SpecterOps Azure Entities API
The Azure Entities API from SpecterOps — 1 operation(s) for azure entities.
OpenAPI Specification
openapi: 3.0.3
info:
title: BloodHound AD Base Entities Azure Entities API
contact:
name: BloodHound Enterprise Support
url: https://bloodhound.specterops.io/
email: support@specterops.io
license:
name: Apache-2.0
url: https://www.apache.org/licenses/LICENSE-2.0
version: v2
description: "This is the API that drives BloodHound Enterprise and Community Edition.\nEndpoint availability is denoted using the `Community` and `Enterprise` tags.\n\nContact information listed is for BloodHound Enterprise customers. To get help with\nBloodHound Community Edition, please join our\n[Slack community](https://ghst.ly/BHSlack/).\n\n## Authentication\n\nThe BloodHound API supports two kinds of authentication: JWT bearer tokens and Signed Requests.\nFor quick tests or one-time calls, the JWT used by your browser may be the simplest route. For\nmore secure and long lived API integrations, the recommended option is signed requests.\n\n### JWT Bearer Token\n\nThe API will accept calls using the following header structure in the HTTP request:\n```\nAuthorization: Bearer $JWT_TOKEN\n```\nIf you open the Network tab within your browser, you will see calls against the API made utilizing\nthis structure. JWT bearer tokens are supported by the BloodHound API, however it is recommended\nthey only be used for temporary access. JWT tokens expire after a set amount of time and require\nre-authentication using secret credentials.\n\n### Signed Requests\n\nSigned requests are the recommended form of authentication for the BloodHound API. Not only are\nsigned requests better for long lived integrations, they also provide more security for the\nrequests being sent. They provide authentication of the client, as well as verification of request\nintegrity when received by the server.\n\nSigned requests consist of three main parts: The client token ID, the request timestamp, and a\nbase64 encoded HMAC signature. These three pieces of information are sent with the request using\nthe following header structure:\n\n```\nAuthorization: bhesignature $TOKEN_ID\nRequestDate: $RFC3339_DATETIME\nSignature: $BASE64ENCODED_HMAC_SIGNATURE\n```\n\nTo use signed requests, you will need to generate an API token. Each API token generated in the\nBloodHound API comes with two parts: The Token ID, which is used in the `Authorization` header,\nand the Token Key, which is used as part of the HMAC hashing process. The token ID should be\nconsidered as public (like a username) and the token key should be considered secret (like a\npassword). Once an API token is generated, you can use the key to sign requests.\n\nFor more documentation about how to work with authentication in the API, including examples\nof how to generate an API token in the BloodHound UI, please refer to this support doc:\n[Working with the BloodHound API](https://bloodhound.specterops.io/integrations/bloodhound-api/working-with-api).\n\n#### Signed Request Pseudo-code Example\n\nFirst, a digest is initiated with HMAC-SHA-256 using the token key as the digest key:\n```python\ndigester = hmac.new(sha256, api_token_key)\n```\n\nOperationKey is the first HMAC digest link in the signature chain. This prevents replay attacks that\nseek to modify the request method or URI. It is composed of concatenating the request method and\nthe request URI with no delimiter and computing the HMAC digest using the token key as the digest\nsecret:\n```python\n# Example: GET /api/v2/test/resource HTTP/1.1\n# Signature Component: GET/api/v2/test/resource\ndigester.write(request_method + request_uri)\n\n# Update the digester for further chaining\ndigester = hmac.New(sha256, digester.hash())\n```\n\nDateKey is the next HMAC digest link in the signature chain. This encodes the RFC3339\nformatted datetime value as part of the signature to the hour to prevent replay\nattacks that are older than max two hours. This value is added to the signature chain\nby cutting off all values from the RFC3339 formatted datetime from the hours value\nforward:\n```python\n# Example: 2020-12-01T23:59:60Z\n# Signature Component: 2020-12-01T23\nrequest_datetime = date.now()\ndigester.write(request_datetime[:13])\n\n# Update the digester for further chaining\ndigester = hmac.New(sha256, digester.hash())\n```\n\nBody signing is the last HMAC digest link in the signature chain. This encodes the\nrequest body as part of the signature to prevent replay attacks that seek to modify\nthe payload of a signed request. In the case where there is no body content the\nHMAC digest is computed anyway, simply with no values written to the digester:\n```python\nif request.body is not empty:\n digester.write(request.body)\n```\n\nFinally, base64 encode the final hash and write the three required headers before\nsending the request:\n```python\nencoded_hash = base64_encode(digester.hash())\nrequest.header.write('Authorization', 'bhesignature ' + token_id)\nrequest.header.write('RequestDate', request_datetime)\nrequest.header.write('Signature', encoded_hash)\n```\n"
servers:
- url: /
description: This is the base path for all endpoints, relative to the domain where the API is being hosted.
