Cisco XDR · OAuth Scopes
Cisco XDR OAuth Scopes
OAuth 2.0
searched
Cisco XDR publishes 41 OAuth 2.0 scopes via the authorizationCode and clientCredentials flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Cisco XDR API on a user’s behalf.
Tokens are issued from https://visibility.amp.cisco.com/iroh/oauth2/token.
This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.
SecurityXDRThreat DetectionIncident ResponseSOCThreat IntelligenceExtended Detection and ResponseAuthenticationWebhookAutomationMCP
Scopes: 41
Flows: authorizationCode, clientCredentials
Method: searched
OAuth endpoints
Authorization URL
https://visibility.amp.cisco.com/iroh/oauth2/authorize
https://visibility.amp.cisco.com/iroh/oauth2/authorize
Token URL
https://visibility.amp.cisco.com/iroh/oauth2/token
https://visibility.amp.cisco.com/iroh/oauth2/token
Flows
authorizationCodeclientCredentials
authorizationCodeclientCredentials
Scopes (41)
| Scope | Description | Flows |
|---|---|---|
| admin | Provide admin privileges | authorizationCode, clientCredentials |
| ao | AO Integration. | authorizationCode |
| ao:read | AO Integration. | clientCredentials |
| asset | Access and modify your assets | authorizationCode, clientCredentials |
| casebook | Casebook Full Access | authorizationCode, clientCredentials |
| casebook:read | Casebook Read Access | authorizationCode |
| casebook:write | Casebook Write Access | authorizationCode |
| cognitive | Cognitive Integration | authorizationCode, clientCredentials |
| enrich | Query your configured modules for threat intelligence | authorizationCode |
| enrich:read | Query your configured modules for threat intelligence | authorizationCode, clientCredentials |
| event | Read IROH Events | authorizationCode, clientCredentials |
| event:read | Get event information for an org. Needed to get full report information. | authorizationCode |
| feedback | Submit Customer Feedback | authorizationCode, clientCredentials |
| global-intel:read | Access AMP Global Intelligence | authorizationCode, clientCredentials |
| inspect | Extract Observables and data from text | authorizationCode |
| inspect:read | Extract Observables and data from text | clientCredentials |
| integration | Manage your modules | authorizationCode |
| integration:read | Manage your modules | authorizationCode, clientCredentials |
| investigation | Perform threat analysis investigation | authorizationCode, clientCredentials |
| invite | Invite users into your organization | authorizationCode |
| invite:read | Invite users into your organization | clientCredentials |
| notification | Receive notifications from integrations | authorizationCode, clientCredentials |
| oauth | Manage OAuth2 Clients | authorizationCode |
| oauth:read | Manage OAuth2 Clients | clientCredentials |
| orbital | Orbital Integration. | authorizationCode, clientCredentials |
| playbook | Access and modify your playbooks | clientCredentials |
| playbook:read | Get playbook state. Needed to get full report information. | authorizationCode |
| private-intel | Private Intelligence Full Access | authorizationCode |
| private-intel:read | Private Intelligence Read Access | authorizationCode, clientCredentials |
| private-intel:write | Private Intelligence Write Access | authorizationCode |
| profile | Get your profile information | authorizationCode |
| profile:read | Get your profile information | clientCredentials |
| registry | Manage registry entries | authorizationCode, clientCredentials |
| response | List and execute response actions using configured modules | authorizationCode |
| response:read | List and execute response actions using configured modules | clientCredentials |
