Huntress REST API

{"info":{"title":"Huntress API Reference","description":"\u003c!-- DO NOT LINT FOR FORMATTING, you will break how it appears on the docs site --\u003e\n\u003cp\u003e\u003ca href='https://www.huntress.com/terms-of-service'\u003e© Huntress - All rights reserved\u003c/a\u003e\u003c/p\u003e\n\u003ch1 id='introduction'\u003eIntroduction\u003c/h1\u003e\n\n\u003cp\u003eWebhook event payloads are available via the dropdown menu above the search bar on this page.\u003c/p\u003e\n\n\u003cp\u003eThe Huntress API follows a RESTful pattern. Requests are made via resource-oriented URLs as described in this document and API responses are formatted as JSON data.\u003c/p\u003e\n\n\u003cp\u003eA command-line client is also available for interacting with the API from your terminal. It requires Ruby 3.1+ and has no external dependencies. You can download it from \u003ca href='https://api.huntress.io/api/huntress-cli'\u003ehttps://api.huntress.io/api/huntress-cli\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eAlternatively, if you'd prefer to use an MCP, we have \u003ca href=\"https://support.huntress.io/hc/en-us/articles/50846554117395-Connecting-to-the-Huntress-MCP-Server\"\u003einstructions for setting up the Huntress MCP\u003c/a\u003e. Note that the MCP is read-only, so this is a good option if you're looking for a safer way to access your Huntress data from an LLM.\u003c/p\u003e\n\n\u003cp\u003eIf you\u0026#39;d like to request additional API endpoints or capabilities, \u003ca href=\"https://feedback.huntress.com/\"\u003esubmit feedback\u003c/a\u003e through our feedback portal.\u003c/p\u003e\n\n\u003ch1 id='api-overview'\u003eAPI Overview\u003c/h1\u003e\n\u003cdetails\u003e\n\t\u003csummary\u003e\u003ch2 id='authentication'\u003eAuthentication\u003c/h2\u003e\u003c/summary\u003e\n\u003cdiv class=\"scalar-code-copy\"\u003e\u003cpre class=\"scalar-codeblock-pre\"\u003e\u003ccode class=\"hljs language-curl\"\u003e\u003cspan class=\"hljs-variable\"\u003e$KEY\u003c/span\u003e = \u003c/span\u003e\u003cspan class=\"hljs-built_in\"\u003eecho \u003c/span\u003e\u003cspan class=\"hljs-string\"\u003e\"$HUNTRESS_PUBLIC_KEY:$HUNTRESS_PRIVATE_KEY\"\u003c/span\u003e | \u003cspan class=\"hljs-built_in\"\u003ebase64\u003c/span\u003e\n\u003cspan class=\"hljs-built_in\"\u003ecurl \u003c/span\u003e\u003cspan class=\"hljs-string\"\u003e\"https://api.huntress.io/v1/agents\"\u003c/span\u003e \\ -H \u003cspan class=\"hljs-string\"\u003e\"Authorization: Basic $KEY\"\u003c/span\u003e\n\u003c/code\u003e\u003c/pre\u003e\n\u003c/div\u003e\n\u003cp\u003eTo begin, generate your API Key at \u003ccode\u003e\u0026lt;your_account_subdomain\u0026gt;.huntress.io\u003c/code\u003e. Once you are logged into your account on the Huntress site, check the dropdown menu at the top-right corner of the site header. You should see \u003ccode\u003eAPI Credentials\u003c/code\u003e among the options if your account has been granted access to the Huntress API. Click on the option to continue to the API Key generation page.\u003c/p\u003e\n\n\u003cp\u003eOnce on the API Key generation page, click on the green Setup button to begin the process to generate your API Key. You will be redirected to a page where you will be prompted to generate your API Key. Click the Generate button to generate a public and private key pair for Huntress API access. The inputs on the page will be filled in with your access credentials once you have done so.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eYour API Private Key will only be visible at this stage of API Key generation. Be sure to save the value provided somewhere secure, as once you navigate away from this page, this value will no longer be accessible and you must regenerate your API credentials if your secret key value is lost.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eIf necessary, you can repeat the process to regenerate your API credentials with a new API Key and API Secret Key on the same API Key generation page, at \u003ccode\u003e\u0026lt;your_account_subdomain\u0026gt;.huntress.io/account/api_credentials\u003c/code\u003e.