Tanium Connections API

openapi: 3.1.0
info:
  title: Tanium Connect Actions Connections API
  description: The Tanium Connect REST API allows creating, editing, and managing connections for delivering endpoint data to downstream systems. Connections link data sources (saved questions, event data, system status) to destinations (files, syslog, HTTP/webhooks, email, SQL databases) and can run on a schedule or be triggered by events. All endpoints are under the /plugin/products/connect/v1/ base path.
  version: 1.0.0
  contact:
    name: Tanium Support
    url: https://community.tanium.com/s/
  license:
    name: Proprietary
    url: https://www.tanium.com/terms-of-use/
  x-date: '2026-03-04'
servers:
- url: https://{tanium_server}
  description: Tanium Server
  variables:
    tanium_server:
      default: tanium.example.com
      description: Hostname or IP address of the Tanium server
security:
- apiToken: []
tags:
- name: Connections
  description: Manage data delivery connections
paths:
  /plugin/products/connect/v1/connections:
    get:
      operationId: listConnections
      summary: List All Connections
      description: Retrieves a list of all configured connections. Each connection defines the link between a data source in Tanium and an external destination, along with formatting, filtering, and scheduling options.
      tags:
      - Connections
      parameters:
      - name: limit
        in: query
        description: Maximum number of connections to return
        schema:
          type: integer
      - name: offset
        in: query
        description: Number of connections to skip for pagination
        schema:
          type: integer
      responses:
        '200':
          description: Connections retrieved successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Connection'
        '401':
          description: Authentication required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    post:
      operationId: createConnection
      summary: Create A New Connection
      description: Creates a new connection linking a data source to a destination with the specified format, filter, and schedule settings. The connection can be configured to deliver data as CSV, JSON, or CEF formats.
      tags:
      - Connections
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConnectionCreate'
      responses:
        '200':
          description: Connection created successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Connection'
        '400':
          description: Invalid connection configuration
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Authentication required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /plugin/products/connect/v1/connections/{connectionId}:
    get:
      operationId: getConnection
      summary: Get A Connection By ID
      description: Retrieves the full configuration and current status of a specific connection, including its source, destination, format, filter, and schedule settings.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection
        schema:
          type: integer
      responses:
        '200':
          description: Connection retrieved successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Connection'
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      operationId: updateConnection
      summary: Update A Connection
      description: Updates the configuration of an existing connection. All connections that share a destination are affected when the destination settings are changed.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection
        schema:
          type: integer
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConnectionUpdate'
      responses:
        '200':
          description: Connection updated successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Connection'
        '400':
          description: Invalid connection configuration
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      operationId: deleteConnection
      summary: Delete A Connection
      description: Permanently deletes a connection and its associated schedule. The underlying source and destination configurations are not affected.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection to delete
        schema:
          type: integer
      responses:
        '200':
          description: Connection deleted successfully
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /plugin/products/connect/v1/connections/{connectionId}/run:
    post:
      operationId: runConnection
      summary: Run A Connection On Demand
      description: Triggers an immediate execution of a connection outside of its normal schedule. This sends the current source data to the configured destination.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection to run
        schema:
          type: integer
      responses:
        '200':
          description: Connection execution initiated
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      status:
                        type: string
                        description: Execution status
                      runId:
                        type: string
                        description: Identifier for this execution run
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /plugin/products/connect/v1/connections/{connectionId}/enable:
    put:
      operationId: enableConnection
      summary: Enable A Connection
      description: Enables a previously disabled connection, allowing it to run on its configured schedule.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection
        schema:
          type: integer
      responses:
        '200':
          description: Connection enabled successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Connection'
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /plugin/products/connect/v1/connections/{connectionId}/disable:
    put:
      operationId: disableConnection
      summary: Disable A Connection
      description: Disables a connection, preventing it from running on its schedule. The connection configuration is preserved and can be re-enabled later.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection
        schema:
          type: integer
      responses:
        '200':
          description: Connection disabled successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Connection'
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /plugin/products/threat-response/api/v1/conns:
    get:
      operationId: listConnections
      summary: List Endpoint Connections
      description: Retrieves a paginated list of live connections to endpoints. Connections can be filtered by status, IP address, platform, and hostname.
      tags:
      - Connections
      parameters:
      - name: limit
        in: query
        description: Maximum number of connections to return
        schema:
          type: integer
      - name: offset
        in: query
        description: Number of connections to skip for pagination
        schema:
          type: integer
      - name: status
        in: query
        description: Filter by connection status
        schema:
          type: string
      - name: ip
        in: query
        description: Filter by endpoint IP address
        schema:
          type: string
      - name: platform
        in: query
        description: Filter by endpoint platform
        schema:
          type: string
      - name: hostname
        in: query
        description: Filter by endpoint hostname
        schema:
          type: string
      responses:
        '200':
          description: Connections retrieved successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Connection_2'
        '401':
          description: Authentication required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /plugin/products/threat-response/api/v1/conns/connect:
    post:
      operationId: createConnection
      summary: Create A Live Connection To An Endpoint
      description: Initiates a live connection to a specified endpoint for investigation purposes. Requires the client ID, IP, platform, and hostname of the target endpoint.
