openapi: 3.2.0
info:
title: Cyware Orchestrate (CO) Open Integrations API
version: v1
description: 'Public Open API for Cyware Orchestrate, Cyware''s security orchestration, automation and response (SOAR) platform. The API covers playbooks (listing, running, run logs, node results, exports, bulk terminate), app integrations (apps, app actions, app instances, action execution, custom app import), source events, persistent lists (storage manager), code snippets, custom email templates, tags, analytics and connectivity/version checks, plus the inbound webhook endpoints used to push events into Orchestrate.
Orchestrate is deployed per tenant, so the server host is the customer''s own Orchestrate deployment; the API is mounted under `/soarapi`.
This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://orchestrateapi.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
contact:
name: Cyware
url: https://www.cyware.com/contact-us
termsOfService: https://www.cyware.com/legal/terms-of-use
x-apievangelist-source: https://orchestrateapi.cyware.com/llms.txt
x-apievangelist-method: generated
servers:
- url: https://{co_host}/soarapi
description: Tenant Orchestrate deployment. Replace {co_host} with your own Orchestrate host. Cyware uses https://demo.cyware.com/soar/ as the example host in the config of its open-source MCP server, and its docs reference the /soarapi base path.
variables:
co_host:
default: demo.cyware.com
security:
- coOpenApiSignature: []
tags:
- name: Integrations
description: Integrations
paths:
/v1/integrations/app-instances/:
post:
operationId: createAppInstance
summary: Create App Instance
tags:
- Integrations
description: Create an instance in a specific app.
externalDocs:
description: Cyware Orchestrate API reference
url: https://orchestrateapi.cyware.com/integrations/create-app-instance
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
is_default:
type: boolean
description: Pass true to set the instance as default.
examples:
- 'true'
title:
type: string
description: Paas a title for the app instance.
examples:
- Final Test
description:
type: string
description: Pass a description for the app instance.
examples:
- Slack test instance
app_unique_id:
type: string
description: Pass the unique ID of the app to create an instance. You can retrieve the unique IDs of apps using the **Get Apps** endpoint.
examples:
- a1027657-4e63-49d2-b3c9-e29949d02359
configuration:
type: object
description: Pass the necessary configurations to create an instance. The required parameters vary depending on the app.
version_slug:
type: string
description: 'Pass the version of the app to create an instance. For example, *1.0.0*.
You can retrieve the supported version using the **Get Apps** endpoint.'
examples:
- 1.0.0
expiry_date:
type: string
description: Pass the expiry date of the app instance in ISO format.
examples:
- '2025-01-01T00:00:00Z'
required:
- title
- app_unique_id
example:
is_default: 'true'
title: Final Test
description: Slack test instance
app_unique_id: a1027657-4e63-49d2-b3c9-e29949d02359
configuration: {}
version_slug: 1.0.0
expiry_date: '2025-01-01T00:00:00Z'
responses:
'201':
description: HTTP 201 response
content:
application/json:
schema:
type: object
properties:
app_unique_id:
type: string
description: Returns the unique ID of the app.
examples:
- a1027657-4e63-49d2-b3c9-e29949d02359
unique_id:
type: string
description: Returns the Unique ID of the instance.
examples:
- dcc1b286-b34f-4f87-a662-3ef45d4aefa9
created_at:
type: string
description: Returns the date and time when the instance was created.
examples:
- '2022-07-27T11:02:22.496Z'
modified_at:
type: string
description: Returns the date and time when the instance was last modified.
examples:
- '2022-07-27T11:02:22.496Z'
title:
type: string
description: Returns the title of the instance.
examples:
- Final Test
slug:
type: string
description: Returns the resource identifier of the instance.
examples:
- final_test
created_by:
type: string
description: Returns the user ID of the user who created the instance.
examples:
- bf62bdbe-c280-4882-b947-c750b31062fb
modified_by:
type: string
description: Returns the user ID of the user who last modified the instance.
examples:
- bf62bdbe-c280-4882-b947-c750b31062fb
is_default:
type: boolean
description: Returns if the instance is a default instance or not.
examples:
- 'true'
expiry_date:
type: string
description: Returns the expiry date of the instance.
examples:
- '2025-01-01T00:00:00Z'
description:
type: string
description: Returns the description of the instance.
examples:
- instance description
connectivity_status:
type: string
description: Returns the connectivity status, indicating either SUCCESS or FAIL.
examples:
- UNTESTED
connector_version:
type: string
description: Returns the version of the app.
examples:
- 2.2.2
configuration:
type: object
description: Returns the configuration details of the instance.
properties:
token:
type: string
description: Retrieves the instance's configuration parameters along with their corresponding values.
examples:
- '*******'
app_title:
type: string
description: Returns the title of the app instance.