\u003c/p\u003e\n\n\u003cp\u003eThe Huntress API implements basic access authentication. Once you have your API Key and API Secret Key, provide these values as the result of a Base64 encoded string in every request to the Huntress API via the \u003ccode\u003eAuthorization\u003c/code\u003e header. Your request header should look something like \u003ccode\u003eAuthorization: Basic [Base64Encode(\u0026lt;your_api_key\u0026gt;:\u0026lt;your_api_secret_key\u0026gt;)]\u003c/code\u003e. Please refer to the code snippets for further examples.\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\t\u003csummary\u003e\u003ch2 id='rate-limits'\u003eRate Limits\u003c/h2\u003e\u003c/summary\u003e\n\u003cp\u003eEvery Huntress API account is rate limited to 60 requests per minute, on a sliding window. This means that no more than 60 requests can be made within a 60 second time interval between the first request and the last request.\u003c/p\u003e\n\n\u003cp\u003eFor example, if request 1 is made at T0, request 2 is made at T5, and requests 3 through 60 are made at T10, making request 61 at T55 would result in a 429 error response. Making request 61 at T61 would succeed, however making request 62 at T61 would fail, at least until the time has passed T65, corresponding to a minute after request 2 was made.\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\t\u003csummary\u003e\u003ch2 id='http-response-codes'\u003eHTTP Response Codes\u003c/h2\u003e\u003c/summary\u003e\n\u003cp\u003eHuntress follows HTTP standards when delivering responses: a \u003ccode\u003e2xx\u003c/code\u003e response is a success, a \u003ccode\u003e4xx\u003c/code\u003e response indicates an issue with the client request, and a \u003ccode\u003e5xx\u003c/code\u003e response indicates an issue with Huntress servers.\n\u003cbr\u003e\n\u003cbr\u003e\nSpecific error codes are detailed in the following table:\u003c/p\u003e\n\u003ctable\u003e\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eError Status Code\u003c/th\u003e\n\u003cth\u003eDetails\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003e400\u003c/td\u003e\n\u003ctd\u003eThere is an unexpected value in the API request being made.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e401\u003c/td\u003e\n\u003ctd\u003eYour request could not be authenticated. Check that your API key is properly formatted and included in the \u003ccode\u003eAuthorization\u003c/code\u003e header.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e404\u003c/td\u003e\n\u003ctd\u003eThe requested resource is unavailable: either it doesn\u0026#39;t exist, or your account does not hold correct permissions to access it.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e429\u003c/td\u003e\n\u003ctd\u003eYou have made too many requests within the rate limit timeframe. See the previous section on \u003ca href=\"#rate_limits\"\u003erate_limits\u003c/a\u003e for details.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e500\u003c/td\u003e\n\u003ctd\u003e\u003cp\u003eAn error has occurred within Huntress servers.\u003c/p\u003e\u003cp\u003eYou could retry the request, but if you encounter continued errors, please \u003ca href=\"https://support.huntress.io\"\u003econtact Support\u003c/a\u003e with details of your error. If all traffic from Huntress is resulting in 500 responses, please check our \u003ca href=\"https://huntressstatus.statuspage.io/\"\u003eHuntress Status Page\u003c/a\u003e.\u003c/p\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\t\u003csummary\u003e\u003ch2 id='pagination'\u003ePagination\u003c/h2\u003e\u003c/summary\u003e\n\u003cp\u003eCertain Huntress API endpoints utilize a \u003ccode\u003epage_token\u003c/code\u003e and \u003ccode\u003elimit\u003c/code\u003e parameter to specify a window location and size, respectively, to the resources currently being requested.