Synqly API
Synqly API as documented publicly: 95 operations. Contract generated from the documentation by API Evangelist (2026-10-21); not the provider's own document.
Operations 95
POST
/v1/assets/devices/bulk-properties
Set custom properties on devices by MAC address (Armis V3 bulk). Creates custom properties if needed.
#
PUT
/v1/assets/software/{deviceuid}
Updates a software inventory record on a known device in the token-linked Integration.
#
GET
/v1/chat/conversations
Returns a list of conversations (channels or workspaces) not scoped to a specific user. Providers that can only enumerate conversations per-user return NotImplemented; use query_us
#
GET
/v1/chat/conversations/{conversationid}/members
Returns the members of a specific conversation.
#
GET
/v1/chat/conversations/{conversationid}/messages
Returns messages from a specific conversation.
#
GET
/v1/chat/messages
Returns all messages across every conversation in the connected workspace or tenant.
#
GET
/v1/chat/users
Returns a list of users in the connected workspace or tenant. Used to discover whose conversations can be queried.
#
GET
/v1/chat/users/{userid}/conversations
Returns a list of conversations scoped to a specific user — DMs, group chats, or (for AI providers) synthesised sessions.
#
GET
/v1/chat/users/{userid}/conversations/{conversationid}/members
Returns the members of a conversation scoped to a specific user. Required for providers where conversations are only addressable via the user (e.g. Teams DMs, Copilot AI sessions).
#
GET
/v1/chat/users/{userid}/conversations/{conversationid}/messages
Returns messages from a conversation scoped to a specific user. Required for providers where conversations are only addressable via the user (e.g. Teams DMs, Copilot AI sessions).
#
GET
/v1/cloudsecurity/cloudresourcesinventory
Returns a list of cloud resources that match the query from the cloud security provider.
#
GET
/v1/cloudsecurity/compliancefindings
Returns a list of compliance findings matching the query from the cloud security provider.
#
GET
/v1/cloudsecurity/events
Returns a list of events that match the query from the cloud security provider.
#
GET
/v1/cloudsecurity/ioms
Returns a list of Indicators of Misconfiguration (IOM) findings that match the query from the cloud security provider.
#
GET
/v1/cloudsecurity/threats
Returns a list of threat detections that match the query from the cloud security provider.
#
GET
/v1/edr/alerts
Returns a list of alerts that match the query from the token-linked EDR source.
#
GET
/v1/edr/applications
Returns a list of applications matching the query from the token-linked EDR source.
#
GET
/v1/edr/edr_events
Returns a list of EDR events that match the query from the token-linked EDR source.
#
GET
/v1/edr/endpoints
Returns a list of endpoint assets matching the query from the token‑linked EDR source.
#
POST
/v1/edr/endpoints/actions/quarantine
Connect or disconnect one or more endpoints assets to the network, allowing or disallowing connections.
#
GET
/v1/edr/endpoints/{id}
Gets a single endpoint assets matching the UID from the token‑linked EDR source.
#
POST
/v1/edr/endpoints/{uid}/actions/execute-command
Runs a provider‑backed command on the endpoint identified by {uid} and returns normalized stdout and stderr without exposing provider session details.
#
POST
/v1/edr/endpoints/{uid}/actions/execute-remote-script
Runs a script on the endpoint identified by {uid} and returns normalized stdout and stderr without exposing provider session details. Long‑running executions return a pending statu
#
POST
/v1/edr/endpoints/{uid}/actions/retrieve-file
Retrieves a file from the endpoint identified by {uid} and returns the provider artifact as a binary file response.
#
GET
/v1/edr/exclusions
Returns the exclusions configured in the token-linked EDR source as OCSF Compliance Findings, one per exclusion rule, with the rule's pattern, type, platform, owner and scope. By d
#
DELETE
/v1/edr/ioas
Deletes the IOA rules identified by the ids in the query params. Some providers scope rule ids to a rule group; for those providers group_id is required.
#
GET
/v1/edr/ioas
Returns a list of IOA rules that match the query from the token-linked EDR source.
#
GET
/v1/edr/policies
Returns the protection policy at one level of the token-linked EDR source's policy tree (global, account, site or group; resource.type selects the level and defaults to global) as
#
GET
/v1/edr/posture_score
Returns the posture score of the endpoint assets that match the query from the token-linked EDR source.
#
GET
/v1/edr/threats
Returns a list of threats that match the query from the token-linked EDR source.
#
GET
/v1/email-security/email-events
Returns a list of email events matching the query from the token-linked Email Security provider. Most providers default to the last 30 days of email events, which the time filter o
#
GET
/v1/email-security/threats
Returns a list of threats matching the query from the token-linked Email Security provider. Defaults to the last 30 days of threats. This can be overridden by using the time filter
#
GET
/v1/email-security/threats/{threatid}
Returns the details of the threat matching {threatId} from the token-linked Email Security provider. If a provider allows for the gathering of more detailed information about a thr
#
GET
/v1/endpoint-management/compliance
Returns a list of device compliance findings matching the query from the token-linked endpoint management source.
