openapi: 3.2.0
info:
title: Cyware Orchestrate (CO) Open Playbooks API
version: v1
description: 'Public Open API for Cyware Orchestrate, Cyware''s security orchestration, automation and response (SOAR) platform. The API covers playbooks (listing, running, run logs, node results, exports, bulk terminate), app integrations (apps, app actions, app instances, action execution, custom app import), source events, persistent lists (storage manager), code snippets, custom email templates, tags, analytics and connectivity/version checks, plus the inbound webhook endpoints used to push events into Orchestrate.
Orchestrate is deployed per tenant, so the server host is the customer''s own Orchestrate deployment; the API is mounted under `/soarapi`.
This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://orchestrateapi.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
contact:
name: Cyware
url: https://www.cyware.com/contact-us
termsOfService: https://www.cyware.com/legal/terms-of-use
x-apievangelist-source: https://orchestrateapi.cyware.com/llms.txt
x-apievangelist-method: generated
servers:
- url: https://{co_host}/soarapi
description: Tenant Orchestrate deployment. Replace {co_host} with your own Orchestrate host. Cyware uses https://demo.cyware.com/soar/ as the example host in the config of its open-source MCP server, and its docs reference the /soarapi base path.
variables:
co_host:
default: demo.cyware.com
security:
- coOpenApiSignature: []
tags:
- name: Playbooks
description: Playbooks
paths:
/v1/playbook/playbook-result/bulk-terminate/:
post:
operationId: bulkTerminateApiView
summary: Bulk Terminate Playbook Runs
tags:
- Playbooks
description: Terminate playbook runs in bulk. You can terminate a maximum of 100 playbook runs at a time with the run status in progress, in-queue, waiting, or on hold.
externalDocs:
description: Cyware Orchestrate API reference
url: https://orchestrateapi.cyware.com/playbook/bulk-terminate-api-view
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
playbook_result_unique_ids:
type: array
description: Pass the unique IDs of the playbook runs in a list. You can retrieve the unique IDs of playbook results using the **Get Playbook Run Logs** endpoint.
items:
type: string
description: Unique ID of the playbook run log 1.
examples:
- 74a0249e-d460-4b72-93c3-be8452f1c85e
required:
- playbook_result_unique_ids
example:
playbook_result_unique_ids:
- 74a0249e-d460-4b72-93c3-be8452f1c85e
responses:
'200':
description: There are no response parameters. A successful task execution returns a response with a status code of 200 OK.
/v1/playbook/export/{playbook_unique_id}/:
get:
operationId: exportPlaybook
summary: Export Playbook
tags:
- Playbooks
description: Returns the export of a playbook in JSON format.
externalDocs:
description: Cyware Orchestrate API reference
url: https://orchestrateapi.cyware.com/playbook/export-playbook
parameters:
- name: AccessID
in: query
required: false
schema:
type: string
description: The Access ID is used to authenticate the Cyware Orchestrate API endpoint.
examples:
- 57d008c4-xxxx-4880-xxxx-1feb943d06ac,
description: The Access ID is used to authenticate the Cyware Orchestrate API endpoint.
- name: Expires
in: query
required: false
schema:
type: string
description: This parameter is used to define an expiry time for the API call.
examples:
- 72a48f16-xxxx-4023-xxxx-40f8e58d1f41
description: This parameter is used to define an expiry time for the API call.
- name: Signature
in: query
required: false
schema:
type: string
description: The Signature is used to authenticate the Cyware Orchestrate API endpoint.
examples:
- ohaUEcyA8hH3WPUo7Y/QOf+zWY0=
description: The Signature is used to authenticate the Cyware Orchestrate API endpoint.
- name: playbook_unique_id
in: path
required: true
schema:
type: string
description: Pass the unique ID of the playbook to export. You can retrieve the unique ID of a playbook using the **Get Playbooks** endpoint.
examples:
- '{playbook_unique_id}'
description: Pass the unique ID of the playbook to export. You can retrieve the unique ID of a playbook using the **Get Playbooks** endpoint.