\n\u003cbr\u003e\u003cbr\u003e\nEach API request will also return a pagination object with details about your current pagination state based on the parameters provided. The pagination object contains:\u003cbr\u003e\u003c/p\u003e\n\n\u003ctable\u003e\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eKey\u003c/th\u003e\n\u003cth\u003eType\u003c/th\u003e\n\u003cth\u003eDescription\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003enext_page_token\u003c/td\u003e\n\u003ctd\u003estring\u003c/td\u003e\n\u003ctd\u003eThe token used to request the next page in paginated results. If no page token is included, the first page contains all results.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003enext_page_url\u003c/td\u003e\n\u003ctd\u003estring\u003c/td\u003e\n\u003ctd\u003eURL containing the next page and the limit provided in the original API request, to be used to continue sequentially accessing resources. Only displays when another page can be accessed.\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e\n\u003cbr\u003e\n\u003cp\u003eFollowing is a formatted example of the pagination object in an API response:\u003cbr\u003e\n\u003cdiv class=\"scalar-code-copy\"\u003e\n\u003cpre class=\"scalar-codeblock-pre\"\u003e\n\u003ccode class=\"hljs language-json\"\u003e\u003cspan class=\"hljs-attr\"\u003e\"pagination\"\u003c/span\u003e\u003cspan class=\"hljs-punctuation\"\u003e: {\u003c/span\u003e\n\u003cspan class=\"hljs-attr\"\u003e  \"next_page_url\"\u003c/span\u003e\u003cspan class=\"hljs-punctuation\"\u003e: \u003c/span\u003e\u003cspan class=\"hljs-string\"\u003e\"https://api.huntress.io/v1/agents?page_token=MjAyMi0wMy0wMVQxODo1NDoyNFo\u0026amp;limit=10\"\u003c/span\u003e\u003cspan class=\"hljs-punctuation\"\u003e,\n\u003c/span\u003e\u003cspan class=\"hljs-attr\"\u003e  \"next_page_token\"\u003c/span\u003e\u003cspan class=\"hljs-punctuation\"\u003e: \u003c/span\u003e\u003cspan class=\"hljs-string\"\u003e\"MjAyMi0wMy0wMVQxODo1NDoyNFo\"\u003c/span\u003e\u003cspan class=\"hljs-punctuation\"\u003e\n}\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\n\u003c/div\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\t\u003csummary\u003e\u003ch2 id='request-and-response-format'\u003eRequest and Response Format\u003c/h2\u003e\u003c/summary\u003e\n\t\u003cdetails\u003e\n\t\t\u003csummary\u003e\u003ch3 id='request'\u003eRequest\u003c/h3\u003e\u003c/summary\u003e\n\t\u003cdiv class=\"scalar-code-copy\"\u003e\n\u003cpre class=\"scalar-codeblock-pre\"\u003e\n\u003ccode class=\"hljs language-curl\"\u003e\u003cspan class=\"hljs-built_in\"\u003ecurl\u003c/span\u003e \u003cspan class=\"hljs-string\"\u003e\"https://api.huntress.io/v1/agents?organization_id=1\u0026amp;page_token=MjAyMi0wMy0wMVQxODo1NDoyNFo\"\u003c/span\u003e -H \u003cspan class=\"hljs-string\"\u003e\"Authorization: Basic \u0026lt;Your B64 encoded hash\u0026gt;\"\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\n\t\u003cp\u003eThe base URL for API requests is \u003ccode\u003eapi.huntress.io/v1/\u003c/code\u003e, followed by the resource requested. Resources can be requested either singularly or as a list, which correspond to \u003ccode\u003e/v1/\u0026lt;resources\u0026gt;/:id\u003c/code\u003e or \u003ccode\u003e/v1/\u0026lt;resources\u0026gt;\u003c/code\u003e respectively, with the exception of the \u003ccode\u003e/v1/account\u003c/code\u003e and \u003ccode\u003e/v1/actor\u003c/code\u003e endpoints, which only returns the account associated with the API credentials provided.\u003c/p\u003e\n\t\u003cp\u003eAs an example, \u003ccode\u003eapi.huntress.io/v1/agents\u003c/code\u003e would return a list of agents, while \u003ccode\u003eapi.huntress.io/v1/agents/1\u003c/code\u003e would return a singular agent with ID: 1.\u003c/p\u003e\n\t\u003cp\u003eParameters are provided to the API through a query string. As an example, providing the organization_id filter as a parameter to the \u003ccode\u003e/v1/agents\u003c/code\u003e endpoint would look like \u003ccode\u003eapi.huntress/io/v1/agents?organization_id=1\u003c/code\u003e. Accessing a sequential page with the same filter active would look like \u003ccode\u003eapi.huntress.io/v1/agents?organization_id=1\u0026amp;page_token=MjAyMi0wMy0wMVQxODo1NDoyNFo\u003c/code\u003e.