SenseOn API

openapi: 3.1.0
info:
  title: SenseOn API
  version: '2026-10-24'
  description: 'GENERATED FROM DOCUMENTATION by API Evangelist on 2026-10-24: 30 operation(s) read from 15 public documentation page(s) (each
    operation names its page in x-source). This is not the provider''s published contract; SenseOn has published no machine-readable contract
    that the pipeline could find. Engine: local.'
  x-evidence-tiers:
    code-example: 3
    documentation: 27
    pages-with-code: 13
    pages-read: 15
  x-generated-from: documentation
  x-provenance: generated
  x-authored-by: API Evangelist
  x-generated: '2026-10-24'
  x-generator: generate-contract-from-docs.py
  x-engine: local
  x-sources:
  - https://docs.senseon.io/en/latest/api_reference
  - https://docs.senseon.io/en/latest/endpoint_requirements
  - https://www.senseon.io/developers
  - https://docs.senseon.io/en/latest/log_ingestion/detailed_configuration_examples
  - https://docs.senseon.io/en/latest/manual_installation
  - https://docs.senseon.io/en/latest/automated_deployment/intune_macos_deployment
  - https://docs.senseon.io/en/latest/automated_deployment/jamf_pro_deployment
  - https://docs.senseon.io/en/latest/automated_deployment/kandji_deployment
  - https://docs.senseon.io/en/latest/automated_deployment/ninjaone_deployment
  - https://docs.senseon.io/en/latest/aws_deploy
  - https://docs.senseon.io/en/latest/product_features/ai_summaries
  - https://docs.senseon.io/en/latest/log_ingestion/configuration
  - https://docs.senseon.io/en/latest/log_ingestion/kubernetes_configuration
  - https://docs.senseon.io/en/latest/log_ingestion/log_ingestion_faqs
  - https://docs.senseon.io/en/latest/troubleshooting
servers:
- url: https://<your-tenant>.senseon.io
paths:
  /:
    get:
      operationId: get
      tags:
      - Api
      summary: GET /
      x-source: https://docs.senseon.io/en/latest/api_reference
      responses:
        '200':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -H \"Authorization: Bearer <token>\"  \"https://<your-tenant>.senseon.io/api/v1/settings?names=notifications.*\" \n Each\
          \ returned setting includes its name , current value , kind , friendly_name , description , and whether your token has update_permission\
          \ . \n Personal Access Token API Endpoints \n Personal Access Tokens (PATs) can be managed programmatically through the Customer Accessible\
          \ API (CAA"
    post:
      operationId: post
      tags:
      - Api
      summary: POST /
      x-source: https://docs.senseon.io/en/latest/log_ingestion/detailed_configuration_examples
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostRequest'
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -X POST https://<code-name>-collector.snson.net  -H \"Content-Type: application/json\"  -d '{\"timestamp\": \"2025-10-17T10:00:00Z\"\
          , \"source\": \"test\", \"message\": \"Connection test\"}' \n Expected response: \n- HTTP 201 Created - Log accepted successfully\n\
          - HTTP 200 OK - Also indicates success \n If this works, your collector is ready. Proceed to configure your specific log source. \n\
          \ If this fails: \n- V"
  /fluent/fluent-bit/master/install.sh:
    get:
      operationId: get_fluent_fluent_bit_master_install_sh
      tags:
      - Fluent
      summary: GET /fluent/fluent-bit/master/install.sh
      x-source: https://docs.senseon.io/en/latest/log_ingestion/detailed_configuration_examples
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: curl https://raw.githubusercontent.com/fluent/fluent-bit/master/install.sh | sh
  /install.sh:
    get:
      operationId: get_install_sh
      tags:
      - Install
      summary: Running the install command on first boot
      x-source: https://docs.senseon.io/en/latest/endpoint_requirements
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /senseonapi/caa/pats:
    get:
      operationId: get_senseonapi_caa_pats
      tags:
      - Senseonapi
      summary: List tokens owned by the authenticated user.
      x-source: https://docs.senseon.io/en/latest/api_reference
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
    post:
      operationId: post_senseonapi_caa_pats
      tags:
      - Senseonapi
      summary: Create a new Personal Access Token.
      x-source: https://docs.senseon.io/en/latest/api_reference
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostSenseonapiCaaPatsRequest'
      responses:
        '201':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostSenseonapiCaaPatsResponse'
      x-evidence:
        kind: documentation
  /senseonapi/caa/pats/all:
    get:
      operationId: get_senseonapi_caa_pats_all
      tags:
      - Senseonapi
      summary: List tokens for all users (requires ui/caa_pat/admin permission).
      x-source: https://docs.senseon.io/en/latest/api_reference
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /senseonapi/caa/pats/scopes:
    get:
      operationId: get_senseonapi_caa_pats_scopes
      tags:
      - Senseonapi
      summary: Return the scopes assigned to the authenticating token.
