StackRox AlertService API

openapi: 3.2.0
info:
  title: Reference Alert Service API
  version: '1'
  description: API reference for the StackRox Kubernetes Security Platform (upstream of Red Hat Advanced Cluster Security). Provides risk analysis, visibility, runtime alerts, policy management, compliance checking, and vulnerability management for containerized workloads. Authentication uses API tokens generated via /v1/apitokens/generate and passed as Bearer tokens.
  contact:
    email: support@stackrox.com
    url: https://www.stackrox.io/
  license:
    name: All Rights Reserved
    url: https://www.stackrox.com/
servers:
- url: https://{central-host}
  description: StackRox Central API server
  variables:
    central-host:
      default: stackrox.localhost
      description: StackRox Central hostname or IP
security:
- ApiToken: []
tags:
- name: AlertService
paths:
  /v1/alerts:
    get:
      summary: List returns the slim list version of the alerts.
      operationId: ListAlerts
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1ListAlertsResponse'
      parameters:
      - name: query
        in: query
        required: false
        schema:
          type: string
      - name: pagination.limit
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.offset
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.sort_option.field
        in: query
        required: false
        schema:
          type: string
      - name: pagination.sort_option.reversed
        in: query
        required: false
        schema:
          type: boolean
          format: boolean
      tags:
      - AlertService
    delete:
      operationId: DeleteAlerts
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1DeleteAlertsResponse'
      parameters:
      - name: query.query
        in: query
        required: false
        schema:
          type: string
      - name: query.pagination.limit
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: query.pagination.offset
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: query.pagination.sort_option.field
        in: query
        required: false
        schema:
          type: string
      - name: query.pagination.sort_option.reversed
        in: query
        required: false
        schema:
          type: boolean
          format: boolean
      - name: confirm
        in: query
        required: false
        schema:
          type: boolean
          format: boolean
      tags:
      - AlertService
  /v1/alerts/resolve:
    patch:
      summary: ResolveAlertsByQuery marks alerts matching search query as resolved.
      operationId: ResolveAlerts
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1Empty'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v1ResolveAlertsRequest'
        required: true
      tags:
      - AlertService
  /v1/alerts/summary/counts:
    get:
      summary: GetAlertsCounts returns the number of alerts in the requested cluster or category.
      operationId: GetAlertsCounts
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1GetAlertsCountsResponse'
      parameters:
      - name: request.query
        in: query
        required: false
        schema:
          type: string
      - name: request.pagination.limit
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: request.pagination.offset
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: request.pagination.sort_option.field
        in: query
        required: false
        schema:
          type: string
      - name: request.pagination.sort_option.reversed
        in: query
        required: false
        schema:
          type: boolean
          format: boolean
      - name: groupBy
        in: query
        required: false
        schema:
          type: string
          enum:
          - UNSET
          - CATEGORY
          - CLUSTER
          default: UNSET
      tags:
      - AlertService
  /v1/alerts/summary/groups:
    get:
      summary: GetAlertsGroup returns alerts grouped by policy.
      operationId: GetAlertsGroup
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1GetAlertsGroupResponse'
      parameters:
      - name: query
        in: query
        required: false
        schema:
          type: string
      - name: pagination.limit
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.offset
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.sort_option.field
        in: query
        required: false
        schema:
          type: string
      - name: pagination.sort_option.reversed
        in: query
        required: false
        schema:
          type: boolean
          format: boolean
      tags:
      - AlertService
  /v1/alerts/summary/timeseries:
    get:
      summary: GetAlertTimeseries returns the alerts sorted by time.
      operationId: GetAlertTimeseries
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1GetAlertTimeseriesResponse'
      parameters:
      - name: query
        in: query
        required: false
        schema:
          type: string
      - name: pagination.limit
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.offset
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.sort_option.field
        in: query
        required: false
        schema:
          type: string
      - name: pagination.sort_option.reversed
        in: query
        required: false
        schema:
          type: boolean
          format: boolean
      tags:
      - AlertService
  /v1/alerts/{id}:
    get:
      summary: GetAlert returns the alert given its id.