\u003c/p\u003e\n\t\u003c/details\u003e\n\t\u003cdetails\u003e\n\t\t\u003csummary\u003e\u003ch3 id='response'\u003eResponse\u003c/h3\u003e\u003c/summary\u003e\n\t\u003cp\u003eThe Huntress API responds with a JSON object containing requested resources if the request is valid and authorized.\u003c/p\u003e\n\t\u003ch4 id='singular-case'\u003eSingular Case\u003c/h4\u003e\n\t\u003cdiv class=\"scalar-code-copy\"\u003e\n\t\u003cpre class=\"scalar-codeblock-pre\"\u003e\u003ccode class=\"hljs-json\"\u003e\u003cspan class=\"hljs-punctuation\"\u003e{\u003c/span\u003e\n\u003cspan class=\"hljs-attr\"\u003e  \"report\"\u003c/span\u003e\u003cspan class=\"hljs-punctuation\"\u003e: { ... }\n}\u003c/span\u003e\u003c/code\u003e\n\u003c/div\u003e\n\t\u003cp\u003eIn the case of accessing a singular resource, the JSON object in question will contain one key that maps the singular resource to the singular representation of the resource name. As an example, if you were to request \u003ccode\u003eapi.huntress.io/v1/reports/1\u003c/code\u003e, the JSON response would contain a single key \u003ccode\u003ereport\u003c/code\u003e that maps to the report with ID: 1.\u003c/p\u003e\n\t\u003ch4 id='multiple-case'\u003eMultiple Case\u003c/h4\u003e\u003cdiv class=\"highlight\"\u003e\u003cpre class=\"highlight json tab-json\"\u003e\n\u003cpre class=\"scalar-codeblock-pre\"\u003e\u003ccode  class=\"hljs-json\"\u003e\u003cspan class=\"hljs-punctuation\"\u003e{\u003c/span\u003e\n\u003cspan class=\"hljs-attr\"\u003e  \"reports\"\u003c/span\u003e\u003cspan class=\"hljs-punctuation\"\u003e: [ ... ],\u003c/span\u003e\n\u003cspan class=\"hljs-attr\"\u003e  \"pagination\"\u003c/span\u003e\u003cspan class=\"hljs-punctuation\"\u003e: { ... }\u003c/span\u003e\n\u003cspan class=\"hljs-punctuation\"\u003e}\u003c/span\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\n\t\u003cp\u003eWhen accessing a list of resources, the JSON response contains two keys at the root level. The first key is the plural representation of that resource. The second is a \u003ccode\u003epagination\u003c/code\u003e key that represents the current state of pagination based on parameters provided in the original request. As an example, a request to \u003ccode\u003eapi.huntress.io/v1/reports\u003c/code\u003e returns a JSON object with the keys \u003ccode\u003ereports\u003c/code\u003e and \u003ccode\u003epagination\u003c/code\u003e at its root level. Further details on the fields within the pagination object can be seen at \u003ca href=\"#pagination\"\u003ethe relevant section\u003c/a\u003e.\u003c/p\u003e\n\t\u003c/details\u003e\n\u003c/details\u003e\n","version":"1.0.0"},"swagger":"2.0","produces":["application/json"],"securityDefinitions":{"basic_auth":{"type":"basic","desc":"Base 64 encoded string of your Huntress Account API key and API secret."}},"security":[{"basic":["basic_auth"]}],"host":"api.huntress.io","schemes":["https"],"tags":[{"name":"Accounts","description":"Operations about Accounts"},{"name":"Actor","description":"Operations about Actors"},{"name":"Agents","description":"Operations about Agents"},{"name":"Invoices","description":"Operations about Invoices"},{"name":"Escalations","description":"Operations about Escalations"},{"name":"External Recon","description":"Operations about External Recons"},{"name":"Identities","description":"Operations about Identities"},{"name":"Incident Reports","description":"Operations about Incident Reports"},{"name":"Users","description":"Operations about Users"},{"name":"Organizations","description":"Operations about Organizations"},{"name":"Platform Actions","description":"Operations about Platform Actions"},{"name":"Summary Reports","description":"Operations about Summary Reports"},{"name":"Signals","description":"Operations about Signals"},{"name":"Unwanted Access Rules","description":"Operations about Unwanted Access Rules"},{"name":"Known VPNs","description":"Operations about Known VPNs"},{"name":"Reseller","description":"Operations for Reseller-level API credentials. These are mostly the same endpoints available in the rest of the API. However, the account ID is included in the URL, so that you can specify which account's resources you want to access."