Investigations can be created by users as a way to have an investigation into a potential attack, allowing users to associate data from one or more sources into a single investigation. An investigation may be utilized by multiple users as part of it's work flow. Investigations have a version history, each change to an investigation will result in a copy of the investigation to be captured and saved, prior versions can then be inspected later.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/spyderbat-investigation-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
openapi: 3.2.0
info:
title: Spyderbat Investigation API
version: 1.0.0
contact:
name: API Support
url: https://api.prod.spyderbat.com/openapi
email: support@spyderbat.com
license:
name: MIT
url: https://mit-license.org/
termsOfService: https://www.spyderbat.com/terms-of-use/
x-logo:
url: /static/sb-logo.svg
backgroundColor: '#161A21'
altText: Spyderbat Logo
description: 'Operations tagged Investigation across 2 of this provider''s published API definitions: spyderbat-openapi-original.json, spyderbat-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prod.spyderbat.com/
description: Spyderbat API Server
security:
- apiToken: []
tags:
- name: Investigation
description: Investigations can be created by users as a way to have an investigation into a potential attack, allowing users to associate data from one or more sources into a single investigation. An investigation may be utilized by multiple users as part of it's work flow. Investigations have a version history, each change to an investigation will result in a copy of the investigation to be captured and saved, prior versions can then be inspected later.
paths:
/api/v1/org/{orgUID}/investigation/:
get:
tags:
- Investigation
summary: List investigations
description: "\nLists investigations\n\n * Will list investigations which the user has the action *investigation:Load* or *investigation:LoadExpired* on\n"
operationId: InvestigationList
parameters:
- name: orgUID
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/DaoInvestigation'
'400':
description: invalid query parameters
content:
application/json:
schema:
$ref: '#/components/schemas/ValidationError'
'403':
description: permission denied
post:
tags:
- Investigation
summary: Create an investigation
description: "\nCreate an investigationan\n\n * Requires the user have the action *investigation:Create*\n"
operationId: InvestigationCreate
parameters:
- name: orgUID
in: path
description: Investigation OrgUID
required: true
schema:
type: string
description: Investigation OrgUID
maxLength: 64
minLength: 9
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/InvestigationCreateInput'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ApiInvestigationCreateOutput'
'400':
description: invalid input parameters
content:
application/json:
schema:
$ref: '#/components/schemas/ValidationError'
'403':
description: permission denied
servers:
- url: https://api.prod.spyderbat.com/
description: Spyderbat API Server
/api/v1/org/{orgUID}/investigation/{investigationUID}:
get:
tags:
- Investigation
summary: Load an investigation
description: "\nLoads an investigation by UID. \n\n * Requires action *investigation:Load* to load an active investigation\n * Requires action *investigation:LoadExpired* to load expired investigations\n\n"
operationId: InvestigationLoad
parameters:
- name: investigationUID
in: path
required: true
schema:
type: string
- name: orgUID
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/DaoInvestigation'
'403':
description: permission denied
put:
tags:
- Investigation
summary: Update an investigation
description: "\nUpdates the investigationan\n\n * Requires the user have the action *investigation:Update*\n"
operationId: InvestigationUpdate
parameters:
- name: investigationUID
in: path
description: Investigation UID
required: true
schema:
type: string
description: Investigation UID
- name: orgUID
in: path
description: Investigation OrgUID
required: true
schema:
type: string
description: Investigation OrgUID
maxLength: 64
minLength: 9
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/InvestigationUpdateInput'
responses:
'200':
description: OK
'400':
description: invalid input parameters
content:
application/json:
schema:
$ref: '#/components/schemas/ValidationError'
'403':
description: permission denied
delete:
tags:
- Investigation
summary: Delete an investigation
description: "\nDeletes an investigation, by setting valid_to=now so that the investigation is virtually deleted.\n\n * Requires the user have the action *investigation:Delete*\n"
operationId: InvestigationDelete
parameters:
- name: investigationUID
in: path
description: Investigation UID
required: true
schema:
type: string
description: Investigation UID
- name: orgUID
in: path
description: Investigation OrgUID
required: true
schema:
type: string
description: Investigation OrgUID
maxLength: 64
minLength: 9
responses:
'200':
description: OK
'403':
description: permission denied
servers:
- url: https://api.prod.spyderbat.com/
description: Spyderbat API Server
/api/v1/org/{orgUID}/investigation/{investigationUID}/version/:
get:
tags:
- Investigation
summary: List Investigation Versions
description: "\nLists prior version of this investigation\n\n * Requires the user have the action *investigation:ListVersions*\n"
operationId: InvestigationListVersions
parameters:
- name: investigationUID
in: path
required: true
schema:
type: string
- name: orgUID
in: path
required: true