      operationId: GetAlert
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/storageAlert'
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      tags:
      - AlertService
  /v1/alerts/{id}/resolve:
    patch:
      summary: ResolveAlert marks the given alert (by ID) as resolved.
      operationId: ResolveAlert
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1Empty'
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v1ResolveAlertRequest'
        required: true
      tags:
      - AlertService
  /v1/alerts/{id}/snooze:
    patch:
      summary: SnoozeAlert is deprecated.
      operationId: SnoozeAlert
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1Empty'
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v1SnoozeAlertRequest'
        required: true
      tags:
      - AlertService
  /v1/alertscount:
    get:
      summary: CountAlerts counts how many alerts match the get request.
      operationId: CountAlerts
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1CountAlertsResponse'
      parameters:
      - name: query
        in: query
        required: false
        schema:
          type: string
      - name: pagination.limit
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.offset
        in: query
        required: false
        schema:
          type: integer
          format: int32
      - name: pagination.sort_option.field
        in: query
        required: false
        schema:
          type: string
      - name: pagination.sort_option.reversed
        in: query
        required: false
        schema:
          type: boolean
          format: boolean
      tags:
      - AlertService
components:
  schemas:
    storageComparator:
      type: string
      enum:
      - LESS_THAN
      - LESS_THAN_OR_EQUALS
      - EQUALS
      - GREATER_THAN_OR_EQUALS
      - GREATER_THAN
      default: LESS_THAN
    storageProcessPolicy:
      type: object
      properties:
        name:
          type: string
        args:
          type: string
        ancestor:
          type: string
        uid:
          type: string
    GetAlertsGroupResponsePolicyGroup:
      type: object
      properties:
        policy:
          $ref: '#/components/schemas/storageListAlertPolicy'
        numAlerts:
          type: string
          format: int64
    v1GetAlertsGroupResponse:
      type: object
      properties:
        alertsByPolicies:
          type: array
          items:
            $ref: '#/components/schemas/GetAlertsGroupResponsePolicyGroup'
    GetAlertsCountsResponseAlertGroup:
      type: object
      properties:
        group:
          type: string
        counts:
          type: array
          items:
            $ref: '#/components/schemas/AlertGroupAlertCounts'
    v1ResolveAlertRequest:
      type: object
      properties:
        id:
          type: string
        whitelist:
          type: boolean
          format: boolean
    ClusterAlertsAlertEvents:
      type: object
      properties:
        severity:
          $ref: '#/components/schemas/storageSeverity'
        events:
          type: array
          items:
            $ref: '#/components/schemas/v1AlertEvent'
    storageListAlertDeployment:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        clusterName:
          type: string
        namespace:
          type: string
        clusterId:
          type: string
        inactive:
          type: boolean
          format: boolean
    storageComponent:
      type: object
      properties:
        name:
          type: string
        version:
          type: string
    storageListAlertPolicy:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        severity:
          $ref: '#/components/schemas/storageSeverity'
        description:
          type: string
        categories:
          type: array
          items:
            type: string
    storagePortPolicy:
      type: object
      properties:
        port:
          type: integer
          format: int32
        protocol:
          type: string
    v1AlertEvent:
      type: object
      properties:
        time:
          type: string
          format: int64
        type:
          $ref: '#/components/schemas/v1Type'
        id:
          type: string
    storageImageNamePolicy:
      type: object
      properties:
        registry:
          type: string
        remote:
          type: string
        tag:
          type: string
    EnvironmentConfigEnvVarSource:
      type: string
      enum:
      - UNSET
      - RAW
      - SECRET_KEY
      - CONFIG_MAP_KEY
      - FIELD
      - RESOURCE_FIELD
      - UNKNOWN
      default: UNSET
      title: For any update to EnvVarSource, please also update 'ui/src/messages/common.js'
    v1GetAlertTimeseriesResponse:
      type: object
      properties:
        clusters:
          type: array
          items:
            $ref: '#/components/schemas/GetAlertTimeseriesResponseClusterAlerts'
    storageProcessSignal:
      type: object
      properties:
        id:
          type: string
          description: 'A unique UUID for identifying the message

            We have this here instead of at the top level

            because we want to have each message to be

            self contained.'
