ThreatLocker

ThreatLocker Action Log API

The ActionLog API from ThreatLocker — 9 operation(s) for actionlog.

GitHub OpenAPI

Operations 9

POST /portalapi/ActionLog/ActionLogGetByParametersV2 Get Action Logs By Parameters.
GET /portalapi/ActionLog/ActionLogGetAllForFileHistory Get All File History by hostname and fullpath
GET /portalapi/ActionLog/ActionLogGetAllForFileHistoryV2 Get All File History by hostname and fullpath
GET /portalapi/ActionLog/ActionLogGetById Get Action Logs by Id.
GET /portalapi/ActionLog/ActionLogGetByIdV2
POST /portalapi/ActionLog/ActionLogGetTestingEnvironmentDetailsById Get Testing Environment Details For VDI HyperV
POST /portalapi/ActionLog/ActionLogGetPolicyConditionsForPermitApplication Get Policy Conditions For Permit Application
POST /portalapi/ActionLog/ActionLogGetSearchString Get Search String (This is for save search).
GET /portalapi/ActionLog/ActionLogGetFileDownloadDetailsById

Documentation

📖
Documentation
https://threatlocker.kb.help/api-documentation/
📖
APIReference
https://portalapi.threatlocker.com/swagger/index.html
📖
GettingStarted
https://threatlocker.kb.help/getting-started-with-threatlocker-portalapis/
📖
Authentication
https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/authentication/threatlocker-authentication.yml

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/openapi/threatlocker-actionlog-api-openapi.yml

Other Resources

🔗
Conventions
https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/conventions/threatlocker-conventions.yml
🔗
ErrorCatalog
https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/errors/threatlocker-problem-types.yml
🔗
DataModel
https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/data-model/threatlocker-data-model.yml
🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/asyncapi/threatlocker-webhooks.yml
🔗
APIsJSON
https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/apis.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/threatlocker-actionlog-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

