SpecterOps Asset Isolation API

openapi: 3.0.3
info:
  title: BloodHound AD Base Entities Asset Isolation API
  contact:
    name: BloodHound Enterprise Support
    url: https://bloodhound.specterops.io/
    email: support@specterops.io
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
  version: v2
  description: "This is the API that drives BloodHound Enterprise and Community Edition.\nEndpoint availability is denoted using the `Community` and `Enterprise` tags.\n\nContact information listed is for BloodHound Enterprise customers. To get help with\nBloodHound Community Edition, please join our\n[Slack community](https://ghst.ly/BHSlack/).\n\n## Authentication\n\nThe BloodHound API supports two kinds of authentication: JWT bearer tokens and Signed Requests.\nFor quick tests or one-time calls, the JWT used by your browser may be the simplest route. For\nmore secure and long lived API integrations, the recommended option is signed requests.\n\n### JWT Bearer Token\n\nThe API will accept calls using the following header structure in the HTTP request:\n```\nAuthorization: Bearer $JWT_TOKEN\n```\nIf you open the Network tab within your browser, you will see calls against the API made utilizing\nthis structure. JWT bearer tokens are supported by the BloodHound API, however it is recommended\nthey only be used for temporary access. JWT tokens expire after a set amount of time and require\nre-authentication using secret credentials.\n\n### Signed Requests\n\nSigned requests are the recommended form of authentication for the BloodHound API. Not only are\nsigned requests better for long lived integrations, they also provide more security for the\nrequests being sent. They provide authentication of the client, as well as verification of request\nintegrity when received by the server.\n\nSigned requests consist of three main parts: The client token ID, the request timestamp, and a\nbase64 encoded HMAC signature. These three pieces of information are sent with the request using\nthe following header structure:\n\n```\nAuthorization: bhesignature $TOKEN_ID\nRequestDate: $RFC3339_DATETIME\nSignature: $BASE64ENCODED_HMAC_SIGNATURE\n```\n\nTo use signed requests, you will need to generate an API token. Each API token generated in the\nBloodHound API comes with two parts: The Token ID, which is used in the `Authorization` header,\nand the Token Key, which is used as part of the HMAC hashing process. The token ID should be\nconsidered as public (like a username) and the token key should be considered secret (like a\npassword). Once an API token is generated, you can use the key to sign requests.\n\nFor more documentation about how to work with authentication in the API, including examples\nof how to generate an API token in the BloodHound UI, please refer to this support doc:\n[Working with the BloodHound API](https://bloodhound.specterops.io/integrations/bloodhound-api/working-with-api).\n\n#### Signed Request Pseudo-code Example\n\nFirst, a digest is initiated with HMAC-SHA-256 using the token key as the digest key:\n```python\ndigester = hmac.new(sha256, api_token_key)\n```\n\nOperationKey is the first HMAC digest link in the signature chain. This prevents replay attacks that\nseek to modify the request method or URI. It is composed of concatenating the request method and\nthe request URI with no delimiter and computing the HMAC digest using the token key as the digest\nsecret:\n```python\n# Example: GET /api/v2/test/resource HTTP/1.1\n# Signature Component: GET/api/v2/test/resource\ndigester.write(request_method + request_uri)\n\n# Update the digester for further chaining\ndigester = hmac.New(sha256, digester.hash())\n```\n\nDateKey is the next HMAC digest link in the signature chain. This encodes the RFC3339\nformatted datetime value as part of the signature to the hour to prevent replay\nattacks that are older than max two hours. This value is added to the signature chain\nby cutting off all values from the RFC3339 formatted datetime from the hours value\nforward:\n```python\n# Example: 2020-12-01T23:59:60Z\n# Signature Component: 2020-12-01T23\nrequest_datetime = date.now()\ndigester.write(request_datetime[:13])\n\n# Update the digester for further chaining\ndigester = hmac.New(sha256, digester.hash())\n```\n\nBody signing is the last HMAC digest link in the signature chain. This encodes the\nrequest body as part of the signature to prevent replay attacks that seek to modify\nthe payload of a signed request. In the case where there is no body content the\nHMAC digest is computed anyway, simply with no values written to the digester:\n```python\nif request.body is not empty:\n  digester.write(request.body)\n```\n\nFinally, base64 encode the final hash and write the three required headers before\nsending the request:\n```python\nencoded_hash = base64_encode(digester.hash())\nrequest.header.write('Authorization', 'bhesignature ' + token_id)\nrequest.header.write('RequestDate', request_datetime)\nrequest.header.write('Signature', encoded_hash)\n```\n"
servers:
- url: /
  description: This is the base path for all endpoints, relative to the domain where the API is being hosted.
