SpecterOps Datapipe API
The Datapipe API from SpecterOps — 2 operation(s) for datapipe.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/specterops-datapipe-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: BloodHound Datapipe API
contact:
name: BloodHound Enterprise Support
url: https://bloodhound.specterops.io/
email: support@specterops.io
license:
name: Apache-2.0
url: https://www.apache.org/licenses/LICENSE-2.0
version: v2
description: This is the API that drives BloodHound Enterprise and Community Edition.
servers:
- url: /
description: This is the base path for all endpoints, relative to the domain where the API is being hosted.
security:
- JWTBearerToken: []
- SignedRequest: []
RequestDate: []
HMACSignature: []
tags:
- name: Datapipe
paths:
/api/v2/datapipe/status:
parameters:
- $ref: '#/components/parameters/header.prefer'
get:
operationId: GetDatapipeStatus
summary: Get datapipe status
description: Gets the current status of the datapipe
tags:
- Datapipe
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
status:
$ref: '#/components/schemas/enum.datapipe-status'
updated_at:
type: string
format: date-time
last_complete_analysis_at:
type: string
format: date-time
last_analysis_run_at:
type: string
format: date-time
next_scheduled_analysis_at:
type: string
format: date-time
description: The next time a scheduled analysis will run. Note this field is Enterprise-Only.
'401':
$ref: '#/components/responses/unauthorized'
'429':
$ref: '#/components/responses/too-many-requests'
/api/v2/analysis:
parameters:
- $ref: '#/components/parameters/header.prefer'
get:
operationId: GetAnalysisRequest
summary: Gets analysis request information
description: 'Returns the current analysis request information. Always returns 200 OK with
the request details. When no request is pending, returns a zero-valued response
with empty strings, false booleans, null arrays, and zero timestamp.'
tags:
- Datapipe
responses:
'200':
description: 'OK. Returns analysis request details if one exists, or a zero-valued
response if no request is pending (requested_by and request_type will be
empty strings, requested_at will be "0001-01-01T00:00:00Z", booleans will
be false, and arrays will be null).
'
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
requested_by:
type: string
request_type:
type: string
requested_at:
type: string
format: date-time
delete_all_graph:
type: boolean
delete_sourceless_graph:
type: boolean
delete_source_kinds:
type: array
items:
type: string
delete_relationships:
type: array
items:
type: string
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'429':
$ref: '#/components/responses/too-many-requests'
'500':
$ref: '#/components/responses/internal-server-error'
put:
operationId: StartAnalysis
summary: Start analysis
description: 'Submits an analysis request attributed to the authenticated user. The
endpoint is idempotent — at most one analysis request can be pending at a
time. Always returns 202 Accepted with no response body.'
tags:
- Datapipe
responses:
'202':
$ref: '#/components/responses/no-content'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'429':
$ref: '#/components/responses/too-many-requests'
'500':
$ref: '#/components/responses/internal-server-error'
delete:
operationId: CancelAnalysisRequest
summary: Cancels an analysis request
description: Flags the API to request the cancellation of analyzing ingest data.
tags:
- Datapipe
responses:
'202':
$ref: '#/components/responses/no-content'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/not-found'
'409':
description: Conflict. You cannot cancel an analysis request because a deletion request is pending
content:
application/json:
schema:
$ref: '#/components/schemas/api.error-wrapper'
'429':
$ref: '#/components/responses/too-many-requests'
'500':
$ref: '#/components/responses/internal-server-error'
components:
responses:
forbidden:
description: '**Forbidden**
This is most commonly caused by an authenticated client trying to
access a resource that it does not have permission for.
'
content:
application/json:
schema:
$ref: '#/components/schemas/api.error-wrapper'
example:
http_status: 403
timestamp: '2024-02-19T19:27:43.866Z'
request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
errors:
- context: clients
message: You do not have permission to access this resource
internal-server-error:
description: '**Internal Server Error**
This is usually the result of either an unexpected database or application error.
The client may try modifying or resending the request, but the error is likely not related to the client
doing something wrong.
