Every API here is available over the APIs.io API and to AI agents over MCP.
{
"openapi": "3.1.0",
"info": {
"title": "Stream Security API",
"description": "Stream Security API for managing security rules, integrations, AI interactions, and more.",
"version": "1.0.0"
},
"servers": [
{
"url": "https://{app}.streamsec.io/openapi"
}
],
"paths": {
"/attack_paths/details/{resource_id}": {
"get": {
"operationId": "attackPaths-details",
"summary": "Get Resource Attack Path Details",
"description": "Retrieves the complete attack path for a specified resource, showing the sequence of network and security components an attacker could traverse to reach it.\n\nThe response returns one or more ordered paths, starting from the origin (e.g., Internet) and listing each intermediate element such as gateways, ACLs, security groups, load balancers, or other relevant resources.\n\nParameters include the unique resource_id (required) and the optional workspace context.\n\nUse this endpoint to visualize potential exposure, assess lateral movement risk, and prioritize remediation actions.",
"tags": [
"Attack Paths"
],
"security": [
{
"BearerAuth": []
}
],
"parameters": [
{
"in": "header",
"name": "workspace",
"schema": {
"description": "Workspace ID",
"type": "string"
},
"description": "Workspace ID"
},
{
"in": "path",
"name": "resource_id",
"schema": {
"type": "string"
},
"required": true
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"paths": {
"type": "array",
"items": {
"type": "array",
"items": {
"type": "string"
}
}
},
"ports": {
"type": "array",
"items": {
"type": "object",
"properties": {
"start": {
"type": "number"
},
"end": {
"type": "number"
},
"protocol": {
"type": "string"
}
},
"required": [
"start",
"end",
"protocol"
],
"additionalProperties": false
}
},
"sources": {
"type": "array",
"items": {
"type": "object",
"properties": {
"resource_id": {
"type": "string"
},
"port_ranges": {
"type": "array",
"items": {
"type": "object",
"properties": {
"start": {
"type": "number"
},
"end": {
"type": "number"
},
"protocol": {
"type": "string"
}
},
"required": [
"start",
"end",
"protocol"
],
"additionalProperties": false
}
}
},
"required": [
"resource_id"
],
"additionalProperties": false
}
}
},
"required": [
"paths"
],
"additionalProperties": false
}
}
}
},
"400": {
"description": "Invalid input data",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.BAD_REQUEST"
}
}
}
},
"401": {
"description": "Authorization not provided",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.UNAUTHORIZED"
}
}
}
},
"403": {
"description": "Insufficient access",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.FORBIDDEN"
}
}
}
},
"404": {
"description": "Not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.NOT_FOUND"
}
}
}
},
"500": {
"description": "Internal server error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR"
}
}
}
}
}
}
},
"/attack_paths": {
"get": {
"operationId": "attackPaths-list",
"summary": "Get Attack Paths",
"description": "Retrieves all attack paths discovered within a workspace. Attack path is a condition in which an asset is both externally exploitable and has a cloud blast radius that allows it to potentially interact with or compromise internal resources.\n\nEach response entry includes the attack path ID, severity, associated finding types, and violations count.\n\nUse this endpoint to review all known attack paths, track exposed resources, and prioritize remediation efforts across the environment.",
"tags": [
"Attack Paths"
],
"security": [
{
"BearerAuth": []
}
],
"parameters": [
{
"in": "header",
"name": "workspace",
"schema": {
"description": "Workspace ID",
"type": "string"
},
"description": "Workspace ID"
},
{
"in": "query",
"name": "attack_path_ids",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"in": "query",
"name": "resource_ids",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"description": {
"type": "string"
},
"severity": {
"type": "number"
},
"finding_types": {
"type": "array",
"items": {
"type": "string",
"enum": [
"misconfiguration",
"internet_exposed",
"insecure_identity",
"vulnerability",
"high_privileges",
"privilege_escalation",
"data_access",
"crown_jewel_access",
"admin_privileges",
"external_access",
"segmentation_breach"
]
}
},
"violations_count": {
"type": "number"
}
},
"required": [
"id"
],
"additionalProperties": false
}
}
}
}
},
"400": {
"description": "Invalid input data",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.BAD_REQUEST"
}
}
}
},
"401": {
"description": "Authorization not provided",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.UNAUTHORIZED"
}
