Upwind Inventory API
The Inventory API from Upwind — 6 operation(s) for inventory.
OpenAPI Specification
openapi: 3.0.3
info:
title: Upwind Management REST API v1 access-management Inventory API
version: '1.0'
description: Upwind Management REST API — administrative and data endpoints for the Upwind cloud security platform (threats, vulnerabilities, configurations, inventory, API security, workflows, access management). Reconstructed faithfully from the embedded OpenAPI operation definitions published in the Upwind docs (docs.upwind.io) by the API Evangelist enrichment pipeline; operation content is verbatim from the provider.
contact:
name: Upwind Support
email: support@upwind.io
url: https://docs.upwind.io/
x-apievangelist:
generated: '2026-07-21'
method: searched
source: https://docs.upwind.io/restapi/v1/introduction (embedded docusaurus-plugin-openapi-docs operation JSON)
servers:
- url: https://api.upwind.io
description: Production endpoint (US)
- url: https://api.eu.upwind.io
description: Production endpoint (EU)
- url: https://api.me.upwind.io
description: Production endpoint (ME)
security:
- OAuth2ClientCredentials: []
tags:
- name: Inventory
paths:
/v2/organizations/{organization-id}/inventory/assets/search:
post:
operationId: assetsSearch
summary: Search asset relationships
description: 'This endpoint retrieves asset metadata, based on its schema, for resources that satisfy specific relationship criteria defined in your query. Unlike a standard search, this API is optimized for graph-style traversals, enabling you to discover assets based on how they are connected to other entities in your environment.
**When to Use This API**
Use this endpoint when your search criteria depend on relationships. For example, use this if you need to find all "Virtual Machines" that are "Connected To" a specific "Subnet" or "Part Of" a specific "EKS cluster".
For an introduction to the query guide and how to use nested conditions, see [graph introduction](inventory) for more details.
Rate limit: Requests to this endpoint are limited to 100 requests per minute per organization. For rate limit adjustments, please contact Upwind Support.'
tags:
- Inventory
parameters:
- name: organization-id
in: path
required: true
schema:
type: string
description: The unique identifier for the organization.
- name: limit
in: query
required: false
schema:
type: integer
format: int32
minimum: 1
maximum: 100
default: 20
description: Specifies the maximum number of items to be returned.
- name: cursor
in: query
required: false
schema:
type: string
description: A cursor for pagination to retrieve the next set of results.
example: eyJvZmZzZXQiOjIwfQ
requestBody:
required: true
content:
application/json:
schema:
type: object
title: Payload
properties:
conditions:
type: array
description: List of filter conditions to apply to the search
items:
type: object
title: Condition
properties:
field:
type: string
description: The field name to filter on.
example: cloud_resource_id
operator:
type: string
description: The comparison operator to apply.
example: eq
enum:
- eq
- gt
- gte
- lt
- lte
- in
- exists
value:
type: array
description: The values to compare against.
example:
- i-12345678
items:
type: string
conditions:
type: array
description: Optional nested conditions for complex queries
items:
type: object
required:
- field
- operator
required:
- conditions
responses:
'200':
description: Search results
content:
application/json:
schema:
type: object
properties:
items:
type: array
items:
type: object
title: Entities
oneOf:
- type: object
title: Compute
oneOf:
- type: object
title: AWS Auto Scaling Group update
properties:
label:
type: string
description: The entity label/type identifier
const: aws_auto_scaling_group
id:
type: string
asset_category:
type: string
description: The asset category for this entity
const: compute_platform
asset_sub_category:
type: string
description: The asset subcategory for this entity
const: scaling_group
arn:
type: string
description: The Amazon Resource Name that uniquely identifies this AWS Auto Scaling group.
cloud_account_id:
type: string
description: This property represents the unique identifier assigned to a cloud account within a specific cloud provider. It is used to distinguish one account from another across services, tenants, and organizations.
cloud_provider:
type: string
description: This property identifies the cloud platform hosting the resource, such as AWS, Azure, or Google Cloud. It helps categorize assets by their originating cloud environment.
cloud_resource_id:
type: string
description: A unique identifier assigned to a resource within a cloud provider's environment. It ensures each resource (such as a VM, storage bucket, or database) can be distinctly referenced, managed and tracked across services and regions.
created_time:
type: string
description: The timestamp indicating when this Auto Scaling group was initially created.
max_size:
type: number
description: Defines the maximum number of instances the Auto Scaling group can scale out to.
min_size:
type: number
description: Defines the minimum number of instances the Auto Scaling group should maintain.
name:
type: string
description: Specifies the name assigned to this Auto Scaling group.
