Upwind threats API
The threats API from Upwind — 18 operation(s) for threats.
OpenAPI Specification
openapi: 3.0.3
info:
title: Upwind Management REST API v1 access-management threats API
version: '1.0'
description: Upwind Management REST API — administrative and data endpoints for the Upwind cloud security platform (threats, vulnerabilities, configurations, inventory, API security, workflows, access management). Reconstructed faithfully from the embedded OpenAPI operation definitions published in the Upwind docs (docs.upwind.io) by the API Evangelist enrichment pipeline; operation content is verbatim from the provider.
contact:
name: Upwind Support
email: support@upwind.io
url: https://docs.upwind.io/
x-apievangelist:
generated: '2026-07-21'
method: searched
source: https://docs.upwind.io/restapi/v1/introduction (embedded docusaurus-plugin-openapi-docs operation JSON)
servers:
- url: https://api.upwind.io
description: Production endpoint (US)
- url: https://api.eu.upwind.io
description: Production endpoint (EU)
- url: https://api.me.upwind.io
description: Production endpoint (ME)
security:
- OAuth2ClientCredentials: []
tags:
- name: threats
paths:
/v1/organizations/{organization-id}/threat-events:
get:
operationId: getEventsList
summary: List events
description: A `GET` request sent to the endpoint root returns a list of Threat Events objects that are associated with the specified organization. To learn more about Threat Events, refer to the [Events Overview](/threats/events/overview) page.
tags:
- threats
parameters:
- description: The unique identifier for the Upwind organization.
example: org_Xk9mPq7RtYwN2vLs
in: path
name: organization-id
required: true
schema:
type: string
- description: The page number to retrieve. Used for pagination along with the `per-page` parameter.
in: query
name: page
required: false
schema:
type: integer
format: int32
default: 1
- description: Specifies how many results are returned on a page.
in: query
name: per-page
required: false
schema:
type: integer
format: int32
default: 100
- description: Filters by the specified cloud account ID.
in: query
name: cloud-account-id
required: false
schema:
type: string
- description: Filters events by the earliest timestamp (in ISO8601 format) when they were first seen.
in: query
name: min-first-seen-time
required: false
schema:
type: string
- description: Filters events by the latest timestamp (in ISO8601 format) when they were first seen.
in: query
name: max-first-seen-time
required: false
schema:
type: string
- description: Filters events by the latest timestamp (in ISO8601 format) when they were last seen.
in: query
name: max-last-seen-time
required: false
schema:
type: string
- description: Filters events by the earliest timestamp (in ISO8601 format) when they were last seen.
in: query
name: min-last-seen-time
required: false
schema:
type: string
- description: Filters events by their category.
in: query
name: category
required: false
schema:
type: string
- description: Filters by the level of severity.
in: query
name: severity
required: false
schema:
type: string
- description: Filters events by the Upwind asset ID.
in: query
name: upwind-asset-id
required: false
schema:
type: string
responses:
'200':
content:
application/json:
schema:
type: array
items:
type: object
description: Base schema for threat events
discriminator:
mapping:
AUDIT_LOG_EVENT:
allOf:
- circular(EventSummary)
- type: object
properties:
data:
type: object
properties:
initiator:
type: object
properties:
data:
type: object
properties:
groups:
type: array
items:
type: string
source_ips:
type: array
items:
type: string
uid:
type: string
user_agent:
type: string
user_name:
type: string
title: InitiatorData
type:
type: string
title: Initiator
title: AuditLogData
title: AuditLogSummary
AWS_CLOUDTRAIL_EVENT:
allOf:
- circular(EventSummary)
- type: object
properties:
endpointId:
type: string
initiator:
type: object
properties:
accessKeyId:
type: string
accountId:
type: string
arn:
type: string
name:
type: string
principalId:
type: string
sessionContext:
type: object
properties:
attributes:
type: object
properties:
creationDate:
type: string
format: date-time
mfaAuthenticated:
type: string
title: DetectionAwsCloudtrailInitiatorSessionAttributes
sessionIssuer:
type: object
properties:
accountId:
type: string
arn:
type: string
principalId:
type: string
type:
type: string
userName:
type: string
title: DetectionAwsCloudtrailInitiatorSessionIssuer
title: DetectionAwsCloudtrailInitiatorSessionContextDetails
type:
type: string
userName:
type: string
title: DetectionAwsCloudtrailInitiatorDetails
rawLog:
type: string
title: AwsCloudtrailSummary
MALICIOUS_FILE_ACTIVITY:
allOf:
- circular(EventSummary)
- type: object
properties:
data:
type: object
properties:
file_hash:
type: string
file_hash_type:
type: string
file_name:
type: string
file_path:
type: string
image_name:
type: string
title: FileSummaryData
title: FileSummary
NETWORK_ACTIVITY:
allOf:
- circular(EventSummary)
- type: object
properties:
data:
type: object
properties:
bad_reputation_ips:
type: array
items:
type: object
properties:
abuse_rate:
type: string
city:
type: string
country:
type: string
direction:
type: string
domain:
type: string
title: BadReputationIpsData
title: BadReputationIpsDataList
title: NetworkActivitySummary
PROCESS_EXECUTION:
allOf:
- circular(EventSummary)
- type: object
properties:
data:
type: object
properties:
command:
type: string
description:
type: string
execution_count:
type: integer
format: int32
last_process_tree:
type: array
items:
type: object
properties:
command:
type: string
end_time:
type: string
format: date-time
host_parent_process_id:
type: integer
format: int32
host_process_id:
type: integer
format: int32
name:
type: string
start_time:
type: string
format: date-time
title: ProcessTreeData
name:
type: string
pattern:
type: string
status:
type: string
user_name:
type: string
validation:
type: array
items:
type: string
title: ProcessExecutionData
title: ProcessExecutionSummary
propertyName: type
properties:
description:
type: string
description: The description of this event.
event_time:
type: string
format: date-time
description: The timestamp when this event occurred.
event_type:
type: string
description: The specific type identifier for this event.
id:
type: string
description: The unique identifier for this event.
resource:
description: The resource associated with this event.
type: object
properties:
cloud_account_id:
type: string
description: The unique identifier for the cloud account associated with this resource.
cloud_provider:
type: string
description: The cloud provider of this resource.
enum:
- AWS
- GCP
- AZURE
- ORACLE
id:
type: string
description: The unique identifier for this resource.
name:
type: string
description: The name of this resource.
region:
type: string
description: The region where this resource is located.
risk_categories:
type: array
description: List of risk categories associated with this resource.
items:
type: string
uniqueItems: true
upwind_asset_id:
type: string
description: The Upwind asset identifier for this resource.
title: EventResource
type:
type: string
required:
- type
title: EventSummary
description: OK
'401':
description: Unauthorized
'403':
description: Forbidden
'429':
description: Rate Limit Exceeded
security:
- OAuth2ClientCredentials: []
/v1/organizations/{organization-id}/threat-detections/{detection-id}:
get:
operationId: get-threat-detection
summary: Get a detection
description: A `GET` request sent to the endpoint root followed by a unique identifier returns detailed information about a specific Threat Detection. This endpoint provides access to comprehensive details such as the triggers (policy violations) and attributes related to the associated resource. To learn more about Threat Detections, refer to the [Detections Overview](/threats/detections/overview) page.
tags:
- threats
parameters:
- description: The unique identifier for the Upwind organization.
example: org_Xk9mPq7RtYwN2vLs
in: path
name: organization-id
required: true
schema:
type: string
- description: The unique identifier for this detection.
in: path
name: detection-id
required: true
schema:
type: string
responses:
'200':
content:
application/json:
schema:
type: object
properties:
category:
type: string
description: The category of this detection.
enum:
- NETWORK
- PROCESS
- CLOUD_LOGS
description:
type: string
description: A detailed description of this detection.
first_seen_time:
type: string
format: date-time
description: The timestamp when this detection was first seen.
id:
type: string
description: The unique identifier for this detection.
last_seen_time:
type: string
format: date-time
description: The timestamp when this detection was last seen.
mitre_attacks:
type: array
description: The MITRE ATT&CK framework information related to this detection.
items:
type: object
properties:
tactic_id:
type: string
description: The unique identifier for the tactic.
tactic_name:
type: string
description: The name of the tactic.
technique_id:
type: string
description: The unique identifier for the technique.
technique_name:
type: string
description: The name of the technique.
title: MitreAttackDetails
occurrence_count:
type: integer
format: int32
description: The count of occurrences for this detection.
resource:
description: The resource associated with this detection.
