ThreatLocker

ThreatLocker Action Log API

The ActionLog API from ThreatLocker — 9 operation(s) for actionlog.

GitHub OpenAPI

Documentation

📖
Documentation
https://threatlocker.kb.help/api-documentation/
📖
APIReference
https://portalapi.threatlocker.com/swagger/index.html
📖
GettingStarted
https://threatlocker.kb.help/getting-started-with-threatlocker-portalapis/
📖
Authentication
https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/authentication/threatlocker-authentication.yml

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/openapi/threatlocker-actionlog-api-openapi.yml

Other Resources

🔗
Conventions
https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/conventions/threatlocker-conventions.yml
🔗
ErrorCatalog
https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/errors/threatlocker-problem-types.yml
🔗
DataModel
https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/data-model/threatlocker-data-model.yml
🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/asyncapi/threatlocker-webhooks.yml
🔗
APIsJSON
https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/apis.yml

OpenAPI Specification

threatlocker-actionlog-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Portal Action Log API
  version: v1.0.0
security:
- Authorization: []
  ManagedOrganizationId: []
  OverrideManagedOrganizationId: []
tags:
- name: ActionLog
paths:
  /portalapi/ActionLog/ActionLogGetByParametersV2:
    post:
      tags:
      - ActionLog
      summary: Get Action Logs By Parameters.
      description: "Parameters Values:\n            \n    {\n          \"ActionType\": \"execute | install\
        \ | network | registry | read | write | move |\n                          delete | baseline |\
        \ powershell | elevate | configuration | dns\",\n          \"SourceTableId\": \"ActionLog = 1\
        \ | DenyActionLog = 2 | BaselineActionLog = 3 | EventLogActionLog = 4\",\n          \"ActionId\"\
        : \"Permit = 1 | Deny = 2 | DenyOptionToRequest = 3 | InstallMode = 4 | MissingCoreFiles = 5 |\
        \ Ringfenced = 6 | AnyDeny = 7\",\n          \"GroupBy\": \"FullPath = path | Hash = hash | SourceIp\
        \ = sourceip | Cert = cert | Hostname = hostname | Username = username | ProcessPath = process\"\
        \n    }"
      parameters:
      - name: usenewsearch
        in: header
        schema:
          type: string
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActionLogParamsDto'
          text/json:
            schema:
              $ref: '#/components/schemas/ActionLogParamsDto'
          application/*+json:
            schema:
              $ref: '#/components/schemas/ActionLogParamsDto'
      responses:
        '200':
          description: OK
  /portalapi/ActionLog/ActionLogGetAllForFileHistory:
    get:
      tags:
      - ActionLog
      summary: Get All File History by hostname and fullpath
      description: "Parameters Values:\n            \n    {\n       \"sourceTableId\": \"ActionLog = 1\
        \ | DenyActionLog = 2 | BaselineActionLog = 3 | EventLogActionLog = 4\"\n    }"
      parameters:
      - name: sourceTableId
        in: query
        description: ''
        schema:
          type: integer
          format: int32
      - name: hostname
        in: query
        description: ''
        schema:
          type: string
      - name: fullPath
        in: query
        description: ''
        schema:
          type: string
      - name: pageNumber
        in: query
        description: ''
        schema:
          type: integer
          format: int32
          default: 1
      - name: pageSize
        in: query
        description: ''
        schema:
          type: integer
          format: int32
          default: 25
      responses:
        '200':
          description: OK
  /portalapi/ActionLog/ActionLogGetAllForFileHistoryV2:
    get:
      tags:
      - ActionLog
      summary: Get All File History by hostname and fullpath
      description: "Parameters Values:\n            \n    {\n       \"sourceTableId\": \"ActionLog = 1\
        \ | DenyActionLog = 2 | BaselineActionLog = 3 | EventLogActionLog = 4\"\n    }"
      parameters:
      - name: sourceTableId
        in: query
        description: ''
        schema:
          type: integer
          format: int32
      - name: hostname
        in: query
        description: ''
        schema:
          type: string
      - name: fullPath
        in: query
        description: ''
        schema:
          type: string
      - name: computerId
        in: query
        description: ''
        schema:
          type: string
          format: uuid
      - name: pageNumber
        in: query
        description: ''
        schema:
          type: integer
          format: int32
          default: 1
      - name: pageSize
        in: query
        description: ''
        schema:
          type: integer
          format: int32
          default: 25
      responses:
        '200':
          description: OK
  /portalapi/ActionLog/ActionLogGetById:
    get:
      tags:
      - ActionLog
      summary: Get Action Logs by Id.
      description: "Parameters Values:\n            \n    {\n          \"sourceTableId\": \"ActionLog\
        \ = 1 | DenyActionLog = 2 | BaselineActionLog = 3 | EventLogActionLog = 4\"\n    }"
      parameters:
      - name: actionLogId
        in: query
        description: ''
        schema:
          type: integer
