Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/huntress:huntress-signals-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Huntress API Reference Signals API
description: '© Huntress - All rights reserved
Introduction
Webhook event payloads are available via the dropdown menu above the search bar on this page.'
version: 1.0.0
servers:
- url: https://api.huntress.io
security:
- basic:
- basic_auth
tags:
- name: Signals
description: Operations about Signals
paths:
/v1/signals:
get:
summary: List Signals
description: 'Shows details of Signals belonging to the account associated with your API credentials.
Signals are used to highlight interesting user or system behaviors that an analyst can reference during a cyber investigation.
A detected Signal could be as broad and low fidelity as the detection of a command line user running whoami, or it could be as specific and high fidelity as detecting a known malware file.
**Note:** This endpoint will also return a `pagination` key on the root level.
Please refer to the pagination section within our docs for more information.'
parameters:
- in: query
name: limit
description: Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
required: false
schema:
type: integer
format: int32
default: 10
maximum: 500
minimum: 1
- in: query
name: page_token
description: Token used to request the next page in paginated results. Defaults to 'null'
required: false
schema:
type: string
- in: query
name: sort_field
description: Field to sort by. Defaults to 'id'.
required: false
schema:
type: string
enum:
- id
- created_at
- updated_at
- status
default: id
- in: query
name: sort_direction
description: Sort direction. Defaults to 'desc'.
required: false
schema:
type: string
enum:
- asc
- desc
default: desc
- in: query
name: investigated_at_min
description: Filter by an ISO-8601 formatted date string that represents the lower bound of the search range for the investigated_at date.
required: false
schema:
type: string
- in: query
name: investigated_at_max
description: Filter by an ISO-8601 formatted date string that represents the upper bound of the search range for the investigated_at date.
required: false
schema:
type: string
- in: query
name: entity_type
description: Filter by the entity type that the Signal originated from. This filter can be used without specifying entity_id.
required: false
schema:
type: string
enum:
- user_entity
- source
- mailbox
- service_principal
- agent
- identity
- in: query
name: entity_id
description: Filter by the entity ID that the Signal originated from. Must be used in tandem with entity_type parameter.
required: false
schema:
type: string
- in: query
name: organization_id
description: Filter by organization ID within Huntress account
required: false
schema:
type: integer
format: int32
- in: query
name: types
description: 'Filter by the types of Signal, must be comma-separated string containing the values: `Antivirus, Process Insights, Managed ITDR, Footholds, MDE Detections, SIEM, Ransomware Canaries, Favicon Detections, Attack Disruptions, App Control`'
required: false
schema:
type: string
- in: query
name: statuses
description: 'Filter by status. Must be comma-separated string containing the values: `reported`, `closed`'
required: false
schema:
type: string
responses:
'200':
description: List Signals
content:
application/json:
schema:
type: object
properties:
signals:
type: array
items:
$ref: '#/components/schemas/Signal'
pagination:
$ref: '#/components/schemas/Pagination'
required:
- signals
- pagination
'403':
description: There was an issue with your API credential or permissions.
content:
application/json:
schema:
$ref: '#/components/schemas/Signal'
tags:
- Signals
operationId: getV1Signals
/v1/signals/{id}:
get:
summary: Get Signal
description: 'Shows details of a single Signal belonging to the account associated with your API credentials.
Signals are used to highlight interesting user or system behaviors that an analyst can reference during a cyber investigation.
A detected Signal could be as broad and low fidelity as the detection of a command line user running whoami, or it could be as specific and high fidelity as detecting a known malware file.'
parameters:
- in: path
name: id
description: Signal ID within Huntress account
required: true
schema:
type: integer
format: int32
responses:
'200':
description: Get Signal
content:
application/json:
schema:
type: object
properties:
signal:
$ref: '#/components/schemas/Signal'
'403':
description: There was an issue with your API credential or permissions.
content:
application/json:
schema:
$ref: '#/components/schemas/Signal'
tags:
- Signals
operationId: getV1SignalsId
components:
schemas:
Pagination:
type: object
properties:
next_page_url:
type: string
next_page_token:
type: string
description: Pagination model
Signal:
type: object
properties:
id:
type: integer
format: int64
example: 1
description: A unique identifier for the signal.
created_at:
type: string
format: date-time
example: '2025-06-26T18:57:03Z'
description: ISO-8601 formatted timestamp for when this signal was created.
details:
type: object
example:
rule_name: Firewall Disabled via Netsh
username: admin22
process_name: C:\WINDOWS\system32\netsh.exe
command_line: NetSh.exe Advfirewall set allprofiles state off
registry_key: ''
file_path: ''
file_rename_target: ''
cleartext: ''
description: Additional details attached to this signal. These details differ based on the signal type and contain information about where the signal originated.
entity:
type: object
example:
id: 72183
name: Laptop 52
type: agent
description: Additional details about the entity from which the signal originated. This will always contain an ID, Type and Name.
investigated_at:
type: string
example: '2025-06-26T18:57:03Z'
description: ISO-8601 formatted timestamp for when this signal was investigated.
investigation_context:
type: string
example: False Positive, Business Accepted Risk
description: Represents categories attached to the signal by a SOC analyst which give extra insight on the investigation.
name:
type: string
example: Firewall Disabled via Netsh
description: The name of the signal.
organization:
type: object
example:
id: 232
name: Huntress
description: Contains information about the organization this signal came from. Includes the organization ID and name.
status:
type: string
example: closed
description: 'The status of the signal. Can be one of: `reported`, `closed`'
type:
type: string
example: Process Insights
description: 'The type of the signal. Can be one of: `Antivirus, Process Insights, Managed ITDR, Footholds, MDE Detections, SIEM, Ransomware Canaries, Favicon Detections, Attack Disruptions, App Control`'
updated_at:
type: string
format: date-time
example: '2025-06-26T18:57:03Z'
description: ISO-8601 formatted timestamp for when this signal was last updated.
description: Signal model
securitySchemes:
basic_auth:
type: http
scheme: basic