| sse | SSE Integration. Manage your Devices. | authorizationCode, clientCredentials |
| telemetry | Collect application data for analytics | authorizationCode, clientCredentials |
| users | Manage users of your organisation | authorizationCode |
| users:read | Manage users of your organization | clientCredentials |
| vault | Grants access to Module Vaults | authorizationCode, clientCredentials |
| webhook | Manage your Webhooks | authorizationCode, clientCredentials |
📄 Provider scope reference: https://visibility.amp.cisco.com/iroh/doc/iroh-auth/index.html#scopes
Source
OAuth Scopes
generated: '2026-08-19'
method: searched
source: openapi/cisco-xdr-actor-api-openapi.yml, openapi/cisco-xdr-asset-api-openapi.yml, openapi/cisco-xdr-asset-mapping-api-openapi.yml,
openapi/cisco-xdr-asset-properties-api-openapi.yml, openapi/cisco-xdr-attack-pattern-api-openapi.yml, openapi/cisco-xdr-automation-openapi.json,
openapi/cisco-xdr-bulk-api-openapi.yml, openapi/cisco-xdr-bundle-api-openapi.yml, openapi/cisco-xdr-campaign-api-openapi.yml,
openapi/cisco-xdr-casebook-api-openapi.yml, openapi/cisco-xdr-coa-api-openapi.yml, openapi/cisco-xdr-deliberate-api-openapi.yml,
openapi/cisco-xdr-event-api-openapi.yml, openapi/cisco-xdr-feed-api-openapi.yml, openapi/cisco-xdr-feedback-api-openapi.yml,
openapi/cisco-xdr-graphql-api-openapi.yml, openapi/cisco-xdr-health-api-openapi.yml, openapi/cisco-xdr-incident-api-openapi.yml,
openapi/cisco-xdr-incidents-investigations-openapi.json, openapi/cisco-xdr-indicator-api-openapi.yml, openapi/cisco-xdr-inspect-api-openapi.yml,
openapi/cisco-xdr-investigation-api-openapi.yml, openapi/cisco-xdr-invite-api-openapi.yml, openapi/cisco-xdr-iroh-api-openapi.yml,
openapi/cisco-xdr-judgement-api-openapi.yml, openapi/cisco-xdr-login-api-openapi.yml, openapi/cisco-xdr-malware-api-openapi.yml,
openapi/cisco-xdr-metrics-api-openapi.yml, openapi/cisco-xdr-moduleinstance-api-openapi.yml, openapi/cisco-xdr-moduletype-api-openapi.yml,
openapi/cisco-xdr-moduletypepatch-api-openapi.yml, openapi/cisco-xdr-note-api-openapi.yml, openapi/cisco-xdr-observe-api-openapi.yml,
openapi/cisco-xdr-one-click-api-openapi.yml, openapi/cisco-xdr-private-intel-api-openapi.yml, openapi/cisco-xdr-properties-api-openapi.yml,
openapi/cisco-xdr-query-api-openapi.yml, openapi/cisco-xdr-refer-api-openapi.yml, openapi/cisco-xdr-relationship-api-openapi.yml,
openapi/cisco-xdr-reputation-api-openapi.yml, openapi/cisco-xdr-response-api-openapi.yml, openapi/cisco-xdr-session-cookie-api-openapi.yml,
openapi/cisco-xdr-sighting-api-openapi.yml, openapi/cisco-xdr-status-api-openapi.yml, openapi/cisco-xdr-target-record-api-openapi.yml,
openapi/cisco-xdr-tool-api-openapi.yml, openapi/cisco-xdr-verdict-api-openapi.yml, openapi/cisco-xdr-version-api-openapi.yml,
openapi/cisco-xdr-vulnerability-api-openapi.yml, openapi/cisco-xdr-webhook-api-openapi.yml, openapi/cisco-xdr-webhookresult-api-openapi.yml
docs: https://visibility.amp.cisco.com/iroh/doc/iroh-auth/index.html#scopes
docs_alt:
- https://developer.cisco.com/docs/cisco-xdr/authentication/
- https://docs.xdr.security.cisco.com/Content/Administration/api-clients.htm
note: Three different views of the same authorization surface, and they do not agree. The specs declare 41 oauth2
scopes. The RFC 8414 authorization-server metadata at visibility.amp.cisco.com/.well-known/oauth-authorization-server
advertises 32. And the operation descriptions inside the IROH specs require 36 finer-grained scope strings that
appear in NEITHER list - things like response/trigger:write, webhook/management:read and private-intel/incident:write.