type: object
properties:
cloud_account_id:
type: string
description: The unique identifier for the cloud account associated with this resource.
cloud_account_name:
type: string
description: The name of the cloud account associated with this resource.
cloud_account_tags:
type: array
description: List of tags associated with the cloud account the resource belongs to.
items:
type: object
properties:
key:
type: string
value:
type: string
title: Tag
cloud_provider:
type: string
description: The cloud provider of this resource.
enum:
- AWS
- GCP
- AZURE
- ORACLE
cluster_id:
type: string
description: The unique identifier for the cluster associated with this resource.
external_id:
type: string
description: The external unique identifier for this resource.
id:
type: string
description: The unique identifier for this resource.
internet_exposure:
type: object
properties:
ingress:
description: The information about incoming internet-facing communication activities of the resource.
type: object
properties:
active_communication:
type: boolean
description: An indicator signaling whether there is active incoming communication from the internet to the resource.
title: InternetExposureDetails
title: InternetExposure
name:
type: string
description: The name of this resource.
namespace:
type: string
region:
type: string
description: The region where this resource is located.
risk_categories:
type: array
items:
type: string
uniqueItems: true
type:
type: string
description: The type of this resource.
upwind_asset_id:
type: string
description: The Upwind asset identifier for this resource.
title: DetectionResource
severity:
type: string
description: The severity level of this detection.
enum:
- LOW
- MEDIUM
- HIGH
- CRITICAL
status:
type: string
description: The status of this detection.
enum:
- PENDING
- OPEN
- ARCHIVED
title:
type: string
description: The title of this detection.
triggers:
type: array
description: List of triggers associated with this detection. Each trigger indicates a policy violation that caused this detection. It comprises the policy identifier and a list of events related to the violation.
items:
type: object
properties:
events:
type: array
description: List of event summaries.
items:
oneOf:
- allOf:
- type: object
description: Base schema for threat events
discriminator:
mapping:
AUDIT_LOG_EVENT: circular(AuditLogSummary)
AWS_CLOUDTRAIL_EVENT:
allOf:
- circular(EventSummary)
- type: object
properties:
endpointId:
type: string
initiator:
type: object
properties:
accessKeyId:
type: string
accountId:
type: string
arn:
type: string
name:
type: string
principalId:
type: string
sessionContext:
type: object
properties:
attributes:
type: object
properties:
creationDate:
type: string
format: date-time
mfaAuthenticated:
type: string
title: DetectionAwsCloudtrailInitiatorSessionAttributes
sessionIssuer:
type: object
properties:
accountId:
type: string
arn:
type: string
principalId:
type: string
type:
type: string
userName:
type: string
title: DetectionAwsCloudtrailInitiatorSessionIssuer
title: DetectionAwsCloudtrailInitiatorSessionContextDetails
type:
type: string
userName:
type: string
title: DetectionAwsCloudtrailInitiatorDetails
rawLog:
type: string
title: AwsCloudtrailSummary
MALICIOUS_FILE_ACTIVITY:
allOf:
- circular(EventSummary)
- type: object
properties:
data:
type: object
properties:
file_hash:
type: string
file_hash_type:
type: string
file_name:
type: string
file_path:
type: string
image_name:
type: string
title: FileSummaryData
title: FileSummary
NETWORK_ACTIVITY:
allOf:
- circular(EventSummary)
- type: object
properties:
data:
type: object
properties:
bad_reputation_ips:
type: array
items:
type: object
properties:
abuse_rate:
type: string
city:
type: string
country:
type: string
direction:
type: string
domain:
type: string
title: BadReputationIpsData
title: BadReputationIpsDataList
title: NetworkActivitySummary
PROCESS_EXECUTION:
allOf:
- circular(EventSummary)
- type: object
properties:
data:
type: object
properties:
command:
type: string
description:
type: string
execution_count:
type: integer
format: int32
last_process_tree:
type: array
items:
type: object
properties:
command:
type: string
end_time:
type: string
format: date-time
host_parent_process_id:
type: integer
format: int32
host_process_id:
type: integer
format: int32
name:
type: string
start_time:
type: string
format: date-time
title: ProcessTreeData
name:
type: string
pattern:
type: string
status:
type: string
user_name:
# --- truncated at 32 KB (3577 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/upwind/refs/heads/main/openapi/upwind-threats-api-openapi.yml