security:
- JWTBearerToken: []
- SignedRequest: []
RequestDate: []
HMACSignature: []
tags:
- name: Azure Entities
paths:
/api/v2/azure/{entity_type}:
parameters:
- $ref: '#/components/parameters/header.prefer'
- name: entity_type
description: Entity Type
in: path
required: true
schema:
type: string
get:
operationId: GetAzureEntity
summary: Get Azure entity
description: 'Retrieves entity information for the given Azure object ID.
If `related_entity_type` parameter is not set, this endpoint will return information
about a single entity. Using the `counts` boolean parameter will further modify the response.
If `related_entity_type` parameter is set, this endpoint will return information about entities
related to a single entity. The `type` parameter will morph the response data structure. The `list`
value for the `type` parameter also accepts `skip` and `limit` parameters.
'
tags:
- Azure Entities
parameters:
- name: object_id
description: The object ID of the entity being operated on.
in: query
required: true
schema:
type: string
- name: counts
description: Returns related entity counts. Does not work with `related_entity_type` parameter.
in: query
schema:
type: boolean
- name: related_entity_type
description: Flags the query to return related entity information based on the type passed.
in: query
schema:
type: string
- name: type
description: The type of return data expected. Only works with `related_entity_type` parameter.
in: query
schema:
type: string
default: list
enum:
- list
- graph
- name: skip
description: 'This query parameter is used for determining the number of objects to skip in pagination.
Only compatible with `related_entity_type` and `type=list`
'
in: query
schema:
$ref: '#/components/schemas/api.params.query.skip'
- name: limit
description: 'This query parameter is used for setting an upper limit of objects returned in paginated responses.
Only compatible with `related_entity_type` and `type=list`
'
in: query
schema:
type: integer
minimum: 0
default: 100
description: The limit of results requested by the client.
responses:
'200':
description: "This endpoint returns a polymorphic response dependent on the query parameters passed. Three\ndifferent response schemas are possible:\n- **entity** schema is used when `related_entity_type` is not set. Additional 'count' properties are\n dependent on the type of entity being queried.\n- **related-list** schema is used when `related_entity_type` is set and `type` parameter is either\n `list` or not set (it is the default), and it supports pagination.\n- **related-graph** schema is used when `related_entity_type` is set and `type=graph`.\n"
content:
application/json:
schema:
oneOf:
- type: object
title: entity
description: 'This response is used when `related_entity_type` is not set. It returns information
about a single node. All node types will return with the basic node fields, but the
additional count properties are dependent on the kind of node returned. Setting
`counts=true` will populate those count details at the cost of performance.
'
properties:
data:
allOf:
- type: object
properties:
kind:
type: string
properties:
type: object
additionalProperties:
type: object
- type: object
additionalProperties:
type: integer
- allOf:
- $ref: '#/components/schemas/api.response.pagination'
- type: object
title: related-list
description: 'This response is used when `related_entity_type` is set and the `type` parameter is
either `list` or not set (it is the default return type). It returns a list of related
entities and supports pagination parameters.
'
properties:
data:
type: array
items:
type: object
properties:
kind:
type: string
properties:
type: object
additionalProperties:
type: object
additionalProperties:
type: integer
- allOf:
- $ref: '#/components/schemas/model.bh-graph.graph'
- title: related-graph
description: 'This response is used when `related_entity_type` is set and the `type` parameter is
set to `graph`. It returns graph data without a basic data response wrapper.
