Demisto Playbook API

swagger: '2.0'
info:
  description: 'This is the public REST API to integrate with the demisto server.

    HTTP request can be sent using any HTTP-client.


    For an example dedicated client take a look at: https://github.com/demisto/demisto-py.


    Requests must include API-key that can be generated in the Demisto web client under ''Settings'' -> ''Integrations'' -> ''API keys''



    Optimistic Locking and Versioning\:


    When using Demisto REST API, you will need to make sure to work on the latest version of the item (incident, entry, etc.), otherwise, you will get a DB version error (which not allow you to override a newer item).

    In addition, you can pass ''version\: -1'' to force data override (make sure that other users data might be lost).


    Assume that Alice and Bob both read the same data from Demisto server, then they both changed the data, and then both tried to write the new versions back to the server. Whose changes should be saved? Alice’s? Bob’s?

    To solve this, each data item in Demisto has a numeric incremental version.

    If Alice saved an item with version 4 and Bob trying to save the same item with version 3, Demisto will rollback Bob request and returns a DB version conflict error.

    Bob will need to get the latest item and work on it so Alice work will not get lost.


    Example request using ''curl''\:


    ```

    curl ''https://hostname:443/incidents/search'' -H ''content-type: application/json'' -H ''accept: application/json'' -H ''Authorization: <API Key goes here>'' --data-binary ''{"filter":{"query":"-status:closed -category:job","period":{"by":"day","fromValue":7}}}'' --compressed

    ```'
  title: Demisto Apikeys Playbook API
  version: 2.0.0
host: hostname:443
schemes:
- https
consumes:
- application/json
- application/xml
produces:
- application/json
security:
- api_key: []
- csrf_token: []
- x-xdr-auth-id: []
tags:
- name: Playbook
paths:
  /playbook/save/yaml:
    post:
      description: Import and override playbook in Cortex XSOAR
      consumes:
      - multipart/form-data
      produces:
      - application/json
      summary: Import and override playbook
      operationId: importPlaybook
      parameters:
      - type: file
        description: file
        name: file
        in: formData
        required: true
      responses:
        '200':
          description: The saved playbook
          schema:
            $ref: '#/definitions/Playbook'
      tags:
      - Playbook
definitions:
  TimerAction:
    type: string
    title: TimerAction ...
    x-go-package: github.com/demisto/server/domain
  PlaybookOutput:
    description: PlaybookOutput represents the playbook output
    type: object
    properties:
      contextPath:
        type: string
        x-go-name: ContextPath
      description:
        type: string
        x-go-name: Description
      type:
        $ref: '#/definitions/OutputType'
    x-go-package: github.com/demisto/server/domain
  FilterOperatorID:
    type: string
    title: FilterOperatorID ...
    x-go-package: github.com/demisto/server/domain
  TaskView:
    description: TaskView represents the view in client of the tasks graph
    type: object
    x-go-package: github.com/demisto/server/domain
  GridColumn:
    type: object
    title: GridColumn ...
    properties:
      displayName:
        type: string
        x-go-name: DisplayName
      fieldCalcScript:
        type: string
        x-go-name: FieldCalcScript
      isDefault:
        type: boolean
        x-go-name: IsDefault
      isReadOnly:
        type: boolean
        x-go-name: IsReadOnly
      key:
        type: string
        x-go-name: Key
      required:
        type: boolean
        x-go-name: Required
      script:
        type: string
        x-go-name: Script
      selectValues:
        type: array
        items:
          type: string
        x-go-name: SelectValues
      type:
        type: string
        x-go-name: Type
      width:
        type: integer
        format: int64
        x-go-name: Width
    x-go-package: github.com/demisto/server/domain
  ArgTransformer:
    type: object
    title: ArgTransformer ...
    properties:
      args:
        x-go-name: Args
      operator:
        $ref: '#/definitions/TransformerOperatorID'
    x-go-package: github.com/demisto/server/domain
  NotifiableItem:
    type: object
    title: NotifiableItem ...
    properties:
      bcc:
        $ref: '#/definitions/AdvanceArg'
      body:
        $ref: '#/definitions/AdvanceArg'
      cc:
        $ref: '#/definitions/AdvanceArg'
      defaultOption:
        type: string
        x-go-name: DefaultOption
      format:
        type: string
        x-go-name: Format
      methods:
        type: array
        items:
          type: string
        x-go-name: Methods
      replyOptions:
        type: array
        items:
          type: string
        x-go-name: ReplyOptions
      subject:
        $ref: '#/definitions/AdvanceArg'
      timings:
        $ref: '#/definitions/NotifyTimings'
      to:
        $ref: '#/definitions/AdvanceArg'
    x-go-package: github.com/demisto/server/domain
  TaskCondition:
    description: 'TaskCondition - contains a condition and a corresponding label

