Malwarebytes Usage API
The Usage API from Malwarebytes — 9 operation(s) for usage.
OpenAPI Specification
openapi: 3.2.0
info:
title: Malwarebytes Usage API
version: 1.0.0
description: 'Operations tagged Usage across 2 of this provider''s published API definitions: malwarebytes-threatdown-nebula-openapi.json, malwarebytes-threatdown-oneview-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.threatdown.com
tags:
- name: Usage
paths:
/nebula/v1/usage/histogram:
servers:
- url: https://api.threatdown.com
post:
description: Search usage histogram
summary: Search usage histogram
security:
- client_credentials:
- read
- user_permissions:
- account.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
title: Search logs
description: Search logs.
examples:
- start_date: '2022-04-01'
end_date: '2022-04-30'
required:
- start_date
- end_date
properties:
start_date:
type: string
title: Start date
description: Start date.
default: ''
examples:
- '2022-04-01'
end_date:
type: string
title: End date
description: End date.
default: ''
examples:
- '2022-04-30'
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Get histogram summary
description: Get histogram summary.
additionalProperties: true
examples:
- 2022-03:
BUS-CLOUD-EPR-01:
entitlement_id: 520b00cd-e00e-4f3d-b6c4-367e468c1791
usage: 1
BUS-MBVPM-01:
entitlement_id: cbc82111-00d4-412c-bf2f-cda422ce8796
usage: 1
2022-04:
BUS-CLOUD-EDR-SER-01:
entitlement_id: edec6e1d-f041-4237-8a58-ceb6ec728faa
usage: 10
BUS-CLOUD-EPR-01:
entitlement_id: 57c5651a-7056-4dc4-a4ca-bf9b1f21bf50
usage: 1
BUS-MBVM-01:
entitlement_id: 0af22979-d910-4112-8f80-e5998f2f48ed
usage: 43
BUS-MBVPM-01:
entitlement_id: cbc82111-00d4-412c-bf2f-cda422ce8796
usage: 1
2022-05:
BUS-CLOUD-EDR-SER-01:
entitlement_id: edec6e1d-f041-4237-8a58-ceb6ec728faa
usage: 9
BUS-CLOUD-EPR-01:
entitlement_id: 57c5651a-7056-4dc4-a4ca-bf9b1f21bf50
usage: 1
BUS-CLOUD-IRSL-01:
entitlement_id: 8cc10d67-5476-456e-bce0-1cf58163d69d
usage: 12
BUS-MBVM-01:
entitlement_id: 0af22979-d910-4112-8f80-e5998f2f48ed
usage: 43
BUS-MBVPM-01:
entitlement_id: cbc82111-00d4-412c-bf2f-cda422ce8796
usage: 1
properties:
BUS-CLOUD-IR-01:
type: object
title: Entitlement usage
properties:
entitlement_id:
type: string
title: Identifier of the entitlement
usage:
type: number
title: Number of seats used
BUS-CLOUD-EPP-01:
type: object
title: Entitlement usage
properties:
entitlement_id:
type: string
title: Identifier of the entitlement
usage:
type: number
title: Number of seats used
BUS-CLOUD-EPR-01:
type: object
title: Entitlement usage
properties:
entitlement_id:
type: string
title: Identifier of the entitlement
usage:
type: number
title: Number of seats used
BUS-CLOUD-EPP-SER-01:
type: object
title: Entitlement usage
properties:
entitlement_id:
type: string
title: Identifier of the entitlement
usage:
type: number
title: Number of seats used
BUS-CLOUD-EDR-SER-01:
type: object
title: Entitlement usage
properties:
entitlement_id:
type: string
title: Identifier of the entitlement
usage:
type: number
title: Number of seats used
tags:
- Usage
operationId: api.nebula.search.usage.histogram
/nebula/v1/usage/logs/summary:
servers:
- url: https://api.threatdown.com
post:
description: Search summary of usage
summary: Search summary of usage
security:
- client_credentials:
- read
- user_permissions:
- account.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
title: The root schema
description: The root schema comprises the entire JSON document.
examples:
- start_date: '2022-04-01'
end_date: '2022-04-30'
required:
- start_date
- end_date
properties:
start_date:
type: string
title: Start date
description: Start date.
default: ''
examples:
- '2022-04-01'
end_date:
type: string
title: End date
description: End date.
default: ''
examples:
- '2022-04-30'
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Get usage summary
description: Get usage summary.