}
}
},
"403": {
"description": "Insufficient access",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.FORBIDDEN"
}
}
}
},
"404": {
"description": "Not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.NOT_FOUND"
}
}
}
},
"500": {
"description": "Internal server error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR"
}
}
}
}
}
}
},
"/attack_paths/violations": {
"get": {
"operationId": "attackPaths-violations",
"summary": "Get Attack Path Violations",
"description": "Retrieves all resources that are violating security posture rules and, as a result, create an attack path condition.\n\nAn attack path occurs when an asset is both externally exploitable and has a cloud blast radius that allows it to potentially interact with or compromise internal resources.\n\nThe response includes the resource IDs along with the timestamps indicating when each resource began violating the rule.",
"tags": [
"Attack Paths"
],
"security": [
{
"BearerAuth": []
}
],
"parameters": [
{
"in": "header",
"name": "workspace",
"schema": {
"description": "Workspace ID",
"type": "string"
},
"description": "Workspace ID"
},
{
"in": "query",
"name": "attack_path_id",
"schema": {
"type": "string"
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"results": {
"type": "array",
"items": {
"type": "object",
"properties": {
"subject_id": {
"type": "string"
},
"first_seen_timestamp": {
"type": "string"
}
},
"required": [
"subject_id"
],
"additionalProperties": false
}
},
"total_count": {
"type": "number"
}
},
"required": [
"results",
"total_count"
],
"additionalProperties": false
}
}
}
},
"400": {
"description": "Invalid input data",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.BAD_REQUEST"
}
}
}
},
"401": {
"description": "Authorization not provided",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.UNAUTHORIZED"
}
}
}
},
"403": {
"description": "Insufficient access",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.FORBIDDEN"
}
}
}
},
"404": {
"description": "Not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.NOT_FOUND"
}
}
}
},
"500": {
"description": "Internal server error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR"
}
}
}
}
}
}
},
"/canaries": {
"get": {
"operationId": "canaries-list",
"summary": "Get Canaries",
"description": "Retrieves a list of all deployed and configured canary resources across monitored accounts.\n\nA canary resource is a controlled, decoy asset - such as an S3 bucket - used to detect unauthorized activity by triggering alerts when predefined detection actions occur.\n\nThis endpoint supports filtering by account ID, region, resource type, status, creator, and other attributes. Optional parameters allow inclusion of related activity logs for each canary.\n\nReturned objects include canary metadata, deployment status, detection settings, exclusion rules, and recent activity indicators.",
"tags": [
"Canaries"
],
"security": [
{
"BearerAuth": []
}
],
"parameters": [
{
"in": "header",
"name": "workspace",
"schema": {
"description": "Workspace ID",
"type": "string"
},
"description": "Workspace ID"
},
{
"in": "query",
"name": "accountId",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"in": "query",
"name": "activityLogs",
"schema": {
"type": "boolean"
}
},
{
"in": "query",
"name": "createdBy",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"in": "query",
"name": "phrase",
"schema": {
"type": "string"
}
},
{
"in": "query",
"name": "region",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"in": "query",
"name": "resourceId",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"in": "query",
"name": "resourceType",
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"in": "query",
"name": "status",
"schema": {
"type": "array",
"items": {
"type": "string",
"enum": [
"active",
"disabled",
"not_deployed",
"deleted"
]
}
}
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"type": "array",
"items": {
"type": "object",
"properties": {
"_id": {
"type": "string"
},
"name": {
"type": "string"
},
"accountId": {
"type": "string"
},
"subscriptionId": {
"type": "string"
},
"resourceGroupId": {
"type": "string"
},
"region": {
"type": "string"
},
"resourceType": {
"type": "string"
},
"description": {
"type": "string"
},
"status": {
"type": "string"
},
"createdBy": {
"type": "string"
},
"createdAt": {
"type": "string"
},
"attackPaths": {
"type": "object",
"propertyNames": {
"type": "string"
},
"additionalProperties": {
"type": "number"
}
},
"detectionsCount": {
"type": "number"
},
"isSandbox": {
"type": "boolean"
},
"hasActivityLogs": {
"type": "boolean"
},
