Demisto Playbook API

openapi: 3.2.0
info:
  description: 'This is the public REST API to integrate with the demisto server.

    HTTP request can be sent using any HTTP-client.


    For an example dedicated client take a look at: https://github.com/demisto/demisto-py.


    Requests must include API-key that can be generated in the Demisto web client under ''Settings'' -> ''Integrations'' -> ''API keys''



    Optimistic Locking and Versioning\:


    When using Demisto REST API, you will need to make sure to work on the latest version of the item (incident, entry, etc.), otherwise, you will get a DB version error (which not allow you to override a newer item).

    In addition, you can pass ''version\: -1'' to force data override (make sure that other users data might be lost).


    Assume that Alice and Bob both read the same data from Demisto server, then they both changed the data, and then both tried to write the new versions back to the server. Whose changes should be saved? Alice’s? Bob’s?

    To solve this, each data item in Demisto has a numeric incremental version.

    If Alice saved an item with version 4 and Bob trying to save the same item with version 3, Demisto will rollback Bob request and returns a DB version conflict error.

    Bob will need to get the latest item and work on it so Alice work will not get lost.


    Example request using ''curl''\:


    ```

    curl ''https://hostname:443/incidents/search'' -H ''content-type: application/json'' -H ''accept: application/json'' -H ''Authorization: <API Key goes here>'' --data-binary ''{"filter":{"query":"-status:closed -category:job","period":{"by":"day","fromValue":7}}}'' --compressed

    ```'
  title: Demisto Apikeys Playbook API
  version: 2.0.0
servers:
- url: https://hostname:443
security:
- api_key: []
- csrf_token: []
- x-xdr-auth-id: []
tags:
- name: Playbook
paths:
  /playbook/save/yaml:
    post:
      description: Import and override playbook in Cortex XSOAR
      summary: Import and override playbook
      operationId: importPlaybook
      responses:
        '200':
          description: The saved playbook
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Playbook'
      tags:
      - Playbook
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  description: file
                  format: binary
              required:
              - file
components:
  schemas:
    ArgTransformer:
      type: object
      title: ArgTransformer ...
      properties:
        args:
          x-go-name: Args
        operator:
          $ref: '#/components/schemas/TransformerOperatorID'
      x-go-package: github.com/demisto/server/domain
    NotifiableItem:
      type: object
      title: NotifiableItem ...
      properties:
        bcc:
          $ref: '#/components/schemas/AdvanceArg'
        body:
          $ref: '#/components/schemas/AdvanceArg'
        cc:
          $ref: '#/components/schemas/AdvanceArg'
        defaultOption:
          type: string
          x-go-name: DefaultOption
        format:
          type: string
          x-go-name: Format
        methods:
          type: array
          items:
            type: string
          x-go-name: Methods
        replyOptions:
          type: array
          items:
            type: string
          x-go-name: ReplyOptions
        subject:
          $ref: '#/components/schemas/AdvanceArg'
        timings:
          $ref: '#/components/schemas/NotifyTimings'
        to:
          $ref: '#/components/schemas/AdvanceArg'
      x-go-package: github.com/demisto/server/domain
    Question:
      type: object
      title: Question - question for a form with a given type.
      properties:
        columns:
          type: array
          items:
            $ref: '#/components/schemas/GridColumn'
          x-go-name: GridColumns
        defaultRows:
          type: array
          items:
            type: object
            additionalProperties:
              type: object
          x-go-name: DefaultRows
        fieldAssociated:
          type: string
          x-go-name: FieldAssociated
        id:
          type: string
          x-go-name: ID
        label:
          type: string
          x-go-name: Label
        labelArg:
          $ref: '#/components/schemas/AdvanceArg'
        options:
          type: array
          items:
            type: string
          x-go-name: Options
        placeholder:
          type: string
          x-go-name: Placeholder
        required:
          type: boolean
          x-go-name: Required
        tooltip:
          type: string
          x-go-name: Tooltip
        type:
          type: string
          x-go-name: Type
      x-go-package: github.com/demisto/server/domain
    TaskLoop:
      description: TaskLoop contains loop details
      type: object
      properties:
        brand:
          type: string
          x-go-name: Brand
        builtinCondition:
          type: array
          items:
            $ref: '#/components/schemas/ArgFilter'
          x-go-name: BuiltInCondition
        exitCondition:
          type: string
          x-go-name: ExitCondition
        forEach:
          type: boolean
          x-go-name: ForEach
        isCommand:
          type: boolean
          x-go-name: IsCommand
        scriptArguments:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/AdvanceArg'
          x-go-name: ScriptArguments
        scriptId:
          type: string
          x-go-name: AutomationScriptID
        wait:
          type: integer
          format: int64
          x-go-name: WaitBetweenIterations
      x-go-package: github.com/demisto/server/domain
    FormDisplay:
      type: object
      title: FormDisplay - display options for communication/ask task (for both email and web forms).
      properties:
        bodyBackgroundColor:
          type: string
          x-go-name: BodyBackgroundColor
        bodyFontColor:
          type: string
          x-go-name: BodyFontColor
        headerBackgroundColor:
          type: string
          x-go-name: HeaderBackgroundColor
        headerFontColor:
          type: string
          x-go-name: HeaderFontColor
        sender:
          type: string
          x-go-name: Sender
        submitButtonBackgroundColor:
          type: string
          x-go-name: SubmitButtonBackgroundColor
        submitButtonFontColor:
          type: string
          x-go-name: SubmitButtonFontColor
        submitText:
          type: string
          x-go-name: SubmitText
      x-go-package: github.com/demisto/server/domain
    TimerAction:
      type: string
      title: TimerAction ...
      x-go-package: github.com/demisto/server/domain
    ComplexArg:
      description: 'ComplexArg - all info that is necessary to compute argument value from context

