Cisco XDR · OpenAPI Overlay 1.0.0

API Evangelist enhancements for Cisco XDR Response

3 actions 3 updates update extends openapi/cisco-xdr-response-api-openapi.yml

Generated by API Evangelist Written by API Evangelist tooling for Cisco XDR's API. It is a proposal applied on top of the contract, not a document Cisco XDR publishes.

View Overlay File View on GitHub Overlay Specification

What the actions change

x-agentic-accessx-apievangelist-familyx-apievangelist-base-urlx-apievangelist-regionsx-apievangelist-idempotencyx-apievangelist-rate-limit

Targets 3

$.info

$.paths['/iroh/iroh-response/respond/trigger/{module-instance-id}/{action-id}'].post

$.paths['/iroh/iroh-response/respond/observables'].post

OpenAPI Overlay

overlay: 1.0.0
info:
  title: API Evangelist enhancements for Cisco XDR Response
  version: 1.0.0
x-generated: '2026-08-19'
x-method: generated
x-source: openapi/cisco-xdr-response-api-openapi.yml + conventions/cisco-xdr-conventions.yml
extends: openapi/cisco-xdr-response-api-openapi.yml
actions:
- target: $.info
  update:
    x-apievangelist-family: IROH platform
    x-apievangelist-base-url: https://visibility.amp.cisco.com/iroh
    x-apievangelist-regions:
      us: https://visibility.amp.cisco.com/iroh
      eu: https://visibility.eu.amp.cisco.com/iroh
      apjc: https://visibility.apjc.amp.cisco.com/iroh
    x-apievangelist-idempotency: none
    x-apievangelist-rate-limit:
      scope: organization
      window: PT1H
      limit: 8000
      headers: [X-Ratelimit-Org-Limit, X-Ratelimit-Org-Remaining, Retry-After]
- target: $.paths['/iroh/iroh-response/respond/trigger/{module-instance-id}/{action-id}'].post
  update:
    x-agentic-access:
      action_class: execute
      consequence: irreversible
      requires_human_authorization: true
      idempotent: false
      prerequisite: POST /iroh/iroh-response/respond/observables
      scope: response/trigger:write
      note: >-
        Blocks, isolates or quarantines through a configured integration module. No idempotency key
        exists, so a retry after a timeout may execute a second containment. Discovery of a valid
        action_id and module_instance_id is mandatory first.
- target: $.paths['/iroh/iroh-response/respond/observables'].post
  update:
    x-agentic-access:
      action_class: read
      consequence: none
      idempotent: true
      scope: response/observables:read