          format: int64
      - name: sourceTableId
        in: query
        description: ''
        schema:
          type: integer
          format: int32
      - name: addToApplication
        in: query
        description: ''
        schema:
          type: boolean
          default: false
      responses:
        '200':
          description: OK
  /portalapi/ActionLog/ActionLogGetByIdV2:
    get:
      tags:
      - ActionLog
      parameters:
      - name: eActionLogId
        in: query
        schema:
          type: string
      - name: sourceTableId
        in: query
        schema:
          type: integer
          format: int32
      - name: addToApplication
        in: query
        schema:
          type: boolean
          default: false
      - name: getAllParents
        in: query
        schema:
          type: boolean
          default: false
      - name: openedFromLink
        in: query
        schema:
          type: boolean
          default: false
      responses:
        '200':
          description: OK
  /portalapi/ActionLog/ActionLogGetTestingEnvironmentDetailsById:
    post:
      tags:
      - ActionLog
      summary: Get Testing Environment Details For VDI HyperV
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FileDownloadDetailsDto'
          text/json:
            schema:
              $ref: '#/components/schemas/FileDownloadDetailsDto'
          application/*+json:
            schema:
              $ref: '#/components/schemas/FileDownloadDetailsDto'
      responses:
        '200':
          description: OK
  /portalapi/ActionLog/ActionLogGetPolicyConditionsForPermitApplication:
    post:
      tags:
      - ActionLog
      summary: Get Policy Conditions For Permit Application
      description: "Parameters Values:\n            \n    {\n          \"OSType\": \"All = 0 | Windows\
        \ = 1 | MAC = 2 | Linux = 3\"\n          \"ActionType\": \"None = 0 | BaseLine = 1 | Configuration\
        \ = 2 | Delete = 3 | Elevation = 4 | Execute = 5 |\n                         Install = 6 | Move\
        \ = 7 | Network = 8  | NewProcess = 9  | Powershell = 10 | Read = 11 |  \n                   \
        \      Registry = 12 | Uninstall = 13 | Write = 14 | OSEventLog = 15\",\n    }"
      parameters:
      - name: usenewsearch
        in: header
        schema:
          type: string
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PermitApplicationDto'
          text/json:
            schema:
              $ref: '#/components/schemas/PermitApplicationDto'
          application/*+json:
            schema:
              $ref: '#/components/schemas/PermitApplicationDto'
      responses:
        '200':
          description: OK
  /portalapi/ActionLog/ActionLogGetSearchString:
    post:
      tags:
      - ActionLog
      summary: Get Search String (This is for save search).
      description: "Parameters Values:\n            \n    {\n           \"ActionType\": \"None = 0 | BaseLine\
        \ = 1 | Configuration = 2 | Delete = 3 | Elevation = 4 | Execute = 5 |\n                     \
        \    Install = 6 | Move = 7 | Network = 8  | NewProcess = 9  | Powershell = 10 | Read = 11 | \
        \ \n                         Registry = 12 | Uninstall = 13 | Write = 14 | OSEventLog = 15\",\n\
        \          \"SourceTableId\": \"ActionLog = 1 | DenyActionLog = 2 | BaselineActionLog = 3 | EventLogActionLog\
        \ = 4\",\n          \"ActionId\": \"Permit = 1 | Deny = 2 | DenyOptionToRequest = 3 | InstallMode\
        \ = 4 | MissingCoreFiles = 5 | Ringfenced = 6 | AnyDeny = 7\",\n          \"GroupBy\": \"FullPath\
        \ = path | Hash = hash | SourceIp = sourceip | Cert = cert | Hostname = hostname | Username =\
        \ username | ProcessPath = process\"\n    }"
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActionLogParamsDto'
          text/json:
            schema:
              $ref: '#/components/schemas/ActionLogParamsDto'
          application/*+json:
            schema:
              $ref: '#/components/schemas/ActionLogParamsDto'
      responses:
        '200':
          description: OK
  /portalapi/ActionLog/ActionLogGetFileDownloadDetailsById:
    get:
      tags:
      - ActionLog
      parameters:
      - name: eActionLogId
        in: query
        schema:
          type: string
      - name: sourceTableId
        in: query
        schema:
          type: integer
          format: int32
      responses:
        '200':
          description: OK
components:
  schemas:
    EngineRating:
      type: object
      properties:
        name:
          type:
          - string
          - 'null'
        rating:
          type:
          - string
          - 'null'
      additionalProperties: false
    RegistryPolicy:
      type: object
      properties:
        registryPolicyId:
          type:
          - string
          - 'null'
        path:
          type:
          - string
          - 'null'
        action:
          type: integer
          description: 1 = Permit, 2 = Deny
          format: int32
        permission:
          type: integer
          description: 1 = Read, 2 = Write
          format: int32
      additionalProperties: false
    FilePolicy:
      type: object
      properties:
        filePolicyId:
          type:
          - string
          - 'null'
        path:
          type:
          - string
          - 'null'
        action:
          type: integer