},{"name":"SIEM","description":"Query your SIEM logs programmatically using \u003ca href=\"https://support.huntress.io/hc/en-us/articles/30113222043155-Searching-Logs-ESQL\"\u003eES|QL (Elasticsearch Query Language)\u003c/a\u003e."}],"paths":{"/v1/reseller/invoices":{"get":{"summary":"List Reseller Invoices","description":"Shows Invoices associated with the current reseller.\n\n**Note:** To see the details of a given invoice, you will\nprobably want to also fetch the associated Account Usage Line Items and\nOrganization Usage Line Items.\n\n**Note:** This endpoint will also return a `pagination` key on the root\nlevel. Please refer to the [pagination\nsection](https://api.huntress.io/docs#pagination) within our docs for\nmore information.\n","produces":["application/json"],"parameters":[{"in":"query","name":"limit","description":"Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.","type":"integer","format":"int32","default":10,"minimum":1,"maximum":500,"required":false},{"in":"query","name":"page_token","description":"Token used to request the next page in paginated results. Defaults to 'null'","type":"string","required":false},{"in":"query","name":"status","description":"Filter by status. One of open, paid, failed, partial_refund, full_refund, draft, voided, processing","type":"string","enum":["open","paid","failed","partial_refund","full_refund","draft","voided","processing"],"required":false}],"responses":{"200":{"description":"List Reseller Invoices","schema":{"type":"object","properties":{"invoices":{"type":"array","items":{"$ref":"#/definitions/Invoice"}},"pagination":{"$ref":"#/definitions/Pagination"}},"required":["invoices","pagination"]}},"400":{"description":"Invalid query parameters"},"403":{"description":"There was an issue with your API credential or permissions.","schema":{"$ref":"#/definitions/Invoice"}}},"tags":["Reseller"],"operationId":"getV1ResellerInvoices"}},"/v1/reseller/invoices/{id}":{"get":{"summary":"Get Reseller Invoice","description":"Shows a specific Reseller Invoice associated with the current\nreseller.\n\nNote: To see the details of this invoice, you will probably\nwant to also fetch the associated Account Usage Line Items and\nOrganization Usage Line Items.\n","produces":["application/json"],"parameters":[{"in":"path","name":"id","type":"integer","format":"int32","required":true}],"responses":{"200":{"description":"Get Reseller Invoice","schema":{"type":"object","properties":{"invoice":{"$ref":"#/definitions/Invoice"}}}},"403":{"description":"There was an issue with your API credential or permissions.","schema":{"$ref":"#/definitions/Invoice"}},"404":{"description":"Invoice not found"}},"tags":["Reseller"],"operationId":"getV1ResellerInvoicesId"}},"/v1/reseller/invoices/{id}/account_usage_line_items":{"get":{"summary":"List Account Usage Line Items","description":"Shows a list of Account Usage Line Items.\n\nThis list provides a detailed breakdown of product usage per account from a given invoice.\n\n**Note:** This endpoint will also return a `pagination` key on the root level.  \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n","produces":["application/json"],"parameters":[{"in":"path","name":"id","type":"integer","format":"int32","required":true},{"in":"query","name":"limit","description":"Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.","type":"integer","format":"int32","default":10,"minimum":1,"maximum":500,"required":false},{"in":"query","name":"page_token","description":"Token used to request the next page in paginated results. Defaults to 'null'","type":"string","required":false}],"responses":{"200":{"description":"List Account Usage Line Items","schema":{"type":"object","properties":{"account_usage_line_items":{"type":"array","items":{"$ref":"#/definitions/AccountUsageLineItem"}},"pagination":{"$ref":"#/definitions/Pagination"}},"required":["account_usage_line_items","pagination"]}},"403":{"description":"There was an issue with your API credential or permissions.","schema":{"$ref":"#/definitions/AccountUsageLineItem"}}},"tags":["Reseller"],"operationId":"getV1ResellerInvoicesIdAccountUsageLineItems"}},"/v1/reseller/invoices/{id}/organization_usage_line_items":{"get":{"summary":"List Organization Usage Line Items","description":"Shows a list of Organization Usage Line Items.