        containerId:
          type: string
          title: ID of container associated with this process
        time:
          type: string
          format: date-time
          title: Process creation time
        name:
          type: string
          title: Process name
        args:
          type: string
          title: Process arguments
        execFilePath:
          type: string
          title: Process executable file path
        pid:
          type: integer
          format: int64
          title: Host process ID
        uid:
          type: integer
          format: int64
          title: Real user ID
        gid:
          type: integer
          format: int64
          title: Real group ID
        lineage:
          type: array
          items:
            type: string
          title: Process Lineage
    storageListAlert:
      type: object
      properties:
        id:
          type: string
        lifecycleStage:
          $ref: '#/components/schemas/storageLifecycleStage'
        time:
          type: string
          format: date-time
        policy:
          $ref: '#/components/schemas/storageListAlertPolicy'
        deployment:
          $ref: '#/components/schemas/storageListAlertDeployment'
        state:
          $ref: '#/components/schemas/storageViolationState'
        enforcementCount:
          type: integer
          format: int32
    v1CountAlertsResponse:
      type: object
      properties:
        count:
          type: integer
          format: int32
    storageKeyValuePolicy:
      type: object
      properties:
        key:
          type: string
        value:
          type: string
        envVarSource:
          $ref: '#/components/schemas/EnvironmentConfigEnvVarSource'
    v1DeleteAlertsResponse:
      type: object
      properties:
        numDeleted:
          type: integer
          format: int64
        dryRun:
          type: boolean
          format: boolean
    storageWhitelistDeployment:
      type: object
      properties:
        name:
          type: string
        scope:
          $ref: '#/components/schemas/storageScope'
    storageVolumePolicy:
      type: object
      properties:
        name:
          type: string
        source:
          type: string
        destination:
          type: string
        readOnly:
          type: boolean
          format: boolean
        type:
          type: string
    v1ResolveAlertsRequest:
      type: object
      properties:
        query:
          type: string
    AlertDeploymentContainer:
      type: object
      properties:
        image:
          $ref: '#/components/schemas/storageContainerImage'
        name:
          type: string
    storagePermissionPolicy:
      type: object
      properties:
        permissionLevel:
          $ref: '#/components/schemas/storagePermissionLevel'
      description: K8S RBAC Permission level configuration.
    AlertViolation:
      type: object
      properties:
        message:
          type: string
        DEPRECATEDProcesses:
          type: array
          items:
            $ref: '#/components/schemas/storageProcessIndicator'
    storageSeverity:
      type: string
      enum:
      - UNSET_SEVERITY
      - LOW_SEVERITY
      - MEDIUM_SEVERITY
      - HIGH_SEVERITY
      - CRITICAL_SEVERITY
      default: UNSET_SEVERITY
    v1ListAlertsResponse:
      type: object
      properties:
        alerts:
          type: array
          items:
            $ref: '#/components/schemas/storageListAlert'
    storagePermissionLevel:
      type: string
      enum:
      - UNSET
      - NONE
      - DEFAULT
      - ELEVATED_IN_NAMESPACE
      - ELEVATED_CLUSTER_WIDE
      - CLUSTER_ADMIN
      default: UNSET
      title: 'For any update to PermissionLevel, also update:

        - central/searchbasedpolicies/builders/k8s_rbac.go

        - ui/src/messages/common.js'
    storageAlertDeployment:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        type:
          type: string
        namespace:
          type: string
        labels:
          type: object
          additionalProperties:
            type: string
        clusterId:
          type: string
        clusterName:
          type: string
        containers:
          type: array
          items:
            $ref: '#/components/schemas/AlertDeploymentContainer'
        annotations:
          type: object
          additionalProperties:
            type: string
        inactive:
          type: boolean
          format: boolean
    storageWhitelist:
      type: object
      properties:
        name:
          type: string
        deployment:
          $ref: '#/components/schemas/storageWhitelistDeployment'