threatlocker-actionlog-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Threatlocker Action Log API
  version: v1.0.0
  description: 'Operations tagged ActionLog across 2 of this provider''s published API definitions: threatlocker-actionlog-api-openapi.yml, threatlocker-portal-openapi-original.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://portalapi.threatlocker.com/portalapi/
  description: Base URL declared by the provider in apis.yml (roadmap#122).
security:
- Authorization: []
  ManagedOrganizationId: []
  OverrideManagedOrganizationId: []
tags:
- name: ActionLog
paths:
  /portalapi/ActionLog/ActionLogGetByParametersV2:
    post:
      tags:
      - ActionLog
      summary: Get Action Logs By Parameters.
      description: "Parameters Values:\n            \n    {\n          \"ActionType\": \"execute | install | network | registry | read | write | move |\n                          delete | baseline | powershell | elevate | configuration | dns\",\n          \"SourceTableId\": \"ActionLog = 1 | DenyActionLog = 2 | BaselineActionLog = 3 | EventLogActionLog = 4\",\n          \"ActionId\": \"Permit = 1 | Deny = 2 | DenyOptionToRequest = 3 | InstallMode = 4 | MissingCoreFiles = 5 | Ringfenced = 6 | AnyDeny = 7\",\n          \"GroupBy\": \"FullPath = path | Hash = hash | SourceIp = sourceip | Cert = cert | Hostname = hostname | Username = username | ProcessPath = process\"\n    }"
      parameters:
      - name: usenewsearch
        in: header
        schema:
          type: string
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActionLogParamsDto'
          text/json:
            schema:
              $ref: '#/components/schemas/ActionLogParamsDto'
          application/*+json:
            schema:
              $ref: '#/components/schemas/ActionLogParamsDto'
      responses:
        '200':
          description: OK
    servers:
    - url: https://portalapi.threatlocker.com/portalapi/
      description: Base URL declared by the provider in apis.yml (roadmap#122).
  /portalapi/ActionLog/ActionLogGetAllForFileHistory:
    get:
      tags:
      - ActionLog
      summary: Get All File History by hostname and fullpath
      description: "Parameters Values:\n            \n    {\n       \"sourceTableId\": \"ActionLog = 1 | DenyActionLog = 2 | BaselineActionLog = 3 | EventLogActionLog = 4\"\n    }"
      parameters:
      - name: sourceTableId
        in: query
        description: ''
        schema:
          type: integer
          format: int32
      - name: hostname
        in: query
        description: ''
        schema:
          type: string
      - name: fullPath
        in: query
        description: ''
        schema:
          type: string
      - name: pageNumber
        in: query
        description: ''
        schema:
          type: integer
          format: int32
          default: 1
      - name: pageSize
        in: query
        description: ''
        schema:
          type: integer
          format: int32
          default: 25
      responses:
        '200':
          description: OK
    servers:
    - url: https://portalapi.threatlocker.com/portalapi/
      description: Base URL declared by the provider in apis.yml (roadmap#122).
  /portalapi/ActionLog/ActionLogGetAllForFileHistoryV2:
    get:
      tags:
      - ActionLog
      summary: Get All File History by hostname and fullpath
      description: "Parameters Values:\n            \n    {\n       \"sourceTableId\": \"ActionLog = 1 | DenyActionLog = 2 | BaselineActionLog = 3 | EventLogActionLog = 4\"\n    }"
      parameters:
      - name: sourceTableId
        in: query
        description: ''
        schema:
          type: integer
          format: int32
      - name: hostname
        in: query
        description: ''
        schema:
          type: string
      - name: fullPath
        in: query
        description: ''
        schema:
          type: string
      - name: computerId
        in: query
        description: ''
        schema:
          type: string
          format: uuid
      - name: pageNumber
        in: query
        description: ''
        schema:
          type: integer
          format: int32
          default: 1
      - name: pageSize
        in: query
        description: ''
        schema:
          type: integer
          format: int32
          default: 25
      responses:
        '200':
          description: OK
    servers:
    - url: https://portalapi.threatlocker.com/portalapi/
      description: Base URL declared by the provider in apis.yml (roadmap#122).
  /portalapi/ActionLog/ActionLogGetById:
    get:
      tags:
      - ActionLog
      summary: Get Action Logs by Id.
      description: "Parameters Values:\n            \n    {\n          \"sourceTableId\": \"ActionLog = 1 | DenyActionLog = 2 | BaselineActionLog = 3 | EventLogActionLog = 4\"\n    }"
      parameters:
      - name: actionLogId
        in: query
        description: ''
        schema:
          type: integer
          format: int64
      - name: sourceTableId
        in: query
        description: ''
        schema:
          type: integer
          format: int32
      - name: addToApplication
        in: query
        description: ''
        schema:
          type: boolean
          default: false
      responses:
        '200':
          description: OK
    servers:
    - url: https://portalapi.threatlocker.com/portalapi/
      description: Base URL declared by the provider in apis.yml (roadmap#122).
  /portalapi/ActionLog/ActionLogGetByIdV2:
    get:
      tags:
      - ActionLog
      parameters:
      - name: eActionLogId
        in: query
        schema:
          type: string
      - name: sourceTableId
        in: query
        schema:
          type: integer
          format: int32
      - name: addToApplication
        in: query
        schema:
          type: boolean
          default: false
      - name: getAllParents
        in: query
        schema:
          type: boolean
          default: false
      - name: openedFromLink
        in: query
        schema:
          type: boolean
          default: false
      responses:
        '200':
          description: OK
    servers:
    - url: https://portalapi.threatlocker.com/portalapi/