      if the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)'
    type: object
    properties:
      condition:
        type: array
        items:
          $ref: '#/definitions/ArgFilter'
        x-go-name: Condition
      label:
        type: string
        x-go-name: Label
    x-go-package: github.com/demisto/server/domain
  OutputType:
    type: string
    title: OutputType ...
    x-go-package: github.com/demisto/server/domain
  Version:
    type: object
    title: Version represents a version.
    properties:
      Digits:
        type: array
        items:
          type: integer
          format: int64
      Label:
        type: string
    x-go-package: github.com/demisto/server/domain
  PlaybookOutputs:
    description: PlaybookOutputs - array of PlaybookOutput
    type: array
    items:
      $ref: '#/definitions/PlaybookOutput'
    x-go-package: github.com/demisto/server/domain
  ArgFilter:
    description: ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)
    type: array
    items:
      $ref: '#/definitions/ArgAtomicFilter'
    x-go-package: github.com/demisto/server/domain
  PlaybookView:
    description: PlaybookView represents the view in client of playbook graph
    type: object
    x-go-package: github.com/demisto/server/domain
  OperatorArgument:
    type: object
    title: OperatorArgument ...
    properties:
      isContext:
        type: boolean
        x-go-name: IsContext
      value:
        $ref: '#/definitions/AdvanceArg'
    x-go-package: github.com/demisto/server/domain
  Question:
    type: object
    title: Question - question for a form with a given type.
    properties:
      columns:
        type: array
        items:
          $ref: '#/definitions/GridColumn'
        x-go-name: GridColumns
      defaultRows:
        type: array
        items:
          type: object
          additionalProperties:
            type: object
        x-go-name: DefaultRows
      fieldAssociated:
        type: string
        x-go-name: FieldAssociated
      id:
        type: string
        x-go-name: ID
      label:
        type: string
        x-go-name: Label
      labelArg:
        $ref: '#/definitions/AdvanceArg'
      options:
        type: array
        items:
          type: string
        x-go-name: Options
      placeholder:
        type: string
        x-go-name: Placeholder
      required:
        type: boolean
        x-go-name: Required
      tooltip:
        type: string
        x-go-name: Tooltip
      type:
        type: string
        x-go-name: Type
    x-go-package: github.com/demisto/server/domain
  NotifyTimings:
    type: object
    title: NotifyTimings - time control on notify items - retries max count and intervals.
    properties:
      completeAfterReplies:
        type: integer
        format: uint64
        x-go-name: CompleteAfterReplies
      retriesCount:
        type: integer
        format: uint64
        x-go-name: RetriesCount
      retriesInterval:
        type: integer
        format: uint64
        x-go-name: RetriesInterval
    x-go-package: github.com/demisto/server/domain
  Task:
    description: Task is the basic task in the task repository that can be associated to an incident via playbook
    type: object
    properties:
      brand:
        type: string
        x-go-name: Brand
      clonedFrom:
        type: string
        x-go-name: ClonedFrom
      comment:
        type: string
        x-go-name: Comment
      conditions:
        type: array
        items:
          type: string
        x-go-name: ConditionnKeys
      description:
        type: string
        x-go-name: Description
      id:
        type: string
        x-go-name: ID
      isCommand:
        type: boolean
        x-go-name: IsCommand
      isLocked:
        type: boolean
        x-go-name: IsLocked
      isSystemTask:
        type: boolean
        x-go-name: IsSystemTask
      isTitleTask:
        type: boolean
        x-go-name: IsTitleTask
      modified:
        type: string
        format: date-time
        x-go-name: Modified
      name:
        type: string
        x-go-name: Name
      playbookId:
        type: string
        x-go-name: PlaybookID
      scriptId:
        type: string
        x-go-name: AutomationScriptID
      sortValues:
        type: array
        items:
          type: string
        x-go-name: SortValues
      tags:
        type: array
        items:
          type: string
        x-go-name: Tags
      type:
        $ref: '#/definitions/TaskType'
      version:
        type: integer
        format: int64
        x-go-name: Versn
    x-go-package: github.com/demisto/server/domain
  PlaybookInputs:
    description: PlaybookInputs - array of PlaybookInput
    type: array
    items:
      $ref: '#/definitions/PlaybookInput'
    x-go-package: github.com/demisto/server/domain
  AdvanceArg:
    description: 'Simple: plain text such as "hello" (constant) or ${File.ID} (DT expression)

