Contraforce

Contraforce Cross-workspace data sources API

The Cross-workspace data sources API from Contraforce — 2 operation(s) for cross-workspace data sources.

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 2

POST /api/v2/datasources/across-workspaces/anomalies List datasource anomalies across workspaces #
GET /api/v2/datasources/across-workspaces Get datasource workspaces across workspaces #

Specifications

⚙
OpenAPI
https://artifacts.apis.io/contraforce/openapi/contraforce-cross-workspace-data-sources-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://artifacts.apis.io/contraforce/json-schema/contraforce-list-multiple-workspaces-general-request-dto-schema.json
📊
JSONSchema
https://artifacts.apis.io/contraforce/json-schema/contraforce-api-response-of-data-connector-workspaces-dto-schema.json
📊
JSONSchema
https://artifacts.apis.io/contraforce/json-schema/contraforce-api-response-of-data-connector-anomalies-dto-schema.json

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/contraforce:contraforce-cross-workspace-data-sources-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

contraforce-cross-workspace-data-sources-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: ContraForce Cross-workspace data sources API
  description: ContraForce platform API for security operations management.
  version: '2.0'
tags:
- name: Cross-workspace data sources
paths:
  /api/v2/datasources/across-workspaces/anomalies:
    post:
      tags:
      - Cross-workspace data sources
      summary: List datasource anomalies across workspaces
      operationId: v2-list-datasource-anomalies-across-workspaces
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListMultipleWorkspacesGeneralRequestDto'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiResponseOfDataConnectorAnomaliesDto'
        '400':
          description: Bad request — validation or parameter binding failed.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiProblemDetails'
        '401':
          description: Unauthorized — missing or invalid Bearer token.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiProblemDetails'
        '403':
          description: Forbidden — insufficient scope or workspace access.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiProblemDetails'
        '404':
          description: Not found — workspace or resource is missing.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiProblemDetails'
        '500':
          description: Internal server error.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiProblemDetails'
  /api/v2/datasources/across-workspaces:
    get:
      tags:
      - Cross-workspace data sources
      summary: Get datasource workspaces across workspaces
      operationId: v2-get-datasource-workspaces-across-workspaces
      parameters:
      - name: workspaceIds
        in: query
        schema:
          type: array
          items:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiResponseOfDataConnectorWorkspacesDto'
        '400':
          description: Bad request — validation or parameter binding failed.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiProblemDetails'
        '401':
          description: Unauthorized — missing or invalid Bearer token.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiProblemDetails'
        '403':
          description: Forbidden — insufficient scope or workspace access.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiProblemDetails'
        '404':
          description: Not found — workspace or resource is missing.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiProblemDetails'
        '500':
          description: Internal server error.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ApiProblemDetails'
components:
  schemas:
    DataConnectorDto:
      type: object
      properties:
        id:
          type:
          - 'null'
          - string
        name:
          type:
          - 'null'
          - string
        description:
          type:
          - 'null'
          - string
        icon:
          type:
          - 'null'
          - string
        link:
          type:
          - 'null'
          - string
        category:
          type:
          - 'null'
          - string
        provider:
          type:
          - 'null'
          - string
        isConnected:
          type: boolean
        isWaitingActivation:
          type: boolean
        directApiConnectionAvailable:
          type: boolean
          description: Indicates if the data connector has an API to connect/disconnect it
        metadata:
          type:
          - 'null'
          - string
          description: Defines a JSON / String that contains the configuration for a specific data source (ARN for AWS CloudTrail)
        isConfigurable:
          type: boolean
          description: Data Connector requires configuration before it can be used (Form of data is needed)
        plan:
          type:
          - 'null'
          - string
        isSupported:
          type: boolean
        isPrivate:
          type: boolean
        isSubscribedToDeployments:
          type: boolean
        deployedVersionDto:
          $ref: '#/components/schemas/VersionDto'
        cfCurrentVersionDto:
          $ref: '#/components/schemas/VersionDto'
        status:
          $ref: '#/components/schemas/DataSourceAnalysisStatus'
        modificationDate:
          type: string
          format: date-time
      description: Data Connector that is supported by the onboarding process and the
    DataConnectorWorkspacesDto:
      type: object
      properties:
        workspaces:
          type:
          - 'null'
          - array
          items:
            type: string
        sources:
          type:
          - 'null'
          - array
          items:
            $ref: '#/components/schemas/DataConnectorWorkspaceSourceDto'
    ResponseMeta:
      type: object
      properties:
        requestId:
          type:
          - 'null'
          - string
        timestamp:
          type:
          - 'null'
          - string
    ApiProblemDetails:
      type: object
      properties:
        type:
          type:
          - 'null'
          - string
        title:
          type:
          - 'null'
          - string
        status:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - 'null'
          - integer
          - string
          format: int32
        detail:
          type:
          - 'null'
          - string
        instance:
          type:
          - 'null'
          - string
        code:
          type:
          - 'null'
          - string
        requestId:
          type:
          - 'null'
          - string
        timestamp:
          type:
          - 'null'
          - string
        target:
          type:
          - 'null'
          - string
        errors:
          type:
          - 'null'
          - object
          additionalProperties:
            type: array
            items:
              type: string
      description: 'API extension of ProblemDetails that surfaces the stable error code,