'
'400':
$ref: '#/components/responses/bad-request'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/not-found'
'429':
$ref: '#/components/responses/too-many-requests'
'500':
$ref: '#/components/responses/internal-server-error'
components:
responses:
not-found:
description: '**Not Found**
This error typically comes from operations where a valid ID was passed to the request
to look up an entity but the entity could not be found.
'
content:
application/json:
schema:
$ref: '#/components/schemas/api.error-wrapper'
example:
http_status: 404
timestamp: '2024-02-19T19:27:43.866Z'
request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
errors:
- context: clients
message: The requested client could not be found.
bad-request:
description: '**Bad Request**
This could be due to one of the following reasons:
- JSON payload is missing or malformed
- Path or query parameters are missing or invalid/malformed
- The data sent is not valid (ex- sending a `string` in an `integer` field)
'
content:
application/json:
schema:
$ref: '#/components/schemas/api.error-wrapper'
example:
http_status: 400
timestamp: '2024-02-19T19:27:43.866Z'
request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
errors:
- context: clients
message: The JSON payload could not be unmarshalled.
forbidden:
description: '**Forbidden**
This is most commonly caused by an authenticated client trying to
access a resource that it does not have permission for.
'
content:
application/json:
schema:
$ref: '#/components/schemas/api.error-wrapper'
example:
http_status: 403
timestamp: '2024-02-19T19:27:43.866Z'
request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
errors:
- context: clients
message: You do not have permission to access this resource
too-many-requests:
description: '**Too Many Requests**
The client has sent too many requests within a certain time window
and tripped the rate limiting middleware.
'
content:
application/json:
schema:
$ref: '#/components/schemas/api.error-wrapper'
example:
http_status: 429
timestamp: '2024-02-19T19:27:43.866Z'
request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
errors:
- context: middleware
message: Too many requests. Please try again later.
internal-server-error:
description: '**Internal Server Error**
This is usually the result of either an unexpected database or application error.
The client may try modifying or resending the request, but the error is likely not related to the client
doing something wrong.
'
content:
application/json:
schema:
$ref: '#/components/schemas/api.error-wrapper'
example:
http_status: 500
timestamp: '2024-02-19T19:27:43.866Z'
request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
errors:
- context: clients
message: The request could not be handled due to an unexpected database error.
unauthorized:
description: '**Unauthorized**
This endpoint failed an authentication requirement. Either the client tried to access
a protected endpoint without being authenticated, or an auth validation failed (ex- invalid
credentials or expired token).
'
content:
application/json:
schema:
$ref: '#/components/schemas/api.error-wrapper'
example:
http_status: 401
timestamp: '2024-02-19T19:27:43.866Z'
request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
errors:
- context: login
message: Unauthorized
schemas:
api.response.pagination:
type: object
properties:
count:
type: integer
minimum: 0
description: The total number of results.
skip:
$ref: '#/components/schemas/api.params.query.skip'
limit:
$ref: '#/components/schemas/api.params.query.limit'
model.bh-graph.link-end:
type: object
properties:
arrow:
type: boolean
backOff:
type: integer
color:
type: string
glyphs:
type: array
items:
$ref: '#/components/schemas/model.bh-graph.glyph'
label:
$ref: '#/components/schemas/model.bh-graph.label'
model.bh-graph.glyph:
type: object
properties:
angle:
type: integer
blink:
type: boolean
border:
$ref: '#/components/schemas/model.bh-graph.item-border'
color:
type: string
fontIcon:
$ref: '#/components/schemas/model.bh-graph.font-icon'
image:
type: string
label:
$ref: '#/components/schemas/model.bh-graph.label'
position:
type: string
radius:
type: integer
size:
type: integer
model.bh-graph.graph:
type: object
additionalProperties:
anyOf:
- $ref: '#/components/schemas/model.bh-graph.node'
- $ref: '#/components/schemas/model.bh-graph.edge'
api.params.query.limit:
type: integer
minimum: 0
description: The limit of results requested by the client.