\n\nThis list provides a detailed breakdown of product usage per organization from a given invoice.\n\n**Note:** This endpoint will also return a `pagination` key on the root level.  \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n","produces":["application/json"],"parameters":[{"in":"path","name":"id","type":"integer","format":"int32","required":true},{"in":"query","name":"limit","description":"Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.","type":"integer","format":"int32","default":10,"minimum":1,"maximum":500,"required":false},{"in":"query","name":"page_token","description":"Token used to request the next page in paginated results. Defaults to 'null'","type":"string","required":false}],"responses":{"200":{"description":"List Organization Usage Line Items","schema":{"type":"object","properties":{"organization_usage_line_items":{"type":"array","items":{"$ref":"#/definitions/OrganizationUsageLineItem"}},"pagination":{"$ref":"#/definitions/Pagination"}},"required":["organization_usage_line_items","pagination"]}},"403":{"description":"There was an issue with your API credential or permissions.","schema":{"$ref":"#/definitions/OrganizationUsageLineItem"}}},"tags":["Reseller"],"operationId":"getV1ResellerInvoicesIdOrganizationUsageLineItems"}},"/v1/reseller/subscriptions":{"get":{"summary":"List Reseller Subscriptions","description":"Shows subscriptions associated with the current reseller's managed accounts.\n\n**Note:** This endpoint will also return a `pagination` key on the root\nlevel. Please refer to the [pagination\nsection](https://api.huntress.io/docs#pagination) within our docs for\nmore information.\n","produces":["application/json"],"parameters":[{"in":"query","name":"limit","description":"Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.","type":"integer","format":"int32","default":10,"minimum":1,"maximum":500,"required":false},{"in":"query","name":"page_token","description":"Token used to request the next page in paginated results. Defaults to 'null'","type":"string","required":false},{"in":"query","name":"sort_field","description":"Field to sort by. Defaults to 'id'.","type":"string","default":"id","enum":["id","status","minimum","created_at","updated_at"],"required":false},{"in":"query","name":"sort_direction","description":"Sort direction. Defaults to 'desc'.","type":"string","default":"desc","enum":["asc","desc"],"required":false},{"in":"query","name":"product","description":"Filter by product type","type":"string","enum":["edr","ispm","itdr","sat","siem"],"required":false},{"in":"query","name":"status","description":"Filter by status","type":"string","enum":["draft","approved","accepted","active","completed"],"required":false}],"responses":{"200":{"description":"List Reseller Subscriptions","schema":{"type":"object","properties":{"subscriptions":{"type":"array","items":{"$ref":"#/definitions/Subscription"}},"pagination":{"$ref":"#/definitions/Pagination"}},"required":["subscriptions","pagination"]}},"400":{"description":"Invalid query parameters"},"403":{"description":"There was an issue with your API credential or permissions.","schema":{"$ref":"#/definitions/Subscription"}}},"tags":["Reseller"],"operationId":"getV1ResellerSubscriptions"},"post":{"summary":"Create Reseller Subscription","description":"Creates a subscription for a product on a reseller-managed account.\n\n**Note:** This endpoint only allows the creation of subscriptions that\nuse the default terms, conditions, and pricing. Please contact your\naccount admin for any terms that are not covered by our standard API.