CybelAngel Alerts API

openapi: 3.2.0
info:
  version: 1.0.0
  title: References Alerts API
  description: 'API for CybelAngel''s Alerts.

    Authentication uses standard [OAuth2 Bearer Tokens](https://tools.ietf.org/html/rfc6750).


    Here is a simple example of how to fetch such a token with curl:


    ```shell

    curl -X POST https://auth.cybelangel.com/oauth/token -H ''content-type: application/json -d ''{"client_id": "client_id", "client_secret": "client_secret", "audience": "https://platform.cybelangel.com/", "grant_type": "client_credentials"}

    ```


    The received access token can then be used as a Bearer token to request our API.'
  contact:
    email: support@cybelangel.com
  license:
    url: https://cybelangel.com/
    name: Proprietary
servers:
- url: https://api.cybelangel.com
tags:
- name: alerts
  description: Alerts
paths:
  /v1/alerts:
    get:
      tags:
      - alerts
      summary: Search alerts
      description: 'Search alerts according to user filters.<br/><br/>Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.<br/>Requests for data outside of this range will not return any results.'
      operationId: alerts_search_alerts_alerts_get
      parameters:
      - name: cursor
        in: query
        description: 'Set it to the the ''cursor'' value received from previous search request to iterate on the following alerts, beyond the limit set per request.

          Searching from a cursor does not impact the total number of results.

          Behavior is undefined if the filters and sort are changed between successive requests.


          Note: with big datasets, iterating on cursor can be much slower than iterating on ''start_date'' filter.'
        required: false
        schema:
          title: Cursor
          description: 'Set it to the the ''cursor'' value received from previous search request to iterate on the following alerts, beyond the limit set per request.

            Searching from a cursor does not impact the total number of results.

            Behavior is undefined if the filters and sort are changed between successive requests.


            Note: with big datasets, iterating on cursor can be much slower than iterating on ''start_date'' filter.'
          anyOf:
          - type: string
      - name: order_by
        in: query
        description: 'Can be multiple fields with +/- for ascending/descending sort.

          Fields can be ingestion_date, detection_date, ml_score.'
        required: false
        schema:
          type: array
          title: Order By
          description: 'Can be multiple fields with +/- for ascending/descending sort.

            Fields can be ingestion_date, detection_date, ml_score.'
          default:
          - +ingestion_date
          - +detection_date
          items:
            type: string
            pattern: '[+-]?(ingestion_date|detection_date|ml_score)'
            minLength: 1
      - name: stream_id
        in: query
        description: 'Stream id used to filter alerts belonging to some organization.

          A client can only query alerts for its allowed streams.'
        required: true
        schema:
          type: string
          title: Stream Id
          description: 'Stream id used to filter alerts belonging to some organization.

            A client can only query alerts for its allowed streams.'
          minLength: 1
          examples:
          - 90b18fad-b9ca-41db-bae1-b4964c1a4e84
        examples:
          default:
            value: 90b18fad-b9ca-41db-bae1-b4964c1a4e84
      - name: start_date
        in: query
        description: 'Minimal ingestion date. Expects a date with timezone information.


          Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.

          Requests for data outside of this range will not return any results.'
        required: true
        schema:
          type: string
          title: Start Date
          description: 'Minimal ingestion date. Expects a date with timezone information.


            Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.

            Requests for data outside of this range will not return any results.'
          format: date-time
          examples:
          - '2024-09-01T10:00:00.000Z'
        examples:
          default:
            value: '2024-09-01T10:00:00.000Z'
      - name: end_date
        in: query
        description: 'Maximal ingestion date. Expects a date with timezone information.


          Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.

          Requests for data outside of this range will not return any results.'
        required: false
        schema:
          title: End Date
          description: 'Maximal ingestion date. Expects a date with timezone information.


            Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.

            Requests for data outside of this range will not return any results.'
          anyOf:
          - type: string
            format: date-time
      - name: status
        in: query
        description: 'Select only alerts having one of the requested statuses.