      x-source: https://docs.senseon.io/en/latest/api_reference
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetSenseonapiCaaPatsScopesResponse'
      x-evidence:
        kind: documentation
  /senseonapi/caa/pats/{patId}:
    delete:
      operationId: delete_senseonapi_caa_pats_patId
      tags:
      - Senseonapi
      summary: Revoke a token by its ID (returns HTTP 204 on success).
      x-source: https://docs.senseon.io/en/latest/api_reference
      parameters:
      - name: patId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /senseonapi/service_accounts:
    get:
      operationId: get_senseonapi_service_accounts
      tags:
      - Senseonapi
      summary: List all service accounts.
      x-source: https://docs.senseon.io/en/latest/api_reference
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
    post:
      operationId: post_senseonapi_service_accounts
      tags:
      - Senseonapi
      summary: Create a service account.
      x-source: https://docs.senseon.io/en/latest/api_reference
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostSenseonapiServiceAccountsRequest'
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /senseonapi/service_accounts/{userId}:
    delete:
      operationId: delete_senseonapi_service_accounts_userId
      tags:
      - Senseonapi
      summary: Delete a service account and revoke its token (returns HTTP 204 on success)
      description: Delete a service account and revoke its token (returns HTTP 204 on success)
      x-source: https://docs.senseon.io/en/latest/api_reference
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
    get:
      operationId: get_senseonapi_service_accounts_userId
      tags:
      - Senseonapi
      summary: Retrieve a single service account
      description: Retrieve a single service account
      x-source: https://docs.senseon.io/en/latest/api_reference
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
    patch:
      operationId: patch_senseonapi_service_accounts_userId
      tags:
      - Senseonapi
      summary: Update a service account (only the fields supplied are changed)
      description: Update a service account (only the fields supplied are changed)
      x-source: https://docs.senseon.io/en/latest/api_reference
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchSenseonapiServiceAccountsUseridRequest'
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /senseonapi/service_accounts/{userId}/token:
    delete:
      operationId: delete_senseonapi_service_accounts_userId_token
      tags:
      - Senseonapi
      summary: Revoke the account's active token (returns HTTP 204 on success)
      description: Revoke the account's active token (returns HTTP 204 on success)
      x-source: https://docs.senseon.io/en/latest/api_reference
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
    post:
      operationId: post_senseonapi_service_accounts_userId_token
      tags:
      - Senseonapi
      summary: Issue the account's token, revoking any existing one
      description: Issue the account's token, revoking any existing one
      x-source: https://docs.senseon.io/en/latest/api_reference
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostSenseonapiServiceAccountsUseridTokenRequest'
      responses:
        '201':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostSenseonapiServiceAccountsUseridTokenResponse'
      x-evidence:
        kind: documentation
  /senseonapi/users/current/totp:
    post:
      operationId: post_senseonapi_users_current_totp
      tags:
      - Senseonapi
      summary: Endpoint to set up TOTP for the current user
      description: Endpoint to set up TOTP for the current user
      x-source: https://docs.senseon.io/en/latest/api_reference
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /senseonapi/users/resend-invite:
    get:
      operationId: get_senseonapi_users_resend_invite
      tags:
      - Senseonapi
      summary: Endpoint to resend a user invite
      description: Endpoint to resend a user invite
      x-source: https://docs.senseon.io/en/latest/api_reference
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/cases:
    post:
      operationId: post_v1_cases
      tags:
      - Cases
      summary: Create a new case (includes any AI summaries that have been generated already on cases).
      x-source: https://docs.senseon.io/en/latest/api_reference
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/cases/{caseId}:
    get:
      operationId: get_v1_cases_caseId
      tags:
      - Cases
      summary: Retrieves case details including summaries, but only if they've been generated already.
      x-source: https://docs.senseon.io/en/latest/api_reference
      parameters:
      - name: caseId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/cases/{caseId}/state:
    patch:
      operationId: patch_v1_cases_caseId_state
      tags:
      - Cases
      summary: Update the state of a security case.
      x-source: https://www.senseon.io/developers
      parameters:
      - name: caseId
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchV1CasesCaseidStateRequest'
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/cases/{caseId}/summary:
    post:
      operationId: post_v1_cases_caseId_summary
      tags:
      - Cases
      summary: Generates (or regenerates) a new LLM summary for a specific case.
      x-source: https://docs.senseon.io/en/latest/api_reference
      parameters:
      - name: caseId
        in: path
        required: true
        schema:
          type: string
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/devices:
    get:
      operationId: get_v1_devices
      tags:
      - Devices
      summary: Read registered device information.
      x-source: https://www.senseon.io/developers
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/devices/{deviceId}:
    get:
      operationId: get_v1_devices_deviceId
      tags:
      - Devices
      summary: Read registered device information for one device.