      Complex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)'
    type: object
    title: 'AdvanceArg - advance argument can be one of the following:'
    properties:
      complex:
        $ref: '#/definitions/ComplexArg'
      simple:
        type: string
        x-go-name: Simple
    x-go-package: github.com/demisto/server/domain
  ReputationCalcAlg:
    type: number
    format: double
    title: ReputationCalcAlg ...
    x-go-package: github.com/demisto/server/domain
  PlaybookTask:
    type: object
    title: PlaybookTask ...
    properties:
      conditions:
        description: Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)
        type: array
        items:
          $ref: '#/definitions/TaskCondition'
        x-go-name: Conditions
      continueOnError:
        type: boolean
        x-go-name: ContinueOnError
      defaultAssignee:
        type: string
        x-go-name: DefaultAssignee
      defaultAssigneeComplex:
        $ref: '#/definitions/AdvanceArg'
      defaultReminder:
        type: integer
        format: int64
        x-go-name: DefaultReminder
      evidenceData:
        $ref: '#/definitions/EvidenceData'
      fieldMapping:
        type: array
        items:
          $ref: '#/definitions/FieldMapping'
        x-go-name: FieldMappingArray
      form:
        $ref: '#/definitions/DataCollectionForm'
      formDisplay:
        $ref: '#/definitions/FormDisplay'
      id:
        type: string
        x-go-name: ID
      ignoreWorker:
        description: Do not run this task in a worker
        type: boolean
        x-go-name: IgnoreWorker
      loop:
        $ref: '#/definitions/TaskLoop'
      message:
        $ref: '#/definitions/NotifiableItem'
      nextTasks:
        type: object
        additionalProperties:
          type: array
          items:
            type: string
        x-go-name: NextTasks
      note:
        type: boolean
        x-go-name: Note
      quietMode:
        $ref: '#/definitions/QuietMode'
      reputationCalc:
        $ref: '#/definitions/ReputationCalcAlg'
      restrictedCompletion:
        type: boolean
        x-go-name: RestrictedCompletion
      scriptArguments:
        type: object
        additionalProperties:
          $ref: '#/definitions/AdvanceArg'
        x-go-name: ScriptArguments
      separateContext:
        type: boolean
        x-go-name: SeparateContext
      skipUnavailable:
        description: 'SkipUnavailable if true then will check if automation exists, integration of that command is installed and

          active or sub playbook exists in Demisto'
        type: boolean
        x-go-name: SkipUnavailable
      sla:
        $ref: '#/definitions/SLA'
      slaReminder:
        $ref: '#/definitions/SLA'
      task:
        $ref: '#/definitions/Task'
      taskId:
        type: string
        x-go-name: TaskID
      timerTriggers:
        description: SLA fields
        type: array
        items:
          $ref: '#/definitions/TimerTrigger'
        x-go-name: TimerTriggers
      type:
        $ref: '#/definitions/TaskType'
      view:
        $ref: '#/definitions/TaskView'
    x-go-package: github.com/demisto/server/domain
  DataCollectionForm:
    type: object
    title: DataCollectionForm - a data collection form with questions.
    properties:
      description:
        type: string
        x-go-name: Description
      expired:
        type: boolean
        x-go-name: Expired
      questions:
        type: array
        items:
          $ref: '#/definitions/Question'
        x-go-name: Questions
      sender:
        type: string
        x-go-name: Sender
      title:
        type: string
        x-go-name: Title
      totalAnswers:
        type: integer
        format: uint64
        x-go-name: TotalAnswers
    x-go-package: github.com/demisto/server/domain
  ComplexArg:
    description: 'ComplexArg - all info that is necessary to compute argument value from context

      Root - the root slice (or object) from to work against

      Filters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)