      tags:
      - Connections
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - client_id
              - ip
              - platform
              - hostname
              properties:
                client_id:
                  type: string
                  description: Tanium client identifier of the endpoint
                ip:
                  type: string
                  description: IP address of the endpoint
                platform:
                  type: string
                  description: Operating system platform
                hostname:
                  type: string
                  description: Hostname of the endpoint
      responses:
        '200':
          description: Connection initiated successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Connection_2'
        '400':
          description: Invalid connection parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /plugin/products/threat-response/api/v1/conns/{connectionId}:
    get:
      operationId: getConnection
      summary: Get A Connection By ID
      description: Retrieves the details and current status of a specific endpoint connection.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection
        schema:
          type: string
      responses:
        '200':
          description: Connection retrieved successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Connection_2'
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /plugin/products/threat-response/api/v1/conns/close/{connectionId}:
    post:
      operationId: closeConnection
      summary: Close A Live Connection
      description: Closes an active live connection to an endpoint, ending the investigation session.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection to close
        schema:
          type: string
      responses:
        '200':
          description: Connection closed successfully
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /plugin/products/threat-response/api/v1/conns/delete/{connectionId}:
    delete:
      operationId: deleteConnection
      summary: Delete A Connection Record
      description: Permanently deletes a connection record from the Threat Response database.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection to delete
        schema:
          type: string
      responses:
        '200':
          description: Connection deleted successfully
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    Connection_2:
      type: object
      properties:
        id:
          type: string
          description: Unique connection identifier
        hostname:
          type: string
          description: Hostname of the connected endpoint
        ip:
          type: string
          description: IP address of the connected endpoint
        platform:
          type: string
          description: Operating system platform
        status:
          type: string
          description: Current connection status
        initiatedAt:
          type: string
          format: date-time
          description: Timestamp when the connection was initiated
        connectedAt:
          type: string
          format: date-time
          description: Timestamp when the connection was established
        message:
          type: string
          description: Status message for the connection
        clientId:
          type: string
          description: Tanium client identifier
        userId:
          type: integer
          description: User who initiated the connection
        eid:
          type: string
          description: Endpoint identifier
        personaId:
          type: integer
          description: Persona identifier
        hasTools:
          type: boolean
          description: Whether endpoint has investigation tools deployed
    ConnectionCreate:
      type: object
      required:
      - name
      - source
      - destination
      properties:
        name:
          type: string
          description: Connection name
        description:
          type: string
          description: Connection description
        enabled:
          type: boolean
          description: Whether the connection should be enabled on creation
          default: true
        source:
          type: object
          required:
          - id
          properties:
            id:
              type: integer
              description: Source identifier
            type:
              type: string
              description: Source type
          description: Data source reference
        destination:
          type: object
          required:
          - id
          properties:
            id:
              type: integer
              description: Destination identifier
          description: Destination reference
        schedule:
          type: object
          properties:
            intervalSeconds:
              type: integer
              description: Interval between runs in seconds
            startTime:
              type: string
              format: date-time
              description: Schedule start time
          description: Schedule configuration
        format:
          type: object
          properties:
            type:
              type: string
              enum:
              - csv
              - json
              - cef
              - leef
              - keyvalue
            options:
              type: object
              properties:
                delimiter:
                  type: string
                headerRow:
                  type: boolean
                timestampFormat:
                  type: string
          description: Output format configuration
        filter:
          type: object
          properties:
            enabled:
              type: boolean
            rules:
              type: array
              items:
                type: object
                properties:
                  column:
                    type: string
                  operator:
                    type: string
                  value:
                    type: string
          description: Data filter configuration
    ConnectionUpdate:
      type: object
      properties:
        name:
          type: string
          description: Updated connection name
        description:
          type: string
          description: Updated connection description
        enabled:
          type: boolean
          description: Updated enabled state
        source:
          type: object
          properties:
            id:
              type: integer
            type:
              type: string
          description: Updated data source reference
        destination:
          type: object
          properties:
            id:
              type: integer
          description: Updated destination reference
        schedule:
          type: object
          properties:
            intervalSeconds:
              type: integer
            startTime:
              type: string
              format: date-time
          description: Updated schedule configuration
        format:
          type: object
          properties:
            type:
              type: string
              enum:
              - csv
              - json
              - cef
              - leef
              - keyvalue
            options:
              type: object
              properties:
                delimiter:
                  type: string
                headerRow:
                  type: boolean
                timestampFormat:
                  type: string