Those hierarchical scopes are what actually gates an operation, so they are captured separately below. An API
Client created from the coarse list alone will get 403s.
authorization_server:
issuer: IROH Auth
authorization_endpoint: https://visibility.amp.cisco.com/iroh/oauth2/authorize
token_endpoint: https://visibility.amp.cisco.com/iroh/oauth2/token
device_authorization_endpoint: https://visibility.amp.cisco.com/iroh/oauth2/device_authorization
refresh_endpoint: https://visibility.amp.cisco.com/iroh/oauth2/refresh
jwks_uri: https://visibility.amp.cisco.com/.well-known/jwks
grant_types_supported:
- authorization_code
- client_credential
- urn:ietf:params:oauth:grant-type:device_code
- urn:ietf:params:oauth:grant-type:token-exchange
code_challenge_methods_supported:
- S256
- plain
scopes_supported:
- forensics_analyst
- insights
- telemetry
- security-events
- integration
- private-intel
- base-telemetry
- admin
- cognitive
- profile
- inspect
- asset
- event
- feedback
- sse
- forensics_admin
- registry
- users
- investigation
- invite
- playbook
- casebook
- forensics_responder
- detection
- orbital
- enrich
- oauth
- global-intel
- response
- notification
- webhook
- ao
schemes:
- name: oauth2
source: openapi/cisco-xdr-actor-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-asset-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-asset-mapping-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-asset-properties-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-attack-pattern-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oAuth2
source: openapi/cisco-xdr-automation-openapi.json
flows:
- flow: clientCredentials
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-bulk-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-bundle-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-campaign-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-casebook-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-coa-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-deliberate-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-event-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-feed-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-feedback-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-graphql-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-health-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-incident-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-incidents-investigations-openapi.json
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-indicator-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-inspect-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-investigation-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-invite-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-iroh-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-judgement-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-login-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-malware-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-metrics-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-moduleinstance-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-moduletype-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-moduletypepatch-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-note-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-observe-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-one-click-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-private-intel-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-properties-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-query-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-refer-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-relationship-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-reputation-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-response-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-session-cookie-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-sighting-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-status-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-target-record-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-tool-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-verdict-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-version-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-vulnerability-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-webhook-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
source: openapi/cisco-xdr-webhookresult-api-openapi.yml
flows:
- flow: authorizationCode
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
scopes:
- scope: admin
description: Provide admin privileges
flows:
- authorizationCode
- clientCredentials
sources:
- openapi/cisco-xdr-automation-openapi.json
- openapi/cisco-xdr-deliberate-api-openapi.yml
- openapi/cisco-xdr-event-api-openapi.yml
- openapi/cisco-xdr-feedback-api-openapi.yml
- openapi/cisco-xdr-health-api-openapi.yml
- openapi/cisco-xdr-inspect-api-openapi.yml
- openapi/cisco-xdr-invite-api-openapi.yml
- openapi/cisco-xdr-iroh-api-openapi.yml
- openapi/cisco-xdr-login-api-openapi.yml
- openapi/cisco-xdr-moduleinstance-api-openapi.yml
- openapi/cisco-xdr-moduletype-api-openapi.yml
- openapi/cisco-xdr-moduletypepatch-api-openapi.yml
- openapi/cisco-xdr-observe-api-openapi.yml
- openapi/cisco-xdr-one-click-api-openapi.yml
- openapi/cisco-xdr-private-intel-api-openapi.yml
- openapi/cisco-xdr-query-api-openapi.yml
- openapi/cisco-xdr-refer-api-openapi.yml
- openapi/cisco-xdr-reputation-api-openapi.yml
- openapi/cisco-xdr-response-api-openapi.yml
- openapi/cisco-xdr-session-cookie-api-openapi.yml
- openapi/cisco-xdr-webhook-api-openapi.yml
- openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: ao
description: AO Integration.
