
schema:
type: string
x-go-name: SchemaType
x-go-name: SchemaType
responses:
'200':
description: 'An GetDataViewSchemaResponse response model
# This is used for returning a response of both data and view schema as a body'
content:
application/json:
schema:
$ref: '#/components/schemas/SchemaByTypeResponse'
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
put:
tags:
- Schemas
summary: handler method for updating adapter template/schema.
description: 'Allowed Role(s): admin'
operationId: schemaUpdateRequest
parameters:
- name: type_or_id
in: path
description: The type or id of schema
required: true
schema:
type: string
x-go-name: TypeORID
x-go-name: TypeORID
requestBody:
description: The schema to submit.
content:
application/json:
schema:
$ref: '#/components/schemas/SchemaPutRequest'
required: true
x-go-name: RequestBody
responses:
'200':
description: 'An GetSchemaResponse response model
# This is used for returning a response of schema as a body'
content:
application/json:
schema:
$ref: '#/components/schemas/Schema'
'312':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
x-codegen-request-body-name: request_body
delete:
tags:
- Schemas
summary: Handler for delete Schema.
description: 'Allowed Role(s): admin'
operationId: deleteSchemaById
parameters:
- name: type_or_id
in: path
description: The type or Id of Schema
required: true
schema:
type: string
x-go-name: TypeORID
x-go-name: TypeORID
responses:
'204':
description: NoContent response model
content: {}
'400':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'403':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'404':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'412':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
'500':
description: A Error is a swagger response to represent error
headers:
code:
schema:
type: integer
format: int64
description:
schema:
type: string
message:
schema:
type: string
content: {}
components:
schemas:
Deprecated:
title: Deprecated ...
type: object
properties:
deprecated_in:
type: string
x-go-name: DeprecatedIn
deprecated_message:
type: string
x-go-name: DeprecatedMessage
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/lib-data/models
Obsolete:
title: Obsolete ...
type: object
properties:
obsolete_from:
type: string
x-go-name: ObsoleteFrom
obsolete_message:
type: string
x-go-name: ObsoleteMessage
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/lib-data/models
AccessMetaType:
title: AccessMetaType ...
type: object
properties:
id:
type: string
x-go-name: ID
type:
type: string
x-go-name: Type
version:
type: string
x-go-name: Version
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/lib-data/models
AccessMeta:
title: AccessMeta ...
type: object
properties:
adapter:
$ref: '#/components/schemas/AccessMetaType'
deprecated:
$ref: '#/components/schemas/Deprecated'
disable_duplicate:
type: boolean
x-go-name: DisableDuplicate
is_integration:
type: boolean
x-go-name: IsIntegration
is_internal:
type: boolean
x-go-name: IsInternal
obsolete:
$ref: '#/components/schemas/Obsolete'
runtime_users:
type: array
items:
$ref: '#/components/schemas/AccessMetaType'
x-go-name: RuntimeUsers
targets:
type: array
items:
$ref: '#/components/schemas/AccessMetaType'
x-go-name: Targets
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/lib-data/models
Serverless:
title: Serverless ...
type: object
properties:
cloud_type:
type: string
x-go-name: CloudType
name:
type: string
x-go-name: Name
region:
type: string
x-go-name: Region
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/lib-data/models
ActionFunc:
title: ActionFunc ...
type: object
properties:
is_microservice:
type: boolean
x-go-name: IsMicroservice
micro_service:
$ref: '#/components/schemas/MicroService'
serverless:
$ref: '#/components/schemas/Serverless'
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/lib-data/models
SchemaByTypeResponse:
title: SchemaByTypeResponse ...
type: object
properties:
data_schema:
$ref: '#/components/schemas/Schema'
view_schema:
$ref: '#/components/schemas/Schema'
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/be-console/models
SchemaNewPostRequest:
title: SchemaNewPostRequest ...
required:
- data_schema
type: object
properties:
data_schema:
$ref: '#/components/schemas/Schema'
view_schema:
$ref: '#/components/schemas/Schema'
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/ao-libs/api/models
SchemaPutRequest:
title: A SchemaPutRequest for one or more schema templates.
