Demisto Inv Playbook API
The Inv Playbook API from Demisto — 11 operation(s) for inv playbook.
The Inv Playbook API from Demisto — 11 operation(s) for inv playbook.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/demisto-inv-playbook-api"
curl "https://apis.io/api/v1/apis?limit=25"
Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
description: 'This is the public REST API to integrate with the demisto server.
HTTP request can be sent using any HTTP-client.
For an example dedicated client take a look at: https://github.com/demisto/demisto-py.
Requests must include API-key that can be generated in the Demisto web client under ''Settings'' -> ''Integrations'' -> ''API keys''
Optimistic Locking and Versioning\:
When using Demisto REST API, you will need to make sure to work on the latest version of the item (incident, entry, etc.), otherwise, you will get a DB version error (which not allow you to override a newer item).
In addition, you can pass ''version\: -1'' to force data override (make sure that other users data might be lost).
Assume that Alice and Bob both read the same data from Demisto server, then they both changed the data, and then both tried to write the new versions back to the server. Whose changes should be saved? Alice’s? Bob’s?
To solve this, each data item in Demisto has a numeric incremental version.
If Alice saved an item with version 4 and Bob trying to save the same item with version 3, Demisto will rollback Bob request and returns a DB version conflict error.
Bob will need to get the latest item and work on it so Alice work will not get lost.
Example request using ''curl''\:
```
curl ''https://hostname:443/incidents/search'' -H ''content-type: application/json'' -H ''accept: application/json'' -H ''Authorization: <API Key goes here>'' --data-binary ''{"filter":{"query":"-status:closed -category:job","period":{"by":"day","fromValue":7}}}'' --compressed
```'
title: Demisto Apikeys Inv Playbook API
version: 2.0.0
servers:
- url: https://hostname:443
security:
- api_key: []
- csrf_token: []
- x-xdr-auth-id: []
tags:
- name: Inv Playbook
paths:
/inv-playbook/task/add/{investigationId}:
post:
description: Add an ad-hoc task to a running playbook
summary: Add ad-hoc task
operationId: addAdHocTask
parameters:
- description: investigation ID
name: investigationId
in: path
required: true
schema:
type: string
responses:
'200':
description: InvestigationPlaybook
content:
application/json:
schema:
$ref: '#/components/schemas/InvestigationPlaybook'
tags:
- Inv Playbook
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/InvPlaybookTaskData'
application/xml:
schema:
$ref: '#/components/schemas/InvPlaybookTaskData'
/inv-playbook/task/assign:
post:
description: Assign a task to an owner
summary: Assign task
operationId: taskAssign
responses:
'200':
description: InvestigationPlaybook
content:
application/json:
schema:
$ref: '#/components/schemas/InvestigationPlaybook'
tags:
- Inv Playbook
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/invPlaybookAssignee'
application/xml:
schema:
$ref: '#/components/schemas/invPlaybookAssignee'
/inv-playbook/task/complete:
post:
description: 'Complete a task with a file attachment
Deprecated - use "/v2/inv-playbook/task/complete"'
summary: '[Deprecated] Complete a task'
operationId: completeTask
responses:
'200':
description: InvestigationPlaybook
content:
application/json:
schema:
$ref: '#/components/schemas/InvestigationPlaybook'
tags:
- Inv Playbook
requestBody:
content:
multipart/form-data:
schema:
type: object
properties:
investigationId:
type: string
description: investigation ID
fileName:
type: string
description: file name
fileComment:
type: string
description: file comment
taskId:
type: string
description: Task Id
taskInput:
type: string
description: task input
version:
type: string
description: Version
file:
type: string
description: file
format: binary
required:
- investigationId
- fileComment
- taskId
- taskInput
- version
- file
/inv-playbook/task/complete/simple:
post:
description: Complete a task without a file attachment
summary: Complete task simple (no file)
operationId: simpleCompleteTask
responses:
'200':
description: InvestigationPlaybook
content:
application/json:
schema:
$ref: '#/components/schemas/InvestigationPlaybook'
tags:
- Inv Playbook
