Contraforce Investigation API
The Investigation API from Contraforce — 2 operation(s) for investigation.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/contraforce:contraforce-investigation-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: ContraForce Investigation API
description: ContraForce platform API for security operations management.
version: '2.0'
tags:
- name: Investigation
paths:
/api/v2/workspaces/{workspaceId}/investigation/users/signin-logs:
get:
tags:
- Investigation
summary: List signin logs
operationId: v2-list-signin-logs
parameters:
- name: workspaceId
in: path
required: true
schema:
type: string
format: uuid
- name: UserId
in: query
schema:
type: string
- name: TimeFilteringType
in: query
required: true
schema:
$ref: '#/components/schemas/TimeFilteringType'
- name: StartDate
in: query
schema:
type: string
format: date-time
- name: EndDate
in: query
schema:
type: string
format: date-time
- name: NextPageLink
in: query
schema:
type: string
- name: EntityName
in: query
schema:
type: string
- name: ResourceId
in: query
schema:
type: string
- name: ResourceName
in: query
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ApiResponseOfSignInLogsResultDto'
'400':
description: Bad request — validation or parameter binding failed.
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ApiProblemDetails'
'401':
description: Unauthorized — missing or invalid Bearer token.
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ApiProblemDetails'
'403':
description: Forbidden — insufficient scope or workspace access.
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ApiProblemDetails'
'404':
description: Not found — workspace or resource is missing.
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ApiProblemDetails'
'500':
description: Internal server error.
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ApiProblemDetails'
/api/v2/workspaces/{workspaceId}/investigation/users/directory-logs:
get:
tags:
- Investigation
summary: List directory logs
operationId: v2-list-directory-logs
parameters:
- name: workspaceId
in: path
required: true
schema:
type: string
format: uuid
- name: UserId
in: query
schema:
type: string
- name: TimeFilteringType
in: query
required: true
schema:
$ref: '#/components/schemas/TimeFilteringType'
- name: StartDate
in: query
schema:
type: string
format: date-time
- name: EndDate
in: query
schema:
type: string
format: date-time
- name: NextPageLink
in: query
schema:
type: string
- name: EntityName
in: query
schema:
type: string
- name: ResourceId
in: query
schema:
type: string
- name: ResourceName
in: query
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ApiResponseOfAuditLogsResultDto'
'400':
description: Bad request — validation or parameter binding failed.
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ApiProblemDetails'
'401':
description: Unauthorized — missing or invalid Bearer token.
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ApiProblemDetails'
'403':
description: Forbidden — insufficient scope or workspace access.
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ApiProblemDetails'
'404':
description: Not found — workspace or resource is missing.
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ApiProblemDetails'
'500':
description: Internal server error.
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ApiProblemDetails'
components:
schemas:
SignInLogsResultDto:
type: object
properties:
dataTable:
description: The user sign-in log data table.
$ref: '#/components/schemas/GeneralTableDto'
nextPageLink:
type:
- 'null'
- string
description: The link to load the next page of user sign-in logs.
message:
type:
- 'null'
- string
description: 'A consumer-neutral message describing why data could not be retrieved.
Present when bool SignInLogsResultDto.CanRetrieveData is `false`.'
canRetrieveData:
type: boolean
description: 'Indicates whether the handler was able to retrieve the requested data.
When `false`, callers should check string SignInLogsResultDto.Message for the reason
and avoid retrying the same request without addressing the underlying cause.'
ResponseMeta:
type: object
properties:
requestId:
type:
- 'null'
- string
timestamp:
type:
- 'null'
- string
ApiProblemDetails:
type: object
properties:
type:
type:
- 'null'
- string
title:
type:
- 'null'
- string
status:
pattern: ^-?(?:0|[1-9]\d*)$
type:
- 'null'
- integer
- string
format: int32
detail:
type:
- 'null'
- string
instance:
type:
- 'null'
- string
code:
type:
- 'null'
- string
requestId:
type:
- 'null'
- string
timestamp:
type:
- 'null'
- string
target:
type:
- 'null'
- string
errors:
type:
- 'null'
- object
additionalProperties:
type: array
items:
type: string
description: 'API extension of ProblemDetails that surfaces the stable error code,
trace identifier, timestamp, optional target, and optional field-keyed validation
error map alongside the RFC 7807 members.'
AuditLogItemDto:
type: object
properties:
date:
type: string
format: date-time
service:
type:
- 'null'
- string
activity:
type:
- 'null'
- string
category:
type:
- 'null'
- string
status:
type:
- 'null'
- string
statusReason:
type:
- 'null'
- string
targetResources:
type:
- 'null'
- array
items:
type: string
targets:
type:
- 'null'
- string
actor:
type:
- 'null'
- string
ApiResponseOfAuditLogsResultDto:
type: object
properties:
data:
$ref: '#/components/schemas/AuditLogsResultDto'
meta:
$ref: '#/components/schemas/ResponseMeta'
description: Standard v2 API response envelope for single-item responses.
GeneralTableDto:
type: object
properties:
columns:
type:
- 'null'
- array
items:
type: string
rows:
type:
- 'null'
- array
items:
type: array
TimeFilteringType:
enum:
- ThreeHours
- SixHours
- TwelveHours
- TwentyFourHours
- FortyEightHours
- Custom
- SevenDays
- ThirtyDays
- NinetyDays
- OneHundredEightyDays
- SixtyDays
- null
AuditLogsResultDto:
type: object
properties:
items:
type:
- 'null'
- array
items:
$ref: '#/components/schemas/AuditLogItemDto'
description: The user audit log items.
nextPageLink:
type:
- 'null'
- string
description: The link to load the next page of user audit logs.
message:
type:
- 'null'
- string
description: 'A consumer-neutral message describing why data could not be retrieved.
Present when bool AuditLogsResultDto.CanRetrieveData is `false`.'
canRetrieveData:
type: boolean
description: 'Indicates whether the handler was able to retrieve the requested data.
When `false`, callers should check string AuditLogsResultDto.Message for the reason
and avoid retrying the same request without addressing the underlying cause.'
ApiResponseOfSignInLogsResultDto:
type: object
properties:
data:
$ref: '#/components/schemas/SignInLogsResultDto'
meta:
$ref: '#/components/schemas/ResponseMeta'
description: Standard v2 API response envelope for single-item responses.