region:
type: string
description: Indicates the Region in which this resource is located.
status:
type: string
description: Indicates the current operational state of the Auto Scaling group, such as whether it is actively scaling resources, suspended, or encountering issues. This attribute provides visibility into the real-time health and lifecycle stage of the Auto Scaling group.
uw_protected_by:
type: string
description: Indicates whether the resource is scanned by a Sensor or a Cloud Scanner.
uw_risk_detections_severity_count_total:
type: number
uw_risk_network_internet_exposure_type:
type: string
description: Describes how this resource or its instances are exposed to the public internet, as determined by Upwind’s network analysis.
uw_risk_network_last_application_layer_internet_ingress_time:
type: string
format: date-time
uw_risk_network_last_imds_v1_at:
type: string
format: date-time
description: Records the latest time any instance in this group accessed Instance Metadata Service v1, which is less secure than IMDSv2.
uw_risk_network_last_imds_v2_at:
type: string
format: date-time
description: Indicates the most recent time an instance in this group accessed Instance Metadata Service v2 (IMDSv2), which offers enhanced security.
uw_risk_network_last_time_being_accessed_from_internet:
type: string
format: date-time
description: Indicates the most recent moment a resource in this group was accessed via a public endpoint or external IP.
uw_risk_network_last_time_being_accessed_from_internet_in_ssh_or_rdp:
type: string
format: date-time
description: Shows the latest time any resource within this Auto Scaling group was accessed from the public internet via SSH or RDP.
uw_risk_network_last_time_communicating_with_database:
type: string
format: date-time
uw_risk_network_last_time_communicating_with_internet:
type: string
format: date-time
description: Indicates the most recent timestamp when an instance in this Auto Scaling group communicated with the public internet.
uw_risk_vulnerabilities_severity_count_total:
type: number
- type: object
title: AWS EC2 AMI
properties:
label:
type: string
description: The entity label/type identifier
const: aws_ec2_ami
id:
type: string
asset_category:
type: string
description: The asset category for this entity
const: compute_platform
asset_sub_category:
type: string
description: The asset subcategory for this entity
const: virtual_machine_image
arn:
type: string
description: The Amazon Resource Name (ARN) is a unique identifier for the AMI within the AWS ecosystem. It provides a standardized way to reference the AMI across different services and APIs, enabling seamless integration and resource management within the AWS cloud platform.
cloud_account_id:
type: string
description: This property represents the unique identifier assigned to a cloud account within a specific cloud provider. It is used to distinguish one account from another across services, tenants, and organizations.
cloud_provider:
type: string
description: This property identifies the cloud platform hosting the resource, such as AWS, Azure, or Google Cloud. It helps categorize assets by their originating cloud environment.
cloud_resource_id:
type: string
description: A unique identifier assigned to a resource within a cloud provider's environment. It ensures each resource (such as a VM, storage bucket, or database) can be distinctly referenced, managed and tracked across services and regions.
is_public:
type: boolean
description: A boolean flag indicating whether the AMI has public launch permissions and can be used to launch instances by any AWS account, or if it is limited to your account or an explicit list of accounts. Public AMIs are commonly provided by AWS, marketplace vendors, or trusted partners.
name:
type: string
description: The name attribute represents the descriptive name assigned to the Amazon Machine Image (AMI). It serves as a human-readable identifier for the AMI, allowing you to easily recognize and manage it within the AWS ecosystem. The name should be concise yet informative, reflecting the purpose or contents of the AMI.
platform:
type: string
description: Indicates the platform or operating system of the Amazon Machine Image (AMI). Common values include "Windows" for Microsoft Windows AMIs, "Amazon Linux" or "Amazon Linux 2" for Amazon's Linux distributions, and other Linux distributions like "RHEL" (Red Hat Enterprise Linux) or "Ubuntu".
- type: object
title: AWS EC2 Instance
properties:
label:
type: string
description: The entity label/type identifier
const: aws_ec2_instance
id:
type: string
asset_category:
type: string
description: The asset category for this entity
const: compute_platform
asset_sub_category:
type: string
description: The asset subcategory for this entity
const: virtual_machine
architecture:
type: string
description: Specifies the CPU architecture of the EC2 instance, such as x86_64 or arm64. This attribute is crucial for selecting the appropriate instance type and ensuring compatibility with the software and applications running on the instance within the AWS cloud infrastructure.
availability_zone:
type: string
description: The Availability Zone in which the EC2 instance is launched. An Availability Zone is an isolated location within an AWS Region, designed for fault tolerance and high availability. Distributing instances across multiple Availability Zones protects applications from failure of a single location.
