Cyware Webhooks API

openapi: 3.2.0
info:
  title: Cyware Orchestrate (CO) Open Webhooks API
  version: v1
  description: 'Public Open API for Cyware Orchestrate, Cyware''s security orchestration, automation and response (SOAR) platform. The API covers playbooks (listing, running, run logs, node results, exports, bulk terminate), app integrations (apps, app actions, app instances, action execution, custom app import), source events, persistent lists (storage manager), code snippets, custom email templates, tags, analytics and connectivity/version checks, plus the inbound webhook endpoints used to push events into Orchestrate.


    Orchestrate is deployed per tenant, so the server host is the customer''s own Orchestrate deployment; the API is mounted under `/soarapi`.


    This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://orchestrateapi.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
  contact:
    name: Cyware
    url: https://www.cyware.com/contact-us
  termsOfService: https://www.cyware.com/legal/terms-of-use
  x-apievangelist-source: https://orchestrateapi.cyware.com/llms.txt
  x-apievangelist-method: generated
servers:
- url: https://{co_host}/soarapi
  description: Tenant Orchestrate deployment. Replace {co_host} with your own Orchestrate host. Cyware uses https://demo.cyware.com/soar/ as the example host in the config of its open-source MCP server, and its docs reference the /soarapi base path.
  variables:
    co_host:
      default: demo.cyware.com
security:
- coOpenApiSignature: []
tags:
- name: Webhooks
  description: Webhooks
paths:
  /{webhook_url}/{app-identifier}/{action-identifier}/:
    post:
      operationId: webhooksCreateEventV2
      summary: Create Event (v2)
      tags:
      - Webhooks
      description: "Creates an event by passing the app identifier and action identifier through the URL and data through the payload. This API provides a concise response with key parameters.\n\n<Callout attributes='{\"isFitToPage\":true,\"dataType\":\"info\",\"style\":{\"width\":\"100%\",\"minWidth\":\"100%\"}}'>\n  <p><strong class=\"slate-bold\">Note</strong>: This API is available in Orchestrate v3.5.9 onwards.</p>\n  <p>To retrieve a detailed response, remove the <code class=\"slate-code\">/v2</code> from the webhook URL. The following is the example webhook URL that retrieves the detailed response: <code class=\"slate-code\">https://soarapi/webhooks_auth/events/?token=1df121212-121x-1212-3434-a67823232356</code>.</p>\n</Callout>"
      externalDocs:
        description: Cyware Orchestrate API reference
        url: https://orchestrateapi.cyware.com/webhooks/create-event-v2
      parameters:
      - name: token
        in: query
        required: true
        schema:
          type: string
          description: Pass the webhook authentication token generated in Orchestrate.
        description: Pass the webhook authentication token generated in Orchestrate.
      - name: webhook_url
        in: path
        required: true
        schema:
          type: string
          description: Pass the webhook URL retrieved from Orchestrate.
        description: Pass the webhook URL retrieved from Orchestrate.
      - name: app-identifier
        in: path
        required: true
        schema:
          type: string
          description: Pass the source app to create an event.
        description: Pass the source app to create an event.
      - name: action-identifier
        in: path
        required: true
        schema:
          type: string
          description: Pass the event type to create an event.
        description: Pass the event type to create an event.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                title:
                  type: string
                  description: Pass a title for the event.
                  examples:
                  - testing
                data:
                  type: string
                  description: Pass the data to include with the event in JSON format.
                  examples:
                  - event data
              required:
              - title
            example:
              title: testing
              data: event data
      responses:
        '201':
          description: HTTP 201 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  title:
                    type: string
                    description: Returns the title of the event.
                    examples:
                    - intel_enrichment
                  readable_id:
                    type: string
                    description: Returns the readable ID of the event.
                    examples:
                    - TEfbb104ed-6
                  unique_id:
                    type: string
                    description: Returns the dynamically generated unique ID of the event.
                    examples:
                    - fbb104ed-6704-4127-8898-f2f6aefe9fc1
                  created:
                    type: string
                    description: Returns the date and time of when the event was created.
                    examples:
                    - '2024-12-11T06:50:59.946589Z'
                  source:
                    type: string
                    description: Returns the source of the event through which it is triggered.
                    examples:
                    - Webhooks
                  app_identifier:
                    type: string
                    description: Returns the source app associated with the event.
                    examples:
                    - CTIX
                  action_identifier:
                    type: string
                    description: Returns the event type associated with the event.
                    examples:
                    - CTIX_submission
              example:
                title: intel_enrichment
                readable_id: TEfbb104ed-6
                unique_id: fbb104ed-6704-4127-8898-f2f6aefe9fc1
                created: '2024-12-11T06:50:59.946589Z'
                source: Webhooks
                app_identifier: CTIX
                action_identifier: CTIX_submission
      x-alternate-documents:
      - title: Create Event
        operationId: webhooksCreateEvent
        url: https://orchestrateapi.cyware.com/webhooks/create-event
  /{webhook_url}/:
    post:
      operationId: createEventsThroughPayloadV2
      summary: Create Events through Payload (v2)
      tags:
      - Webhooks