security:
- JWTBearerToken: []
- SignedRequest: []
  RequestDate: []
  HMACSignature: []
tags:
- name: Asset Isolation
paths:
  /api/v2/asset-groups:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    get:
      operationId: ListAssetGroups
      summary: List all asset isolation groups
      description: Lists all asset isolation groups.
      tags:
      - Asset Isolation
      parameters:
      - name: sort_by
        description: Sortable columns are `name`, `tag`, and `member_count`.
        in: query
        schema:
          $ref: '#/components/schemas/api.params.query.sort-by'
      - name: name
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      - name: tag
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      - name: system_group
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      - name: member_count
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.integer'
      - name: id
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.integer'
      - $ref: '#/components/parameters/query.created-at'
      - $ref: '#/components/parameters/query.updated-at'
      - $ref: '#/components/parameters/query.deleted-at'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      asset_groups:
                        type: array
                        items:
                          $ref: '#/components/schemas/model.asset-group'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
    post:
      operationId: CreateAssetGroup
      summary: Create an asset group
      description: Creates an asset group
      tags:
      - Asset Isolation
      requestBody:
        description: The request body for creating an asset group
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/model.asset-group'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/model.asset-group'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/asset-groups/{asset_group_id}:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    - name: asset_group_id
      description: ID of the asset group record to retrieve
      in: path
      required: true
      schema:
        type: integer
        format: int32
    get:
      operationId: GetAssetGroup
      summary: Get asset group by ID
      description: Retrieve asset group by ID
      tags:
      - Asset Isolation
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/model.asset-group'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
    put:
      operationId: UpdateAssetGroup
      summary: Update an asset group
      description: Updates an asset group
      tags:
      - Asset Isolation
      requestBody:
        description: The request body for updating an asset group.
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/model.asset-group'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
    delete:
      operationId: DeleteAssetGroup
      summary: Delete an asset group
      description: Deletes an asset group
      tags:
      - Asset Isolation
      responses:
        '200':
          $ref: '#/components/responses/no-content'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '409':
          description: '**Conflict**

            The client tried to delete a system defined asset group.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api.error-wrapper'
              example:
                http_status: 409
                timestamp: '2024-02-19T19:27:43.866Z'
                request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
                errors:
                - context: agi
                  message: Cannot delete a system defined asset group.
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/asset-groups/{asset_group_id}/collections:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    - name: asset_group_id
      description: ID of the asset_group record to retrieve
      in: path
      required: true
      schema:
        type: integer
        format: int32
    get:
      operationId: ListAssetGroupCollections
      summary: List asset group collections
      description: Returns all historical memberships if no URL params are specified.
      tags:
      - Asset Isolation
      parameters:
      - name: sort_by
        in: query
        schema:
          $ref: '#/components/schemas/api.params.query.sort-by'
      - name: id
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.integer'
      - $ref: '#/components/parameters/query.created-at'
      - $ref: '#/components/parameters/query.updated-at'
      - $ref: '#/components/parameters/query.deleted-at'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/model.asset-group-collection'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/asset-groups/{asset_group_id}/selectors:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    - name: asset_group_id
      description: ID of the asset_group record to retrieve
      in: path
      required: true
      schema:
        type: integer
        format: int32
    post:
      operationId: UpdateAssetGroupSelectorsDeprecated
      deprecated: true
      summary: Update asset group selectors
      description: DEPRECATED use PUT instead. Updates asset group selectors.