        trace identifier, timestamp, optional target, and optional field-keyed validation

        error map alongside the RFC 7807 members.'
    DataSourceAnalysisStatus:
      enum:
      - RulesDeployed
      - UpdatesAvailable
      - PartiallyDeployed
      - NoRulesDeployed
    ApiResponseOfDataConnectorWorkspacesDto:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/DataConnectorWorkspacesDto'
        meta:
          $ref: '#/components/schemas/ResponseMeta'
      description: Standard v2 API response envelope for single-item responses.
    DataConnectorWorkspaceSourceDto:
      type: object
      properties:
        workspaceId:
          type:
          - 'null'
          - string
        workspaceName:
          type:
          - 'null'
          - string
        tenantId:
          type:
          - 'null'
          - string
        source:
          type:
          - 'null'
          - string
        dataConnectorCount:
          pattern: ^-?(?:0|[1-9]\d*)$
          type:
          - integer
          - string
          format: int32
    DataConnectorAnomaliesDto:
      type: object
      properties:
        items:
          type:
          - 'null'
          - array
          items:
            $ref: '#/components/schemas/DataConnectorAnomalyItemDto'
    ListMultipleWorkspacesGeneralRequestDto:
      type: object
      properties:
        workspaceIds:
          type:
          - 'null'
          - array
          items:
            type: string
        timeFilterSelection:
          description: 'Canonical representation of a global time filter.

            When Type == Custom, CustomStartUtc and CustomEndUtc must be provided (UTC).'
          $ref: '#/components/schemas/TimeFilterSelection'
    DataConnectorAnomalyItemDto:
      type: object
      properties:
        workspaceName:
          type:
          - 'null'
          - string
        dataConnector:
          description: Data Connector that is supported by the onboarding process and the
          $ref: '#/components/schemas/DataConnectorDto'
        status:
          $ref: '#/components/schemas/DataConnectorAnomalyStatus'
    DataConnectorAnomalyStatus:
      enum:
      - Active
      - Resolved
      - Investigating
      - Failed
    ApiResponseOfDataConnectorAnomaliesDto:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/DataConnectorAnomaliesDto'
        meta:
          $ref: '#/components/schemas/ResponseMeta'
      description: Standard v2 API response envelope for single-item responses.
    TimeFilteringType:
      enum:
      - ThreeHours
      - SixHours
      - TwelveHours
      - TwentyFourHours
      - FortyEightHours
      - Custom
      - SevenDays
      - ThirtyDays
      - NinetyDays
      - OneHundredEightyDays
      - SixtyDays
      - null
    TimeFilterSelection:
      type: object
      properties:
        type:
          $ref: '#/components/schemas/TimeFilteringType'
        customStartUtc:
          type:
          - 'null'
          - string
          format: date-time
        customEndUtc:
          type:
          - 'null'
          - string
          format: date-time
      description: 'Canonical representation of a global time filter.

        When Type == Custom, CustomStartUtc and CustomEndUtc must be provided (UTC).'
    VersionDto:
      type: object
      properties:
        dataConnectorId:
          type:
          - 'null'
          - string
        version:
          type:
          - 'null'
          - string
        creationDate:
          type: string
          format: date-time