      description: Base URL declared by the provider in apis.yml (roadmap#122).
  /portalapi/ActionLog/ActionLogGetTestingEnvironmentDetailsById:
    post:
      tags:
      - ActionLog
      summary: Get Testing Environment Details For VDI HyperV
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FileDownloadDetailsDto'
          text/json:
            schema:
              $ref: '#/components/schemas/FileDownloadDetailsDto'
          application/*+json:
            schema:
              $ref: '#/components/schemas/FileDownloadDetailsDto'
      responses:
        '200':
          description: OK
    servers:
    - url: https://portalapi.threatlocker.com/portalapi/
      description: Base URL declared by the provider in apis.yml (roadmap#122).
  /portalapi/ActionLog/ActionLogGetPolicyConditionsForPermitApplication:
    post:
      tags:
      - ActionLog
      summary: Get Policy Conditions For Permit Application
      description: "Parameters Values:\n            \n    {\n          \"OSType\": \"All = 0 | Windows = 1 | MAC = 2 | Linux = 3\"\n          \"ActionType\": \"None = 0 | BaseLine = 1 | Configuration = 2 | Delete = 3 | Elevation = 4 | Execute = 5 |\n                         Install = 6 | Move = 7 | Network = 8  | NewProcess = 9  | Powershell = 10 | Read = 11 |  \n                         Registry = 12 | Uninstall = 13 | Write = 14 | OSEventLog = 15\",\n    }"
      parameters:
      - name: usenewsearch
        in: header
        schema:
          type: string
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PermitApplicationDto'
          text/json:
            schema:
              $ref: '#/components/schemas/PermitApplicationDto'
          application/*+json:
            schema:
              $ref: '#/components/schemas/PermitApplicationDto'
      responses:
        '200':
          description: OK
    servers:
    - url: https://portalapi.threatlocker.com/portalapi/
      description: Base URL declared by the provider in apis.yml (roadmap#122).
  /portalapi/ActionLog/ActionLogGetSearchString:
    post:
      tags:
      - ActionLog
      summary: Get Search String (This is for save search).
      description: "Parameters Values:\n            \n    {\n           \"ActionType\": \"None = 0 | BaseLine = 1 | Configuration = 2 | Delete = 3 | Elevation = 4 | Execute = 5 |\n                         Install = 6 | Move = 7 | Network = 8  | NewProcess = 9  | Powershell = 10 | Read = 11 |  \n                         Registry = 12 | Uninstall = 13 | Write = 14 | OSEventLog = 15\",\n          \"SourceTableId\": \"ActionLog = 1 | DenyActionLog = 2 | BaselineActionLog = 3 | EventLogActionLog = 4\",\n          \"ActionId\": \"Permit = 1 | Deny = 2 | DenyOptionToRequest = 3 | InstallMode = 4 | MissingCoreFiles = 5 | Ringfenced = 6 | AnyDeny = 7\",\n          \"GroupBy\": \"FullPath = path | Hash = hash | SourceIp = sourceip | Cert = cert | Hostname = hostname | Username = username | ProcessPath = process\"\n    }"
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActionLogParamsDto'
          text/json:
            schema:
              $ref: '#/components/schemas/ActionLogParamsDto'
          application/*+json:
            schema:
              $ref: '#/components/schemas/ActionLogParamsDto'
      responses:
        '200':
          description: OK
    servers:
    - url: https://portalapi.threatlocker.com/portalapi/
      description: Base URL declared by the provider in apis.yml (roadmap#122).
  /portalapi/ActionLog/ActionLogGetFileDownloadDetailsById:
    get:
      tags:
      - ActionLog
      parameters:
      - name: eActionLogId
        in: query
        schema:
          type: string
      - name: sourceTableId
        in: query
        schema:
          type: integer
          format: int32
      responses:
        '200':
          description: OK
    servers:
    - url: https://portalapi.threatlocker.com/portalapi/
      description: Base URL declared by the provider in apis.yml (roadmap#122).
components:
  schemas:
    Certificate:
      type: object
      properties:
        subject:
          type:
          - string
          - 'null'
          default: ''
        sha:
          type:
          - string
          - 'null'
          default: ''
        value:
          type:
          - string
          - 'null'
          default: ''
        validCert:
          type: boolean
      additionalProperties: false
    ComputerGroupItemDto:
      type: object
      properties:
        computerGroupId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        name:
          type:
          - string
          - 'null'
          default: ''
        organizationId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        organizationName:
          type:
          - string
          - 'null'
          default: ''
        default:
          type:
          - boolean
          - 'null'
        osType:
          type: integer
          format: int32
        isGlobal:
          type: boolean
      additionalProperties: false
    FileDownloadDetailsDto:
      type: object
      properties:
        approvalRequestId:
          type: string
          format: uuid
        filename:
          type:
          - string
          - 'null'
        fileUrl:
          type:
          - string
          - 'null'
        eActionLogId:
          type:
          - string
          - 'null'
        sourceTableId:
          type:
          - integer
          - 'null'
          format: int32
      additionalProperties: false
    SystemAuditDetails:
      type: object
      properties:
        page:
          type:
          - string
          - 'null'
          default: ''
        function:
          type:
          - string
          - 'null'
          default: ''
        objectId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        details:
          type:
          - string
          - 'null'
          default: ''
      additionalProperties: false
    NetworkExclusionDto:
      type: object
      properties:
        policyId:
          type: string
          format: uuid
        tagPrefixTypeId:
          type: integer
          format: int32
        value:
          type:
          - string
          - 'null'