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
title:
type: string
description: Returns the title of the playbook.
examples:
- Playbook- IP Malicious
start_node:
type: string
description: Returns the label of the playbook's start node.
examples:
- start
nodes:
type: object
description: Returns node details as key-value pairs, where each key represents a unique node identifier, for example, 1, and the corresponding value contains the node's attributes.
properties:
'1':
type: object
properties:
type:
type: string
description: Returns the type of the node.
examples:
- REGULAR
internal_id:
type: string
description: Returns the node number in the playbook.
examples:
- '1'
title:
type: string
description: Returns the title of the node.
examples:
- AbuseIPDB - Get IP Address Reputation Details - Version 1.0.0
description:
type: object
description: Returns the description of the node.
actions:
type: array
description: Returns details of the action such as action name, input data, action type, and more.
items:
type: object
properties:
action:
type: string
description: Returns the name of the action node.
examples:
- check_ip_address
parameter_data_source:
type: object
description: Returns the input data passed for the action node.
properties:
loop_keys:
type: array
description: Returns true if the input value is set to iterate the node execution over a list of input values.
items: {}
ip_address:
type: string
description: Input value passed to the node.
examples:
- 1.1.1.1
action_type:
type: string
description: 'Returns the type of the action node. Example: *PREDEFINED*.'
examples:
- PREDEFINED
app_instances:
type: array
description: Returns the list of selected instances for the app to run the playbook.
items:
type: string
description: Name of the instance used to execute the playbook.
examples:
- test_instance
action_data:
type: object
description: Returns action details, such as the app name, version, selected action, and more.
properties:
action_identifier:
type: string
description: Returns the unique identifier of the action.
examples:
- check_ip_address
app:
type: string
description: Returns the app name associated with the action.
examples:
- abuse_ipdb
app_slug:
type: string
description: Returns the resource identifier of the app.
examples:
- abuse_ipdb_1_0_0
app_version:
type: string
description: Returns the version of the app used in the playbook.
examples:
- 1.0.0
app_title:
type: string
description: Returns the title of the app associated with the action.
examples:
- AbuseIPDB
action_title:
type: string
description: Returns the title of the action.
examples:
- Get IP Address Reputation Details
is_system:
type: boolean
description: Indicates if the app is a system app or custom app.
examples:
- true
output_params:
type: object
description: Returns the node's output parameters if the save node output option is enabled.
save_customized_result:
type: boolean
description: Returns true to save the customized result of the node, else returns false.
examples:
- false
run_async:
type: boolean
description: Returns true to run the node synchronously, else returns false.
examples:
- false
action_run_attempt:
type: number
description: Returns the number of times the action was rerun by the Cyware agent.
examples:
- 1
action_run_buffer_time:
type: number
description: Returns buffer time set for the Cyware agent to rerun the action.
examples:
- 1
save_result:
type: boolean
description: Returns true to save the output of the node, else returns false.
examples:
- true
conditions:
type: array
description: Returns the conditions configured to execute the playbook.
items: {}
extra_params:
type: object
description: Returns the details of the node position and validation.
properties:
position:
type: object
description: Returns the details of the x and y axis of a node in the playbook canvas.
properties:
x:
type: number
description: Returns the position of the x axis on the canvas.
examples:
- 280
y:
type: number
description: Returns the position of the y axis on the canvas.
examples:
- 260
validations:
type: object
description: Returns whether the playbook execution was successful or if any validation errors were encountered during execution.
properties:
is_not_valid:
type: boolean
description: Returns whether the playbook execution was successful or not.
examples:
- false
io_params_format:
type: object
description: Returns a dictionary containing information about the input details of a node.
stop_on_error:
type: boolean
description: Returns true if the abort playbook if the node fails is enabled; otherwise, returns false.
examples:
- true
memory_params:
type: object
description: Returns the configurations of the memory node.
sub_type:
type: string
description: Returns the sub-type of the node.
enum:
- PREDEFINED
- CUSTOM
- PLAYBOOK
- EXPRESSION_BASED
- STORAGE
- START
examples:
- PREDEFINED
condition_type:
type: object
description: Returns the condition type of the node.
io_params_email_details:
type: object
description: Returns the information related to the email such as the body of the email and subject.
enable_io_param_email_details:
type: boolean
description: Returns whether email notifications are enabled and if the details are configured or not.
examples:
- false
enable_app_notification:
type: boolean
description: Returns if the email notifications through the platform and mobile app are enabled or not.