          description: Updated output format configuration
        filter:
          type: object
          properties:
            enabled:
              type: boolean
            rules:
              type: array
              items:
                type: object
                properties:
                  column:
                    type: string
                  operator:
                    type: string
                  value:
                    type: string
          description: Updated data filter configuration
    Error:
      type: object
      properties:
        text:
          type: string
          description: Error message text
        errors:
          type: array
          items:
            type: object
            properties:
              message:
                type: string
          description: List of error details
    Destination:
      type: object
      properties:
        id:
          type: integer
          description: Unique destination identifier
        name:
          type: string
          description: Destination name
        type:
          type: string
          description: Destination type
          enum:
          - file
          - syslog
          - http
          - email
          - s3
          - sql
        configuration:
          type: object
          description: Type-specific destination configuration
          properties:
            host:
              type: string
              description: Destination hostname (syslog, http, sql)
            port:
              type: integer
              description: Destination port (syslog, sql)
            protocol:
              type: string
              description: Protocol (TCP, UDP for syslog; HTTP, HTTPS for http)
            url:
              type: string
              description: Full URL for HTTP destinations
            method:
              type: string
              description: HTTP method for webhook destinations
              enum:
              - POST
              - PUT
              - PATCH
            path:
              type: string
              description: File path for file destinations
            bucket:
              type: string
              description: S3 bucket name
            region:
              type: string
              description: AWS region for S3 destinations
            useTls:
              type: boolean
              description: Whether to use TLS encryption
            headers:
              type: object
              additionalProperties:
                type: string
              description: Custom HTTP headers for webhook destinations
        createdAt:
          type: string
          format: date-time
          description: Destination creation timestamp
        updatedAt:
          type: string
          format: date-time
          description: Destination last update timestamp
    Connection:
      type: object
      properties:
        id:
          type: integer
          description: Unique connection identifier
        name:
          type: string
          description: Connection name
        description:
          type: string
          description: Connection description
        enabled:
          type: boolean
          description: Whether the connection is enabled
        source:
          $ref: '#/components/schemas/Source'
        destination:
          $ref: '#/components/schemas/Destination'
        schedule:
          $ref: '#/components/schemas/Schedule'
        format:
          type: object
          properties:
            type:
              type: string
              description: Output format type
              enum:
              - csv
              - json
              - cef
              - leef
              - keyvalue
            options:
              type: object
              properties:
                delimiter:
                  type: string
                  description: Field delimiter for CSV format
                headerRow:
                  type: boolean
                  description: Include header row in CSV output
                timestampFormat:
                  type: string
                  description: Timestamp format string
              description: Format-specific options
          description: Output format configuration
        filter:
          type: object
          properties:
            enabled:
              type: boolean
              description: Whether filtering is enabled
            rules:
              type: array
              items:
                type: object
                properties:
                  column:
                    type: string
                    description: Column to filter on
                  operator:
                    type: string
                    description: Filter operator
                  value:
                    type: string
                    description: Filter value
              description: Filter rules
          description: Data filter configuration
        lastRunStatus:
          type: string
          description: Status of the last execution
        lastRunTime:
          type: string
          format: date-time
          description: Timestamp of the last execution
        createdAt:
          type: string
          format: date-time
          description: Connection creation timestamp
        updatedAt:
          type: string
          format: date-time
          description: Connection last update timestamp
    Source:
      type: object
      properties:
        id:
          type: integer
          description: Unique source identifier
        name:
          type: string
          description: Source name
        type:
          type: string
          description: Source type
          enum:
          - saved_question
          - question_log
          - system_status
          - event
          - discover
          - integrity_monitor
          - threat_response
        description:
          type: string
          description: Source description
        savedQuestionId:
          type: integer
          description: Associated saved question ID (for saved_question type)
        columns:
          type: array
          items:
            type: object
            properties:
              name:
                type: string
                description: Column name
              type:
                type: string
                description: Column data type
          description: Available output columns
    Schedule:
      type: object
      properties:
        id:
          type: integer
          description: Unique schedule identifier
        connectionId:
          type: integer
          description: Associated connection identifier
        intervalSeconds:
          type: integer
          description: Interval between runs in seconds
        startTime:
          type: string
          format: date-time
          description: Schedule start time
        lastRunTime:
          type: string
          format: date-time
          description: Timestamp of the last run
        nextRunTime:
          type: string
          format: date-time
          description: Timestamp of the next scheduled run
        lastRunStatus:
          type: string
          description: Status of the last run
        enabled:
          type: boolean
          description: Whether the schedule is active
  securitySchemes:
    apiToken:
      type: apiKey
      name: session
      in: header
      description: API token passed in the session header for authenticating with the Tanium Connect API.