      Accessor - the key to access to each result after filter

      Transformers - a slice to transformers to apply on the result of the accessed key from each result

      e.g. if user want to take from context all File.DisplayName where File.Extension is ''EXE'', and the result in uppercase than:

      Root: is "File"

      Filters: will hold the "File.DisplayName where File.Extension is ''EXE''" query

      Accessor: is "DisplayName"

      Transformers: will hold the uppercase transformation'
    type: object
    properties:
      accessor:
        type: string
        x-go-name: Accessor
      filters:
        type: array
        items:
          $ref: '#/definitions/ArgFilter'
        x-go-name: Filters
      root:
        type: string
        x-go-name: Root
      transformers:
        type: array
        items:
          $ref: '#/definitions/ArgTransformer'
        x-go-name: Transformers
    x-go-package: github.com/demisto/server/domain
  SLA:
    type: object
    title: SLA ...
    properties:
      days:
        type: integer
        format: int64
        x-go-name: Days
      hours:
        type: integer
        format: int64
        x-go-name: Hours
      weeks:
        type: integer
        format: int64
        x-go-name: Weeks
    x-go-package: github.com/demisto/server/domain
  Playbook:
    description: Playbook is a collection of tasks
    type: object
    properties:
      brands:
        type: array
        items:
          type: string
        x-go-name: Brands
      commands:
        type: array
        items:
          type: string
        x-go-name: Commands
      comment:
        type: string
        x-go-name: Description
      commitMessage:
        type: string
        x-go-name: CommitMessage
      dbotCreatedBy:
        description: Who has created this event - relevant only for manual incidents
        type: string
        x-go-name: CreatedBy
      detached:
        type: boolean
        x-go-name: Detached
      fromServerVersion:
        $ref: '#/definitions/Version'
      hasRole:
        description: Internal field to make queries on role faster
        type: boolean
        x-go-name: HasRole
      hidden:
        type: boolean
        x-go-name: Hidden
      id:
        type: string
        x-go-name: ID
      inputs:
        $ref: '#/definitions/PlaybookInputs'
      itemVersion:
        $ref: '#/definitions/Version'
      locked:
        type: boolean
        x-go-name: Locked
      missingScriptsIds:
        type: array
        items:
          type: string
        x-go-name: MissingScriptsIDs
      modified:
        type: string
        format: date-time
        x-go-name: Modified
      name:
        type: string
        x-go-name: Name
      nameRaw:
        type: string
        x-go-name: NameRaw
      outputs:
        $ref: '#/definitions/PlaybookOutputs'
      packID:
        type: string
        x-go-name: PackID
      prevName:
        type: string
        x-go-name: PrevName
      previousRoles:
        description: PreviousRoleName - do not change this field manually
        type: array
        items:
          type: string
        x-go-name: PreviousRoleName
      primaryTerm:
        type: integer
        format: int64
        x-go-name: PrimaryTerm
      private:
        type: boolean
        x-go-name: Private
      propagationLabels:
        type: array
        items:
          type: string
        x-go-name: PropagationLabels
      quiet:
        type: boolean
        x-go-name: Quiet
      roles:
        description: The role assigned to this investigation
        type: array
        items:
          type: string
        x-go-name: RoleName
      scriptIds:
        type: array
        items:
          type: string
        x-go-name: ScriptIDs
      sequenceNumber:
        type: integer
        format: int64
        x-go-name: SeqNum
      shouldCommit:
        type: boolean
        x-go-name: ShouldCommit
      sortValues:
        type: array
        items:
          type: string
        x-go-name: SortValues
      sourcePlaybookID:
        type: string
        x-go-name: SourcePlaybookID
      startTaskId:
        type: string
        x-go-name: StartTaskID
      system:
        type: boolean
        x-go-name: System
      tags:
        type: array
        items:
          type: string
        x-go-name: Tags
      taskIds:
        description: 'auto generated field that will contain all task ids in this playbook