        Root - the root slice (or object) from to work against

        Filters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)

        Accessor - the key to access to each result after filter

        Transformers - a slice to transformers to apply on the result of the accessed key from each result

        e.g. if user want to take from context all File.DisplayName where File.Extension is ''EXE'', and the result in uppercase than:

        Root: is "File"

        Filters: will hold the "File.DisplayName where File.Extension is ''EXE''" query

        Accessor: is "DisplayName"

        Transformers: will hold the uppercase transformation'
      type: object
      properties:
        accessor:
          type: string
          x-go-name: Accessor
        filters:
          type: array
          items:
            $ref: '#/components/schemas/ArgFilter'
          x-go-name: Filters
        root:
          type: string
          x-go-name: Root
        transformers:
          type: array
          items:
            $ref: '#/components/schemas/ArgTransformer'
          x-go-name: Transformers
      x-go-package: github.com/demisto/server/domain
    ArgFilter:
      description: ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)
      type: array
      items:
        $ref: '#/components/schemas/ArgAtomicFilter'
      x-go-package: github.com/demisto/server/domain
    Playbook:
      description: Playbook is a collection of tasks
      type: object
      properties:
        brands:
          type: array
          items:
            type: string
          x-go-name: Brands
        commands:
          type: array
          items:
            type: string
          x-go-name: Commands
        comment:
          type: string
          x-go-name: Description
        commitMessage:
          type: string
          x-go-name: CommitMessage
        dbotCreatedBy:
          description: Who has created this event - relevant only for manual incidents
          type: string
          x-go-name: CreatedBy
        detached:
          type: boolean
          x-go-name: Detached
        fromServerVersion:
          $ref: '#/components/schemas/Version'
        hasRole:
          description: Internal field to make queries on role faster
          type: boolean
          x-go-name: HasRole
        hidden:
          type: boolean
          x-go-name: Hidden
        id:
          type: string
          x-go-name: ID
        inputs:
          $ref: '#/components/schemas/PlaybookInputs'
        itemVersion:
          $ref: '#/components/schemas/Version'
        locked:
          type: boolean
          x-go-name: Locked
        missingScriptsIds:
          type: array
          items:
            type: string
          x-go-name: MissingScriptsIDs
        modified:
          type: string
          format: date-time
          x-go-name: Modified
        name:
          type: string
          x-go-name: Name
        nameRaw:
          type: string
          x-go-name: NameRaw
        outputs:
          $ref: '#/components/schemas/PlaybookOutputs'
        packID:
          type: string
          x-go-name: PackID
        prevName:
          type: string
          x-go-name: PrevName
        previousRoles:
          description: PreviousRoleName - do not change this field manually
          type: array
          items:
            type: string
          x-go-name: PreviousRoleName
        primaryTerm:
          type: integer
          format: int64
          x-go-name: PrimaryTerm
        private:
          type: boolean
          x-go-name: Private
        propagationLabels:
          type: array
          items:
            type: string
          x-go-name: PropagationLabels
        quiet:
          type: boolean
          x-go-name: Quiet
        roles:
          description: The role assigned to this investigation
          type: array
          items:
            type: string
          x-go-name: RoleName
        scriptIds:
          type: array
          items:
            type: string
          x-go-name: ScriptIDs
        sequenceNumber:
          type: integer
          format: int64
          x-go-name: SeqNum
        shouldCommit:
          type: boolean
          x-go-name: ShouldCommit
        sortValues:
          type: array
          items:
            type: string
          x-go-name: SortValues
        sourcePlaybookID:
          type: string
          x-go-name: SourcePlaybookID
        startTaskId:
          type: string
          x-go-name: StartTaskID
        system:
          type: boolean
          x-go-name: System
        tags:
          type: array
          items:
            type: string
          x-go-name: Tags
        taskIds:
          description: 'auto generated field that will contain all task ids in this playbook