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/DaoInvestigation'
'403':
description: permission denied
servers:
- url: https://api.prod.spyderbat.com/
description: Spyderbat API Server
/api/v1/org/{orgUID}/investigation/{investigationUID}/version/{version}:
get:
tags:
- Investigation
summary: Load Investigation Version
description: "\nLoads a specific version of an investigation\n\n * Requires the user have the action *investigation:LoadVersion*\n"
operationId: InvestigationLoadVersion
parameters:
- name: investigationUID
in: path
required: true
schema:
type: string
- name: orgUID
in: path
required: true
schema:
type: string
- name: version
in: path
required: true
schema:
type: integer
format: int32
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/DaoInvestigation'
'403':
description: permission denied
servers:
- url: https://api.prod.spyderbat.com/
description: Spyderbat API Server
components:
schemas:
InvestigationCreateInput:
type: object
properties:
created_by:
type: string
description: UID of user who created the investigation
data:
type: object
additionalProperties: {}
description: JSON Object associated with the investigation
modified_by:
type: string
description: UID of the user who last modified the investigation
modified_on:
type: string
description: Date the investigation was last modified
format: date-time
name:
type: string
description: Name of the investigation
resource_name:
type: string
description: Resource name used for RBAC
resource_policy:
$ref: '#/components/schemas/ResourcePolicy'
tags:
type: array
items:
type: string
description: User supplied tags
maxItems: 20
valid_from:
type: string
description: Valid from date, the first date this object was valid
format: date-time
valid_to:
type: string
description: Valid to date, the date this object is valid to
format: date-time
version:
type: integer
description: Version of the investigation
format: int32
RbacStatement:
type: object
properties:
actions:
type: array
items:
type: string
description: The actions that may be performed
maxItems: 50
minItems: 1
condition:
$ref: '#/components/schemas/RbacConditionMap'
effect:
type: string
description: The effect of the statement, i.e. allow or deny
maxLength: 5
resources:
type: array
items:
type: string
description: The resource the statement applies to
maxItems: 25
minItems: 1
sid:
type: string
description: Statement ID, used to identify the statement in audit logs
maxLength: 32
required:
- effect
- sid
DaoInvestigation:
type: object
properties:
created_by:
type: string
description: UID of user who created the investigation
data:
type: object
additionalProperties: {}
description: JSON Object associated with the investigation
modified_by:
type: string
description: UID of the user who last modified the investigation
modified_on:
type: string
description: Date the investigation was last modified
format: date-time
name:
type: string
description: Name of the investigation
org_uid:
type: string
description: Investigation OrgUID
maxLength: 64
minLength: 9
resource_name:
type: string
description: Resource name used for RBAC
resource_policy:
$ref: '#/components/schemas/ResourcePolicy'
tags:
type: array
items:
type: string
description: User supplied tags
maxItems: 20
uid:
type: string
description: Investigation UID
valid_from:
type: string
description: Valid from date, the first date this object was valid
format: date-time
valid_to:
type: string
description: Valid to date, the date this object is valid to
format: date-time
version:
type: integer
description: Version of the investigation
format: int32
ResourcePolicy:
type: object
properties:
name:
type: string
description: Name of the resource policy
maxLength: 32
statements:
type: array
items:
$ref: '#/components/schemas/RbacStatement'
description: List of statements to be examined by the resource policy
version:
type: string
maxLength: 24
description: Resource policy for RBAC
InvestigationUpdateInput:
type: object
properties:
created_by:
type: string
description: UID of user who created the investigation
data:
type: object
additionalProperties: {}
description: JSON Object associated with the investigation
modified_by:
type: string
description: UID of the user who last modified the investigation
modified_on:
type: string
description: Date the investigation was last modified
format: date-time
name:
type: string
description: Name of the investigation
resource_name:
type: string
description: Resource name used for RBAC
resource_policy:
$ref: '#/components/schemas/ResourcePolicy'
tags:
type: array
items:
type: string
description: User supplied tags
maxItems: 20
valid_from:
type: string
description: Valid from date, the first date this object was valid
format: date-time
valid_to:
type: string
description: Valid to date, the date this object is valid to
format: date-time
version:
type: integer
description: Version of the investigation
format: int32
ApiInvestigationCreateOutput:
type: object
properties:
uid:
type: string
RbacConditionMap:
type: object
description: Additional conditions which may be applied
ValidationError:
type: object
properties:
err_msg:
type: string
description: Message regarding the validation failure
field:
type: string
description: Field name which failed validation
property:
type: string
description: JSON property name of the field which failed validation
tags:
type: string
description: Validation tag which failed
securitySchemes:
apiToken:
type: http
scheme: bearer
bearerFormat: JWT
x-refined-from:
- spyderbat-openapi-original.json
- spyderbat-openapi.json