additionalProperties: true
examples:
- 2dc6485d-f80e-4f59-bd81-b2436853452a:
BUS-CLOUD-IR-01:
catalog_code: BUS-CLOUD-EPR-01
billable_catalog_code: BUS-CLOUD-EPR-01
combo_code: NEBULA-EPR-COMBO
billable_combo_code: NEBULA-EPR-COMBO
entitlement_id: de21d245-ccfe-4361-89e8-95108613f9dd
billable_entitlement_id: de21d245-ccfe-4361-89e8-95108613f9dd
license_term_type: usage_billing
billable_term_type: usage_billing
licensed_seats: 10
usage: 1
properties: {}
tags:
- Usage
operationId: api.nebula.search.usage.summary
/nebula/v1/usage/logs:
servers:
- url: https://api.threatdown.com
post:
description: Search logs of usage
summary: Search logs of usage
security:
- client_credentials:
- read
- user_permissions:
- account.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
- name: accountid
required: true
in: header
description: Your Nebula account id (Ex. "9256034b-7967-4253-a5d9-260663e4fa4f")
schema:
type: string
pattern: '[\da-fA-F]{8}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{4}-?[\da-fA-F]{12}$'
requestBody:
content:
application/json:
schema:
type: object
title: Search logs
description: Search logs.
examples:
- start_date: '2022-04-01'
end_date: '2022-04-30'
entity_type: machine
page_size: 50
next_cursor: 0
required:
- start_date
- end_date
properties:
start_date:
type: string
title: Start date
description: Start date.
default: ''
examples:
- '2022-04-01'
end_date:
type: string
title: End date
description: End date.
default: ''
examples:
- '2022-04-30'
page_size:
type: integer
title: The page_size schema
default: 0
examples:
- 50
entity_type:
type: string
enum:
- machine
- identity
description: Optional entity type filter. Defaults to machine.
next_cursor:
type: integer
title: The next_cursor schema
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Get logs
description: Usage logs response for a single entity type.
additionalProperties: true
examples:
- results:
- id: 6080220
machine_id: 48ec2d74-ae08-44d6-9154-c05569466f64
entitlement_id: 216b796d-e7f4-46b8-80c6-f1bbb232fa35
billable_entitlement_id: 216b796d-e7f4-46b8-80c6-f1bbb232fa35
license_term_type: usage_billing
billable_term_type: usage_billing
policy_id: 4ce76b02-5f43-4170-a204-80685c408e06
group_id: 4744fb43-a481-4dc5-a335-655268957655
created_at: '2022-04-06T17:48:30Z'
installed_at: '2021-11-01T12:00:00Z'
account_id: e59ce7be-6172-4b3a-b1da-6eede7d110b3
parent_account_id: e59ce7be-6172-4b3a-b1da-6eede7d110b3
os_type: 1
os_platform: 2
catalog_code: BUS-CLOUD-IRSL-01
billable_catalog_code: BUS-CLOUD-IRSL-01
combo_code: NEBULA-IRSL-COMBO
billable_combo_code: NEBULA-IRSL-COMBO
product_code: NCEPR-B
endpoint_name: Mac 2
policy_name: Default Policy
site_name: JCP-DEV
next_cursor: 6080220
- results:
- id: 2000058922
machine_id: null
entitlement_id: 35a6f53e-4c39-4631-8e0f-d641c7270241
billable_entitlement_id: 35a6f53e-4c39-4631-8e0f-d641c7270241
license_term_type: usage_billing
billable_term_type: usage_billing
policy_id: null
group_id: null
created_at: '2026-03-10T16:55:58Z'
installed_at: '2026-03-10T16:55:58Z'
account_id: 3a1fe16c-fa8d-415b-9680-d079666d005f
parent_account_id: 3a1fe16c-fa8d-415b-9680-d079666d005f
os_type: null
os_platform: null
catalog_code: BUS-TDITDR-01
billable_catalog_code: BUS-TDITDR-01
combo_code: NEBULA-ITDR-COMBO
billable_combo_code: NEBULA-ITDR-COMBO
product_code: NCCA-B,TDITD-B
serial_number: null
endpoint_name: null
policy_name: null
site_name: srao_quMTLjyLQ
entity_type: identity
global_identity_id: 103335
user_type: guest
identity_type: user
user_email: dcontini-test@td-eso.com
next_cursor: 2000058922
properties:
next_cursor:
type:
- integer
- 'null'
description: Numeric pagination cursor. Returns 0 when there are no more results.
results:
type:
- array
- object
- 'null'
description: Array by default. Object/null allowed for backward compatibility.
items:
type: object
additionalProperties: true
additionalProperties: true
tags:
- Usage
operationId: api.nebula.search.usagelogs
/oneview/v1/accounts/{account_id}/usage/changelogs/{machine_id}:
servers:
- url: https://api.threatdown.com
post:
description: Get entitlement history for an endpoint
summary: Get entitlement history for an endpoint
security:
- client_credentials:
- read
- user_permissions:
- account.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
title: Search logs
description: Search logs.