          By default selects only ''new'' alerts to exclude alerts automatically discarded by our ML tools or already processed by analysts.'
        required: false
        schema:
          type: array
          title: Status
          description: 'Select only alerts having one of the requested statuses.

            By default selects only ''new'' alerts to exclude alerts automatically discarded by our ML tools or already processed by analysts.'
          default:
          - new
          items:
            $ref: '#/components/schemas/AlertStatus'
      - name: category
        in: query
        description: If set, select alerts with specified categories.
        required: false
        schema:
          type: array
          title: Category
          description: If set, select alerts with specified categories.
          default: []
          items:
            $ref: '#/components/schemas/AlertCategory'
      - name: customer_assessment
        in: query
        description: 'If set, select only alerts having one of the requested customer assessments.

          This is the **customer.assessment** field that may be set by clients using the API.'
        required: false
        schema:
          type: array
          title: Customer Assessment
          description: 'If set, select only alerts having one of the requested customer assessments.

            This is the **customer.assessment** field that may be set by clients using the API.'
          default: []
          items:
            $ref: '#/components/schemas/CustomerAssessment'
      - name: keyword
        in: query
        description: If set, select alerts matching specified keywords aliases.
        required: false
        schema:
          type: array
          title: Keyword
          description: If set, select alerts matching specified keywords aliases.
          default: []
          items:
            type: string
            minLength: 1
      - name: keyword_id
        in: query
        description: If set, select alerts matching specified keyword identifiers.
        required: false
        schema:
          type: array
          title: Keyword Id
          description: If set, select alerts matching specified keyword identifiers.
          default: []
          items:
            type: string
            minLength: 1
      - name: min_ml_score
        in: query
        description: If set, select alerts with equal or higher 'ml.score'.
        required: false
        schema:
          type: integer
          title: Min Ml Score
          description: If set, select alerts with equal or higher 'ml.score'.
          minimum: 0
          maximum: 100
          default: 0
      - name: hostname
        in: query
        description: If set, select alerts with any specified hostname value.
        required: false
        schema:
          type: array
          title: Hostname
          description: If set, select alerts with any specified hostname value.
          default: []
          items:
            type: string
            minLength: 1
      - name: ip
        in: query
        description: If set, select alerts with specified IP address among 'ip', 'server_ip' or 'victim_ip' fields.
        required: false
        schema:
          type: array
          title: Ip
          description: If set, select alerts with specified IP address among 'ip', 'server_ip' or 'victim_ip' fields.
          default: []
          items:
            type: string
            minLength: 1
      - name: search_query
        in: query
        description: Words to search in alerts text fields.
        required: false
        schema:
          title: Search Query
          description: Words to search in alerts text fields.
          anyOf:
          - type: string
            minLength: 1
      - name: limit
        in: query
        description: Max number of returned alerts. Increasing it will also increase the payload.
        required: false
        schema:
          type: integer
          title: Limit
          description: Max number of returned alerts. Increasing it will also increase the payload.
          minimum: 0
          maximum: 1000
          default: 10
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertList'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ValidationError_'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_UnknownError_'
      security:
      - jwt: []
      servers:
      - url: https://api.cybelangel.com
  /v1/alerts/{alert_id}:
    get:
      tags:
      - alerts
      summary: Get an alert
      description: 'Get an alert by its unique id.<br/><br/>Note: Historical data is only available starting from January 1, 2024, and is retained for a maximum of 12 months.<br/>Requests for data outside of this range will not return any results.'
      operationId: alerts_search_an_alert_alerts__alert_id__get
      parameters:
      - name: alert_id
        in: path
        description: ID of an alert.
        required: true
        schema:
          type: string
          title: Alert Id
          description: ID of an alert.
          minLength: 1
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicAlert'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ValidationError_'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_UnknownError_'
      security:
      - jwt: []
      servers:
      - url: https://api.cybelangel.com
  /v1/alerts/{alert_id}/customer:
    patch:
      tags:
      - alerts