examples:
- App
is_removed:
type: boolean
description: Indicates if the instance is deleted or not.
examples:
- 'false'
on_lite:
type: boolean
description: Indicates if the app instance is Cyware Agent compatible or not.
examples:
- 'false'
csol_lite_id:
type: string
description: Returns the Cyware Agent ID.
tested_by:
type: string
description: Returns the unique ID of the user who tested the instance.
connectivity_message:
type: string
description: Returns the message elaborating the connectivity status of the instance. For example, *Authentication successful*.
connectivity_detail:
type: string
description: Returns the details related to the connectivity of the instance.
status_code:
type: string
description: Returns the status code based on the status of the instance.
uploaded_file_data:
type: array
description: Returns the uploaded file data if a file is uploaded to create an instance.
items: {}
expiry_mail_sent:
type: boolean
description: Returns if the instance expiry email is sent to the users or not.
examples:
- 'false'
tested_by_data:
type: object
description: Returns the details of the user who tested the instance.
properties:
first_name:
type: string
description: Returns the first name of the user who tested the instance.
examples:
- 'John '
last_name:
type: string
description: Returns the last name of the user who tested the instance.
examples:
- Doe
created_by_data:
type: object
description: Returns the details of the user who created the instance.
properties:
unique_id:
type: string
description: Returns the unique ID of the user who created the instance.
examples:
- bf62bdbe-c280-4882-b947-c750b31062fb
first_name:
type: string
description: Returns the first name of the user who created the instance.
examples:
- Jon
last_name:
type: string
description: Returns the last name of the user who created the instance.
examples:
- Doe
full_name:
type: string
description: Returns the full name of the user who created the instance.
examples:
- Jon Doe
modified_by_data:
type: object
description: Returns the details of the user who last modified the instance.
properties:
unique_id:
type: string
description: Returns the unique ID of the user who last modified the instance.
examples:
- bf62bdbe-c280-4882-b947-c750b31062fb
first_name:
type: string
description: Returns the first name of the user who last modified the instance.
examples:
- Jon
last_name:
type: string
description: Returns the last name of the user who last modified the instance.
examples:
- Doe
full_name:
type: string
description: Returns the full name of the user who last modified the instance.
examples:
- Jon Doe
example:
app_unique_id: a1027657-4e63-49d2-b3c9-e29949d02359
unique_id: dcc1b286-b34f-4f87-a662-3ef45d4aefa9
created_at: '2022-07-27T11:02:22.496Z'
modified_at: '2022-07-27T11:02:22.496Z'
title: Final Test
slug: final_test
created_by: bf62bdbe-c280-4882-b947-c750b31062fb
modified_by: bf62bdbe-c280-4882-b947-c750b31062fb
is_default: 'true'
expiry_date: '2025-01-01T00:00:00Z'
description: instance description
connectivity_status: UNTESTED
connector_version: 2.2.2
configuration:
token: '*******'
app_title: App
is_removed: 'false'
on_lite: 'false'
csol_lite_id: null
tested_by: null
connectivity_message: null
connectivity_detail: null
status_code: null
uploaded_file_data: []
expiry_mail_sent: 'false'
tested_by_data:
first_name: 'John '
last_name: Doe
created_by_data:
unique_id: bf62bdbe-c280-4882-b947-c750b31062fb
first_name: Jon
last_name: Doe
full_name: Jon Doe
modified_by_data:
unique_id: bf62bdbe-c280-4882-b947-c750b31062fb
first_name: Jon
last_name: Doe
full_name: Jon Doe
get:
operationId: listAppInstances
summary: Get App Instances
tags:
- Integrations
description: Retrieves a list of available instances for all apps. To retrieve instances of a specific app, pass the unique ID of the app.
externalDocs:
description: Cyware Orchestrate API reference
url: https://orchestrateapi.cyware.com/integrations/list-app-instances
parameters:
- name: page
in: query
required: false
schema:
type: integer
description: Pass the page number to retrieve the app details.
default: '1'
examples:
- '1'
description: Pass the page number to retrieve the app details.
- name: page_size
in: query
required: false
schema:
type: integer
description: Pass the number of records to display per page.
default: '10'
examples:
- '10'
description: Pass the number of records to display per page.
- name: app_unique_id
in: query
required: false
schema:
type: string
description: "Pass the app unique ID to retrieve the instances of the app. You can retrieve the unique ID of an app using the **Get Apps** endpoint. \nIf the app ID is not passed, all available instances will be retrieved."
examples:
- e591047c-8879-4579-b2db-f6a1eae44c15
description: "Pass the app unique ID to retrieve the instances of the app. You can retrieve the unique ID of an app using the **Get Apps** endpoint. \nIf the app ID is not passed, all available instances will be retrieved."