          description: 1 = Permit, 2 = Deny
          format: int32
        permission:
          type: integer
          description: 1 = Read, 2 = Write
          format: int32
      additionalProperties: false
    SystemAuditItem:
      type: object
      properties:
        organizationId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        userId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        username:
          type:
          - string
          - 'null'
          default: ''
        action:
          type:
          - string
          - 'null'
          default: ''
        ipAddress:
          type:
          - string
          - 'null'
          default: ''
        effectiveAction:
          type:
          - string
          - 'null'
          default: ''
        details:
          $ref: '#/components/schemas/SystemAuditDetails'
        masterViewOnly:
          type: boolean
        dateTime:
          type: string
          format: date-time
        systemAuditId:
          type: string
          format: uuid
        systemAuditObjectTypeId:
          type:
          - integer
          - 'null'
          format: int32
        organizationName:
          type:
          - string
          - 'null'
        ticketNumber:
          type:
          - string
          - 'null'
          default: ''
        notes:
          type:
          - string
          - 'null'
          default: ''
      additionalProperties: false
    Certificate:
      type: object
      properties:
        subject:
          type:
          - string
          - 'null'
          default: ''
        sha:
          type:
          - string
          - 'null'
          default: ''
        value:
          type:
          - string
          - 'null'
          default: ''
        validCert:
          type: boolean
      additionalProperties: false
    ParamsFieldsDto:
      type: object
      properties:
        name:
          type:
          - string
          - 'null'
          default: filter
        filterType:
          type: integer
          format: int32
          default: 1
        fieldType:
          type: integer
          format: int32
          default: 1
        value:
          type:
          - string
          - 'null'
          default: Remove White Noise
        label:
          type:
          - string
          - 'null'
          default: Filter
        dropdownLabel:
          type:
          - string
          - 'null'
          default: Remove White Noise
        isDropDown:
          type: boolean
          default: true
        guidValue:
          type:
          - string
          - 'null'
          format: uuid
          default: null
        numericValue:
          type:
          - integer
          - 'null'
          format: int32
          default: null
        longValue:
          type:
          - integer
          - 'null'
          format: int64
          default: null
        boolValue:
          type:
          - boolean
          - 'null'
          default: null
        dateTimeValue:
          type:
          - string
          - 'null'
          format: date-time
          default: null
        fieldAttributeId:
          type:
          - integer
          - 'null'
          format: int32
          default: null
        listValue:
          type:
          - array
          - 'null'
          items:
            type: string
          default: null
        listGuidValue:
          type:
          - array
          - 'null'
          items:
            type: string
            format: uuid
          default: null
        listNumericValue:
          type:
          - array
          - 'null'
          items:
            type: integer
            format: int32
          default: null
        listLongValue:
          type:
          - array
          - 'null'
          items:
            type: integer
            format: int64
          default: null
        dateTimeInterval:
          type:
          - array
          - 'null'
          items:
            type: string
            format: date-time
          default: null
      additionalProperties: false
    PermitApplicationDto:
      type: object
      properties:
        computerId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        computerGroupId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        organizationId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        organizationIds:
          type:
          - array
          - 'null'
          items:
            type: string
            format: uuid
          default: '[]'
        osType:
          type: integer
          format: int32
        userInstance:
          type:
          - string
          - 'null'
          default: ''
        approvalRequest:
          $ref: '#/components/schemas/ApprovalRequestDto'
        isFromApproval:
          type: boolean
          readOnly: true
        actionLog:
          $ref: '#/components/schemas/ActionLogDto'
        isFromActionLog:
          type: boolean
          readOnly: true
        actionType:
          type:
          - string
          - 'null'
          default: ''
        isElevationRequest:
          type: boolean
        isExtensionRequest:
          type: boolean
        edgeStoreUrl:
          type:
          - string
          - 'null'
          default: ''
        chromeStoreUrl:
          type:
          - string
          - 'null'
          default: ''
        canViewOnSystemLookup:
          type: boolean
        systemLookupUrl:
          type:
          - string
          - 'null'
          default: ''
        canViewVirusTotal:
          type: boolean
        virusTotalUrl:
          type:
          - string
          - 'null'
          default: ''
        fileHistoryChecked:
          type: boolean
        suggestCustomRule:
          type:
          - boolean
          - 'null'
        fileDetails:
          $ref: '#/components/schemas/PermitFileDetails'
        matchingApplications:
          $ref: '#/components/schemas/PermitMatchingApplications'
        policyConditions:
          $ref: '#/components/schemas/PermitPolicyConditions'
        policyExpirationDate:
          type:
          - string
          - 'null'
          format: date-time
        ringfencingOptions:
          $ref: '#/components/schemas/AdvRFPolicy'
        networkExclusions:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/NetworkExclusionDto'
        ringfenceActionId:
          type: integer
          format: int32
        isRingfenced:
          type: boolean
          readOnly: true
        hasRingfencingAsProduct:
          type: boolean
        hasElevation:
          type: boolean
        organizationHasElevation:
          type: boolean
        elevationStatus:
          type: integer
          format: int32
        elevationExpiration:
          type: integer
          format: int32
        elevationExpirationDate:
          type:
          - string
          - 'null'
          format: date-time
        policyLevel:
          $ref: '#/components/schemas/PermitPolicyLevel'
        adminNotes:
          $ref: '#/components/schemas/PermitAdminNotes'
        applicationList:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/ApplicationOnlineDto'
        systemAudits:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/SystemAuditItem'
        allowTMM:
          type: boolean
        fileExclusions:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/FileExclusionDto'
        hasOriginApprovalCenter:
          type:
          - boolean
          - 'null'
        responseSubject:
          type:
          - string
          - 'null'
        responseReason:
          type:
          - string
          - 'null'
        notifyOnResponse:
          type: boolean
        isExecutionRequest:
          type: boolean
          readOnly: true
      additionalProperties: false
    PermitAdminNotes:
      type: object
      properties:
        ticket:
          type:
          - string
          - 'null'
          default: ''
        requestorEmail:
          type:
          - string
          - 'null'
          default: ''
        comments:
          type:
          - string
          - 'null'
          default: ''
      additionalProperties: false
    ComputerGroupItemDto:
      type: object
      properties:
        computerGroupId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        name:
          type:
          - string
          - 'null'
          default: ''
        organizationId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        organizationName:
          type:
          - string
          - 'null'
          default: ''
        default:
          type:
          - boolean
          - 'null'
        osType:
          type: integer
          format: int32
        isGlobal:
          type: boolean
      additionalProperties: false
    NetworkPolicy:
      type: object
      properties:
        networkPolicyId:
          type:
          - string
          - 'null'
        server:
          type:
          - string
          - 'null'
        port:
          type: integer
          format: int32
        action:
          type: integer
          description: 1 = Permit, 2 = Deny
          format: int32
        serverDisplayName:
          type:
          - string
          - 'null'
      additionalProperties: false
    SystemAuditDetails:
      type: object
      properties:
        page:
          type:
          - string
          - 'null'
          default: ''
        function:
          type:
          - string
          - 'null'
          default: ''
        objectId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        details:
          type:
          - string
          - 'null'
          default: ''
      additionalProperties: false
    PermitPolicyLevel:
      type: object
      properties:
        canUseEntireOrganization:
          type: boolean
        toEntireOrganization:
          type: boolean
        toComputerGroup:
          type: boolean
        selectedComputerGroup:
          $ref: '#/components/schemas/ComputerGroupItemDto'
        toComputer:
          type: boolean
      additionalProperties: false
    ApprovalRequestTimerDto:
      type: object
      properties:
        approvalRequestId:
          type: string
          format: uuid
        requestDate:
          type: string
          format: date-time
        assignedDate:
          type: string
          format: date-time
        escalatedDate:
          type: string
          format: date-time
        returnedDate:
          type: string
          format: date-time
        reassignedDate:
          type: string
          format: date-time
        actionedDate:
          type: string
          format: date-time
        totalTimeInSeconds:
          type: integer
          format: int32
          default: 0
      additionalProperties: false
    ActionLogParamsDto:
      type: object
      properties:
        actionType:
          type:
          - string
          - 'null'
          default: null
        sourceTableId:
          type: integer
          format: int32
          default: 1
        actionLogId:
          type:
          - integer
          - 'null'
          format: int64
          default: null
        policyId:
          type: string
          format: uuid
          default: null
        actionId:
          type:
          - integer
          - 'null'
          format: int32
          default: null
        filter:
          type:
          - string
          - 'null'
          default: null
        showChildOrganizations:
          type: boolean
          default: false
        simulateDeny:
          type: boolean
          default: false
        onlyTrueDenies:
          type: boolean
          default: false
        username:
          type:
          - string
          - 'null'
          default: null
        hostname:
          type:
          - string
          - 'null'
          default: ''
        processId:
          type:
          - integer
          - 'null'
          format: int32
          default: null
        fullPath:
          type:
          - string
          - 'null'
          default: ''
        deviceType:
          type:
          - string
          - 'null'
          default: null
        dateTime:
          type:
          - array
          - 'null'
          items:
            type: string
            format: date-time
          default: null
        groupBy:
          type:
          - string
          - 'null'
          default: null
        pageNumber:
          type: integer
          format: int32
          default: 1
        pageSize:
          type: integer
          format: int32
          default: 25
        paramsFieldsDto:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/ParamsFieldsDto'
        startDate:
          type:
          - string
          - 'null'
          format: date-time
        endDate:
          type:
          - string
          - 'null'
          format: date-time
        dateTimeLastImported:
          type:
          - string
          - 'null'
          format: date-time
        showTotalCount:
          type: boolean
        getNewCount:
          type: boolean
        exportMode:
          type: boolean
        totalRows:
          type: integer
          format: int32
        useEId:
          type: boolean
        lastSortValue:
          type: integer
          format: int64
        sortBy:
          type:
          - string
          - 'null'
          default: ''
        sortDescending:
          type: boolean
          default: true
        groupBys:
          type:
          - array
          - 'null'
          items:
            type: integer
            format: int32
        actionTypes:
          type:
          - array
          - 'null'
          items:
            type: string
        showKnownThreatsOnly:
          type: boolean
        hasPolicyId:
          type: boolean
          default: false
      additionalProperties: false
    ThreatLockerActionDto:
      type: object
      properties:
        fullpath:
          type:
          - string
          - 'null'
          default: ''
        policyid:
          type:
          - string
          - 'null'
          default: ''
        username:
          type:
          - string
          - 'null'
          default: ''
        actionid:
          type: integer
          format: int32
        hash:
          type:
          - string
          - 'null'
          default: ''
        processName:
          type:
          - string
          - 'null'
          default: ''
        certs:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/ThreatLockerCertDto'
        applicationId:
          type:
          - string
          - 'null'
          default: ''
        datetime:
          type: string
          format: date-time
        logAction:
          type: boolean
        SerialNumber:
          type:
          - string
          - 'null'
          default: ''
        deviceType:
          type:
          - string
          - 'null'
          default: ''
        actionType:
          type:
          - string
          - 'null'
          default: ''
        size:
          type: integer
          format: int64
        processId:
          type: integer
          format: int32
        ringFence:
          type: boolean
        policyName:
          type:
          - string
          - 'null'
          default: ''
        applicationName:
          type:
          - string
          - 'null'
          default: ''
        encryptionStatus:
          type: integer
          format: int32
        installedBy:
          type:
          - array
          - 'null'
          items:
            type: string
          default: '[]'
        monitorOnly:
          type: boolean
        notes:
          type:
          - string
          - 'null'
          default: ''
        sha256:
          type:
          - string
          - 'null'
          default: ''
        ringfencePolicyId:
          type:
          - string
          - 'null'
          default: ''
        remotePresence:
          type: boolean
        organizationId:
