Tanium Connections API

openapi: 3.2.0
info:
  title: Tanium Connections API
  version: 1.0.0
  contact:
    name: Tanium Support
    url: https://community.tanium.com/s/
  license:
    name: Proprietary
    url: https://www.tanium.com/terms-of-use/
  x-date: '2026-03-04'
  description: 'Operations tagged Connections across 2 of this provider''s published API definitions: tanium-connect-api-openapi.yml, tanium-threat-response-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{tanium_server}
  description: Tanium Server
  variables:
    tanium_server:
      default: tanium.example.com
      description: Hostname or IP address of the Tanium server
security:
- apiToken: []
tags:
- name: Connections
  description: Manage data delivery connections
paths:
  /plugin/products/connect/v1/connections:
    get:
      operationId: listConnections
      summary: List All Connections
      description: Retrieves a list of all configured connections. Each connection defines the link between a data source in Tanium and an external destination, along with formatting, filtering, and scheduling options.
      tags:
      - Connections
      parameters:
      - name: limit
        in: query
        description: Maximum number of connections to return
        schema:
          type: integer
      - name: offset
        in: query
        description: Number of connections to skip for pagination
        schema:
          type: integer
      responses:
        '200':
          description: Connections retrieved successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Connection'
        '401':
          description: Authentication required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    post:
      operationId: createConnection
      summary: Create A New Connection
      description: Creates a new connection linking a data source to a destination with the specified format, filter, and schedule settings. The connection can be configured to deliver data as CSV, JSON, or CEF formats.
      tags:
      - Connections
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConnectionCreate'
      responses:
        '200':
          description: Connection created successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Connection'
        '400':
          description: Invalid connection configuration
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Authentication required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    servers:
    - url: https://{tanium_server}
      description: Tanium Server
      variables:
        tanium_server:
          default: tanium.example.com
          description: Hostname or IP address of the Tanium server
  /plugin/products/connect/v1/connections/{connectionId}:
    get:
      operationId: getConnection
      summary: Get A Connection By ID
      description: Retrieves the full configuration and current status of a specific connection, including its source, destination, format, filter, and schedule settings.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection
        schema:
          type: integer
      responses:
        '200':
          description: Connection retrieved successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Connection'
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      operationId: updateConnection
      summary: Update A Connection
      description: Updates the configuration of an existing connection. All connections that share a destination are affected when the destination settings are changed.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection
        schema:
          type: integer
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConnectionUpdate'
      responses:
        '200':
          description: Connection updated successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Connection'
        '400':
          description: Invalid connection configuration
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      operationId: deleteConnection
      summary: Delete A Connection
      description: Permanently deletes a connection and its associated schedule. The underlying source and destination configurations are not affected.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection to delete
        schema:
          type: integer
      responses:
        '200':
          description: Connection deleted successfully
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    servers:
    - url: https://{tanium_server}
      description: Tanium Server
      variables:
        tanium_server:
          default: tanium.example.com
          description: Hostname or IP address of the Tanium server
  /plugin/products/connect/v1/connections/{connectionId}/run:
    post:
      operationId: runConnection
      summary: Run A Connection On Demand
      description: Triggers an immediate execution of a connection outside of its normal schedule. This sends the current source data to the configured destination.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection to run
        schema:
          type: integer
      responses:
        '200':
          description: Connection execution initiated
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      status:
                        type: string
                        description: Execution status
                      runId:
                        type: string
                        description: Identifier for this execution run
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    servers:
    - url: https://{tanium_server}
      description: Tanium Server
      variables:
        tanium_server:
          default: tanium.example.com
          description: Hostname or IP address of the Tanium server
  /plugin/products/connect/v1/connections/{connectionId}/enable:
    put:
      operationId: enableConnection
      summary: Enable A Connection
      description: Enables a previously disabled connection, allowing it to run on its configured schedule.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection
        schema:
          type: integer
      responses:
        '200':
          description: Connection enabled successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Connection'
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    servers:
    - url: https://{tanium_server}
      description: Tanium Server
      variables:
        tanium_server:
          default: tanium.example.com
          description: Hostname or IP address of the Tanium server
  /plugin/products/connect/v1/connections/{connectionId}/disable:
    put:
      operationId: disableConnection
      summary: Disable A Connection
      description: Disables a connection, preventing it from running on its schedule. The connection configuration is preserved and can be re-enabled later.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection
        schema:
          type: integer
      responses:
        '200':
          description: Connection disabled successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Connection'
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    servers:
    - url: https://{tanium_server}
      description: Tanium Server
      variables:
        tanium_server:
          default: tanium.example.com
          description: Hostname or IP address of the Tanium server
  /plugin/products/threat-response/api/v1/conns:
    get:
      operationId: listConnections
      summary: List Endpoint Connections
      description: Retrieves a paginated list of live connections to endpoints. Connections can be filtered by status, IP address, platform, and hostname.