            Needed for searching with bleve'
          type: array
          items:
            type: string
          x-go-name: TaskIDs
        tasks:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/PlaybookTask'
          x-go-name: Tasks
        toServerVersion:
          $ref: '#/components/schemas/Version'
        vcShouldIgnore:
          type: boolean
          x-go-name: VCShouldIgnore
        version:
          type: integer
          format: int64
          x-go-name: Versn
        view:
          $ref: '#/components/schemas/PlaybookView'
      x-go-package: github.com/demisto/server/domain
    TransformerOperatorID:
      type: string
      title: TransformerOperatorID ...
      x-go-package: github.com/demisto/server/domain
    ArgAtomicFilter:
      description: ArgAtomicFilter - operator with two sides that return true/false
      type: object
      properties:
        ignoreCase:
          type: boolean
          x-go-name: IgnoreCase
        left:
          $ref: '#/components/schemas/OperatorArgument'
        operator:
          $ref: '#/components/schemas/FilterOperatorID'
        right:
          $ref: '#/components/schemas/OperatorArgument'
        type:
          type: string
          x-go-name: Type
      x-go-package: github.com/demisto/server/domain
    FilterOperatorID:
      type: string
      title: FilterOperatorID ...
      x-go-package: github.com/demisto/server/domain
    Version:
      type: object
      title: Version represents a version.
      properties:
        Digits:
          type: array
          items:
            type: integer
            format: int64
        Label:
          type: string
      x-go-package: github.com/demisto/server/domain
    OperatorArgument:
      type: object
      title: OperatorArgument ...
      properties:
        isContext:
          type: boolean
          x-go-name: IsContext
        value:
          $ref: '#/components/schemas/AdvanceArg'
      x-go-package: github.com/demisto/server/domain
    PlaybookOutputs:
      description: PlaybookOutputs - array of PlaybookOutput
      type: array
      items:
        $ref: '#/components/schemas/PlaybookOutput'
      x-go-package: github.com/demisto/server/domain
    PlaybookInput:
      description: PlaybookInput represents the playbook input
      type: object
      properties:
        description:
          type: string
          x-go-name: Description
        key:
          type: string
          x-go-name: Key
        required:
          type: boolean
          x-go-name: Required
        value:
          $ref: '#/components/schemas/AdvanceArg'
      x-go-package: github.com/demisto/server/domain
    TaskType:
      description: TaskType is the Task in the playbook context as a node
      type: string
      x-go-package: github.com/demisto/server/domain
    FieldMapping:
      description: FieldMapping - Map a task output (complex or simple value) to an incident field
      type: object
      properties:
        fieldId:
          type: string
          x-go-name: IncidentField
        output:
          $ref: '#/components/schemas/AdvanceArg'
      x-go-package: github.com/demisto/server/domain
    OutputType:
      type: string
      title: OutputType ...
      x-go-package: github.com/demisto/server/domain
    GridColumn:
      type: object
      title: GridColumn ...
      properties:
        displayName:
          type: string
          x-go-name: DisplayName
        fieldCalcScript:
          type: string
          x-go-name: FieldCalcScript
        isDefault:
          type: boolean
          x-go-name: IsDefault
        isReadOnly:
          type: boolean
          x-go-name: IsReadOnly
        key:
          type: string
          x-go-name: Key
        required:
          type: boolean
          x-go-name: Required
        script:
          type: string
          x-go-name: Script
        selectValues:
          type: array
          items:
            type: string
          x-go-name: SelectValues
        type:
          type: string
          x-go-name: Type
        width:
          type: integer
          format: int64
          x-go-name: Width
      x-go-package: github.com/demisto/server/domain
    DataCollectionForm:
      type: object
      title: DataCollectionForm - a data collection form with questions.
      properties:
        description:
          type: string
          x-go-name: Description
        expired:
          type: boolean
          x-go-name: Expired
        questions:
          type: array
          items:
            $ref: '#/components/schemas/Question'
          x-go-name: Questions
        sender:
          type: string
          x-go-name: Sender
        title:
          type: string
          x-go-name: Title
        totalAnswers:
          type: integer
          format: uint64
          x-go-name: TotalAnswers
      x-go-package: github.com/demisto/server/domain
    EvidenceData:
      description: EvidenceData - all evidence properties to evaluate in task process
      type: object
      properties:
        customFields:
          description: This field must have empty json key
          type: object
          additionalProperties:
            $ref: '#/components/schemas/AdvanceArg'
          x-go-name: CustomFields
        description:
          $ref: '#/components/schemas/AdvanceArg'
        occurred:
          $ref: '#/components/schemas/AdvanceArg'
        tags:
          $ref: '#/components/schemas/AdvanceArg'
      x-go-package: github.com/demisto/server/domain
    TaskCondition:
      description: 'TaskCondition - contains a condition and a corresponding label