      additionalProperties: false
    PermitApplicationDto:
      type: object
      properties:
        computerId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        computerGroupId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        organizationId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        organizationIds:
          type:
          - array
          - 'null'
          items:
            type: string
            format: uuid
          default: '[]'
        osType:
          type: integer
          format: int32
        userInstance:
          type:
          - string
          - 'null'
          default: ''
        approvalRequest:
          $ref: '#/components/schemas/ApprovalRequestDto'
        isFromApproval:
          type: boolean
          readOnly: true
        actionLog:
          $ref: '#/components/schemas/ActionLogDto'
        isFromActionLog:
          type: boolean
          readOnly: true
        actionType:
          type:
          - string
          - 'null'
          default: ''
        isElevationRequest:
          type: boolean
        isExtensionRequest:
          type: boolean
        edgeStoreUrl:
          type:
          - string
          - 'null'
          default: ''
        chromeStoreUrl:
          type:
          - string
          - 'null'
          default: ''
        canViewOnSystemLookup:
          type: boolean
        systemLookupUrl:
          type:
          - string
          - 'null'
          default: ''
        canViewVirusTotal:
          type: boolean
        virusTotalUrl:
          type:
          - string
          - 'null'
          default: ''
        fileHistoryChecked:
          type: boolean
        suggestCustomRule:
          type:
          - boolean
          - 'null'
        fileDetails:
          $ref: '#/components/schemas/PermitFileDetails'
        matchingApplications:
          $ref: '#/components/schemas/PermitMatchingApplications'
        policyConditions:
          $ref: '#/components/schemas/PermitPolicyConditions'
        policyExpirationDate:
          type:
          - string
          - 'null'
          format: date-time
        ringfencingOptions:
          $ref: '#/components/schemas/AdvRFPolicy'
        networkExclusions:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/NetworkExclusionDto'
        ringfenceActionId:
          type: integer
          format: int32
        isRingfenced:
          type: boolean
          readOnly: true
        hasRingfencingAsProduct:
          type: boolean
        hasElevation:
          type: boolean
        organizationHasElevation:
          type: boolean
        elevationStatus:
          type: integer
          format: int32
        elevationExpiration:
          type: integer
          format: int32
        elevationExpirationDate:
          type:
          - string
          - 'null'
          format: date-time
        policyLevel:
          $ref: '#/components/schemas/PermitPolicyLevel'
        adminNotes:
          $ref: '#/components/schemas/PermitAdminNotes'
        applicationList:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/ApplicationOnlineDto'
        systemAudits:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/SystemAuditItem'
        allowTMM:
          type: boolean
        fileExclusions:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/FileExclusionDto'
        hasOriginApprovalCenter:
          type:
          - boolean
          - 'null'
        responseSubject:
          type:
          - string
          - 'null'
        responseReason:
          type:
          - string
          - 'null'
        notifyOnResponse:
          type: boolean
        isExecutionRequest:
          type: boolean
          readOnly: true
      additionalProperties: false
    NetworkPolicy:
      type: object
      properties:
        networkPolicyId:
          type:
          - string
          - 'null'
        server:
          type:
          - string
          - 'null'
        port:
          type: integer
          format: int32
        action:
          type: integer
          description: 1 = Permit, 2 = Deny
          format: int32
        serverDisplayName:
          type:
          - string
          - 'null'
      additionalProperties: false
    ThreatLockerCertDto:
      type: object
      properties:
        sha:
          type:
          - string
          - 'null'
          default: ''
        subject:
          type:
          - string
          - 'null'
          default: ''
        validCert:
          type: boolean
        digestmismatch:
          type: integer
          format: int32
      additionalProperties: false
    ActionLogParamsDto:
      type: object
      properties:
        actionType:
          type:
          - string
          - 'null'
          default: null
        sourceTableId:
          type: integer
          format: int32
          default: 1
        actionLogId:
          type:
          - integer
          - 'null'
          format: int64
          default: null
        policyId:
          type: string
          format: uuid
          default: null
        actionId:
          type:
          - integer
          - 'null'
          format: int32
          default: null
        filter:
          type:
          - string
          - 'null'
          default: null
        showChildOrganizations:
          type: boolean
          default: false
        simulateDeny:
          type: boolean
          default: false
        onlyTrueDenies:
          type: boolean
          default: false
        username:
          type:
          - string
          - 'null'
          default: null
        hostname:
          type:
          - string
          - 'null'
          default: ''
        processId:
          type:
          - integer
          - 'null'
          format: int32
          default: null
        fullPath:
          type:
          - string
          - 'null'
          default: ''
        deviceType:
          type:
          - string
          - 'null'
          default: null
        dateTime:
          type:
          - array
          - 'null'
          items:
            type: string
            format: date-time
          default: null