      summary: Set customer fields
      description: Allow to edit customer-maintained fields in an alert published by the API.<br/><br/>The only use now is to assess the alerts.<br/>These assessments may then be used by CybelAngel to improve the alerts automated filtering.
      operationId: alerts_patch_an_alert_alerts__alert_id__customer_patch
      parameters:
      - name: alert_id
        in: path
        description: ID of an alert.
        required: true
        schema:
          type: string
          title: Alert Id
          description: ID of an alert.
          minLength: 1
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AlertRequestCustomerFieldsPatch'
      responses:
        '204':
          description: No Content
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ValidationError_'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_UnknownError_'
      security:
      - jwt: []
      servers:
      - url: https://api.cybelangel.com
  /v1/alerts/{alert_id}/credentials:
    get:
      tags:
      - alerts
      summary: Get leak alert credentials (deprecated)
      description: This endpoint is deprecated and will be removed in a future release.<br/>Use /v1/alerts/<alert_id>/leak-credentials instead.
      operationId: alerts_get_alert_credentials_deprecated_alerts__alert_id__credentials_get
      parameters:
      - name: alert_id
        in: path
        description: ID of an alert.
        required: true
        schema:
          type: string
          title: Alert Id
          description: ID of an alert.
          minLength: 1
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialsResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ValidationError_'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
        '410':
          description: Gone
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_GoneError_'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_UnknownError_'
      deprecated: true
      security:
      - jwt: []
      servers:
      - url: https://api.cybelangel.com
  /v1/alerts/{alert_id}/leak-credentials:
    get:
      tags:
      - alerts
      summary: Get leak alert credentials
      description: Get credentials associated with an alert.
      operationId: alerts_get_alert_credentials_alerts__alert_id__leak_credentials_get
      parameters:
      - name: alert_id
        in: path
        description: ID of an alert.
        required: true
        schema:
          type: string
          title: Alert Id
          description: ID of an alert.
          minLength: 1
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialsResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ValidationError_'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_UnknownError_'
      security:
      - jwt: []
      servers:
      - url: https://api.cybelangel.com
  /v1/alerts/{alert_id}/codeshare-findings:
    get:
      tags:
      - alerts
      summary: Get codeshare alert findings
      description: 'Get sensitive code snippets for a codeshare alert.<br/><br/>Note: downloading hundreds of thousands of findings may take a few dozen seconds.'
      operationId: alerts_get_codeshare_findings_alerts__alert_id__codeshare_findings_get
      parameters:
      - name: alert_id
        in: path
        description: ID of an alert.
        required: true
        schema:
          type: string
          title: Alert Id
          description: ID of an alert.
          minLength: 1
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FindingsResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ValidationError_'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_UnknownError_'
      security:
      - jwt: []
      servers:
      - url: https://api.cybelangel.com
  /v1/alerts/{alert_id}/dns-screenshot:
    get:
      tags:
      - alerts
      summary: Get DNS alert screenshot.
      description: Get the website screenshot associated with a DNS alert.<br/><br/>If a screenshot is present, it is returned as a PNG file.<br/>If no screenshot was taken for the alert, a 204 NO_CONTENT is returned.<br/>If the alert is older than 180 days a GONE response is returned.
      operationId: alerts_get_alert_dns_screenshot_alerts__alert_id__dns_screenshot_get
      parameters:
      - name: alert_id
        in: path
        description: ID of an alert.
        required: true
        schema:
          type: string
          title: Alert Id
          description: ID of an alert.
          minLength: 1
      responses:
        '200':
          description: OK
          content:
            image/png:
              schema:
                type: string
                contentMediaType: application/octet-stream
        '204':
          description: No Content
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ValidationError_'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
        '410':
          description: Gone
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_GoneError_'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_UnknownError_'
      security:
      - jwt: []
      servers:
      - url: https://api.cybelangel.com
  /v1/leak-credentials:
    get:
      tags:
      - alerts
      summary: Get leak credentials
      description: Get leak credentials we collected.
      operationId: alerts_get_leak_credentials_leak_credentials_get
      parameters:
      - name: stream_id
        in: query
        description: 'Stream id used to filter alerts belonging to some organization.