"initialTags": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string"
},
"value": {
"type": "string"
}
},
"required": [
"key",
"value"
],
"additionalProperties": false
}
},
"excludeTags": {
"type": "array",
"items": {
"type": "object",
"properties": {
"_id": {
"type": "string"
},
"key": {
"type": "string"
},
"match_type": {
"type": "string"
},
"value": {
"type": "string"
}
},
"required": [
"_id",
"key",
"match_type",
"value"
],
"additionalProperties": false
}
},
"resourceId": {
"type": "string"
},
"iamRoles": {
"type": "array",
"items": {
"type": "string"
}
},
"allowProjectVmAccess": {
"type": "boolean"
},
"detectionEnabled": {
"type": "boolean"
},
"detectionActions": {
"type": "array",
"items": {
"type": "string"
}
},
"azureStorageAccountId": {
"type": "string"
}
},
"required": [
"_id",
"name",
"accountId",
"region",
"resourceType",
"status",
"createdAt"
],
"additionalProperties": false
}
}
}
}
},
"400": {
"description": "Invalid input data",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.BAD_REQUEST"
}
}
}
},
"401": {
"description": "Authorization not provided",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.UNAUTHORIZED"
}
}
}
},
"403": {
"description": "Insufficient access",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.FORBIDDEN"
}
}
}
},
"404": {
"description": "Not found",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.NOT_FOUND"
}
}
}
},
"500": {
"description": "Internal server error",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR"
}
}
}
}
}
}
},
"/config-changes/{id}": {
"get": {
"operationId": "configChanges-details",
"summary": "Get Configuration Change Details",
"description": "Retrieves the full details of a specific configuration change by its unique ID, including associated violations and attack paths.\n\nConfiguration changes are write audit events analyzed for security impact, such as internet exposure, privilege escalation, or new database access.\n\nUse this endpoint to investigate the change, assess its risk, and understand potential exploitation paths.",
"tags": [
"Config Changes"
],
"security": [
{
"BearerAuth": []
}
],
"parameters": [
{
"in": "header",
"name": "workspace",
"schema": {
"description": "Workspace ID",
"type": "string"
},
"description": "Workspace ID"
},
{
"in": "path",
"name": "id",
"schema": {
"type": "string"
},
"required": true
}
],
"responses": {
"200": {
"description": "Successful response",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"details": {
"type": "object",
"properties": {
"_id": {
"type": "string"
},
"severity": {
"type": "number"
},
"event_name": {
"type": "string"
},
"timestamp": {
"type": "string"
},
"source": {
"type": "object",
"properties": {
"type": {
"type": "string"
},
"metadata": {
"type": "object",
"propertyNames": {
"type": "string"
},
"additionalProperties": {}
}
},
"additionalProperties": false
},
"sub_events": {
"type": "array",
"items": {
"type": "object",
"properties": {
"_id": {
"type": "string"
},
"is_base": {
"type": "boolean"
},
"severity": {
"type": "number"
},
"action_type": {
"type": "string"
},
"cloud_provider": {
"type": "string"
},
"cloud_source_ip": {
"type": "string"
},
"cloud_user_arn": {
"type": "string"
},
"account_id": {
"type": "string"
},
"region": {
"type": "string"
},
"resource_blocks": {
"type": "array",
"items": {
"type": "string"
}
},
"resource_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"entities": {
"type": "array",
"items": {
"type": "object",
"properties": {
"id": {
"type": "string"
},
"type": {
"type": "string"
}
},
"required": [
"id"
],
"additionalProperties": false
}
},
"config_changes": {
"type": "array",
"items": {
"type": "object",
"properties": {
"resource_id": {
"type": "string"
},
"before": {},
"after": {}
},
"required": [
"resource_id",
"before",
"after"
],
"additionalProperties": false
}
},
"user_agent": {
"type": "string"
},
"comment": {
"type": "string"
},
"impact_types": {
"type": "array",
"items": {
"type": "string"
}
},
"hidden": {
"type": "boolean"
}
},
"required": [
"_id"
],
"additionalProperties": false
}
},
"impact_types": {
"type": "array",
"items": {
"type": "string"
}
},
"account_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"violations_by_violated_rules_severity": {
"type": "object",
"propertyNames": {
"type": "string"
},
"additionalProperties": {
"type": "number"
}
},
"raw_event": {}
},
"required": [
"_id"
],
"additionalProperties": false
},
"risks": {
"type": "object",
"properties": {
"violations": {
"type": "array",
# --- truncated at 32 KB (388 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/stream-security/refs/heads/main/openapi/stream-security-api-openapi.json