        image:
          $ref: '#/components/schemas/storageWhitelistImage'
        expiration:
          type: string
          format: date-time
    storageImageName:
      type: object
      properties:
        registry:
          type: string
        remote:
          type: string
        tag:
          type: string
        fullName:
          type: string
    storageScope:
      type: object
      properties:
        cluster:
          type: string
        namespace:
          type: string
        label:
          $ref: '#/components/schemas/storageScopeLabel'
    storageResourcePolicy:
      type: object
      properties:
        cpuResourceRequest:
          $ref: '#/components/schemas/storageNumericalPolicy'
        cpuResourceLimit:
          $ref: '#/components/schemas/storageNumericalPolicy'
        memoryResourceRequest:
          $ref: '#/components/schemas/storageNumericalPolicy'
        memoryResourceLimit:
          $ref: '#/components/schemas/storageNumericalPolicy'
    AlertProcessViolation:
      type: object
      properties:
        message:
          type: string
        processes:
          type: array
          items:
            $ref: '#/components/schemas/storageProcessIndicator'
    storageEnforcementAction:
      type: string
      enum:
      - UNSET_ENFORCEMENT
      - SCALE_TO_ZERO_ENFORCEMENT
      - UNSATISFIABLE_NODE_CONSTRAINT_ENFORCEMENT
      - KILL_POD_ENFORCEMENT
      - FAIL_BUILD_ENFORCEMENT
      default: UNSET_ENFORCEMENT
    PortConfigExposureLevel:
      type: string
      enum:
      - UNSET
      - EXTERNAL
      - NODE
      - INTERNAL
      - HOST
      default: UNSET
    storageDockerfileLineRuleField:
      type: object
      properties:
        instruction:
          type: string
        value:
          type: string
    AlertGroupAlertCounts:
      type: object
      properties:
        severity:
          $ref: '#/components/schemas/storageSeverity'
        count:
          type: string
          format: int64
    storagePolicy:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        description:
          type: string
        rationale:
          type: string
        remediation:
          type: string
        disabled:
          type: boolean
          format: boolean
        categories:
          type: array
          items:
            type: string
        fields:
          $ref: '#/components/schemas/storagePolicyFields'
        lifecycleStages:
          type: array
          items:
            $ref: '#/components/schemas/storageLifecycleStage'
        whitelists:
          type: array
          items:
            $ref: '#/components/schemas/storageWhitelist'
        scope:
          type: array
          items:
            $ref: '#/components/schemas/storageScope'
        severity:
          $ref: '#/components/schemas/storageSeverity'
        enforcementActions:
          type: array
          items:
            $ref: '#/components/schemas/storageEnforcementAction'
        notifiers:
          type: array
          items:
            type: string
        lastUpdated:
          type: string
          format: date-time
    GetAlertTimeseriesResponseClusterAlerts:
      type: object
      properties:
        cluster:
          type: string
        severities:
          type: array
          items:
            $ref: '#/components/schemas/ClusterAlertsAlertEvents'
    v1GetAlertsCountsResponse:
      type: object
      properties:
        groups:
          type: array
          items:
            $ref: '#/components/schemas/GetAlertsCountsResponseAlertGroup'
    storagePortExposurePolicy:
      type: object
      properties:
        exposureLevels:
          type: array
          items:
            $ref: '#/components/schemas/PortConfigExposureLevel'
    storageViolationState:
      type: string
      enum:
      - ACTIVE
      - SNOOZED
      - RESOLVED
      default: ACTIVE
    storageAlert:
      type: object
      properties:
        id:
          type: string
        policy:
          $ref: '#/components/schemas/storagePolicy'
        lifecycleStage:
          $ref: '#/components/schemas/storageLifecycleStage'
        deployment:
          $ref: '#/components/schemas/storageAlertDeployment'
        violations:
          type: array
          items:
            $ref: '#/components/schemas/AlertViolation'
        processViolation:
          $ref: '#/components/schemas/AlertProcessViolation'
        enforcement:
          $ref: '#/components/schemas/AlertEnforcement'
        time:
          type: string
          format: date-time
        firstOccurred:
          type: string
          format: date-time