        if the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)'
      type: object
      properties:
        condition:
          type: array
          items:
            $ref: '#/components/schemas/ArgFilter'
          x-go-name: Condition
        label:
          type: string
          x-go-name: Label
      x-go-package: github.com/demisto/server/domain
    PlaybookTask:
      type: object
      title: PlaybookTask ...
      properties:
        conditions:
          description: Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)
          type: array
          items:
            $ref: '#/components/schemas/TaskCondition'
          x-go-name: Conditions
        continueOnError:
          type: boolean
          x-go-name: ContinueOnError
        defaultAssignee:
          type: string
          x-go-name: DefaultAssignee
        defaultAssigneeComplex:
          $ref: '#/components/schemas/AdvanceArg'
        defaultReminder:
          type: integer
          format: int64
          x-go-name: DefaultReminder
        evidenceData:
          $ref: '#/components/schemas/EvidenceData'
        fieldMapping:
          type: array
          items:
            $ref: '#/components/schemas/FieldMapping'
          x-go-name: FieldMappingArray
        form:
          $ref: '#/components/schemas/DataCollectionForm'
        formDisplay:
          $ref: '#/components/schemas/FormDisplay'
        id:
          type: string
          x-go-name: ID
        ignoreWorker:
          description: Do not run this task in a worker
          type: boolean
          x-go-name: IgnoreWorker
        loop:
          $ref: '#/components/schemas/TaskLoop'
        message:
          $ref: '#/components/schemas/NotifiableItem'
        nextTasks:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
          x-go-name: NextTasks
        note:
          type: boolean
          x-go-name: Note
        quietMode:
          $ref: '#/components/schemas/QuietMode'
        reputationCalc:
          $ref: '#/components/schemas/ReputationCalcAlg'
        restrictedCompletion:
          type: boolean
          x-go-name: RestrictedCompletion
        scriptArguments:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/AdvanceArg'
          x-go-name: ScriptArguments
        separateContext:
          type: boolean
          x-go-name: SeparateContext
        skipUnavailable:
          description: 'SkipUnavailable if true then will check if automation exists, integration of that command is installed and