examples:
- start_date: '2022-04-01'
end_date: '2022-04-30'
required:
- start_date
- end_date
properties:
start_date:
type: string
title: Start date
description: Start date.
examples:
- '2022-04-01'
end_date:
type: string
title: End date
description: End date.
examples:
- '2022-04-30'
responses:
'200':
description: response schema
content:
application/json:
schema:
type: array
title: Root Schema
items:
type: object
title: A Schema
required:
- machine_id
- machine_name
- policy_id
- policy_name
- group_id
- group_name
- created_at
- license_term_type
- protection
- modules
properties:
machine_id:
type: string
title: The machine_id Schema
examples:
- 687560a3-57d9-4c1d-aa82-6d4890e859c6
machine_name:
type: string
title: The machine_name Schema
examples:
- Windows server 76fab277-4ad8-40bc-a700-6151e3dfb5cc
policy_id:
type: string
title: The policy_id Schema
examples:
- d68b2d8a-ae5e-4df2-baa7-275f8ad62a16
- 4c19e10a-df4c-4d5a-bd14-111b025c62d1
policy_name:
type: string
title: The policy_name Schema
examples:
- EPS with EDR Policy dad6d891-f761-4829-8a8c-05262c57eb48
- Default Policy
group_id:
type: string
title: The group_id Schema
examples:
- 4298ff68-b68b-4faa-bae6-c3810c5be8a9
group_name:
type: string
title: The group_name Schema
examples:
- Default Group
created_at:
type: string
title: The created_at Schema
examples:
- '2023-01-30T17:47:05Z'
- '2023-01-30T17:45:45Z'
- '2023-01-30T17:45:28Z'
license_term_type:
type: string
title: The license_term_type Schema. It is unknown when the first entitlment change is a module addition/removal
examples:
- cloud_evaluation
- usage_billing
- unknown
protection:
type: string
title: The protection Schema. It is unknown when the first entitlment change is a module addition/removal
enum:
- IR
- EDR
- EP
- MOB
- unknown
examples:
- IR
- EDR
- EP
modules:
type: array
title: The modules Schema
items:
type: string
examples:
- machine_id: 687560a3-57d9-4c1d-aa82-6d4890e859c6
machine_name: Windows server 76fab277-4ad8-40bc-a700-6151e3dfb5cc
policy_id: d68b2d8a-ae5e-4df2-baa7-275f8ad62a16
policy_name: EPS with EDR Policy dad6d891-f761-4829-8a8c-05262c57eb48
group_id: 4298ff68-b68b-4faa-bae6-c3810c5be8a9
group_name: Default Group
created_at: '2023-01-30T17:47:05Z'
license_term_type: cloud_evaluation
protection: EDR
modules:
- MBDNS-B
tags:
- Usage
operationId: api.rmm.search.changelogs
/oneview/v1/usage/logs/summary/export:
servers:
- url: https://api.threatdown.com
post:
description: Export usage data
summary: Export usage data
security:
- client_credentials:
- read
- user_permissions:
- account.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
title: Export request
required:
- select
- format
- start_date
- end_date
- account_ids
properties:
start_date:
type: string
title: Start date
description: Start date.
default: ''
examples:
- '2022-04-01'
end_date:
type: string
title: End date
description: End date.
default: ''
examples:
- '2022-04-30'
account_ids:
type: array
title: MSP ids
description: MSP ids.
examples:
- - account_id
items:
type: string
title: The first anyOf schema
default: ''
examples:
- account_id
format:
type: string
title: The output file
enum:
- csv
- xlsx
- html
- ods
- txt
- rtf
- json
download:
type: boolean
title: Whether to instruct the client to download the response as a file. Only clients like browsers are supported
type:
type: string
title: The encoding of the output
enum:
- string
- base64
- binary
default: string
select:
type: array
title: Which fields to select from the response
items:
type: object
title: Field
required:
- field
- newField
properties:
newField:
type: string
title: the new value
field:
type: string
title: The response field to map to a new value
enum:
- site
- site_license
- product_name
- billable_usage_count
- report_month
responses:
'200':
description: Successful response
tags:
- Usage
operationId: api.rmm.search.usage.summary.export
/oneview/v1/usage/histogram:
servers:
- url: https://api.threatdown.com
post:
description: Search usage histogram
summary: Search usage histogram
security:
- client_credentials:
- read
- user_permissions:
- account.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
title: Search logs
description: Search logs.
examples:
- account_ids:
- account_id
required:
- account_ids
properties:
account_ids:
type: array
title: Account ids
description: Account ids.
examples:
- - account_id
items:
type: string
description: Account IDs.
default: ''
examples:
- account_id
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Get histogram summary
description: Get histogram summary.