cloud_account_id:
type: string
description: This property represents the unique identifier assigned to a cloud account within a specific cloud provider. It is used to distinguish one account from another across services, tenants, and organizations.
cloud_provider:
type: string
description: This property identifies the cloud platform hosting the resource, such as AWS, Azure, or Google Cloud. It helps categorize assets by their originating cloud environment.
cloud_resource_id:
type: string
description: A unique identifier assigned to a resource within a cloud provider's environment. It ensures each resource (such as a VM, storage bucket, or database) can be distinctly referenced, managed and tracked across services and regions.
ebs_optimized:
type: boolean
description: A boolean value indicating whether the EC2 instance is optimized for Amazon Elastic Block Store (EBS) I/O. When enabled, this feature provides dedicated capacity for Amazon EBS I/O, which can improve performance for workloads that involve frequent data transfers between the instance and EBS volumes.
ena_support:
type: boolean
description: A boolean flag indicating whether the Elastic Network Adapter (ENA) is enabled for this EC2 instance. ENA is an enhanced networking option that provides higher packet per second (PPS) performance and lower latencies compared to traditional network interfaces.
instance_type:
type: string
description: Specifies the EC2 instance type, which determines the virtual hardware resources (CPU, memory, storage, and networking capacity) allocated to the instance within the AWS cloud infrastructure. Selecting the appropriate instance type is crucial for optimizing performance and cost-effectiveness.
ipv6_address:
type: string
description: The IPv6 address associated with the EC2 instance's primary network interface. IPv6 addresses enable modern IP communication and are a key requirement for many cloud-based applications and services. Proper IPv6 configuration is crucial for internet connectivity.
life_cycle:
type: string
description: The lifeCycle attribute specifies the current operational phase of an EC2 instance within the AWS cloud infrastructure. It reflects the instance's state, such as pending, running, stopping, stopped, or terminated, allowing for effective monitoring and management of the instance's lifecycle events and transitions.
name:
type: string
description: The user-defined name assigned to the EC2 instance, serving as a unique identifier within the AWS account. This name should adhere to AWS naming conventions and best practices to ensure proper resource management and organization within the cloud environment.
platform:
type: string
description: The operating system platform for the instance (e.g. Windows or Linux/Unix). This determines which AMIs are compatible and which configuration settings apply. Selecting the right platform is crucial for application compatibility and licensing requirements.
private_dns_name:
type: string
description: The internal DNS hostname that can be used for private AWS networking communication with the EC2 instance from other resources within the same VPC. This hostname is only resolvable from within the VPC's private IP address range and cannot be accessed externally over the internet.
private_ip:
type: string
description: The private IPv4 address assigned to the EC2 instance from the Amazon VPC IPv4 address pool. This IP address is used for communication within the VPC network and is not accessible from the public internet.
public_dns_name:
type: string
description: The public DNS name associated with the Amazon EC2 instance, which can be used to access the instance from the internet. This hostname is automatically generated and managed by AWS, providing a convenient way to connect to the instance without relying on its public IP address.
public_ip:
type: string
description: The public IP address assigned to the EC2 instance, allowing it to communicate with the internet and other external resources. This IP address is crucial for accessing the instance from outside the AWS network and enabling various cloud-based services.
region:
type: string
description: Indicates the Region in which this resource is located.
status:
type: string
description: Indicates the current state of the EC2 instance, such as pending, running, stopping, stopped, shutting-down, or terminated. The instance status provides visibility into the instance lifecycle and is essential for monitoring and managing EC2 resources within the AWS cloud environment.
uw_protected_by:
type: string
description: Indicates whether the resource is scanned by a Sensor or a Cloud Scanner.
uw_risk_detections_severity_count_total:
type: number
uw_risk_network_internet_exposure_type:
type: string
description: Describes how this resource or its instances are exposed to the public internet, as determined by Upwind’s network analysis.
uw_risk_network_last_application_layer_internet_ingress_time:
type: string
format: date-time
uw_risk_network_last_imds_v1_at:
type: string
format: date-time
description: Records the latest time any instance in this group accessed Instance Metadata Service v1, which is less secure than IMDSv2.
uw_risk_network_last_imds_v2_at:
type: string
format: date-time
description: Indicates the most recent time an instance in this group accessed Instance Metadata Service v2 (IMDSv2), which offers enhanced security.
uw_risk_network_last_time_being_accessed_from_internet:
type: string
format: date-time
description: Indicates the most recent moment a resource in this group was accessed via a public endpoint or external IP.