            active or sub playbook exists in Demisto'
          type: boolean
          x-go-name: SkipUnavailable
        sla:
          $ref: '#/components/schemas/SLA'
        slaReminder:
          $ref: '#/components/schemas/SLA'
        task:
          $ref: '#/components/schemas/Task'
        taskId:
          type: string
          x-go-name: TaskID
        timerTriggers:
          description: SLA fields
          type: array
          items:
            $ref: '#/components/schemas/TimerTrigger'
          x-go-name: TimerTriggers
        type:
          $ref: '#/components/schemas/TaskType'
        view:
          $ref: '#/components/schemas/TaskView'
      x-go-package: github.com/demisto/server/domain
    Task:
      description: Task is the basic task in the task repository that can be associated to an incident via playbook
      type: object
      properties:
        brand:
          type: string
          x-go-name: Brand
        clonedFrom:
          type: string
          x-go-name: ClonedFrom
        comment:
          type: string
          x-go-name: Comment
        conditions:
          type: array
          items:
            type: string
          x-go-name: ConditionnKeys
        description:
          type: string
          x-go-name: Description
        id:
          type: string
          x-go-name: ID
        isCommand:
          type: boolean
          x-go-name: IsCommand
        isLocked:
          type: boolean
          x-go-name: IsLocked
        isSystemTask:
          type: boolean
          x-go-name: IsSystemTask
        isTitleTask:
          type: boolean
          x-go-name: IsTitleTask
        modified:
          type: string
          format: date-time
          x-go-name: Modified
        name:
          type: string
          x-go-name: Name
        playbookId:
          type: string
          x-go-name: PlaybookID
        scriptId:
          type: string
          x-go-name: AutomationScriptID
        sortValues:
          type: array
          items:
            type: string
          x-go-name: SortValues
        tags:
          type: array
          items:
            type: string
          x-go-name: Tags
        type:
          $ref: '#/components/schemas/TaskType'
        version:
          type: integer
          format: int64
          x-go-name: Versn
      x-go-package: github.com/demisto/server/domain
    TaskView:
      description: TaskView represents the view in client of the tasks graph
      type: object
      x-go-package: github.com/demisto/server/domain
    NotifyTimings:
      type: object
      title: NotifyTimings - time control on notify items - retries max count and intervals.
      properties:
        completeAfterReplies:
          type: integer
          format: uint64
          x-go-name: CompleteAfterReplies
        retriesCount:
          type: integer
          format: uint64
          x-go-name: RetriesCount
        retriesInterval:
          type: integer
          format: uint64
          x-go-name: RetriesInterval
      x-go-package: github.com/demisto/server/domain
    PlaybookInputs:
      description: PlaybookInputs - array of PlaybookInput
      type: array
      items:
        $ref: '#/components/schemas/PlaybookInput'
      x-go-package: github.com/demisto/server/domain
    PlaybookOutput:
      description: PlaybookOutput represents the playbook output
      type: object
      properties:
        contextPath:
          type: string
          x-go-name: ContextPath
        description:
          type: string
          x-go-name: Description
        type:
          $ref: '#/components/schemas/OutputType'
      x-go-package: github.com/demisto/server/domain
    SLA:
      type: object
      title: SLA ...
      properties:
        days:
          type: integer
          format: int64
          x-go-name: Days
        hours:
          type: integer
          format: int64
          x-go-name: Hours
        weeks:
          type: integer
          format: int64
          x-go-name: Weeks
      x-go-package: github.com/demisto/server/domain
    QuietMode:
      description: QuietMode quiet mode for playbook task
      type: integer
      format: int64
      x-go-package: github.com/demisto/server/domain
    TimerTrigger:
      type: object
      title: TimerTrigger ...
      properties:
        action:
          $ref: '#/components/schemas/TimerAction'
        fieldName:
          type: string
          x-go-name: FieldName
      x-go-package: github.com/demisto/server/domain
    AdvanceArg:
      description: 'Simple: plain text such as "hello" (constant) or ${File.ID} (DT expression)

        Complex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)'
      type: object
      title: 'AdvanceArg - advance argument can be one of the following:'
      properties:
        complex:
          $ref: '#/components/schemas/ComplexArg'
        simple:
          type: string
          x-go-name: Simple
      x-go-package: github.com/demisto/server/domain
    ReputationCalcAlg:
      type: number
      format: double
      title: ReputationCalcAlg ...
      x-go-package: github.com/demisto/server/domain
    PlaybookView:
      description: PlaybookView represents the view in client of playbook graph
      type: object
      x-go-package: github.com/demisto/server/domain
  securitySchemes:
    api_key:
      type: apiKey
      name: Authorization
      in: header
    csrf_token:
      type: apiKey
      name: X-XSRF-TOKEN
      in: header
    x-xdr-auth-id:
      type: apiKey
      name: x-xdr-auth-id
      in: header