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/invTaskInfo'
application/xml:
schema:
$ref: '#/components/schemas/invTaskInfo'
/inv-playbook/task/delete/{investigationId}/{invPBTaskId}:
post:
description: Delete an ad-hoc task from a running playbook
summary: Delete ad-hoc task
operationId: deleteAdHocTask
parameters:
- description: investigation ID
name: investigationId
in: path
required: true
schema:
type: string
- description: ad-hoc task ID
name: invPBTaskId
in: path
required: true
schema:
type: string
responses:
'200':
description: InvestigationPlaybook
content:
application/json:
schema:
$ref: '#/components/schemas/InvestigationPlaybook'
tags:
- Inv Playbook
/inv-playbook/task/due:
post:
description: Set the task due date
summary: Set task due date
operationId: taskSetDue
responses:
'200':
description: InvestigationPlaybook
content:
application/json:
schema:
$ref: '#/components/schemas/InvestigationPlaybook'
tags:
- Inv Playbook
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/invPlaybookDue'
application/xml:
schema:
$ref: '#/components/schemas/invPlaybookDue'
/inv-playbook/task/edit/{investigationId}:
post:
description: Edit an ad-hoc task in a running playbook
summary: Edit ad-hoc task
operationId: editAdHocTask
parameters:
- description: investigation ID
name: investigationId
in: path
required: true
schema:
type: string
responses:
'200':
description: InvestigationPlaybook
content:
application/json:
schema:
$ref: '#/components/schemas/InvestigationPlaybook'
tags:
- Inv Playbook
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/InvPlaybookTaskData'
application/xml:
schema:
$ref: '#/components/schemas/InvPlaybookTaskData'
/inv-playbook/task/note/add:
post:
description: Add comment to a task
summary: Task add comment
operationId: taskAddComment
responses:
'200':
description: InvestigationPlaybook
content:
application/json:
schema:
$ref: '#/components/schemas/InvestigationPlaybook'
tags:
- Inv Playbook
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/invTaskInfo'
application/xml:
schema:
$ref: '#/components/schemas/invTaskInfo'
/inv-playbook/task/uncomplete:
post:
description: Reopen a closed task and change the status to uncomplete
summary: Un complete a task
operationId: taskUnComplete
responses:
'200':
description: InvestigationPlaybook
content:
application/json:
schema:
$ref: '#/components/schemas/InvestigationPlaybook'
tags:
- Inv Playbook
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/invTaskInfo'
application/xml:
schema:
$ref: '#/components/schemas/invTaskInfo'
/v2/inv-playbook/task/complete:
post:
description: Complete a task with command and multiple file attachments
summary: Complete a task
operationId: completeTaskV2
responses:
'200':
description: InvestigationPlaybook
content:
application/json:
schema:
$ref: '#/components/schemas/InvestigationPlaybook'
tags:
- Inv Playbook
requestBody:
content:
multipart/form-data:
schema:
type: object
properties:
investigationId:
type: string
description: investigation ID
taskId:
type: string
description: Task Id
taskComment:
type: string
description: Task comment or command to run
taskInput:
type: string
description: Task input
version:
type: string
description: Version
file:
type: string
description: Files to attach to the task
format: binary
fileNames:
type: string
description: file names separated by %###% (only if files provided)
fileComments:
type: string
description: file comment separated by %###% (only if files provided)
required:
- investigationId
- taskId
- taskInput
- version
- file
/v2/inv-playbook/task/form/submit:
post:
description: Submit a data collection task with given answers and multiple file attachments
summary: Complete a task
operationId: submitTaskForm
responses:
'200':
description: InvestigationPlaybook
content:
application/json:
schema:
$ref: '#/components/schemas/InvestigationPlaybook'
tags:
- Inv Playbook
requestBody:
content:
multipart/form-data:
schema:
type: object
properties:
investigationId:
type: string
description: investigation ID
taskId:
type: string
description: Task Id
answers:
type: string
description: the answers to the task form. Answers are keyed by numerical question id
file:
type: string
description: Files to attach to the task
format: binary
required:
- investigationId
- taskId
- answers
components:
schemas:
ArgTransformer:
type: object
title: ArgTransformer ...