        groupBy:
          type:
          - string
          - 'null'
          default: null
        pageNumber:
          type: integer
          format: int32
          default: 1
        pageSize:
          type: integer
          format: int32
          default: 25
        paramsFieldsDto:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/ParamsFieldsDto'
        startDate:
          type:
          - string
          - 'null'
          format: date-time
        endDate:
          type:
          - string
          - 'null'
          format: date-time
        dateTimeLastImported:
          type:
          - string
          - 'null'
          format: date-time
        showTotalCount:
          type: boolean
        getNewCount:
          type: boolean
        exportMode:
          type: boolean
        totalRows:
          type: integer
          format: int32
        useEId:
          type: boolean
        lastSortValue:
          type: integer
          format: int64
        sortBy:
          type:
          - string
          - 'null'
          default: ''
        sortDescending:
          type: boolean
          default: true
        groupBys:
          type:
          - array
          - 'null'
          items:
            type: integer
            format: int32
        actionTypes:
          type:
          - array
          - 'null'
          items:
            type: string
        showKnownThreatsOnly:
          type: boolean
        hasPolicyId:
          type: boolean
          default: false
      additionalProperties: false
    Int32ObjectKeyValuePair:
      type: object
      properties:
        key:
          type: integer
          format: int32
        value: {}
      additionalProperties: false
    PermitFileDetails:
      type: object
      properties:
        fullPath:
          type:
          - string
          - 'null'
          default: ''
        processPath:
          type:
          - string
          - 'null'
          default: ''
        hash:
          type:
          - string
          - 'null'
          default: ''
        certificates:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/ThreatLockerCertDto'
        createdByProcesses:
          type:
          - array
          - 'null'
          items:
            type: string
          default: '[]'
        filename:
          type:
          - string
          - 'null'
          default: ''
        sha256:
          type:
          - string
          - 'null'
          default: ''
        date:
          type: string
          format: date-time
        originalHostname:
          type:
          - string
          - 'null'
          default: ''
        hostname:
          type:
          - string
          - 'null'
          default: ''
        username:
          type:
          - string
          - 'null'
          default: ''
        organizationName:
          type:
          - string
          - 'null'
          default: ''
        policyName:
          type:
          - string
          - 'null'
          default: ''
        applicationName:
          type:
          - string
          - 'null'
          default: ''
        requestorReason:
          type:
          - string
          - 'null'
          default: ''
        approvalStatus:
          type:
          - string
          - 'null'
          default: ''
        approvalBy:
          type:
          - string
          - 'null'
          default: ''
        size:
          type: integer
          format: int64
      additionalProperties: false
    SystemAuditItem:
      type: object
      properties:
        organizationId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        userId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        username:
          type:
          - string
          - 'null'
          default: ''
        action:
          type:
          - string
          - 'null'
          default: ''
        ipAddress:
          type:
          - string
          - 'null'
          default: ''
        effectiveAction:
          type:
          - string
          - 'null'
          default: ''
        details:
          $ref: '#/components/schemas/SystemAuditDetails'
        masterViewOnly:
          type: boolean
        dateTime:
          type: string
          format: date-time
        systemAuditId:
          type: string
          format: uuid
        systemAuditObjectTypeId:
          type:
          - integer
          - 'null'
          format: int32
        organizationName:
          type:
          - string
          - 'null'
        ticketNumber:
          type:
          - string
          - 'null'
          default: ''
        notes:
          type:
          - string
          - 'null'
          default: ''
      additionalProperties: false
    AdvRFPolicy:
      type: object
      properties:
        hideCustomRules:
          type: boolean
        restrictApplicationSpawning:
          type: boolean
        restrictRegistryAccess:
          type: boolean
        restrictFileAccess:
          type: boolean
        restrictNetworkAccess:
          type: boolean
        restrictApplication:
          type: boolean
        rfFilePolicy:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/FilePolicy'
        rfNetworkPolicy:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/NetworkPolicy'
        rfRegistryPolicy:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/RegistryPolicy'
        rfAssociatedApplicationPolicy:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/AssociatedApplicationPolicy'
      additionalProperties: false
    ApprovalRequestDto:
      type: object
      properties:
        statusIdEscalatedToMSP:
          type: integer
          format: int32
        statusIdEscalatedByCustomer:
          type: integer
          format: int32
        masterOrganizationId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        approvedBy:
          type:
          - string
          - 'null'
          default: ''
        approvalRequestId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        dateTime:
          type: string
          format: date-time
        path:
          type:
          - string