flows:
- authorizationCode
sources:
- openapi/cisco-xdr-deliberate-api-openapi.yml
- openapi/cisco-xdr-event-api-openapi.yml
- openapi/cisco-xdr-feedback-api-openapi.yml
- openapi/cisco-xdr-health-api-openapi.yml
- openapi/cisco-xdr-incidents-investigations-openapi.json
- openapi/cisco-xdr-inspect-api-openapi.yml
- openapi/cisco-xdr-invite-api-openapi.yml
- openapi/cisco-xdr-iroh-api-openapi.yml
- openapi/cisco-xdr-login-api-openapi.yml
- openapi/cisco-xdr-moduleinstance-api-openapi.yml
- openapi/cisco-xdr-moduletype-api-openapi.yml
- openapi/cisco-xdr-moduletypepatch-api-openapi.yml
- openapi/cisco-xdr-observe-api-openapi.yml
- openapi/cisco-xdr-one-click-api-openapi.yml
- openapi/cisco-xdr-private-intel-api-openapi.yml
- openapi/cisco-xdr-query-api-openapi.yml
- openapi/cisco-xdr-refer-api-openapi.yml
- openapi/cisco-xdr-reputation-api-openapi.yml
- openapi/cisco-xdr-response-api-openapi.yml
- openapi/cisco-xdr-session-cookie-api-openapi.yml
- openapi/cisco-xdr-webhook-api-openapi.yml
- openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: ao:read
description: AO Integration.
flows:
- clientCredentials
sources:
- openapi/cisco-xdr-automation-openapi.json
- scope: asset
description: Access and modify your assets
flows:
- authorizationCode
- clientCredentials
sources:
- openapi/cisco-xdr-automation-openapi.json
- openapi/cisco-xdr-deliberate-api-openapi.yml
- openapi/cisco-xdr-event-api-openapi.yml
- openapi/cisco-xdr-feedback-api-openapi.yml
- openapi/cisco-xdr-health-api-openapi.yml
- openapi/cisco-xdr-incidents-investigations-openapi.json
- openapi/cisco-xdr-inspect-api-openapi.yml
- openapi/cisco-xdr-invite-api-openapi.yml
- openapi/cisco-xdr-iroh-api-openapi.yml
- openapi/cisco-xdr-login-api-openapi.yml
- openapi/cisco-xdr-moduleinstance-api-openapi.yml
- openapi/cisco-xdr-moduletype-api-openapi.yml
- openapi/cisco-xdr-moduletypepatch-api-openapi.yml
- openapi/cisco-xdr-observe-api-openapi.yml
- openapi/cisco-xdr-one-click-api-openapi.yml
- openapi/cisco-xdr-private-intel-api-openapi.yml
- openapi/cisco-xdr-query-api-openapi.yml
- openapi/cisco-xdr-refer-api-openapi.yml
- openapi/cisco-xdr-reputation-api-openapi.yml
- openapi/cisco-xdr-response-api-openapi.yml
- openapi/cisco-xdr-session-cookie-api-openapi.yml
- openapi/cisco-xdr-webhook-api-openapi.yml
- openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: casebook
description: Casebook Full Access
flows:
- authorizationCode
- clientCredentials
sources:
- openapi/cisco-xdr-actor-api-openapi.yml
- openapi/cisco-xdr-asset-api-openapi.yml
- openapi/cisco-xdr-asset-mapping-api-openapi.yml
- openapi/cisco-xdr-asset-properties-api-openapi.yml
- openapi/cisco-xdr-attack-pattern-api-openapi.yml
- openapi/cisco-xdr-automation-openapi.json
- openapi/cisco-xdr-bulk-api-openapi.yml
- openapi/cisco-xdr-bundle-api-openapi.yml
- openapi/cisco-xdr-campaign-api-openapi.yml
- openapi/cisco-xdr-casebook-api-openapi.yml
- openapi/cisco-xdr-coa-api-openapi.yml
- openapi/cisco-xdr-deliberate-api-openapi.yml
- openapi/cisco-xdr-event-api-openapi.yml