properties:
args:
x-go-name: Args
operator:
$ref: '#/components/schemas/TransformerOperatorID'
x-go-package: github.com/demisto/server/domain
NotifiableItem:
type: object
title: NotifiableItem ...
properties:
bcc:
$ref: '#/components/schemas/AdvanceArg'
body:
$ref: '#/components/schemas/AdvanceArg'
cc:
$ref: '#/components/schemas/AdvanceArg'
defaultOption:
type: string
x-go-name: DefaultOption
format:
type: string
x-go-name: Format
methods:
type: array
items:
type: string
x-go-name: Methods
replyOptions:
type: array
items:
type: string
x-go-name: ReplyOptions
subject:
$ref: '#/components/schemas/AdvanceArg'
timings:
$ref: '#/components/schemas/NotifyTimings'
to:
$ref: '#/components/schemas/AdvanceArg'
x-go-package: github.com/demisto/server/domain
invTaskInfo:
type: object
properties:
args:
type: object
additionalProperties:
$ref: '#/components/schemas/AdvanceArg'
x-go-name: Args
comment:
type: string
x-go-name: Comment
conditions:
type: array
items:
$ref: '#/components/schemas/TaskCondition'
x-go-name: Conditions
inTaskID:
type: string
x-go-name: TaskID
input:
type: string
x-go-name: Input
invId:
type: string
x-go-name: ID
loopArgs:
type: object
additionalProperties:
$ref: '#/components/schemas/AdvanceArg'
x-go-name: LoopArgs
loopCondition:
type: array
items:
$ref: '#/components/schemas/ArgFilter'
x-go-name: LoopCondition
version:
type: integer
format: int64
x-go-name: Version
x-go-package: github.com/demisto/server/web
Question:
type: object
title: Question - question for a form with a given type.
properties:
columns:
type: array
items:
$ref: '#/components/schemas/GridColumn'
x-go-name: GridColumns
defaultRows:
type: array
items:
type: object
additionalProperties:
type: object
x-go-name: DefaultRows
fieldAssociated:
type: string
x-go-name: FieldAssociated
id:
type: string
x-go-name: ID
label:
type: string
x-go-name: Label
labelArg:
$ref: '#/components/schemas/AdvanceArg'
options:
type: array
items:
type: string
x-go-name: Options
placeholder:
type: string
x-go-name: Placeholder
required:
type: boolean
x-go-name: Required
tooltip:
type: string
x-go-name: Tooltip
type:
type: string
x-go-name: Type
x-go-package: github.com/demisto/server/domain
TaskLoop:
description: TaskLoop contains loop details
type: object
properties:
brand:
type: string
x-go-name: Brand
builtinCondition:
type: array
items:
$ref: '#/components/schemas/ArgFilter'
x-go-name: BuiltInCondition
exitCondition:
type: string
x-go-name: ExitCondition
forEach:
type: boolean
x-go-name: ForEach
isCommand:
type: boolean
x-go-name: IsCommand
scriptArguments:
type: object
additionalProperties:
$ref: '#/components/schemas/AdvanceArg'
x-go-name: ScriptArguments
scriptId:
type: string
x-go-name: AutomationScriptID
wait:
type: integer
format: int64
x-go-name: WaitBetweenIterations
x-go-package: github.com/demisto/server/domain
InvestigationPlaybookData:
description: InvestigationPlaybookData returns all data of an investigation playbook, not including history
type: object
properties:
ReadyPlaybookInputs:
type: object
additionalProperties:
type: object
additionalProperties:
type: object
autoExtracting:
type: boolean
x-go-name: AutoExtracting
comment:
type: string
x-go-name: Description
inputs:
$ref: '#/components/schemas/PlaybookInputs'
investigationId:
type: string
x-go-name: InvestigationID
name:
type: string
x-go-name: Name
outputs:
$ref: '#/components/schemas/PlaybookOutputs'
playbookId:
type: string
x-go-name: PlaybookID
startDate:
type: string
format: date-time
x-go-name: StartDate
startTaskId:
description: FirstTask is the root task of the playbook
type: string
x-go-name: StartTaskID
state:
$ref: '#/components/schemas/InvestigationPlaybookState'
subPlaybookInputs:
type: object
additionalProperties:
$ref: '#/components/schemas/PlaybookInputs'
x-go-name: SubPlaybookInputs
subPlaybookOutputs:
type: object
additionalProperties:
$ref: '#/components/schemas/PlaybookOutputs'
x-go-name: SubPlaybookOutputs
tasks:
type: object
additionalProperties:
$ref: '#/components/schemas/InvestigationPlaybookTask'
x-go-name: Tasks
view:
$ref: '#/components/schemas/PlaybookView'
x-go-package: github.com/demisto/server/domain
InvPlaybookTaskData:
type: object
title: InvPlaybookTaskData ...