      description: "Creates an event by passing the app identifier, action identifier, and data through the payload. This API endpoint provides a concise response with key parameters.\n\n<Callout attributes='{\"isFitToPage\":true,\"dataType\":\"info\",\"style\":{\"width\":\"100%\",\"minWidth\":\"100%\"}}'>\n  <p><strong class=\"slate-bold\">Note</strong>: This API is available in Orchestrate v3.5.9 onwards.</p>\n  <p>To retrieve a detailed response, remove the <code class=\"slate-code\">/v2</code> from the webhook URL. The following is the example webhook URL that retrieves the detailed response: <code class=\"slate-code\">https://soarapi/webhooks_auth/events/?token=1df121212-121x-1212-3434-a67823232356.</code></p>\n</Callout>"
      externalDocs:
        description: Cyware Orchestrate API reference
        url: https://orchestrateapi.cyware.com/webhooks/create-events-through-payload-v2
      parameters:
      - name: token
        in: query
        required: true
        schema:
          type: string
          description: Pass the webhooks authentication token generated in Cyware Orchestrate.
        description: Pass the webhooks authentication token generated in Cyware Orchestrate.
      - name: webhook_url
        in: path
        required: true
        schema:
          type: string
          description: Pass the webhook URL generated in Cyware Orchestrate.
        description: Pass the webhook URL generated in Cyware Orchestrate.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                title:
                  type: string
                  description: Pass a title for the event.
                  examples:
                  - intel_submission
                app_identifier:
                  type: string
                  description: Pass the source app to create an event.
                  examples:
                  - '{{app-identifier}}'
                data:
                  type: object
                  description: Pass the data to include with the event in JSON format.
                action_identifier:
                  type: string
                  description: Pass the event type to create an event.
                  examples:
                  - '{{action-identifier}}'
              required:
              - app_identifier
              - data
              - action_identifier
            example:
              title: intel_submission
              app_identifier: '{{app-identifier}}'
              data: {}
              action_identifier: '{{action-identifier}}'
      responses:
        '201':
          description: HTTP 201 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  title:
                    type: string
                    description: Returns the title of the event.
                    examples:
                    - intel enrichment
                  readable_id:
                    type: string
                    description: Returns the readable ID generated for the event.
                    examples:
                    - TE5d8bba33-d
                  unique_id:
                    type: string
                    description: Returns the dynamically generated unique ID of the event.
                    examples:
                    - 5d8bba33-dec1-41cb-b230-f94ade63ad62
                  created:
                    type: string
                    description: Returns the date and time of when the event was created.
                    examples:
                    - '2024-12-11T07:05:42.095277Z'
                  source:
                    type: string
                    description: Returns the source of the event through which it is triggered. For example, *open API*.
                    examples:
                    - Webhooks
                  app_identifier:
                    type: string
                    description: Returns the source app associated with the event.
                    examples:
                    - CTIX
                  action_identifier:
                    type: string
                    description: Returns the event type associated with the event.
                    examples:
                    - CTIX_submission
              example:
                title: intel enrichment
                readable_id: TE5d8bba33-d
                unique_id: 5d8bba33-dec1-41cb-b230-f94ade63ad62
                created: '2024-12-11T07:05:42.095277Z'
                source: Webhooks
                app_identifier: CTIX
                action_identifier: CTIX_submission
      x-alternate-documents:
      - title: Create Events through Payload
        operationId: createEventsThroughPayload
        url: https://orchestrateapi.cyware.com/webhooks/create-events-through-payload
  /{webhook_url}/test_connectivity/:
    get:
      operationId: webhooksTestConnectivity
      summary: Test connectivity
      tags:
      - Webhooks
      description: Use this API to test the connectivity.
      externalDocs:
        description: Cyware Orchestrate API reference
        url: https://orchestrateapi.cyware.com/webhooks/test-connectivity
      parameters:
      - name: token
        in: query
        required: true
        schema:
          type: string
          description: Pass the webhooks authentication token generated in Cyware Orchestrate. For example, ab1929a2-7d56-4511-b130-a5c3b6592702.
        description: Pass the webhooks authentication token generated in Cyware Orchestrate. For example, ab1929a2-7d56-4511-b130-a5c3b6592702.
      - name: webhook_url
        in: path
        required: true
        schema:
          type: string
          description: Pass the webhook URL retrieved from Orchestrate application.
        description: Pass the webhook URL retrieved from Orchestrate application.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
                    description: "Indicates the status of the connection. \nExample: *ok*"
                    examples:
                    - ok
              example:
                status: ok
components:
  securitySchemes:
    coOpenApiSignature:
      type: apiKey
      in: query
      name: access_id
      description: Orchestrate Open API credentials. Every request carries access_id, expires (epoch, current time + up to 30 seconds) and signature query parameters, where StringToSign = access_id + "\n" + expires and Signature = Base64(HMAC-SHA1(secret_key, StringToSign)). See https://orchestrateapi.cyware.com/authentication
externalDocs:
  description: Cyware Orchestrate API Reference
  url: https://orchestrateapi.cyware.com/