Malwarebytes DNS API

openapi: 3.2.0
info:
  title: ThreatDown DNS API
  description: '# Introduction

    ThreatDown OneView APIs provide you resources to remotely manage the security of your devices from code. It integrates ThreatDown protection into your workflows and pipelines. The following are some of the actions you can do with OneView APIs:


    - Manage the security of your endpoints. - Analyze endpoint assets. - Perform advance analysis on detections of malware, ransomware, exploits, and other threats by ThreatDown Endpoint Agent. - Scan, isolate, remediate, and reboot endpoints. - Create new sites. - Provision OneView users. - Create subscriptions for your customers. - Subscribe to security Webhook events to get notified of detections. ## Authentication


    ThreatDown API uses OAuth2 to allow secure authorization in a simple and standard method from web, mobile, and desktop applications. Refer to the Authentication endpoint to retrieve an `access_token` using your `client_id` and `client_secret`. ## Access'' scopes


    Access scopes are the permissions that applications require for authorization and use. When creating a new application, you can decide the access level the application has to your account''s data. This utility allows you to restrict the scope of access to your account''s data depending on the application''s needs. For example, if you only need to analyze detections found on your endpoint, the read scope will be enough to prevent that application from modifying data or issuing jobs. Specifying access scopes gives you control over the access of your data. You can set different scopes to provide the appropriate credentials to your team. For example, you may want your company''s IT department to be able to isolate infected endpoints, while you may want your analysts to only read data for generating reports. To do so, you can create two applications using different scopes, and provide the right people with the right pair of credentials for programmatic access. See Authentication for available scopes. ## User permissions


    The user associated with the client (i.e. the user that created the OAuth2 application) must have the required permissions to perform the requested operation. If the user does not have sufficient permissions, the API will respond with a `403 Forbidden` status code. For each API, you can find the required permissions in the AUTHORIZATIONS dropdown, under `user_permissions`. Some API requires additional permissions based on the data in the body:

    - **jobs** issue API requires `.performActions` depending on the `command` (\ can be `endpoints`, `softwareInventory`, or `detections`)

    - **notifications** create/update API requires `.view` depending on the `category`

    - **reports** create/update API requires `.view` depending on the `type`


    ## Getting Started


    After having obtained an `access_token`, you will be able to create Sites which you will be able to manage through apis. Once you have created a customer, the next step is to use the Subscription APIs to assign a valid subscription for your customer. This will attach an `account_id` property to your Sites resources that you can use for Endpoints, Detections, Jobs, Webhooks and other APIs for security management. ## Rate Limiting


    ThreatDown API implements a rate-limiting mechanism to prevent abuse. The rate-limiting mechanism is implemented using a leaky bucket algorithm. Once you exceed the available limit, our server will respond with a `429` status code. You can throttle your requests and retry them later. The current limit, which you can see in the table below, has shown to be enough for most use cases. If you encounter `429` error codes, consider taking the following actions to minimize your APIs usage:


    - Subscribe to webhooks events instead of polling the API for reacting to changes. - Throttle the requests you send to the ThreatDown API for not exceeding the limit. - Batch requests when possible. - Contact us and request to increase the API quota for your application. Currently, the default available quota is `360` requests per minute.'
  version: 1.0.0
  x-logo:
    altText: ThreatDown logo
    url: https://assets.threatdown.com/hermes/ThreatDown_Horizontal_Navy.png
    backgroundColor: '#FFFFFF'
servers:
- url: https://api.threatdown.com
tags:


# --- truncated at 32 KB (346 KB total) ---
# Full source: https://artifacts.apis.io/malwarebytes/openapi/malwarebytes-dns-api-openapi.yml