type: object
properties:
access_meta:
$ref: '#/components/schemas/AccessMeta'
action_func:
$ref: '#/components/schemas/ActionFunc'
attributes:
type: object
additionalProperties:
type: object
properties: {}
x-go-name: Attributes
description:
type: string
x-go-name: Description
group:
type: string
x-go-name: Group
id:
type: string
x-go-name: SchemaID
inherits:
type: object
properties: {}
x-go-name: Inherits
invisible:
type: boolean
x-go-name: Invisible
is_internal:
type: boolean
x-go-name: IsInternal
name:
type: string
x-go-name: Name
output_schema:
type: object
additionalProperties:
type: object
properties: {}
x-go-name: OutputSchema
property_schema:
type: object
additionalProperties:
type: object
properties: {}
x-go-name: PropertySchema
title:
type: string
x-go-name: Title
trigger_schema:
type: object
additionalProperties:
type: object
properties: {}
x-go-name: TriggerSchema
variable_schema:
type: object
additionalProperties:
type: object
properties: {}
x-go-name: VariableSchema
version:
type: string
x-go-name: Version
view_config:
type: object
additionalProperties:
type: object
properties: {}
x-go-name: ViewConfig
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/ao-libs/api/models
MicroService:
title: MicroService ...
type: object
properties:
end_point:
type: string
x-go-name: EndPoint
name:
type: string
x-go-name: Name
port:
type: integer
format: uint32
x-go-name: Port
protocol:
type: string
x-go-name: Protocol
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/lib-data/models
SchemaNewPostResponse:
title: SchemaNewPostResponse ...
type: object
properties:
data_schema:
$ref: '#/components/schemas/Schema'
view_schema:
$ref: '#/components/schemas/Schema'
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/be-console/models
Schema:
title: Schema ...
type: object
properties:
access_meta:
$ref: '#/components/schemas/AccessMeta'
action_func:
$ref: '#/components/schemas/ActionFunc'
attributes:
type: object
additionalProperties:
type: object
properties: {}
x-go-name: Attributes
base_type:
type: string
x-go-name: BaseType
created_by:
type: string
x-go-name: CreatedBy
created_on:
type: string
format: date-time
x-go-name: CreatedOn
description:
type: string
x-go-name: Description
group:
type: string
x-go-name: Group
inherits:
type: object
properties: {}
x-go-name: Inherits
invisible:
type: boolean
x-go-name: Invisible
name:
type: string
x-go-name: Name
output_schema:
type: object
additionalProperties:
type: object
properties: {}
x-go-name: OutputSchema
owner:
type: string
x-go-name: Owner
property_schema:
type: object
additionalProperties:
type: object
properties: {}
x-go-name: PropertySchema
schema_id:
type: string
x-go-name: SchemaID
schema_type:
type: string
x-go-name: SchemaType
title:
type: string
x-go-name: Title
trigger_schema:
type: object
additionalProperties:
type: object
properties: {}
x-go-name: TriggerSchema
type:
type: string
x-go-name: Type
unique_name:
type: string
x-go-name: UniqueName
updated_by:
type: string
x-go-name: UpdatedBy
updated_on:
type: string
format: date-time
x-go-name: UpdatedOn
variable_schema:
type: object
additionalProperties:
type: object
properties: {}
x-go-name: VariableSchema
variable_type:
type: boolean
x-go-name: VariableType
version:
type: string
x-go-name: Version
view_config:
type: object
additionalProperties:
type: object
properties: {}
x-go-name: ViewConfig
x-go-package: bitbucket-eng-sjc1.cisco.com/bitbucket/nextg/ao-libs/api/models
securitySchemes:
oAuth2:
type: oauth2
flows:
clientCredentials:
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
scopes:
telemetry: Collect application data for analytics
integration:read: Manage your modules
private-intel:read: Access Private Intelligence
admin: Provide admin privileges
cognitive: Cognitive Integration
profile:read: Get your profile information
inspect:read: Extract Observables and data from text
asset: Access and modify your assets
event: Read IROH Events
feedback: Submit Customer Feedback
sse: SSE Integration. Manage your Devices.
registry: Manage registry entries
users:read: Manage users of your organization
investigation: Perform threat analysis investigation
invite:read: Invite users into your organization
casebook: Access and modify your casebooks
playbook: Access and modify your playbooks
orbital: Orbital Integration.
enrich:read: Query your configured modules for threat intelligence
oauth:read: Manage OAuth2 Clients
vault: Grants access to Module Vaults
response:read: List and execute response actions using configured modules
notification: Receive notifications from integrations
global-intel:read: Access AMP Global Intelligence
webhook: Manage your Webhooks
ao:read: AO Integration.
x-original-swagger-version: '2.0'