      tags:
      - Asset Isolation
      requestBody:
        description: The request body for updating asset group selectors
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/model.asset-group-selector-spec'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      added_selectors:
                        type: array
                        items:
                          $ref: '#/components/schemas/model.asset-group-selector'
                      removed_selectors:
                        type: array
                        items:
                          $ref: '#/components/schemas/model.asset-group-selector'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
    put:
      operationId: UpdateAssetGroupSelectors
      summary: Update asset group selectors
      description: Updates asset group selectors
      tags:
      - Asset Isolation
      requestBody:
        description: The request body for updating asset group selectors
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/model.asset-group-selector-spec'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      added_selectors:
                        type: array
                        items:
                          $ref: '#/components/schemas/model.asset-group-selector'
                      removed_selectors:
                        type: array
                        items:
                          $ref: '#/components/schemas/model.asset-group-selector'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/asset-groups/{asset_group_id}/selectors/{asset_group_selector_id}:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    - name: asset_group_id
      description: ID of the asset_group record to retrieve
      in: path
      required: true
      schema:
        type: integer
        format: int32
    - name: asset_group_selector_id
      description: ID of the asset_group_selector record to retrieve
      in: path
      required: true
      schema:
        type: integer
        format: int32
    delete:
      operationId: DeleteAssetGroupSelector
      summary: Delete an asset group selector
      description: Deletes an asset group selector
      tags:
      - Asset Isolation
      responses:
        '200':
          $ref: '#/components/responses/no-content'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '409':
          description: '**Conflict**

            System defined asset group selectors cannot be deleted.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api.error-wrapper'
              example:
                http_status: 409
                timestamp: '2024-02-19T19:27:43.866Z'
                request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
                errors:
                - context: agi
                  message: Cannot delete system defined asset group selector.
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/asset-groups/{asset_group_id}/custom-selectors:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    - name: asset_group_id
      description: ID of the asset_group record to retrieve
      in: path
      required: true
      schema:
        type: integer
        format: int32
    get:
      operationId: GetAssetGroupCustomMemberCount
      summary: Get asset group custom member count
      description: Get asset group custom member count
      tags:
      - Asset Isolation
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  custom_member_count:
                    type: integer
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/asset-groups/{asset_group_id}/members:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    - name: asset_group_id
      description: ID of the asset_group record to retrieve
      in: path
      required: true
      schema:
        type: integer
        format: int32
    get:
      operationId: ListAssetGroupMembers
      deprecated: true
      summary: List all asset isolation group members
      description: '**Deprecated**: This endpoint will no longer be supported in a future release. Please use `GET /api/v2/asset-group-tags/{asset_group_tag_id}/members` or `GET /api/v2/asset-group-tags/{asset_group_tag_id}/selectors/{asset_group_tag_selector_id}/members` instead.

        '
      tags:
      - Asset Isolation
      parameters:
      - $ref: '#/components/parameters/query.skip'
      - $ref: '#/components/parameters/query.limit'
      - name: sort_by
        in: query
        description: 'Sortable columns are `object_id`, `asset_group_id`, `primary_kind`, `environment_id`, `environment_kind`, and `name`.