'
content:
application/json:
schema:
$ref: '#/components/schemas/api.error-wrapper'
example:
http_status: 500
timestamp: '2024-02-19T19:27:43.866Z'
request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
errors:
- context: clients
message: The request could not be handled due to an unexpected database error.
unauthorized:
description: '**Unauthorized**
This endpoint failed an authentication requirement. Either the client tried to access
a protected endpoint without being authenticated, or an auth validation failed (ex- invalid
credentials or expired token).
'
content:
application/json:
schema:
$ref: '#/components/schemas/api.error-wrapper'
example:
http_status: 401
timestamp: '2024-02-19T19:27:43.866Z'
request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
errors:
- context: login
message: Unauthorized
no-content:
description: '**No Content**
This response will contain no response body.
'
content:
text/plain:
schema:
type: string
example: '[this request has no response data]'
too-many-requests:
description: '**Too Many Requests**
The client has sent too many requests within a certain time window
and tripped the rate limiting middleware.
'
content:
application/json:
schema:
$ref: '#/components/schemas/api.error-wrapper'
example:
http_status: 429
timestamp: '2024-02-19T19:27:43.866Z'
request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
errors:
- context: middleware
message: Too many requests. Please try again later.
not-found:
description: '**Not Found**
This error typically comes from operations where a valid ID was passed to the request
to look up an entity but the entity could not be found.
'
content:
application/json:
schema:
$ref: '#/components/schemas/api.error-wrapper'
example:
http_status: 404
timestamp: '2024-02-19T19:27:43.866Z'
request_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
errors:
- context: clients
message: The requested client could not be found.
schemas:
enum.datapipe-status:
type: string
enum:
- idle
- ingesting
- analyzing
api.error-detail:
type: object
properties:
context:
type: string
description: The context in which the error took place
message:
type: string
description: A human-readable description of the error
api.error-wrapper:
type: object
description: ''
properties:
http_status:
type: integer
description: The HTTP status code
minimum: 100
maximum: 600
timestamp:
type: string
format: date-time
description: The RFC-3339 timestamp in which the error response was sent
request_id:
type: string
format: uuid
description: The unique identifier of the request that failed
errors:
type: array
items:
$ref: '#/components/schemas/api.error-detail'
description: The error(s) that occurred from processing the request
parameters:
header.prefer:
name: Prefer
description: Prefer header, used to specify a custom timeout in seconds using the wait parameter as per RFC7240. Passing in wait=-1 bypasses all timeout limits when the feature is enabled.
in: header
required: false
schema:
type: string
default: wait=30
pattern: ^wait=(-1|[0-9]+)$
securitySchemes:
JWTBearerToken:
description: '`Authorization: Bearer $JWT_TOKEN`
'
type: http
scheme: bearer
bearerFormat: JWT
SignedRequest:
description: '`Authorization: bhesignature $TOKEN_ID`
'
type: apiKey
name: Authorization
in: header
RequestDate:
description: '`RequestDate: $RFC3339_DATETIME`
'
type: apiKey
name: RequestDate
in: header
HMACSignature:
description: '`Signature: $BASE64ENCODED_HMAC_SIGNATURE`
'
type: apiKey
name: Signature
in: header
x-tagGroups:
- name: Community & Enterprise
tags:
- Auth
- Roles
- Permissions
- API Tokens
- BloodHound Users
- Collectors
- Collection Uploads
- Custom Node Management
- API Info
- Search
- Audit
- Config
- Asset Isolation
- Graph
- Azure Entities
- AD Base Entities
- Computers
- Containers
- Domains
- GPOs
- AIA CAs
- Root CAs
- Enterprise CAs
- NT Auth Stores
- Cert Templates
- OUs
- AD Users
- Groups
- Data Quality
- Datapipe
- Cypher
- OpenGraph (Experimental)
- name: Enterprise Only
tags:
- EULA
- BHE Users
- Analysis
- Client Ingest
- Clients
- Jobs
- Tasks
- Events (Schedules)
- Attack Paths
- Risk Posture
- Meta Entities
- Alerts