      tags:
      - Connections
      parameters:
      - name: limit
        in: query
        description: Maximum number of connections to return
        schema:
          type: integer
      - name: offset
        in: query
        description: Number of connections to skip for pagination
        schema:
          type: integer
      - name: status
        in: query
        description: Filter by connection status
        schema:
          type: string
      - name: ip
        in: query
        description: Filter by endpoint IP address
        schema:
          type: string
      - name: platform
        in: query
        description: Filter by endpoint platform
        schema:
          type: string
      - name: hostname
        in: query
        description: Filter by endpoint hostname
        schema:
          type: string
      responses:
        '200':
          description: Connections retrieved successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Connection_2'
        '401':
          description: Authentication required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    servers:
    - url: https://{tanium_server}
      description: Tanium Server
      variables:
        tanium_server:
          default: tanium.example.com
          description: Hostname or IP address of the Tanium server
  /plugin/products/threat-response/api/v1/conns/connect:
    post:
      operationId: createConnection
      summary: Create A Live Connection To An Endpoint
      description: Initiates a live connection to a specified endpoint for investigation purposes. Requires the client ID, IP, platform, and hostname of the target endpoint.
      tags:
      - Connections
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - client_id
              - ip
              - platform
              - hostname
              properties:
                client_id:
                  type: string
                  description: Tanium client identifier of the endpoint
                ip:
                  type: string
                  description: IP address of the endpoint
                platform:
                  type: string
                  description: Operating system platform
                hostname:
                  type: string
                  description: Hostname of the endpoint
      responses:
        '200':
          description: Connection initiated successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Connection_2'
        '400':
          description: Invalid connection parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    servers:
    - url: https://{tanium_server}
      description: Tanium Server
      variables:
        tanium_server:
          default: tanium.example.com
          description: Hostname or IP address of the Tanium server
  /plugin/products/threat-response/api/v1/conns/{connectionId}:
    get:
      operationId: getConnection
      summary: Get A Connection By ID
      description: Retrieves the details and current status of a specific endpoint connection.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection
        schema:
          type: string
      responses:
        '200':
          description: Connection retrieved successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Connection_2'
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    servers:
    - url: https://{tanium_server}
      description: Tanium Server
      variables:
        tanium_server:
          default: tanium.example.com
          description: Hostname or IP address of the Tanium server
  /plugin/products/threat-response/api/v1/conns/close/{connectionId}:
    post:
      operationId: closeConnection
      summary: Close A Live Connection
      description: Closes an active live connection to an endpoint, ending the investigation session.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection to close
        schema:
          type: string
      responses:
        '200':
          description: Connection closed successfully
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    servers:
    - url: https://{tanium_server}
      description: Tanium Server
      variables:
        tanium_server:
          default: tanium.example.com
          description: Hostname or IP address of the Tanium server
  /plugin/products/threat-response/api/v1/conns/delete/{connectionId}:
    delete:
      operationId: deleteConnection
      summary: Delete A Connection Record
      description: Permanently deletes a connection record from the Threat Response database.
