Malwarebytes Schedules API
Scheduled scans allow you to automate scans to run based on a certain schedule, rather than manually triggering a scan. Use these APIs to create and manage your scan schedules.
OpenAPI Specification
openapi: 3.2.0
info:
title: Malwarebytes Schedules API
version: 1.0.0
description: 'Operations tagged Schedules across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Schedules
description: "Scheduled scans allow you to automate scans to run based on a certain schedule, rather than manually triggering a scan. \n\nUse these APIs to create and manage your scan schedules."
paths:
/nebula/v1/schedules/{id}:
servers:
- url: https://api.threatdown.com
delete:
description: Delete a schedule by its id.
summary: Delete a schedule
security:
- client_credentials:
- read
- write
- user_permissions:
- schedules.delete
status:
outage:
- auth
parameters:
- name: id
required: true
in: path
description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
responses:
'200':
description: Successful response
tags:
- Schedules
operationId: api.nebula.delete.schedules
get:
description: Get schedule by id.
summary: Get schedule by id
security:
- client_credentials:
- read
- user_permissions:
- schedules.view
status:
outage:
- auth
parameters:
- name: id
required: true
in: path
description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
additionalProperties: true
title: Schedule Response
properties:
id:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
title: Id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
name:
type: string
title: Name
etag:
type: string
title: ETAG
description: etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property.
command:
type: string
title: Command
examples:
- command.threat.scan
- command.asset.refresh
rrule:
type: string
title: Frequency and start date
examples:
- FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100
enabled:
type: boolean
title: Enabled
default: true
splay:
type: integer
title: Splay
description: Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.
default: 5
minimum: 0
command_data:
type: object
additionalProperties: true
title: Command data
examples:
- schedule_for_windows: true
scan_settings:
pum_detection: Detect
scan_registry: true
type: CustomScan
no_archive: false
fixed_drive: true
scan_path: ''
ark: true
scan_startup: true
pup_detection: Detect
scan_memory: true
remove: true
mac_scan_settings:
remove: true
pup_detection: Ignore
schedule_for_mac: true
properties:
schedule_for_mac:
type: boolean
title: Schedule for Mac
schedule_for_windows:
type: boolean
title: Schedule for Windows
scan_settings:
type: object
additionalProperties: true
title: Scan settings
properties:
type:
type: string
title: Scan method
enum:
- CustomScan
- ThreatScan
- HyperScan
examples:
- CustomScan
- ThreatScan
- HyperScan
remove:
type: boolean
title: Remove
scan_path:
type: string
title: Scan path
scan_memory:
type: boolean
title: Scan memory objects
default: true
scan_registry:
type: boolean
title: Scan registry
scan_startup:
type: boolean
title: Scan startup
fixed_drive:
type: boolean
title: Scan all local drives on endpoints
no_archive:
type: boolean
title: Do not scan archives
ark:
type: boolean
title: Scan for rootkits
pup_detection:
type: string
title: Potentially Unwanted Programs, treat as malware
examples:
- Detect
- Ignore
pum_detection:
type: string
title: Potentially Unwanted Modifications, treat as malware.
examples:
- Detect
- Ignore
mac_scan_settings:
type: object
additionalProperties: true
title: Mac scan settings
properties:
remove:
type: boolean
title: Quarantine found threats automatically
pup_detection:
type: string
title: Treat detections as malware.
examples:
- Detect
- Ignore
group_ids:
type: array
title: Collection of Group IDs
items:
type: string
title: Group ids
tags:
- Schedules
operationId: api.nebula.get.schedule.id
put:
description: Update schedule. You must use "add groups for schedule" to update group route.
summary: Update schedule
security:
- client_credentials:
- read
- write
- user_permissions:
- schedules.edit
status:
outage:
- auth
parameters:
- name: id
required: true
in: path
description: Valid UUID (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
additionalProperties: true
title: Update schedule
required:
- etag
properties:
etag:
type: string
title: Etag
description: etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property.
name:
type: string
title: Name
command:
type: string
title: Command
examples:
- command.threat.scan
- command.asset.refresh
rrule:
type: string
title: Frequency and start date
examples:
- FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100
enabled:
type: boolean
title: Command is enabled
default: true
splay:
type: integer
title: Splay
description: Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.