uw_risk_network_last_time_being_accessed_from_internet_in_ssh_or_rdp:
type: string
format: date-time
description: Shows the latest time any resource within this Auto Scaling group was accessed from the public internet via SSH or RDP.
uw_risk_network_last_time_communicating_with_database:
type: string
format: date-time
uw_risk_network_last_time_communicating_with_internet:
type: string
format: date-time
description: Indicates the most recent timestamp when an instance in this Auto Scaling group communicated with the public internet.
uw_risk_vulnerabilities_severity_count_total:
type: number
- type: object
title: AWS ECS Cluster
properties:
label:
type: string
description: The entity label/type identifier
const: aws_ecs_cluster
id:
type: string
asset_category:
type: string
description: The asset category for this entity
const: compute_platform
asset_sub_category:
type: string
description: The asset subcategory for this entity
const: container_cluster
arn:
type: string
description: This property contains the Amazon Resource Name (ARN) of the ECS cluster. It uniquely identifies the resource across all AWS services.
cloud_account_id:
type: string
description: This property represents the unique identifier assigned to a cloud account within a specific cloud provider. It is used to distinguish one account from another across services, tenants, and organizations.
cloud_provider:
type: string
description: This property identifies the cloud platform hosting the resource, such as AWS, Azure, or Google Cloud. It helps categorize assets by their originating cloud environment.
cloud_resource_id:
type: string
description: A unique identifier assigned to a resource within a cloud provider's environment. It ensures each resource (such as a VM, storage bucket, or database) can be distinctly referenced, managed and tracked across services and regions.
name:
type: string
description: This property represents the name of the ECS cluster. It serves as a human-friendly identifier for the cluster within the AWS environment.
region:
type: string
description: Indicates the Region in which this resource is located.
status:
type: string
description: This property indicates the current operational status of the ECS cluster. It reflects whether the cluster is active, draining, or inactive.
uw_protected_by:
type: string
description: Indicates whether the resource is scanned by a Sensor or a Cloud Scanner.
- type: object
title: AWS ECS Container Instance
properties:
label:
type: string
description: The entity label/type identifier
const: aws_ecs_container_instance
id:
type: string
asset_category:
type: string
description: The asset category for this entity
const: compute_platform
asset_sub_category:
type: string
description: The asset subcategory for this entity
const: ecs_workload
agent_connected:
type: boolean
description: A boolean flag indicating whether the Amazon ECS container agent running on the instance is currently connected and communicating with the ECS control plane. This helps monitor the health and availability of the instance for scheduling and managing containers.
agent_update_status:
type: string
description: Indicates the current status of the ECS container agent software running on the container instance. This status reflects whether the agent is up-to-date, pending an update, or encountering issues during the update process.
agent_version:
type: string
description: The agentVersion attribute indicates the version of the Amazon ECS container agent software running on the container instance. The agent is responsible for managing the resource and lifecycle of containers on the instance. Keeping the agent up-to-date ensures access to the latest features and bug fixes.
agent_version_hash:
type: string
description: A hash value representing the specific version of the Amazon ECS container agent software installed and running on the instance. This attribute allows tracking agent updates and versioning across the ECS cluster.
arn:
type: string
description: The arn attribute represents the Amazon Resource Name (ARN) of the ECS container instance. It uniquely identifies the container instance within the AWS account and region. The ARN follows the format arn:aws:ecs:[region]:[aws_account_id]:container-instance/[cluster_name]/[container_instance_id].
cloud_account_id:
type: string
description: This property represents the unique identifier assigned to a cloud account within a specific cloud provider. It is used to distinguish one account from another across services, tenants, and organizations.
cloud_provider:
type: string
description: This property identifies the cloud platform hosting the resource, such as AWS, Azure, or Google Cloud. It helps categorize assets by their originating cloud environment.
cloud_resource_id:
type: string
description: A unique identifier assigned to a resource within a cloud provider's environment. It ensures each resource (such as a VM, storage bucket, or database) can be distinctly referenced, managed and tracked across services and regions.
docker_version:
type: string
description: Specifies the version of the Docker engine installed on the Amazon ECS container instance, which is responsible for building, running, and managing Docker containers. Tracking the Docker version helps ensure compatibility and plan upgrades across the cluster.
name:
type: string
description: The name attribute specifies the unique identifier assigned to the Amazon ECS container instance. This value is a user-defined string that helps distinguish and manage container instances within an ECS cluster. It is recommended to use a descriptive naming convention that aligns with organizational standards.
overall_health_status:
# --- truncated at 32 KB (753 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/upwind/refs/heads/main/openapi/upwind-inventory-api-openapi.yml