examples:
- false
edges:
type: array
description: Returns the details of the node connection.
items:
type: object
properties:
source_node:
type: string
description: Returns the name of the source node.
examples:
- start
destination_node:
type: string
description: Returns the node number of the destination.
examples:
- '3'
label:
type: string
description: Returns labels associated with conditions and their connections.
examples:
- DEFAULT_LABEL
labels:
type: array
description: Returns the list of labels added to the playbook.
items: {}
tags:
type: array
description: Returns the list of tags added to the playbook.
items: {}
status:
type: string
description: Returns the playbook run status.
examples:
- ACTIVE
cron_expression:
type: object
description: Returns the cron string used for scheduling the playbook.
output_params:
type: object
description: Returns the output parameters as a JSON list of key-value pairs.
is_runnable:
type: boolean
description: Returns true if it is a Cyware playbook, and returns false if it is a custom playbook.
examples:
- true
description:
type: object
description: Returns the description of the playbook.
auto_terminate:
type: boolean
description: Returns true if the auto-termination of the playbook is enabled, else false.
examples:
- false
auto_terminate_interval:
type: object
description: Returns the time interval to auto-terminate the playbook if it's UNFINISHED.
categories:
type: array
description: Returns the category of the playbook in Orchestrate > Manage Playbooks > Playbook Store. These categories are assigned to the default playbooks provided by Orchestrate.
items: {}
schedule_info:
type: object
description: Returns the details of the playbook schedule.
properties:
details:
type: object
description: Returns schedule details such as end time, mode, and more in key-value pairs.
properties:
ends:
type: string
description: Returns the end time for the playbook's schedule.
examples:
- never
mode:
type: string
description: Returns the frequency set for the playbook execution.
examples:
- once
end_value:
type: boolean
description: Returns if the end value was configured or not.
examples:
- true
repeat_on:
type: array
description: Returns the scheduled days specified for the playbook's execution.
items: {}
run_count:
type: number
description: Returns the number of times the playbook has been executed.
start_time:
type: string
description: Returns the date and time when the playbook execution was initiated.
examples:
- '2022-04-14T06:51:02.891Z'
is_scheduled:
type: boolean
description: Returns if the playbook execution is scheduled or not.
examples:
- false
example:
title: Playbook- IP Malicious
start_node: start
nodes:
'1':
type: REGULAR
internal_id: '1'
title: AbuseIPDB - Get IP Address Reputation Details - Version 1.0.0
description: {}
actions:
- action: check_ip_address
parameter_data_source:
loop_keys: []
ip_address: 1.1.1.1
action_type: PREDEFINED
app_instances:
- test_instance
action_data:
action_identifier: check_ip_address
app: abuse_ipdb
app_slug: abuse_ipdb_1_0_0
app_version: 1.0.0
app_title: AbuseIPDB
action_title: Get IP Address Reputation Details
is_system: true
output_params: {}
save_customized_result: false
run_async: false
action_run_attempt: 1
action_run_buffer_time: 1
save_result: true
conditions: []
extra_params:
position:
x: 280
y: 260
validations:
is_not_valid: false
io_params_format: {}
stop_on_error: true
memory_params: {}
sub_type: PREDEFINED
condition_type: {}
io_params_email_details: {}
enable_io_param_email_details: false
enable_app_notification: false
edges:
- source_node: start
destination_node: '3'
label: DEFAULT_LABEL
labels: []
tags: []
status: ACTIVE
cron_expression: {}
output_params: {}
is_runnable: true
description: {}
auto_terminate: false
auto_terminate_interval: {}
categories: []
schedule_info:
details:
ends: never
mode: once
end_value: true
repeat_on: []
run_count: null
start_time: '2022-04-14T06:51:02.891Z'
is_scheduled: false
/v1/playbook/node-results/{node_unique_id}/:
get:
operationId: getNodeResultDetails
summary: Get Node Result Details
tags:
- Playbooks
description: Returns the details of a specific node.
externalDocs:
description: Cyware Orchestrate API reference
url: https://orchestrateapi.cyware.com/playbook/get-node-result-details
parameters:
- name: node_unique_id
in: path
required: true
schema:
type: string
description: Pass the unique ID of the node. You can retrieve the unique ID of a node using the **Get Playbook Run Log Details** endpoint.
examples:
- 958fcb71-8bcd-41a5-9019-25e82ec96379
description: Pass the unique ID of the node. You can retrieve the unique ID of a node using the **Get Playbook Run Log Details** endpoint.