          - 'null'
          default: ''
        hash:
          type:
          - string
          - 'null'
          default: ''
        username:
          type:
          - string
          - 'null'
          default: ''
        hostname:
          type:
          - string
          - 'null'
          default: ''
        statusId:
          type: integer
          format: int32
        computerId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        organizationName:
          type:
          - string
          - 'null'
          default: ''
        json:
          type:
          - string
          - 'null'
          default: ''
        ticketId:
          type:
          - string
          - 'null'
          default: ''
        requestor:
          type:
          - string
          - 'null'
          default: ''
        requestorReason:
          type:
          - string
          - 'null'
          default: ''
        requestorEmailAddress:
          type:
          - string
          - 'null'
          default: ''
        comments:
          type:
          - string
          - 'null'
          default: ''
        actionDate:
          type:
          - string
          - 'null'
          format: date-time
        organizationId:
          type: string
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        multiLevelApprovalRequestId:
          type:
          - string
          - 'null'
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        approvalNumber:
          type: integer
          format: int32
        approvedByTierLevel:
          type: integer
          format: int32
        tempPolicyId:
          type:
          - string
          - 'null'
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        policyId:
          type:
          - string
          - 'null'
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        tempApplicationId:
          type:
          - string
          - 'null'
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        applicationId:
          type:
          - string
          - 'null'
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        multiLevelApprovalStatusId:
          type: integer
          format: int32
        initialApprovalTierLevel:
          type: integer
          format: int32
        approvalCount:
          type: integer
          format: int32
        pendingTierLevel:
          type: integer
          format: int32
        hasPendingApprovalRequest:
          type: boolean
        ipAddress:
          type:
          - string
          - 'null'
          default: ''
        isAssigned:
          type:
          - boolean
          - 'null'
          default: false
          readOnly: true
        assigneeUserId:
          type:
          - string
          - 'null'
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        threatLockerDataCenterId:
          type:
          - string
          - 'null'
          format: uuid
          default: 00000000-0000-0000-0000-000000000000
        instanceName:
          type:
          - string
          - 'null'
          default: ''
        assigneeUsername:
          type:
          - string
          - 'null'
          default: ''
        assigneeFirstName:
          type:
          - string
          - 'null'
          default: ''
        assigneeLastname:
          type:
          - string
          - 'null'
          default: ''
        threatLockerActionDto:
          $ref: '#/components/schemas/ThreatLockerActionDto'
        notes:
          type:
          - string
          - 'null'
          default: ''
        signature:
          type:
          - string
          - 'null'
          default: ''
        tlInstructions:
          type:
          - string
          - 'null'
          default: ''
        suggestCustomRule:
          type:
          - boolean
          - 'null'
        authorizeForPermit:
          type:
          - boolean
          - 'null'
        portalApiUrl:
          type:
          - string
          - 'null'
          default: ''
        cyberHeroManagementConfigured:
          type: boolean
        maxTriggeredStartDate:
          type:
          - string
          - 'null'
          format: date-time
        isEscalatedByCyberHero:
          type: boolean
          readOnly: true
        isEscalatedByCustomer:
          type: boolean
          readOnly: true
        ticketApprovalManager:
          type:
          - string
          - 'null'
          default: ''
        showMfaChallenge:
          type: boolean
        showMfaRegistration:
          type: boolean
        linkedMfaUser:
          type:
          - string
          - 'null'
        serialNumber:
          type:
          - string
          - 'null'
          default: ''
        approvalRequestTimerDto:
          $ref: '#/components/schemas/ApprovalRequestTimerDto'
        canRequestNewBuiltIn:
          type: boolean
          default: false
        isAssigneeLoggedIntoMaster:
          type: boolean
          default: false
        retrievedAssigneeUsername:
          type: boolean
        count:
          type: integer
          format: int32
        assigneeOrganizationId:
          type:
          - string
          - 'null'
          format: uuid
          default: null
      additionalProperties: false
    PolicyManualOption:
      type: object
      properties:
        fullPath:
          type:
          - string
          - 'null'
          default: ''
        processPath:
          type:
          - string
          - 'null'
          default: ''
        cert:
          type:
          - string
          - 'null'
          default: ''
        hash:
          type:
          - string
          - 'null'
          default: ''
        sha256:
          type:
          - string
          - 'null'
          default: ''
        createdBy:
          type:
          - string
          - 'null'
          default: ''
        isDefaultOption:
          type: boolean
        disabled:
          type: boolean
      additionalProperties: 

# --- truncated at 32 KB (52 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/threatlocker/refs/heads/main/openapi/threatlocker-actionlog-api-openapi.yml