\n","produces":["application/json"],"consumes":["application/json"],"parameters":[{"name":"SubscriptionCreationParameters","in":"body","required":true,"schema":{"$ref":"#/definitions/SubscriptionCreationParameters"}}],"responses":{"201":{"description":"Create Reseller Subscription","schema":{"type":"object","properties":{"subscription":{"$ref":"#/definitions/Subscription"}}}},"400":{"description":"Invalid parameters"},"404":{"description":"Record not found (likely the account)"},"422":{"description":"Could not create subscription"}},"tags":["Reseller"],"operationId":"SubscriptionCreationParameters"}},"/v1/reseller/subscriptions/{id}":{"get":{"summary":"Get Reseller Subscription","description":"Shows details on a single subscription associated with the current reseller's managed accounts.","produces":["application/json"],"parameters":[{"in":"path","name":"id","type":"integer","format":"int32","required":true}],"responses":{"200":{"description":"Get Reseller Subscription","schema":{"type":"object","properties":{"subscription":{"$ref":"#/definitions/Subscription"}}}},"400":{"description":"Something about the request is malformed."},"404":{"description":"Record not found."}},"tags":["Reseller"],"operationId":"getV1ResellerSubscriptionsId"},"patch":{"summary":"Update Reseller Subscription","description":"Updates a subscription associated with the current reseller's managed accounts.\n\nFor **approved** subscriptions: updates minimum, billing_interval, and purchase_order.\n\nFor **active** subscriptions: toggles `auto_renew` and/or adds units via `additional_units` (with optional `purchase_order`).\n","produces":["application/json"],"consumes":["application/json"],"parameters":[{"in":"path","name":"id","type":"integer","format":"int32","required":true},{"name":"SubscriptionUpdateParameters","in":"body","required":true,"schema":{"$ref":"#/definitions/SubscriptionUpdateParameters"}}],"responses":{"200":{"description":"Update Reseller Subscription","schema":{"type":"object","properties":{"subscription":{"$ref":"#/definitions/Subscription"}}}},"400":{"description":"Something about the request is malformed."},"404":{"description":"Record not found."},"409":{"description":"Subscription is not in a valid status for this update."},"422":{"description":"Could not update subscription."}},"tags":["Reseller"],"operationId":"SubscriptionUpdateParameters"}},"/v1/reseller/subscriptions/{id}/upgrade":{"post":{"summary":"Upgrade Reseller Subscription","description":"Upgrades an active subscription by creating a new subscription with a\nhigher minimum and/or price tier, replacing the existing one.\n\nThis is modeled as a sub-resource because the operation creates a new\nsubscription record rather than modifying the existing one in place.\n","produces":["application/json"],"consumes":["application/json"],"parameters":[{"in":"path","name":"id","type":"integer","format":"int32","required":true},{"name":"SubscriptionUpgradeParameters","in":"body","required":true,"schema":{"$ref":"#/definitions/SubscriptionUpgradeParameters"}}],"responses":{"201":{"description":"Upgrade Reseller Subscription","schema":{"type":"object","properties":{"subscription":{"$ref":"#/definitions/Subscription"}}}},"400":{"description":"Something about the request is malformed."},"404":{"description":"Record not found."},"422":{"description":"Could not upgrade subscription."}},"tags":["Reseller"],"operationId":"SubscriptionUpgradeParameters"}},"/v1/siem/query":{"post":{"summary":"Execute ESQL Query","description":"Execute an ESQL query against your SIEM logs and receive paginated JSON results.\n\nThis endpoint uses POST so that the ESQL query string can be sent in the request body\nrather than as a URL query parameter, avoiding URL length limits for complex queries.\n\nQueries must begin with `FROM logs`. Results are limited to 200 rows per page.\nIf `next_page_token` is present, pass it as `page_token` in a subsequent request\n(with the same `range_start` and `range_end`) to retrieve the next page.