          A client can only query alerts for its allowed streams.'
        required: true
        schema:
          type: string
          title: Stream Id
          description: 'Stream id used to filter alerts belonging to some organization.

            A client can only query alerts for its allowed streams.'
          minLength: 1
          examples:
          - 90b18fad-b9ca-41db-bae1-b4964c1a4e84
        examples:
          default:
            value: 90b18fad-b9ca-41db-bae1-b4964c1a4e84
      - name: start_date
        in: query
        description: Minimal ingestion date. Expects a date with timezone information.
        required: true
        schema:
          type: string
          title: Start Date
          description: Minimal ingestion date. Expects a date with timezone information.
          format: date-time
          examples:
          - '2024-09-01T10:00:00.000Z'
        examples:
          default:
            value: '2024-09-01T10:00:00.000Z'
      - name: end_date
        in: query
        description: Maximal ingestion date. Expects a date with timezone information.
        required: false
        schema:
          title: End Date
          description: Maximal ingestion date. Expects a date with timezone information.
          anyOf:
          - type: string
            format: date-time
      - name: match
        in: query
        description: Words to search in credentials logins and targets.
        required: false
        schema:
          title: Match
          description: Words to search in credentials logins and targets.
          anyOf:
          - type: string
            minLength: 1
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CredentialsResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ValidationError_'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
        '410':
          description: Gone
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_GoneError_'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorResponse_UnknownError_'
      security:
      - jwt: []
      servers:
      - url: https://api.cybelangel.com
components:
  schemas:
    Source:
      type: string
      enum:
      - onedrive
      - googledrive
      - dropbox
      title: Source
      description: Cloud drive source type.
    Docshare:
      type: object
      title: Docshare
      description: Potential document leak on a public document sharing platform like Scribd, Trello, Prezi, Slideshare...
      properties:
        author:
          title: Author
          description: Some identifier of the document author on the source platform. Could be a login, an email or not provided at all.
          examples:
          - ydningrm78
          anyOf:
          - type: string
        title:
          title: Title
          description: Title of the shared document, if present in the source.
          examples:
          - Company Security deep dive
          anyOf:
          - type: string
        context:
          type: string
          title: Context
          description: 'First few lines of the shared document.

            It is also limited to a few thousand characters from the start of the document.'
          examples:
          - "\n        FOR INTERNAL USE ONLY!\n        Our company security policy\n        1/ Passwords\n        2/ BYOD\n        3/ Office rules\n        "
        document_date:
          type: string
          title: Document Date
          description: Date on which the document was shared on the source platform.
          format: date-time
          examples:
          - '2024-09-16T00:00:00Z'
        source:
          type: string
          title: Source
          description: 'Name of the platform on which the document was shared.

            It can be a well-known website name like ''scribd'' or ''prezi'', or any domain name.'
          examples:
          - scribd
        url:
          type: string
          title: Url
          description: URL of the shared document at the time it was detected. It may no longer be valid.
          examples:
          - https://www.scribd.com/document/4976346763/Company-Policy
      required:
      - context
      - document_date
      - source
      - url
    NotFoundError:
      type: object
      title: NotFoundError
      description: Nothing matches the given URI
      properties:
        message:
          type: string
          title: Message
      required:
      - message
    DBProtocol:
      type: string
      enum:
      - elasticsearch
      - mongo
      - sql
      - pgsql
      title: DBProtocol
      description: Different kind of databases.
    APIErrorResponse_NotFoundError_:
      type: object
      title: APIErrorResponse[NotFoundError]
      properties:
        error:
          $ref: '#/components/schemas/NotFoundError'
      required:
      - error
    Board:
      type: object
      title: Board
      description: Message board (or internet forum) post that was matched by a keyword.
      properties:
        source:
          type: string
          title: Source
          description: Message board platform where we found the post.
          examples:
          - administrator.example.co.uk
        board:
          type: string
          title: Board
          description: Name of the message board on the platform.
          examples:
          - forum
        title:
          type: string
          title: Title
          description: Tile of the post or its thread on the platform.
          examples:
          - AD - Give ownership of computer object
        url:
          type: string
          title: Url
          description: URL to the message board post.
          examples:
          - https://administrator.example.co.uk/forum/ad-give-ownership-of-computer-object-465997.html
        context:
          type: string
          title: Context
          description: 'First few lines of the message board post.