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
results:
type: array
description: Returns details of an app instance.
items:
type: object
properties:
app_unique_id:
type: string
description: Returns the unique ID of the app.
examples:
- e591047c-8879-4579-b2db-f6a1eae44c15
unique_id:
type: string
description: Returns the unique ID of the instance.
examples:
- d6a03423-52fd-479b-a79d-85102e53861f
created_at:
type: string
description: Returns the date and time when the instance was created.
examples:
- '2021-06-30T20:52:29.968Z'
modified_at:
type: string
description: Returns the date and time when the instance was last modified.
examples:
- '2021-11-10T09:07:33.942Z'
title:
type: string
description: Returns the title of the instance.
examples:
- UAT
slug:
type: string
description: Returns resource identifier of the instance.
examples:
- uat_instance
created_by:
type: string
description: Returns the unique ID of the user who created the instance.
examples:
- 49c5781f-ed52-4e13-ad25-9deffdfba7a8
modified_by:
type: string
description: Returns the unique ID of the user who last modified the instance.
examples:
- 49c5781f-ed52-4e13-ad25-9deffdfba7a8
description:
type: string
description: Returns the description of the instance.
examples:
- new
tested_by:
type: string
description: Returns the name of the user who tested the instance.
examples:
- 49c5781f-ed52-4e13-ad25-9deffdfba7a8
tested_date:
type: string
description: Returns the date and time when the instance was tested.
examples:
- '2021-11-10T09:07:33.941Z'
connectivity_status:
type: string
description: Returns the connectivity status, indicating either SUCCESS or FAIL.
examples:
- SUCCESS
connectivity_message:
type: string
description: Returns the message elaborating the connectivity status. For example, *Authentication successful*.
examples:
- Connection test successful!
connector_version:
type: string
description: Returns the version of the app.
examples:
- 1.0.1
configuration:
type: object
description: Returns the details of the app instance configurations.
properties:
api_key:
type: string
description: Returns the details of the configurations.
examples:
- 061331ee8e0efb19dbf0c60d60e67597e91594185031b798dca24cff0810a24a
app_title:
type: string
description: Returns the title of the app associated with the instance.
examples:
- Virus Total Alpha
is_removed:
type: boolean
description: Returns if the instance is deleted or not.
examples:
- false
is_default:
type: boolean
description: Returns if the instance is a default instance or not.
examples:
- false
on_lite:
type: boolean
description: Indicates if the instance of the app is supported on the Agent.
examples:
- false
csol_lite_id:
type: string
description: Returns the Cyware Agent ID.
examples:
- e0011ab0-af8b-44c4-b3f1-ede9143b0507 A
connectivity_detail:
type: string
description: Returns the details of the test connectivity.
status_code:
type: string
description: Returns the status code based on the status of the instance.
uploaded_file_data:
type: array
description: Returns the file data if uploaded while creating the instance.
items: {}
expiry_mail_sent:
type: boolean
description: Returns if the instance expiry mail is sent or not.
examples:
- false
tested_by_data:
type: object
description: Returns the details of the user who tested the instance.
properties:
unique_id:
type: string
description: Returns the unique ID of the user who tested the instance.
examples:
- 49c5781f-ed52-4e13-ad25-9deffdfba7a8
first_name:
type: string
description: Returns the first name of the user who tested the instance.
examples:
- Bob
last_name:
type: string
description: Returns the last name of the user who tested the instance.
examples:
- David
full_name:
type: string
description: Returns the full name of the user who tested the instance.
examples:
- Bob David
created_by_data:
type: object
description: Returns the details of the user who created the instance.
properties:
unique_id:
type: string
description: Returns the unique ID of the user who created the instance.
examples:
- 49c5781f-ed52-4e13-ad25-9deffdfba7a8
first_name:
type: string
description: Returns the first name of the user who created the instance.
examples:
- Bob
last_name:
type: string
description: Returns the last name of the user who created the instance.
examples:
- David
full_name:
type: string
description: Returns the full name of the user who created the instance.
examples:
- Bob David
modified_by_data:
type: object
description: Returns the details of the user who last modified the instance.
properties:
unique_id:
type: string
description: Returns the unique ID of the user who last modified the instance.
examples:
- 49c5781f-ed52-4e13-ad25-9deffdfba7a8
first_name:
type: string
description: Returns the first name of the user who last modified the instance.
examples:
- Bob
last_name:
type: string
description: Returns the last name of the user who last modified the instance.
examples:
- David
full_name:
type: string
description: Returns the full name of the user who last modified the instance.
examples:
- Bob David
count:
type: number
description: Returns the total number of instances in the app.
examples:
- 1
link:
type: object
description: Returns the links for the previous and next pages.