\n\n**Response**\n\nReturns a JSON object with two top-level keys:\n\n- `logs` — Array of objects. Each object represents one log record. Keys are ECS field\n  names (e.g. `event.provider`, `host.hostname`). The fields present depend on the columns\n  selected by your ESQL query (e.g. a `KEEP` command). With no column selection, all\n  available ECS fields are returned.\n\n- `pagination` — Object. Contains `next_page_token` (string) when additional results are\n  available; empty object `{}` when all results have been returned. Pass `next_page_token`\n  as `page_token` in your next request to retrieve the following page.\n","produces":["application/json"],"consumes":["application/json"],"parameters":[{"name":"postV1SiemQuery","in":"body","required":true,"schema":{"$ref":"#/definitions/postV1SiemQuery"}}],"responses":{"200":{"description":"Query executed successfully.","schema":{"$ref":"#/definitions/SiemQueryResult"}},"400":{"description":"Missing or invalid request parameters."},"401":{"description":"Authentication credentials are missing or invalid."},"404":{"description":"SIEM query feature is not enabled for this account."},"408":{"description":"Query timed out."},"413":{"description":"Query exceeded memory limit."},"422":{"description":"Invalid ESQL query or query parameters."}},"tags":["SIEM"],"operationId":"postV1SiemQuery"}},"/v1/account":{"get":{"summary":"Get Account","description":"Shows details of the top-level Huntress Account associated with your API credentials.","produces":["application/json"],"responses":{"200":{"description":"Get Account","schema":{"type":"object","properties":{"account":{"$ref":"#/definitions/Account"}}}},"403":{"description":"There was an issue with your API credential or permissions.","schema":{"$ref":"#/definitions/Account"}}},"tags":["Accounts"],"operationId":"getV1Account"}},"/v1/accounts":{"get":{"summary":"List Accounts","description":"Shows all accounts associated with your API credentials.\n\n**Note:** This endpoint will also return a `pagination` key on the root level.  \nPlease refer to the [pagination section](https://api.huntress.io/docs#pagination) within our docs for more information.\n","produces":["application/json"],"parameters":[{"in":"query","name":"limit","description":"Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.","type":"integer","format":"int32","default":10,"minimum":1,"maximum":500,"required":false},{"in":"query","name":"page_token","description":"Token used to request the next page in paginated results. Defaults to 'null'","type":"string","required":false},{"in":"query","name":"sort_field","description":"Field to sort by. Defaults to 'id'.","type":"string","default":"id","enum":["id","name","subdomain","created_at","updated_at"],"required":false},{"in":"query","name":"sort_direction","description":"Sort direction. Defaults to 'desc'.","type":"string","default":"desc","enum":["asc","desc"],"required":false},{"in":"query","name":"status","description":"Filter by status.","type":"string","enum":["enabled","disabled"],"required":false},{"in":"query","name":"name","description":"Filter by account name.","type":"string","required":false},{"in":"query","name":"subdomain","description":"Filter by subdomain.","type":"string","required":false}],"responses":{"200":{"description":"List Accounts","schema":{"type":"object","properties":{"accounts":{"type":"array","items":{"$ref":"#/definitions/Account"}},"pagination":{"$ref":"#/definitions/Pagination"}},"required":["accounts","pagination"]}},"403":{"description":"There was an issue with your API credential or permissions.","schema":{"$ref":"#/definitions/Account"}}},"tags":["Reseller"],"operationId":"getV1Accounts"},"post":{"summary":"Create Account","description":"Create a new account under the reseller associated with the supplied API credential.","produces":["

# --- truncated at 32 KB (219 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/huntress/refs/heads/main/openapi/huntress-rest-openapi.json