properties:
addAfter:
type: boolean
x-go-name: AddAfter
automationScript:
type: string
x-go-name: AutomationScript
description:
type: string
x-go-name: Description
name:
type: string
x-go-name: Name
neighborInvPBTaskId:
type: string
x-go-name: NeighborInvPBTaskID
scriptArguments:
type: object
additionalProperties:
$ref: '#/components/schemas/AdvanceArg'
x-go-name: ScriptArguments
tags:
type: array
items:
type: string
x-go-name: Tags
x-go-package: github.com/demisto/server/services
invPlaybookDue:
type: object
properties:
date:
type: string
format: date-time
x-go-name: Date
inTaskID:
type: string
x-go-name: TaskID
invId:
type: string
x-go-name: ID
version:
type: integer
format: int64
x-go-name: Version
x-go-package: github.com/demisto/server/web
TimerAction:
type: string
title: TimerAction ...
x-go-package: github.com/demisto/server/domain
ComplexArg:
description: 'ComplexArg - all info that is necessary to compute argument value from context
Root - the root slice (or object) from to work against
Filters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)
Accessor - the key to access to each result after filter
Transformers - a slice to transformers to apply on the result of the accessed key from each result
e.g. if user want to take from context all File.DisplayName where File.Extension is ''EXE'', and the result in uppercase than:
Root: is "File"
Filters: will hold the "File.DisplayName where File.Extension is ''EXE''" query
Accessor: is "DisplayName"
Transformers: will hold the uppercase transformation'
type: object
properties:
accessor:
type: string
x-go-name: Accessor
filters:
type: array
items:
$ref: '#/components/schemas/ArgFilter'
x-go-name: Filters
root:
type: string
x-go-name: Root
transformers:
type: array
items:
$ref: '#/components/schemas/ArgTransformer'
x-go-name: Transformers
x-go-package: github.com/demisto/server/domain
ArgFilter:
description: ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)
type: array
items:
$ref: '#/components/schemas/ArgAtomicFilter'
x-go-package: github.com/demisto/server/domain
InvestigationPlaybookTask:
description: InvestigationPlaybookTask is the Task in the playbook context as a node
type: object
properties:
arguments:
type: object
additionalProperties:
type: object
x-go-name: Arguments
assignee:
type: string
x-go-name: Assignee
assigneeSet:
type: boolean
x-go-name: AssigneeSet
blockingTasks:
type: array
items:
type: string
x-go-name: BlockingTasks
comments:
description: Whether this task had any comments or not
type: boolean
x-go-name: Comments
completedBy:
type: string
x-go-name: CompletedBy
completedCount:
type: integer
format: int64
x-go-name: CompletedCount
completedDate:
type: string
format: date-time
x-go-name: CompletedDate
conditions:
description: Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)
type: array
items:
$ref: '#/components/schemas/TaskCondition'
x-go-name: Conditions
continueOnError:
type: boolean
x-go-name: ContinueOnError
defaultAssignee:
type: string
x-go-name: DefaultAssignee
defaultAssigneeComplex:
$ref: '#/components/schemas/AdvanceArg'
defaultReminder:
type: integer
format: int64
x-go-name: DefaultReminder