      tags:
      - Connections
      parameters:
      - name: connectionId
        in: path
        required: true
        description: Unique identifier of the connection to delete
        schema:
          type: string
      responses:
        '200':
          description: Connection deleted successfully
        '404':
          description: Connection not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    servers:
    - url: https://{tanium_server}
      description: Tanium Server
      variables:
        tanium_server:
          default: tanium.example.com
          description: Hostname or IP address of the Tanium server
components:
  schemas:
    ConnectionUpdate:
      type: object
      properties:
        name:
          type: string
          description: Updated connection name
        description:
          type: string
          description: Updated connection description
        enabled:
          type: boolean
          description: Updated enabled state
        source:
          type: object
          properties:
            id:
              type: integer
            type:
              type: string
          description: Updated data source reference
        destination:
          type: object
          properties:
            id:
              type: integer
          description: Updated destination reference
        schedule:
          type: object
          properties:
            intervalSeconds:
              type: integer
            startTime:
              type: string
              format: date-time
          description: Updated schedule configuration
        format:
          type: object
          properties:
            type:
              type: string
              enum:
              - csv
              - json
              - cef
              - leef
              - keyvalue
            options:
              type: object
              properties:
                delimiter:
                  type: string
                headerRow:
                  type: boolean
                timestampFormat:
                  type: string
          description: Updated output format configuration
        filter:
          type: object
          properties:
            enabled:
              type: boolean
            rules:
              type: array
              items:
                type: object
                properties:
                  column:
                    type: string
                  operator:
                    type: string
                  value:
                    type: string
          description: Updated data filter configuration
    Error:
      type: object
      properties:
        text:
          type: string
          description: Error message text
        errors:
          type: array
          items:
            type: object
            properties:
              message:
                type: string
          description: List of error details
    ConnectionCreate:
      type: object
      required:
      - name
      - source
      - destination
      properties:
        name:
          type: string
          description: Connection name
        description:
          type: string
          description: Connection description
        enabled:
          type: boolean
          description: Whether the connection should be enabled on creation
          default: true
        source:
          type: object
          required:
          - id
          properties:
            id:
              type: integer
              description: Source identifier
            type:
              type: string
              description: Source type
          description: Data source reference
        destination:
          type: object
          required:
          - id
          properties:
            id:
              type: integer
              description: Destination identifier
          description: Destination reference
        schedule:
          type: object
          properties:
            intervalSeconds:
              type: integer
              description: Interval between runs in seconds
            startTime:
              type: string
              format: date-time
              description: Schedule start time
          description: Schedule configuration
        format:
          type: object
          properties:
            type:
              type: string
              enum:
              - csv
              - json
              - cef
              - leef
              - keyvalue
            options:
              type: object
              properties:
                delimiter:
                  type: string
                headerRow:
                  type: boolean
                timestampFormat:
                  type: string
          description: Output format configuration
        filter:
          type: object
          properties:
            enabled:
              type: boolean
            rules:
              type: array
              items:
                type: object
                properties:
                  column:
                    type: string
                  operator:
                    type: string
                  value:
                    type: string
          description: Data filter configuration
    Connection:
      type: object
      properties:
        id:
          type: integer
          description: Unique connection identifier
        name:
          type: string
          description: Connection name
        description:
          type: string
          description: Connection description
        enabled:
          type: boolean
          description: Whether the connection is enabled
        source:
          $ref: '#/components/schemas/Source'
        destination:
          $ref: '#/components/schemas/Destination'
        schedule:
          $ref: '#/components/schemas/Schedule'
        format:
          type: object
          properties:
            type:
              type: string
              description: Output format type
              enum:
              - csv
              - json
              - cef
              - leef
              - keyvalue
            options:
              type: object
              properties:
                delimiter:
                  type: string
                  description: Field delimiter for CSV format
                headerRow:
                  type: boolean
                  description: Include header row in CSV output
                timestampFormat:
                  type: string
                  description: Timestamp format string
              description: Format-specific options
          description: Output format configuration
        filter:
          type: object
          properties:
            enabled:
              type: boolean
              description: Whether filtering is enabled
            rules:
              type: array
              items:
                type: object
                properties:
                  column:
                    type: string
                    description: Column to filter on
                  operator:
                    type: string
                    description: Filter operator
                  value:
                    type: string
                    description: Filter value
              description: Filter rules
          description: Data filter configuration
        lastRunStatus:
          type: string
          description: Status of the last execution
        lastRunTime:
          type: string
          format: date-time
          description: Timestamp of the last execution
        createdAt:
          type: string
          format: date-time
          description: Connection creation timestamp
        updatedAt:
          type: string
          format: date-time
          description: Connection last update timestamp
    Schedule:
      type: object
      properties:
        id:
          type: integer
          description: Unique schedule identifier
        connectionId:
          type: integer
          description: Associated connection identifier
        intervalSeconds:
          type: integer
          description: Interval between runs in seconds
        startTime:
          type: string
          format: date-time
          description: Schedule start time
        lastRunTime:
          type: string
          format: date-time
          description: Timestamp of the last run
        nextRunTime:
          type: string
          format: date-time
          description: Timestamp of the next scheduled run
        lastRunStatus:
          type: string
          description: Status of the last run
        enabled:
          type: boolean
          description: Whether the schedule is active
    Destination:
      type: object
      properties:
        id:
          type: integer
          description: Unique destination identifier
        name:
          type: string
          description: Destination name
        type:
          type: string
          description: Destination type
          enum:
          - file
          - syslog
          - http
          - email
          - s3
          - sql
        configuration:
          type: object
          description: Type-specific destination configuration
          properties:
            host:
              type: string
              description: Destination hostname (syslog, http, sql)
            port:
              type: integer
              description: Destination port (syslog, sql)
            protocol:
              type: string
              description: Protocol (TCP, UDP for syslog; HTTP, HTTPS for http)
            url:
              type: string
              description: Full URL for HTTP destinations
            method:
              type: string
              description: HTTP method for webhook destinations
              enum:
              - POST
              - PUT
              - PATCH
            path:
              type: string
              description: File path for file destinations
            bucket:
              type: string
              description: S3 bucket name
            region:
              type: string
              description: AWS region for S3 destinations
            useTls:
              type: boolean
              description: Whether to use TLS encryption
            headers:
              type: object
              additionalProperties:
                type: string
              description: Custom HTTP headers for webhook destinations
        createdAt:
          type: string
          format: date-time
          description: Destination creation timestamp
        updatedAt:
          type: string
          format: date-time
          description: Destination last update timestamp
    Source:
      type: object
      properties:
        id:
          type: integer
          description: Unique source identifier
        name:
          type: string
          description: Source name
        type:
          type: string
          description: Source type
          enum:
          - saved_question
          - question_log
          - system_status
          - event
          - discover
          - integrity_monitor
          - threat_response
        description:
          type: string
          description: Source description
        savedQuestionId:
          type: integer
          description: Associated saved question ID (for saved_question type)
        columns:
          type: array
          items:
            type: object
            properties:
              name:
                type: string
                description: Column name
              type:
                type: string
                description: Column data type
          description: Available output columns
    Connection_2:
      type: object
      properties:
        id:
          type: string
          description: Unique connection identifier
        hostname:
          type: string
          description: Hostname of the connected endpoint
        ip:
          type: string
          description: IP address of the connected endpoint
        platform:
          type: string
          description: Operating system platform
        status:
          type: string
          description: Current connection status
        initiatedAt:
          type: string
          format: date-time
          description: Timestamp when the connection was initiated
        connectedAt:
          type: string
          format: date-time
          description: Timestamp when the connection was established
        message:
          type: string
          description: Status message for the connection
        clientId:
          type: string
          description: Tanium client identifier
        userId:
          type: integer
          description: User who initiated the connection
        eid:
          type: string
          description: Endpoint identifier
        personaId:
          type: integer
          description: Persona identifier
        hasTools:
          type: boolean
          description: Whether endpoint has investigation tools deployed
  securitySchemes:
    apiToken:
      type: apiKey
      name: session
      in: header
      description: API token passed in the session header for authenticating with the Tanium Connect API.
x-refined-from:
- tanium-connect-api-openapi.yml
- tanium-threat-response-api-openapi.yml