additionalProperties: true
examples:
- 2022-03:
BUS-CLOUD-EPR-01:
entitlement_id: 520b00cd-e00e-4f3d-b6c4-367e468c1791
usage: 1
BUS-MBVPM-01:
entitlement_id: cbc82111-00d4-412c-bf2f-cda422ce8796
usage: 1
2022-04:
BUS-CLOUD-EDR-SER-01:
entitlement_id: edec6e1d-f041-4237-8a58-ceb6ec728faa
usage: 10
BUS-CLOUD-EPR-01:
entitlement_id: 57c5651a-7056-4dc4-a4ca-bf9b1f21bf50
usage: 1
BUS-MBVM-01:
entitlement_id: 0af22979-d910-4112-8f80-e5998f2f48ed
usage: 43
BUS-MBVPM-01:
entitlement_id: cbc82111-00d4-412c-bf2f-cda422ce8796
usage: 1
2022-05:
BUS-CLOUD-EDR-SER-01:
entitlement_id: edec6e1d-f041-4237-8a58-ceb6ec728faa
usage: 9
BUS-CLOUD-EPR-01:
entitlement_id: 57c5651a-7056-4dc4-a4ca-bf9b1f21bf50
usage: 1
BUS-CLOUD-IRSL-01:
entitlement_id: 8cc10d67-5476-456e-bce0-1cf58163d69d
usage: 12
BUS-MBVM-01:
entitlement_id: 0af22979-d910-4112-8f80-e5998f2f48ed
usage: 43
BUS-MBVPM-01:
entitlement_id: cbc82111-00d4-412c-bf2f-cda422ce8796
usage: 1
properties:
BUS-CLOUD-IR-01:
type: object
title: Entitlement usage
properties:
entitlement_id:
type: string
title: Identifier of the entitlement
usage:
type: number
title: Number of seats used
BUS-CLOUD-EPP-01:
type: object
title: Entitlement usage
properties:
entitlement_id:
type: string
title: Identifier of the entitlement
usage:
type: number
title: Number of seats used
BUS-CLOUD-EPR-01:
type: object
title: Entitlement usage
properties:
entitlement_id:
type: string
title: Identifier of the entitlement
usage:
type: number
title: Number of seats used
BUS-CLOUD-EPP-SER-01:
type: object
title: Entitlement usage
properties:
entitlement_id:
type: string
title: Identifier of the entitlement
usage:
type: number
title: Number of seats used
BUS-CLOUD-EDR-SER-01:
type: object
title: Entitlement usage
properties:
entitlement_id:
type: string
title: Identifier of the entitlement
usage:
type: number
title: Number of seats used
tags:
- Usage
operationId: api.rmm.search.usage.histogram
/oneview/v1/usage/logs/summary:
servers:
- url: https://api.threatdown.com
post:
description: Search summary of usage
summary: Search summary of usage
security:
- client_credentials:
- read
- user_permissions:
- account.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
title: The root schema
description: The root schema comprises the entire JSON document.
examples:
- start_date: '2022-04-01'
end_date: '2022-04-30'
account_ids:
- account_id
required:
- start_date
- end_date
- account_ids
properties:
start_date:
type: string
title: Start date
description: Start date.
default: ''
examples:
- '2022-04-01'
end_date:
type: string
title: End date
description: End date.
default: ''
examples:
- '2022-04-30'
account_ids:
type: array
title: MSP ids
description: MSP ids.
examples:
- - account_id
items:
type: string
title: The first anyOf schema
default: ''
examples:
- account_id
responses:
'200':
description: response schema
content:
application/json:
schema:
type: object
title: Get usage summary
description: Get usage summary.
additionalProperties: true
examples:
- 2dc6485d-f80e-4f59-bd81-b2436853452a:
BUS-CLOUD-IR-01:
catalog_code: BUS-CLOUD-EPR-01
billable_catalog_code: BUS-CLOUD-EPR-01
combo_code: NEBULA-EPR-COMBO
billable_combo_code: NEBULA-EPR-COMBO
entitlement_id: de21d245-ccfe-4361-89e8-95108613f9dd
billable_entitlement_id: de21d245-ccfe-4361-89e8-95108613f9dd
license_term_type: usage_billing
billable_term_type: usage_billing
licensed_seats: 10
usage: 1
properties: {}
tags:
- Usage
operationId: api.rmm.search.usage.summary
/oneview/v1/usage/two-tier/logs/summary/export:
servers:
- url: https://api.threatdown.com
post:
description: Two tier usage summary export
summary: Two tier usage summary export
security:
- client_credentials:
- read
- user_permissions:
- account.view
status:
outage:
- auth
parameters:
- name: authorization
required: true
in: header
description: Authorization token
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
title: Export request
required:
- select
- format
- start_date
# --- truncated at 32 KB (43 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/malwarebytes/refs/heads/main/openapi/malwarebytes-usage-api-openapi.yml