#
GET
/v1/endpoint-management/devices
Returns a list of managed devices matching the query from the token-linked endpoint management source.
#
POST
/v1/endpoint-management/devices/actions/remediate
Performs a remediation action on a managed device from the token-linked endpoint management source.
#
POST
/v1/endpoint-management/devices/actions/update
Triggers the device to check in and enforce all assigned policies, profiles, and pending updates.
#
POST
/v1/endpoint-management/devices/actions/wipe
Factory resets or erases all data from the device.
#
GET
/v1/endpoint-management/devices/{id}
Gets a single managed device matching the ID from the token-linked endpoint management source.
#
GET
/v1/endpoint-management/devices/{id}/applications
Returns a list of applications installed on a managed device from the token-linked endpoint management source.
#
GET
/v1/grc/controls/{controlid}
Returns the compliance control matching {controlId} from the token-linked GRC integration.
#
GET
/v1/grc/devices
Returns the compliance state of every device tracked in the token-linked GRC integration, as OCSF Compliance Findings. Includes compliant devices.
#
GET
/v1/grc/devices/{deviceid}
Returns the compliance state of the device matching {deviceId} from the token-linked GRC integration.
#
GET
/v1/grc/evidence
Returns the documentation artifacts collected in the token-linked GRC integration.
#
GET
/v1/grc/frameworks
Returns the compliance frameworks tracked in the token-linked GRC integration.
#
GET
/v1/grc/personnel
Returns the compliance state of every person tracked in the token-linked GRC integration, as OCSF Compliance Findings. Includes compliant personnel.
#
GET
/v1/grc/personnel/{personnelid}
Returns the compliance state of the person matching {personnelId} from the token-linked GRC integration.
#
GET
/v1/grc/tests
Returns the automated compliance tests defined in the token-linked GRC integration.
#
GET
/v1/grc/tests/{testid}
Returns the compliance test matching {testId} from the token-linked GRC integration.
#
POST
/v1/hooks
Proxy webhook messages from webhook providers to webhook recievers. For exact webhook implementations please refer to providers e.g. Ticketing. This is just an API call used in tha
#
POST
/v1/hooks/passthrough/{webhookcursor}
Proxy webhook messages from webhook providers to webhook recievers. For exact webhook implementations please refer to providers e.g. Ticketing. This is just an API call used in tha
#
GET
/v1/identity/groups
Returns a list of Group objects wrapped in the OCSF Entity Management event of type Read from the token-linked identity provider.
#
GET
/v1/identity/groups/{groupid}
Returns a Group object wrapped in an OCSF Entity Management event of type Read from the token-linked identity provider. Depending on the providers offerings, this may include addit
#
GET
/v1/identity/groups/{groupid}/members
Returns list of User objects wrapped in an OCSF Entity Management event of type Read from the token‑linked identity provider that are members in the group referenced by ID.
#
GET
/v1/identity/risk-events
Returns identity threat / risk events (for example Microsoft Entra Identity Protection risk detections for users), normalized to OCSF.
#
GET
/v1/identity/risky-users
Returns rolled-up risky user records (for example Microsoft Entra Identity Protection riskyUsers), each normalized to an OCSF Entity Management Read event.
#
GET
/v1/identity/users
Returns a list of User objects wrapped in the OCSF Entity Management event of type Read from the token-linked identity provider.
#
GET
/v1/identity/users/{userid}
Returns a User object wrapped in an OCSF Entity Management event of type Read from the token-linked identity provider. Depending on the providers offerings, this may include additi
#
POST
/v1/identity/users/{userid}/actions/disable
Disables a user in the identity system based on user ID.
#
POST
/v1/identity/users/{userid}/actions/enable
Reenables a disabled user in the identity system based on user ID.
#
POST
/v1/identity/users/{userid}/actions/expire_all_sessions
Logs a user out of all current sessions so they must log in again.
#
POST
/v1/identity/users/{userid}/actions/force_reset_password
Forces a user to reset their password before they can log in again.
#
GET
/v1/identity/users/{userid}/picture
Returns the profile picture for a user as binary image data. The Content‑Type header indicates the image format (e.g., image/jpeg, image/png).
#
GET
/v1/incident-response/escalation-policies
Returns a list of incident response escalation policies.
#
GET
/v1/incident-response/escalation-policies/{escalationpolicyid}/users-on-call
Returns a list of users that are currently on call for an incident response escalation policy.
#
GET
/v1/network-security/traffic/log-configurations
Returns traffic log configurations discovered for the integration.
#