api.error-detail:
type: object
properties:
context:
type: string
description: The context in which the error took place
message:
type: string
description: A human-readable description of the error
model.bh-graph.item-border:
type: object
properties:
color:
type: string
model.bh-graph.node:
allOf:
- $ref: '#/components/schemas/model.bh-graph.item'
- type: object
properties:
border:
type: object
properties:
color:
type: string
lineStyle:
type: string
width:
type: integer
coordinates:
type: object
properties:
lat:
type: integer
lng:
type: integer
cutout:
type: boolean
fontIcon:
$ref: '#/components/schemas/model.bh-graph.font-icon'
halos:
type: array
items:
type: object
properties:
color:
type: string
radius:
type: integer
width:
type: integer
image:
type: string
label:
type: object
properties:
backgroundColor:
type: string
bold:
type: boolean
center:
type: boolean
color:
type: string
fontFamily:
type: string
fontSize:
type: integer
text:
type: string
shape:
type: string
size:
type: integer
model.bh-graph.edge:
allOf:
- $ref: '#/components/schemas/model.bh-graph.item'
- type: object
properties:
end1:
$ref: '#/components/schemas/model.bh-graph.link-end'
end2:
$ref: '#/components/schemas/model.bh-graph.link-end'
flow:
type: object
properties:
velocity:
type: integer
id1:
type: string
id2:
type: string
label:
$ref: '#/components/schemas/model.bh-graph.label'
lineStyle:
type: string
width:
type: integer
api.error-wrapper:
type: object
description: ''
properties:
http_status:
type: integer
description: The HTTP status code
minimum: 100
maximum: 600
timestamp:
type: string
format: date-time
description: The RFC-3339 timestamp in which the error response was sent
request_id:
type: string
format: uuid
description: The unique identifier of the request that failed
errors:
type: array
items:
$ref: '#/components/schemas/api.error-detail'
description: The error(s) that occurred from processing the request
model.bh-graph.label:
type: object
properties:
bold:
type: boolean
color:
type: string
fontFamily:
type: string
text:
type: string
model.bh-graph.font-icon:
type: object
properties:
color:
type: string
fontFamily:
type: string
text:
type: string
api.params.query.skip:
type: integer
minimum: 0
description: The number of items to skip in a paginated response.
model.bh-graph.item:
type: object
properties:
color:
type: string
fade:
type: boolean
data:
type: object
additionalProperties: true
glyphs:
type: array
items:
$ref: '#/components/schemas/model.bh-graph.glyph'
parameters:
header.prefer:
name: Prefer
description: Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Passing in wait=-1 bypasses all timeout limits when the feature is enabled.
in: header
required: false
schema:
type: string
default: wait=30
pattern: ^wait=(-1|[0-9]+)$
securitySchemes:
JWTBearerToken:
description: '`Authorization: Bearer $JWT_TOKEN`
'
type: http
scheme: bearer
bearerFormat: JWT
SignedRequest:
description: '`Authorization: bhesignature $TOKEN_ID`
'
type: apiKey
name: Authorization
in: header
RequestDate:
description: '`RequestDate: $RFC3339_DATETIME`
'
type: apiKey
name: RequestDate
in: header
HMACSignature:
description: '`Signature: $BASE64ENCODED_HMAC_SIGNATURE`
'
type: apiKey
name: Signature
in: header
x-tagGroups:
- name: Community & Enterprise
tags:
- Auth
- Roles
- Permissions
- API Tokens
- BloodHound Users
- Collectors
- Collection Uploads
- Custom Node Management
- API Info
- Search
- Audit
- Config
- Asset Isolation
- Graph
- Azure Entities
- AD Base Entities
- Computers
- Containers
- Domains
- GPOs
- AIA CAs
- Root CAs
- Enterprise CAs
- NT Auth Stores
- Cert Templates
- OUs
- AD Users
- Groups
- Data Quality
- Datapipe
- Cypher
- OpenGraph (Experimental)
- name: Enterprise Only
tags:
- EULA
- BHE Users
- Analysis
- Client Ingest
- Clients
- Jobs
- Tasks
- Events (Schedules)
- Attack Paths
- Risk Posture
- Meta Entities
- Alerts