          '
        schema:
          $ref: '#/components/schemas/api.params.query.sort-by'
      - name: object_id
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      - name: primary_kind
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      - name: environment_id
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      - name: environment_kind
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      - name: name
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      - name: custom_member
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/api.response.pagination'
                - type: object
                  properties:
                    data:
                      type: object
                      properties:
                        members:
                          type: array
                          items:
                            $ref: '#/components/schemas/model.asset-group-member'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/asset-groups/{asset_group_id}/members/counts:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    - name: asset_group_id
      description: ID of the asset_group record to retrieve
      in: path
      required: true
      schema:
        type: integer
        format: int32
    get:
      operationId: ListAssetGroupMemberCountByKind
      summary: List asset group member count by kind
      description: List counts of members of an asset isolation group by primary kind.
      tags:
      - Asset Isolation
      parameters:
      - name: object_id
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      - name: environment_id
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      - name: primary_kind
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      - name: environment_kind
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      - name: name
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      - name: custom_member
        in: query
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      total_count:
                        type: integer
                      counts:
                        type: object
                        additionalProperties:
                          type: integer
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/asset-group-tags/{asset_group_tag_id}/members/{asset_group_member_id}:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    - name: asset_group_tag_id
      description: ID of the asset_group_tag of a selector
      in: path
      required: true
      schema:
        type: integer
        format: int32
    - name: asset_group_member_id
      description: ID of member to list selectors
      in: path
      required: true
      schema:
        type: integer
        format: int32
    get:
      operationId: GetAssetGroupSelectorsByMemberId
      summary: Get asset group tag selectors of a specific object by member id
      description: Get a list of selectors for an object by member id.
      tags:
      - Asset Isolation
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      member:
                        allOf:
                        - $ref: '#/components/schemas/model.asset-group-tags-member'
                        - type: object
                          properties:
                            selectors:
                              type: array
                              items:
                                $ref: '#/components/schemas/model.asset-group-tags-selector-response'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/asset-group-tags:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    get:
      operationId: GetAssetGroupTags
      summary: Get Asset Group Tags
      description: Get a list of asset groups
      tags:
      - Asset Isolation
      parameters:
      - name: type
        in: query
        required: false
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.integer-strict'
      - name: counts
        description: Whether to include counts of selectors and members for each tag
        in: query
        schema:
          type: boolean
          default: false
      - name: name
        in: query
        required: false
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      - name: description
        in: query
        required: false
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string'
      - name: created_at
        in: query
        required: false
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.time'
      - name: created_by
        in: query
        required: false
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string-strict'
      - name: updated_at
        in: query
        required: false
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.time'
      - name: updated_by
        in: query
        required: false
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string-strict'
      - name: deleted_at
        in: query
        required: false
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.time'
      - name: deleted_by
        in: query
        required: false
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.string-strict'
      - name: require_certify
        in: query
        required: false
        schema:
          $ref: '#/components/schemas/api.params.predicate.filter.boolean'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      tags:
                        type: array
                        items:
                          oneOf:
                          - $ref: '#/components/schemas/model.asset-group-tag'
                          - allOf:
                            - $ref: '#/components/schemas/model.asset-group-tag'
                            - type: object
                              properties:
                                counts:
                                  type: object
                                  properties:
                                    members:
                                      type: integer
                                      format: int64
                                    selectors:
                                      type: integer
                                    custom_selectors:
                                      type: integer
                                    default_selectors:
                                      type: integer
                                    disabled_selectors:
                                      type: integer
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
    post:
      operationId: CreateAssetGroupTag
      summary: Create Asset Group Tag
      description: Creates an asset group tag ie. a tier or label
      tags:
      - Asset Isolation
      requestBody:
        description: The request body for creating an asset group tag. Name and type fields are required.
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/model.asset-group-tag-request'
              - type: object
                properties:
                  name:
                    type: string
                  type:
                    type: string
                required:
                - name
                - type
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/model.asset-group-tag'
        '400':
          $ref: '#/components/responses/bad-request'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not-found'
        '429':
          $ref: '#/components/responses/too-many-requests'
        '500':
          $ref: '#/components/responses/internal-server-error'
  /api/v2/asset-group-tags/{asset_group_tag_id}:
    parameters:
    - $ref: '#/components/parameters/header.prefer'
    - name: asset_group_tag_id
      description: ID of

# --- truncated at 32 KB (87 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/specterops/refs/heads/main/openapi/specterops-asset-isolation-api-openapi.yml