        state:
          $ref: '#/components/schemas/storageViolationState'
        snoozeTill:
          type: string
          format: date-time
    storageProcessIndicator:
      type: object
      properties:
        id:
          type: string
          title: A unique uuid for the Indicator message
        deploymentId:
          type: string
        deploymentStateTs:
          type: string
          format: int64
        containerName:
          type: string
        podId:
          type: string
        signal:
          $ref: '#/components/schemas/storageProcessSignal'
        clusterId:
          type: string
        namespace:
          type: string
        containerStartTime:
          type: string
          format: date-time
      title: 'Next available tag: 11'
    storageWhitelistImage:
      type: object
      properties:
        name:
          type: string
    storageNumericalPolicy:
      type: object
      properties:
        op:
          $ref: '#/components/schemas/storageComparator'
        value:
          type: number
          format: float
    storageHostMountPolicy:
      type: object
      properties:
        readOnly:
          type: boolean
          format: boolean
    v1Empty:
      type: object
    v1Type:
      type: string
      enum:
      - CREATED
      - REMOVED
      default: CREATED
    storageContainerImage:
      type: object
      properties:
        id:
          type: string
          title: These tags maintain backwards compatibiltiy with the previously embedded storage.Image
        name:
          $ref: '#/components/schemas/storageImageName'
        notPullable:
          type: boolean
          format: boolean
    storageLifecycleStage:
      type: string
      enum:
      - DEPLOY
      - BUILD
      - RUNTIME
      default: DEPLOY
    storageScopeLabel:
      type: object
      properties:
        key:
          type: string
        value:
          type: string
    AlertEnforcement:
      type: object
      properties:
        action:
          $ref: '#/components/schemas/storageEnforcementAction'
        message:
          type: string
    v1SnoozeAlertRequest:
      type: object
      properties:
        id:
          type: string
        snoozeTill:
          type: string
          format: date-time
    storagePolicyFields:
      type: object
      properties:
        imageName:
          $ref: '#/components/schemas/storageImageNamePolicy'
        imageAgeDays:
          type: string
          format: int64
        lineRule:
          $ref: '#/components/schemas/storageDockerfileLineRuleField'
        cvss:
          $ref: '#/components/schemas/storageNumericalPolicy'
        cve:
          type: string
        component:
          $ref: '#/components/schemas/storageComponent'
        scanAgeDays:
          type: string
          format: int64
        noScanExists:
          type: boolean
          format: boolean
        env:
          $ref: '#/components/schemas/storageKeyValuePolicy'
        command:
          type: string
        args:
          type: string
        directory:
          type: string
        user:
          type: string
        volumePolicy:
          $ref: '#/components/schemas/storageVolumePolicy'
        portPolicy:
          $ref: '#/components/schemas/storagePortPolicy'
        requiredLabel:
          $ref: '#/components/schemas/storageKeyValuePolicy'
        requiredAnnotation:
          $ref: '#/components/schemas/storageKeyValuePolicy'
        disallowedAnnotation:
          $ref: '#/components/schemas/storageKeyValuePolicy'
        privileged:
          type: boolean
          format: boolean
        dropCapabilities:
          type: array
          items:
            type: string
        addCapabilities:
          type: array
          items:
            type: string
        containerResourcePolicy:
          $ref: '#/components/schemas/storageResourcePolicy'
        processPolicy:
          $ref: '#/components/schemas/storageProcessPolicy'
        readOnlyRootFs:
          type: boolean
          format: boolean
        fixedBy:
          type: string
        portExposurePolicy:
          $ref: '#/components/schemas/storagePortExposurePolicy'
        permissionPolicy:
          $ref: '#/components/schemas/storagePermissionPolicy'
        hostMountPolicy:
          $ref: '#/components/schemas/storageHostMountPolicy'
        whitelistEnabled:
          type: boolean
          format: boolean
      title: 'Next Available Tag: 29'
  securitySchemes:
    ApiToken:
      type: apiKey
      in: header
      name: Authorization
      description: 'StackRox API token. Format: Bearer {token}'