            It is also limited to a few thousand characters from the start of the document.'
          examples:
          - 'AD - give ownership of computer object

            Hi, do any of you have the time or desire to recreate the following? (It''s NOT about taking ownership, it''s about relinquishing ownership.) An AD user UserA is not a member of the Organization Admins, Domain Admins, or BuiltIn Admins. This user is the owner of a computer object. UserA also has full access to this object. UserA is trying to change the owner of this computer object. No matter which user or group he specifies: the error occurs: The new owner of COMPUTER1 cannot be set up. This security identifier cannot be assigned as the owner of the object. An admin change the owner of this object to UserB. UserA can then successfully change the owner of this computer object and enter other third parties there. And it repeats. But as soon as UserA registers himself as the owner again, he can no longer change the owner. The above error occurs again. Now I''m on the fence. An owner of the ACL cannot enter another owner? Huh, did I miss something? That would be new to me... If someone could recreate that, that would be really great. E'
      required:
      - source
      - board
      - title
      - url
      - context
    Database:
      type: object
      title: Database
      description: Potential confidential data matching the keywords was found on a publicly exposed database server.
      properties:
        city:
          title: City
          description: English name of the city where the database server is located.
          examples:
          - Paris
          anyOf:
          - type: string
        country:
          title: Country
          description: English name of the country where the database is located.
          examples:
          - France
          anyOf:
          - type: string
        country_code:
          title: Country Code
          description: ISO 3166-1 alpha-2 code of the country where the database server is located.
          examples:
          - FR
          anyOf:
          - type: string
        database:
          type: string
          title: Database
          description: Name of the main database with matching data on the server.
          examples:
          - admin_cluster
        databases_count:
          type: integer
          title: Databases Count
          description: Number of database with matching data found on the server.
          default: 1
        ip:
          title: Ip
          description: 'IP address of the publicly accessible database.

            Not set when the server is a cloud provider (AWS, Azure...) and thus has no consistent ip.'
          examples:
          - 203.0.113.73
          anyOf:
          - type: string
            format: ipvanyaddress
        port:
          type: integer
          title: Port
          description: Public database server port, used to check its content.
          examples:
          - 27017
        protocol:
          $ref: '#/components/schemas/DBProtocol'
          description: Public database server protocol.
        reverse_hostname:
          type: string
          title: Reverse Hostname
          description: Publicly accessible database server reverse hostname.
          examples:
          - vm123465.example.fr
      required:
      - database
      - port
      - protocol
      - reverse_hostname
    AccountType:
      type: string
      enum:
      - User
      - Organization
      title: AccountType
      description: Type of account on a code sharing platform.
    AlertStatus:
      type: string
      enum:
      - new
      - autodiscarded
      - discarded
      - interesting
      - forwarded
      - report_sent
      title: AlertStatus
      description: Status of alerts, set by cybelangel automated systems and analysts.
    Match:
      type: object
      title: Match
      description: Match of a keyword linking this alert to the user stream.
      properties:
        source:
          type: string
          title: Source
          description: Indicates the technical 

# --- truncated at 32 KB (78 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cybelangel/refs/heads/main/openapi/cybelangel-alerts-api-openapi.yml