default: 5
minimum: 0
command_data:
type: object
additionalProperties: true
title: Command data
examples:
- schedule_for_windows: true
scan_settings:
pum_detection: Detect
scan_registry: true
type: CustomScan
no_archive: false
fixed_drive: true
scan_path: ''
ark: true
scan_startup: true
pup_detection: Detect
scan_memory: true
remove: true
mac_scan_settings:
remove: true
pup_detection: Ignore
schedule_for_mac: true
properties:
schedule_for_mac:
type: boolean
title: Schedule for Mac
schedule_for_windows:
type: boolean
title: Schedule for Windows
scan_settings:
type: object
additionalProperties: true
title: Scan settings
properties:
type:
type: string
title: Scan method
enum:
- CustomScan
- ThreatScan
- HyperScan
examples:
- CustomScan
- ThreatScan
- HyperScan
remove:
type: boolean
title: Remove
scan_path:
type: string
title: Scan path
scan_memory:
type: boolean
title: Scan memory objects
default: true
scan_registry:
type: boolean
title: Scan registry
scan_startup:
type: boolean
title: Scan startup
fixed_drive:
type: boolean
title: Scan all local drives on endpoints
no_archive:
type: boolean
title: Do not scan archives
ark:
type: boolean
title: Scan for rootkits
pup_detection:
type: string
title: Potentially Unwanted Programs, treat as malware
enum:
- Detect
- Ignore
pum_detection:
type: string
title: Potentially Unwanted Modifications, treat as malware.
enum:
- Detect
- Ignore
mac_scan_settings:
type: object
additionalProperties: true
title: Mac scan settings
properties:
remove:
type: boolean
title: Quarantine found threats automatically
pup_detection:
type: string
title: Treat detections as malware.
enum:
- Detect
- Ignore
scan_path:
type: array
title: Scan path
items:
type: string
minLength: 1
fixed_drive:
type: boolean
title: Scan all local drives on endpoints
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
additionalProperties: true
title: Schedule Response
properties:
id:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
title: Id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
name:
type: string
title: Name
etag:
type: string
title: ETAG
description: etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property.
command:
type: string
title: Command
examples:
- command.threat.scan
- command.asset.refresh
rrule:
type: string
title: Frequency and start date
examples:
- FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100
enabled:
type: boolean
title: Enabled
default: true
splay:
type: integer
title: Splay
description: Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.
default: 5
minimum: 0
command_data:
type: object
additionalProperties: true
title: Command data
examples:
- schedule_for_windows: true
scan_settings:
pum_detection: Detect
scan_registry: true
type: CustomScan
no_archive: false
fixed_drive: true
scan_path: ''
ark: true
scan_startup: true
pup_detection: Detect
scan_memory: true
remove: true
mac_scan_settings:
remove: true
pup_detection: Ignore
schedule_for_mac: true
properties:
schedule_for_mac:
type: boolean
title: Schedule for Mac
schedule_for_windows:
type: boolean
title: Schedule for Windows
scan_settings:
type: object
additionalProperties: true
title: Scan settings
properties:
type:
type: string
title: Scan method
enum:
- CustomScan
- ThreatScan
- HyperScan
examples:
- CustomScan
- ThreatScan
- HyperScan
remove:
type: boolean
title: Remove
scan_path:
type: string
title: Scan path
scan_memory:
type: boolean
title: Scan memory objects
default: true
scan_registry:
type: boolean
title: Scan registry
scan_startup:
type: boolean
title: Scan startup
fixed_drive:
type: boolean
title: Scan all local drives on endpoints
no_archive:
type: boolean
title: Do not scan archives
ark:
type: boolean
title: Scan for rootkits
pup_detection:
type: string
title: Potentially Unwanted Programs, treat as malware
examples:
- Detect
- Ignore
pum_detection:
type: string
title: Potentially Unwanted Modifications, treat as malware.
examples:
- Detect
- Ignore
mac_scan_settings:
type: object
additionalProperties: true
title: Mac scan settings
properties:
remove:
type: boolean
title: Quarantine found threats automatically
pup_detection:
type: string
title: Treat detections as malware.