          type:
          - string
          - 'null'
          default: ''
        hostname:
          type:
          - string
          - 'null'
          default: ''
        computerId:
          type:
          - string
          - 'null'
          default: ''
        manufacturer:
          type:
          - string
          - 'null'
          default: ''
        osType:
          type: integer
          format: int32
        destinationIP:
          type:
          - string
          - 'null'
          default: ''
        DomainName:
          type:
          - string
          - 'null'
          default: ''
        organizationName:
          type:
          - string
          - 'null'
          default: ''
      additionalProperties: false
    FileExclusionDto:
      type: object
      properties:
        policyId:
          type: string
          format: uuid
        tagItemType:
          type: integer
          format: int32
        path:
          type:
          - string
          - 'null'
        permission:
          type: integer
          format: int32
      additionalProperties: false
    ApprovalRequestDto:
      type: object
      properties:
        statusIdEscalatedToMSP:
          type: integer
          format: int32
        statusIdEscalatedByCustomer:
          type: integer
          format: int32
        masterOrganizationId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        approvedBy:
          type:
          - string
          - 'null'
          default: ''
        approvalRequestId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        dateTime:
          type: string
          format: date-time
        path:
          type:
          - string
          - 'null'
          default: ''
        hash:
          type:
          - string
          - 'null'
          default: ''
        username:
          type:
          - string
          - 'null'
          default: ''
        hostname:
          type:
          - string
          - 'null'
          default: ''
        statusId:
          type: integer
          format: int32
        computerId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        organizationName:
          type:
          - string
          - 'null'
          default: ''
        json:
          type:
          - string
          - 'null'
          default: ''
        ticketId:
          type:
          - string
          - 'null'
          default: ''
        requestor:
          type:
          - string
          - 'null'
          default: ''
        requestorReason:
          type:
          - string
          - 'null'
          default: ''
        requestorEmailAddress:
          type:
          - string
          - 'null'
          default: ''
        comments:
          type:
          - string
          - 'null'
          default: ''
        actionDate:
          type:
          - string
          - 'null'
          format: date-time
        organizationId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        multiLevelApprovalRequestId:
          type:
          - string
          - 'null'
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        approvalNumber:
          type: integer
          format: int32
        approvedByTierLevel:
          type: integer
          format: int32
        tempPolicyId:
          type:
          - string
          - 'null'
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        policyId:
          type:
          - string
          - 'null'
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        tempApplicationId:
          type:
          - string
          - 'null'
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        applicationId:
          type:
          - string
          - 'null'
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        multiLevelApprovalStatusId:
          type: integer
          format: int32
        initialApprovalTierLevel:
          type: integer
          format: int32
        approvalCount:
          type: integer
          format: int32
        pendingTierLevel:
          type: integer
          format: int32
        hasPendingApprovalRequest:
          type: boolean
        ipAddress:
          type:
          - string
          - 'null'
          default: ''
        isAssigned:
          type:
          - boolean
          - 'null'
          default: false
          readOnly: true
        assigneeUserId:
          type:
          - string
          - 'null'
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        threatLockerDataCenterId:
          type:
          - string
          - 'null'
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        instanceName:
          type:
          - string
          - 'null'
          default: ''
        assigneeUsername:
          type:
          - string
          - 'null'
          default: ''
        assigneeFirstName:
          type:
          - string
          - 'null'
          default: ''
        assigneeLastname:
          type:
          - string
          - 'null'
          default: ''
        threatLockerActionDto:
          $ref: '#/components/schemas/ThreatLockerActionDto'
        notes:
          type:
          - string
          - 'null'
          defaul

# --- truncated at 32 KB (51 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/openapi/threatlocker-actionlog-api-openapi.yml