dueDate:
type: string
format: date-time
x-go-name: DueDate
dueDateSet:
type: boolean
x-go-name: DueDateSet
entries:
type: array
items:
type: string
x-go-name: Entries
evidenceData:
$ref: '#/components/schemas/EvidenceData'
executionCount:
type: integer
format: int64
x-go-name: ExecutionCount
fieldMapping:
type: array
items:
$ref: '#/components/schemas/FieldMapping'
x-go-name: FieldMappingArray
forEachIndex:
description: Parameters needed for loops
type: integer
format: int64
x-go-name: ForEachIndex
forEachInputs:
type: object
additionalProperties:
type: array
items:
type: object
x-go-name: ForEachInputs
form:
$ref: '#/components/schemas/DataCollectionForm'
id:
type: string
x-go-name: ID
ignoreWorker:
description: Do not run this task in a worker
type: boolean
x-go-name: IgnoreWorker
indent:
type: integer
format: int64
x-go-name: Indent
input:
type: string
x-go-name: Input
loop:
$ref: '#/components/schemas/TaskLoop'
message:
$ref: '#/components/schemas/NotifiableItem'
nextTasks:
type: object
additionalProperties:
type: array
items:
type: string
x-go-name: NextTasks
note:
type: boolean
x-go-name: Note
outputs:
type: object
additionalProperties:
type: object
x-go-name: Outputs
parentBlockCount:
description: the number of tasks that are waiting on blocked in subplaybooks of this task
type: integer
format: int64
x-go-name: ParentBlockCount
parentPlaybookID:
type: string
x-go-name: ParentPlaybookTaskID
patched:
description: Indicates whether this task was patched to InvPB and did not originally belong to the playbook
type: boolean
x-go-name: Patched
playbookInputs:
type: object
additionalProperties:
type: object
x-go-name: PlaybookInputs
previousTasks:
type: object
additionalProperties:
type: array
items:
type: string
x-go-name: PreviousTasks
quietMode:
$ref: '#/components/schemas/QuietMode'
reminder:
description: Duration in minutes, this field is not persisted here
type: integer
format: int64
x-go-name: Reminder
reputationCalc:
$ref: '#/components/schemas/ReputationCalcAlg'
restrictedCompletion:
type: boolean
x-go-name: RestrictedCompletion
scriptArguments:
type: object
additionalProperties:
$ref: '#/components/schemas/AdvanceArg'
x-go-name: ScriptArguments
separateContext:
type: boolean
x-go-name: SeparateContext
sla:
$ref: '#/components/schemas/SLA'
slaReminder:
$ref: '#/components/schemas/SLA'
startDate:
type: string
format: date-time
x-go-name: StartDate
state:
$ref: '#/components/schemas/TaskState'
subPlaybook:
$ref: '#/components/schemas/InvestigationPlaybook'
task:
$ref: '#/components/schemas/Task'
taskCompleteData:
description: History complete data
type: array
items:
$ref: '#/components/schemas/InvPlaybookTaskCompleteData'
x-go-name: TaskCompleteData
taskId:
type: string
x-go-name: TaskID
timerTriggers:
description: SLA fields
type: array
items:
$ref: '#/components/schemas/TimerTrigger'
x-go-name: TimerTriggers
type:
$ref: '#/components/schemas/TaskType'
view:
$ref: '#/components/schemas/TaskView'
willNotExecuteCount:
type: integer
format: int64
x-go-name: WillNotExecuteCount
x-go-package: github.com/demisto/server/domain
TransformerOperatorID:
type: string
title: TransformerOperatorID ...