      x-source: https://www.senseon.io/developers
      parameters:
      - name: deviceId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/observations/list:
    post:
      operationId: post_v1_observations_list
      tags:
      - Observations
      summary: List security observations.
      x-source: https://www.senseon.io/developers
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV1ObservationsListRequest'
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/observations/{observationId}:
    get:
      operationId: get_v1_observations_observationId
      tags:
      - Observations
      summary: Retrieve a single security observation.
      x-source: https://www.senseon.io/developers
      parameters:
      - name: observationId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/settings:
    get:
      operationId: get_v1_settings
      tags:
      - Settings
      summary: Read one or more settings.
      x-source: https://docs.senseon.io/en/latest/api_reference
      parameters:
      - name: names
        in: query
        required: true
        schema:
          type: string
        description: Comma‑separated list of setting names or wildcard patterns to read.
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetV1SettingsResponse'
      x-evidence:
        kind: documentation
    put:
      operationId: put_v1_settings
      tags:
      - Settings
      summary: Update one or more settings.
      x-source: https://docs.senseon.io/en/latest/api_reference
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PutV1SettingsRequest'
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/telemetry/query:
    post:
      operationId: post_v1_telemetry_query
      tags:
      - Telemetry
      summary: Queue a raw telemetry query, then retrieve its result from GET /v1/telemetry/result/{query_id}.
      x-source: https://www.senseon.io/developers
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV1TelemetryQueryRequest'
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/telemetry/result/{queryId}:
    get:
      operationId: get_v1_telemetry_result_queryId
      tags:
      - Telemetry
      summary: Retrieve the result of a queued telemetry query.
      x-source: https://www.senseon.io/developers
      parameters:
      - name: queryId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
components:
  schemas:
    GetResponse:
      type: object
      properties:
        name:
          type: string
        expiry_at:
          type: integer
        scopes:
          type: array
          items:
            type: string
    PostRequest:
      type: object
      properties:
        timestamp:
          type: string
          format: date-time
        source:
          type: string
        message:
          type: string
    PostSenseonapiCaaPatsRequest:
      type: object
      properties:
        name:
          type: string
          description: Name of the token.
        expiry_at:
          type: integer
          description: Expiration timestamp in milliseconds since the Unix epoch.
        scopes:
          type: array
          description: Array of scope strings.
      required:
      - name
      - expiry_at
      - scopes
    PostSenseonapiCaaPatsResponse:
      type: object
      properties:
        pat_id:
          type: string
          description: UUID of the created token.
        token:
          type: string
          description: The token value (returned only once).
    GetSenseonapiCaaPatsScopesResponse:
      type: object
      properties:
        scopes:
          type: array
          description: List of scope strings.
    PostSenseonapiServiceAccountsRequest:
      type: object
      properties:
        name:
          type: string
          description: Unique name of the service account.
        description:
          type: string
          description: Description of the service account.
      required:
      - name
    PatchSenseonapiServiceAccountsUseridRequest:
      type: object
      properties:
        name:
          type: string
        description:
          type: string
        enabled:
          type: boolean
    PostSenseonapiServiceAccountsUseridTokenRequest:
      type: object
      properties:
        scopes:
          type: array
          description: List of token scopes
        expiry_at:
          type: integer
          description: Timestamp in milliseconds since the Unix epoch, or null for no expiry
      required:
      - scopes
    PostSenseonapiServiceAccountsUseridTokenResponse:
      type: object
      properties:
        pat_id:
          type: string
        scopes:
          type: array
        expiry_at:
          type: integer
        token:
          type: string
    PatchV1CasesCaseidStateRequest:
      type: object
      properties:
        state:
          type: string
          description: New state value for the case.
      required:
      - state
    PostV1ObservationsListRequest:
      type: object
      properties:
        query:
          type: string
          description: Query object to filter observations.
      required:
      - query
    GetV1SettingsResponse:
      type: object
      properties:
        name:
          type: string
          description: Setting name.
        value:
          type: string
          description: Current value of the setting.
        kind:
          type: string
          description: Data type of the setting.
        friendly_name:
          type: string
          description: Human‑readable name.
        description:
          type: string
          description: Description of the setting.
        update_permission:
          type: boolean
          description: Whether the token can update this setting.
    PutV1SettingsRequest:
      type: object
      properties:
        <setting_name>:
          type: string
          description: Map of setting names to new values.
      required:
      - <setting_name>
    PostV1TelemetryQueryRequest:
      type: object
      properties:
        query:
          type: string
          description: Telemetry query definition.
      required:
      - query
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
security:
- bearer: []
tags:
- name: Api
- name: Cases
- name: Devices
- name: Fluent
- name: Install
- name: Observations
- name: Senseonapi
- name: Settings
- name: Telemetry