          Needed for searching with bleve'
        type: array
        items:
          type: string
        x-go-name: TaskIDs
      tasks:
        type: object
        additionalProperties:
          $ref: '#/definitions/PlaybookTask'
        x-go-name: Tasks
      toServerVersion:
        $ref: '#/definitions/Version'
      vcShouldIgnore:
        type: boolean
        x-go-name: VCShouldIgnore
      version:
        type: integer
        format: int64
        x-go-name: Versn
      view:
        $ref: '#/definitions/PlaybookView'
    x-go-package: github.com/demisto/server/domain
  ArgAtomicFilter:
    description: ArgAtomicFilter - operator with two sides that return true/false
    type: object
    properties:
      ignoreCase:
        type: boolean
        x-go-name: IgnoreCase
      left:
        $ref: '#/definitions/OperatorArgument'
      operator:
        $ref: '#/definitions/FilterOperatorID'
      right:
        $ref: '#/definitions/OperatorArgument'
      type:
        type: string
        x-go-name: Type
    x-go-package: github.com/demisto/server/domain
  TaskType:
    description: TaskType is the Task in the playbook context as a node
    type: string
    x-go-package: github.com/demisto/server/domain
  FormDisplay:
    type: object
    title: FormDisplay - display options for communication/ask task (for both email and web forms).
    properties:
      bodyBackgroundColor:
        type: string
        x-go-name: BodyBackgroundColor
      bodyFontColor:
        type: string
        x-go-name: BodyFontColor
      headerBackgroundColor:
        type: string
        x-go-name: HeaderBackgroundColor
      headerFontColor:
        type: string
        x-go-name: HeaderFontColor
      sender:
        type: string
        x-go-name: Sender
      submitButtonBackgroundColor:
        type: string
        x-go-name: SubmitButtonBackgroundColor
      submitButtonFontColor:
        type: string
        x-go-name: SubmitButtonFontColor
      submitText:
        type: string
        x-go-name: SubmitText
    x-go-package: github.com/demisto/server/domain
  FieldMapping:
    description: FieldMapping - Map a task output (complex or simple value) to an incident field
    type: object
    properties:
      fieldId:
        type: string
        x-go-name: IncidentField
      output:
        $ref: '#/definitions/AdvanceArg'
    x-go-package: github.com/demisto/server/domain
  TransformerOperatorID:
    type: string
    title: TransformerOperatorID ...
    x-go-package: github.com/demisto/server/domain
  EvidenceData:
    description: EvidenceData - all evidence properties to evaluate in task process
    type: object
    properties:
      customFields:
        description: This field must have empty json key
        type: object
        additionalProperties:
          $ref: '#/definitions/AdvanceArg'
        x-go-name: CustomFields
      description:
        $ref: '#/definitions/AdvanceArg'
      occurred:
        $ref: '#/definitions/AdvanceArg'
      tags:
        $ref: '#/definitions/AdvanceArg'
    x-go-package: github.com/demisto/server/domain
  PlaybookInput:
    description: PlaybookInput represents the playbook input
    type: object
    properties:
      description:
        type: string
        x-go-name: Description
      key:
        type: string
        x-go-name: Key
      required:
        type: boolean
        x-go-name: Required
      value:
        $ref: '#/definitions/AdvanceArg'
    x-go-package: github.com/demisto/server/domain
  TaskLoop:
    description: TaskLoop contains loop details
    type: object
    properties:
      brand:
        type: string
        x-go-name: Brand
      builtinCondition:
        type: array
        items:
          $ref: '#/definitions/ArgFilter'
        x-go-name: BuiltInCondition
      exitCondition:
        type: string
        x-go-name: ExitCondition
      forEach:
        type: boolean
        x-go-name: ForEach
      isCommand:
        type: boolean
        x-go-name: IsCommand
      scriptArguments:
        type: object
        additionalProperties:
          $ref: '#/definitions/AdvanceArg'
        x-go-name: ScriptArguments
      scriptId:
        type: string
        x-go-name: AutomationScriptID
      wait:
        type: integer
        format: int64
        x-go-name: WaitBetweenIterations
    x-go-package: github.com/demisto/server/domain
  TimerTrigger:
    type: object
    title: TimerTrigger ...
    properties:
      action:
        $ref: '#/definitions/TimerAction'
      fieldName:
        type: string
        x-go-name: FieldName
    x-go-package: github.com/demisto/server/domain
  QuietMode:
    description: QuietMode quiet mode for playbook task
    type: integer
    format: int64
    x-go-package: github.com/demisto/server/domain
securityDefinitions:
  api_key:
    type: apiKey
    name: Authorization
    in: header
  csrf_token:
    type: apiKey
    name: X-XSRF-TOKEN
    in: header
  x-xdr-auth-id:
    type: apiKey
    name: x-xdr-auth-id
    in: header