x-go-package: github.com/demisto/server/domain
ArgAtomicFilter:
description: ArgAtomicFilter - operator with two sides that return true/false
type: object
properties:
ignoreCase:
type: boolean
x-go-name: IgnoreCase
left:
$ref: '#/components/schemas/OperatorArgument'
operator:
$ref: '#/components/schemas/FilterOperatorID'
right:
$ref: '#/components/schemas/OperatorArgument'
type:
type: string
x-go-name: Type
x-go-package: github.com/demisto/server/domain
InvPlaybookTaskCompleteData:
type: object
title: InvPlaybookTaskCompleteData ...
properties:
arguments:
type: object
additionalProperties:
type: object
x-go-name: Arguments
completedBy:
type: string
x-go-name: CompletedBy
completedCount:
type: integer
format: int64
x-go-name: CompletedCount
completedDate:
type: string
format: date-time
x-go-name: CompletedDate
entries:
type: array
items:
type: string
x-go-name: Entries
input:
type: string
x-go-name: Input
outputs:
type: object
additionalProperties:
type: object
x-go-name: Outputs
playbookInputs:
type: object
additionalProperties:
type: object
x-go-name: PlaybookInputs
startDate:
type: string
format: date-time
x-go-name: StartDate
state:
$ref: '#/components/schemas/TaskState'
willNotExecuteCount:
type: integer
format: int64
x-go-name: WillNotExecuteCount
x-go-package: github.com/demisto/server/domain
FilterOperatorID:
type: string
title: FilterOperatorID ...
x-go-package: github.com/demisto/server/domain
OperatorArgument:
type: object
title: OperatorArgument ...
properties:
isContext:
type: boolean
x-go-name: IsContext
value:
$ref: '#/components/schemas/AdvanceArg'
x-go-package: github.com/demisto/server/domain
PlaybookView:
description: PlaybookView represents the view in client of playbook graph
type: object
x-go-package: github.com/demisto/server/domain
InvestigationPlaybookState:
description: InvestigationPlaybookState indicates the state of the running playbook
type: string
x-go-package: github.com/demisto/server/domain
PlaybookOutputs:
description: PlaybookOutputs - array of PlaybookOutput
type: array
items:
$ref: '#/components/schemas/PlaybookOutput'
x-go-package: github.com/demisto/server/domain
PlaybookInput:
description: PlaybookInput represents the playbook input
type: object
properties:
description:
type: string
x-go-name: Description
key:
type: string
x-go-name: Key
required:
type: boolean
x-go-name: Required
value:
$ref: '#/components/schemas/AdvanceArg'
x-go-package: github.com/demisto/server/domain
TaskType:
description: TaskType is the Task in the playbook context as a node
type: string
x-go-package: github.com/demisto/server/domain
TaskState:
description: TaskState indicates the state of the task during the incident/investigation execution
type: string
x-go-package: github.com/demisto/server/domain
FieldMapping:
description: FieldMapping - Map a task output (complex or simple value) to an incident field
type: object
properties:
fieldId:
type: string
x-go-name: IncidentField
output:
$ref: '#/components/schemas/AdvanceArg'
x-go-package: github.com/demisto/server/domain
invPlaybookAssignee:
type: object
properties:
assignee:
type: string
x-go-name: Assignee
inTaskID:
type: string
x-go-name: TaskID
invId:
type: string
x-go-name: ID
version:
type: integer
format: int64
x-go-name: Version
x-go-package: github.com/demisto/server/web
OutputType:
type: string
title: OutputType ...
x-go-package: github.com/demisto/server/domain
GridColumn:
type: object
title: GridColumn ...
properties:
displayName:
type: string
x-go-name: DisplayName
fieldCalcScript:
type: string
x-go-name: FieldCalcScript
isDefault:
type: boolean
x-go-name: IsDefault
isReadOnly:
type: boolean
x-go-name: IsReadOnly
key:
type: string
x-go-name: Key
required:
type: boolean
x-go-name: Required
script:
type: string
x-go-name: Script
selectValues:
type: array
# --- truncated at 32 KB (41 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/demisto/refs/heads/main/openapi/demisto-inv-playbook-api-openapi.yml