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
unique_id:
type: string
description: Returns the unique ID of the node result.
examples:
- 958fcb71-8bcd-41a5-9019-25e82ec96379
created:
type: string
description: Returns the date and time when the node was created.
examples:
- '2025-02-11T09:40:42.254810Z'
modified:
type: string
description: Returns the date and time when the node was last modified.
examples:
- '2025-02-11T09:40:42.459133Z'
status:
type: string
description: Returns the status of the node run.
examples:
- SUCCESS
execution_time:
type: number
description: Returns the execution time of the node in seconds.
examples:
- 0.204323
node_data:
type: object
description: Returns the details of the node.
properties:
type:
type: string
description: Returns the type of the node. For example, *START*.
examples:
- START
internal_id:
type: string
description: Returns the internal ID of the node.
examples:
- start
title:
type: string
description: Returns the title of the node.
examples:
- Start
unique_id:
type: string
description: Returns the unique ID of the node.
examples:
- 692b1154-2f1b-4a07-b742-578b546ef8b8
is_removed:
type: boolean
description: Returns if the node is deleted or not.
examples:
- false
io_params_format:
type: object
description: Returns the input parameter template details of the input node.
sub_type:
type: string
description: Returns the subtype of the node. For example, PREDEFINED.
enum:
- PREDEFINED
- CUSTOM
- PLAYBOOK
- EXPRESSION_BASED
- STORAGE
- start
examples:
- start
result:
type: object
description: Returns the link to the previous and next page.
initial_params:
type: object
description: Returns the input values of a node as key-value pairs in JSON format.
error:
type: object
description: Returns the error that occurred during node execution.
io_params:
type: object
description: Returns the input data passed to the node.
io_approved_by:
type: string
description: Returns the unique ID of the user who entered input for the node.
io_approved_by_data:
type: string
description: Returns the details of the user who provided the input. The details include `unique_id`, `first_name`, `last_name`, and `full_name`.
splitted_columns:
type: array
description: 'Returns the following values from a playbook result and node result that exceed 4 MB
- Input Values (`initial_params`)
- Output Values (`result`)'
items: {}
example:
unique_id: 958fcb71-8bcd-41a5-9019-25e82ec96379
created: '2025-02-11T09:40:42.254810Z'
modified: '2025-02-11T09:40:42.459133Z'
status: SUCCESS
execution_time: 0.204323
node_data:
type: START
internal_id: start
title: Start
unique_id: 692b1154-2f1b-4a07-b742-578b546ef8b8
is_removed: false
io_params_format: {}
sub_type: start
result: {}
initial_params: {}
error: {}
io_params: {}
io_approved_by: null
io_approved_by_data: null
splitted_columns: []
/v1/playbook/playbook-result/{playbook_result_unique_id}/:
get:
operationId: getPlaybookDetailRunLog
summary: Get Playbook Run Log Details
tags:
- Playbooks
description: Returns run logs of a specific playbook.
externalDocs:
description: Cyware Orchestrate API reference
url: https://orchestrateapi.cyware.com/playbook/get-playbook-detail-run-log
parameters:
- name: playbook_result_unique_id
in: path
required: true
schema:
type: string
description: Pass the unique ID generated during the playbook run. You can retrieve the unique ID of a run log using the **Get Playbook Run Logs** endpoint.
examples:
- e322985a-59a0-404c-adae-a4ba28d64f22
description: Pass the unique ID generated during the playbook run. You can retrieve the unique ID of a run log using the **Get Playbook Run Logs** endpoint.
responses:
'200':
description: HTTP 200 response
content:
application/json:
schema:
type: object
properties:
status:
type: string
description: Returns the playbook run status.
examples:
- SUCCESS
unique_id:
type: string
description: Returns the unique ID that is generated dynamically on playbook execution.
examples:
- e32298
# --- truncated at 32 KB (264 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-playbooks-api-openapi.yml