examples:
- Detect
- Ignore
group_ids:
type: array
title: Collection of Group IDs
items:
type: string
title: Group ids
tags:
- Schedules
operationId: api.nebula.put.schedule
/nebula/v1/schedules:
servers:
- url: https://api.threatdown.com
get:
description: Get schedules. You must create a separate request "Get schedule by id" to get assigned groups for a schedule. has to be made.
summary: Get schedules
security:
- client_credentials:
- read
- user_permissions:
- schedules.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
- name: next_cursor
required: false
in: query
description: The pagination cursor for next set of results. For further documentation, check Pagination section.
schema:
type: string
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Collection of schedules
required:
- schedules
- total_count
- next_cursor
properties:
schedules:
type: array
title: Schedules
items:
type: object
additionalProperties: true
title: Schedule Response
properties:
id:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
title: Id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
examples:
- 9256034b-7967-4253-a5d9-260663e4fa4f
name:
type: string
title: Name
etag:
type: string
title: ETAG
description: etags are identifiers that change on every update. Their use is to prevent race conditions when multiple clients are modifying the same resource. Supply this tag empty when creating a schedule. When updating, you need to fetch the latest value by GETting a schedule. You should always get the current etag before trying to modify a resource that has an etag property.
command:
type: string
title: Command
examples:
- command.threat.scan
- command.asset.refresh
rrule:
type: string
title: Frequency and start date
examples:
- FREQ=DAILY;INTERVAL=1;DTSTART=20200313T000100
enabled:
type: boolean
title: Enabled
default: true
splay:
type: integer
title: Splay
description: Time randomization window in minutes. Delays task execution by a random amount within this range to distribute load across endpoints.
default: 5
minimum: 0
command_data:
type: object
additionalProperties: true
title: Command data
examples:
- schedule_for_windows: true
scan_settings:
pum_detection: Detect
scan_registry: true
type: CustomScan
no_archive: false
fixed_drive: true
scan_path: ''
ark: true
scan_startup: true
pup_detection: Detect
scan_memory: true
remove: true
mac_scan_settings:
remove: true
pup_detection: Ignore
schedule_for_mac: true
properties:
schedule_for_mac:
type: boolean
title: Schedule for Mac
schedule_for_windows:
type: boolean
title: Schedule for Windows
scan_settings:
type: object
additionalProperties: true
title: Scan settings
properties:
type:
type: string
title: Scan method
enum:
- CustomScan
- ThreatScan
- HyperScan
examples:
- CustomScan
- ThreatScan
- HyperScan
remove:
type: boolean
title: Remove
scan_path:
type: string
title: Scan path
scan_memory:
type: boolean
title: Scan memory objects
default: true
scan_registry:
type: boolean
title: Scan registry
scan_startup:
type: boolean
title: Scan startup
fixed_drive:
type: boolean
title: Scan all local drives on endpoints
no_archive:
type: boolean
title: Do not scan archives
ark:
type: boolean
title: Scan for rootkits
pup_detection:
type: string
title: Potentially Unwanted Programs, treat as malware
examples:
- Detect
- Ignore
pum_detection:
type: string
title: Potentially Unwanted Modifications, treat as malware.
examples:
- Detect
- Ignore
mac_scan_settings:
type: object
additionalProperties: true
title: Mac scan settings
properties:
remove:
type: boolean
title: Quarantine found threats automatically
pup_detection:
type: string
title: Treat detections as malware.
examples:
- Detect
- Ignore
group_ids:
type: array
title: Collection of Group IDs
items:
type: string
title: Group ids
total_count:
type: integer
title: Total Count
description: Total count of results.
next_cursor:
type: string
title: The pagination cursor for next set of results. For further documentation, check Pagination section.
examples:
- eyJzdGFydF9pbmRleCI6MTAwfQ==
tags:
- Schedules
operationId: api.nebula.get.schedules
post:
description: Create schedule. you must use "Add groups for schedule" to add a group route.
summary: Create schedule
security:
- client_credentials:
- read
- write
- user_permissions:
- schedules.create
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
additionalProperties: true
# --- truncated at 32 KB (113 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-schedules-api-openapi.yml