properties:
next:
type: string
description: Returns the API endpoint to the previous page.
previous:
type: string
description: Returns the API endpoint to the next page.
example:
results:
- app_unique_id: e591047c-8879-4579-b2db-f6a1eae44c15
unique_id: d6a03423-52fd-479b-a79d-85102e53861f
created_at: '2021-06-30T20:52:29.968Z'
modified_at: '2021-11-10T09:07:33.942Z'
title: UAT
slug: uat_instance
created_by: 49c5781f-ed52-4e13-ad25-9deffdfba7a8
modified_by: 49c5781f-ed52-4e13-ad25-9deffdfba7a8
description: new
tested_by: 49c5781f-ed52-4e13-ad25-9deffdfba7a8
tested_date: '2021-11-10T09:07:33.941Z'
connectivity_status: SUCCESS
connectivity_message: Connection test successful!
connector_version: 1.0.1
configuration:
api_key: 061331ee8e0efb19dbf0c60d60e67597e91594185031b798dca24cff0810a24a
app_title: Virus Total Alpha
is_removed: false
is_default: false
on_lite: false
csol_lite_id: e0011ab0-af8b-44c4-b3f1-ede9143b0507 A
connectivity_detail: null
status_code: null
uploaded_file_data: []
expiry_mail_sent: false
tested_by_data:
unique_id: 49c5781f-ed52-4e13-ad25-9deffdfba7a8
first_name: Bob
last_name: David
full_name: Bob David
created_by_data:
unique_id: 49c5781f-ed52-4e13-ad25-9deffdfba7a8
first_name: Bob
last_name: David
full_name: Bob David
modified_by_data:
unique_id: 49c5781f-ed52-4e13-ad25-9deffdfba7a8
first_name: Bob
last_name: David
full_name: Bob David
count: 1
link:
next: null
previous: null
/v1/integrations/apps/download/{app_slug}/:
get:
operationId: downloadAppPackage
summary: Download App Package
tags:
- Integrations
description: Download the app's ZIP file by entering the app identifier. You can save the response as a ZIP file to your device.
externalDocs:
description: Cyware Orchestrate API reference
url: https://orchestrateapi.cyware.com/integrations/download-app-package
parameters:
- name: app_slug
in: path
required: true
schema:
type: string
description: 'Pass the app''s unique resource identifier to generate a downloadable response file.
Example: *abuse_ipdb_1_1_0*.
You can retrieve the app slug of an app using the **Get Apps** endpoint.'
examples:
- abuse_ipdb_1_1_0
description: 'Pass the app''s unique resource identifier to generate a downloadable response file.
Example: *abuse_ipdb_1_1_0*.
You can retrieve the app slug of an app using the **Get Apps** endpoint.'
responses:
'200':
description: This API endpoint has no response parameters. However, the result of this API can be saved as a ZIP file on your device.
content:
json:
schema:
type: object
properties:
raw:
type: string
examples:
- "PKconnector.py#!/usr/bin/env python\n\nimport requests\n\n\"\"\"\nDescription: Abuse IPDB API Integration.\nReference: https://docs.abuseipdb.com/#introduction\nAPI Version - V2\nAuthentication Type - API Token based normal Authentication\n\"\"\"\n\n\nclass AbuseIpdbConnector(object):\n \"\"\"\n an object which make request on your behalf\n \"\"\"\n def __init__(self, api_token, **kwargs):\n \"\"\"\n description: init function\n :param api_token: api token\n :param kwargs:\n \"\"\"\n api_version = \"v2\"\n url = \"https://api.abuseipdb.com/api\"\n self.base_url = \"{0}/{1}\".format(url, api_version)\n self.api_token = api_token\n\n def test_connection(self, **kwargs):\n \"\"\"\n description: test connection\n :param kwargs:\n :return:\n \"\"\"\n try:\n endpoint = self.base_url\n response = requests.request(\"GET\", endpoint)\n if response.status_code < 500:\n return True\n else:\n return False\n except KeyError:\n return False\n\n def action_check_ip_address(self, ip_address, detailed_report=False,\n get_report_since=30, **kwargs):\n \"\"\"\n description: check ip address(v4/v6) reputation\n :param ip_address: ip address\n :param detailed_report: Want to include Detailed Report or not in response,\n Default value is False.\n :param get_report_since: determines how far back in time want to go to fetch\n reports. Default is '30' Days, min: 1 day, max: 365 days\n :param kwargs:\n :return:\n \"\"\"\n endpoint = \"check\"\n query_string = {\n \"ipAddress\": ip_address,\n \"verbose\": detailed_report,\n \"maxAgeInDays\": get_report_since\n }\n response =
# --- truncated at 32 KB (218 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-integrations-api-openapi.yml