- openapi/cisco-xdr-feed-api-openapi.yml
- openapi/cisco-xdr-feedback-api-openapi.yml
- openapi/cisco-xdr-graphql-api-openapi.yml
- openapi/cisco-xdr-health-api-openapi.yml
- openapi/cisco-xdr-incident-api-openapi.yml
- openapi/cisco-xdr-incidents-investigations-openapi.json
- openapi/cisco-xdr-indicator-api-openapi.yml
- openapi/cisco-xdr-inspect-api-openapi.yml
- openapi/cisco-xdr-investigation-api-openapi.yml
- openapi/cisco-xdr-invite-api-openapi.yml
- openapi/cisco-xdr-iroh-api-openapi.yml
- openapi/cisco-xdr-judgement-api-openapi.yml
- openapi/cisco-xdr-login-api-openapi.yml
- openapi/cisco-xdr-malware-api-openapi.yml
- openapi/cisco-xdr-metrics-api-openapi.yml
- openapi/cisco-xdr-moduleinstance-api-openapi.yml
- openapi/cisco-xdr-moduletype-api-openapi.yml
- openapi/cisco-xdr-moduletypepatch-api-openapi.yml
- openapi/cisco-xdr-note-api-openapi.yml
- openapi/cisco-xdr-observe-api-openapi.yml
- openapi/cisco-xdr-one-click-api-openapi.yml
- openapi/cisco-xdr-private-intel-api-openapi.yml
- openapi/cisco-xdr-properties-api-openapi.yml
- openapi/cisco-xdr-query-api-openapi.yml
- openapi/cisco-xdr-refer-api-openapi.yml
- openapi/cisco-xdr-relationship-api-openapi.yml
- openapi/cisco-xdr-reputation-api-openapi.yml
- openapi/cisco-xdr-response-api-openapi.yml
- openapi/cisco-xdr-session-cookie-api-openapi.yml
- openapi/cisco-xdr-sighting-api-openapi.yml
- openapi/cisco-xdr-status-api-openapi.yml
- openapi/cisco-xdr-target-record-api-openapi.yml
- openapi/cisco-xdr-tool-api-openapi.yml
- openapi/cisco-xdr-verdict-api-openapi.yml
- openapi/cisco-xdr-version-api-openapi.yml
- openapi/cisco-xdr-vulnerability-api-openapi.yml
- openapi/cisco-xdr-webhook-api-openapi.yml
- openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: casebook:read
description: Casebook Read Access
flows:
- authorizationCode
sources:
- openapi/cisco-xdr-actor-api-openapi.yml
- openapi/cisco-xdr-asset-api-openapi.yml
- openapi/cisco-xdr-asset-mapping-api-openapi.yml
- openapi/cisco-xdr-asset-properties-api-openapi.yml
- openapi/cisco-xdr-attack-pattern-api-openapi.yml
- openapi/cisco-xdr-bulk-api-openapi.yml
- openapi/cisco-xdr-bundle-api-openapi.yml
- openapi/cisco-xdr-campaign-api-openapi.yml
- openapi/cisco-xdr-casebook-api-openapi.yml
- openapi/cisco-xdr-coa-api-openapi.yml
- openapi/cisco-xdr-event-api-openapi.yml
- openapi/cisco-xdr-feed-api-openapi.yml
- openapi/cisco-xdr-graphql-api-openapi.yml
- openapi/cisco-xdr-incident-api-openapi.yml
- openapi/cisco-xdr-incidents-investigations-openapi.json
- openapi/cisco-xdr-indicator-api-openapi.yml
- openapi/cisco-xdr-investigation-api-openapi.yml
- openapi/cisco-xdr-judgement-api-openapi.yml
- openapi/cisco-xdr-malware-api-openapi.yml
- openapi/cisco-xdr-metrics-api-openapi.yml
- openapi/cisco-xdr-note-api-openapi.yml
- openapi/cisco-xdr-properties-api-openapi.yml
- openapi/cisco-xdr-relationship-api-openapi.yml
- openapi/cisco-xdr-sighting-api-openapi.yml
- openapi/cisco-xdr-status-api-openapi.yml
- openapi/cisco-xdr-target-record-api-openapi.yml
- openapi/cisco-xdr-tool-api-openapi.yml
- openapi/cisco-xdr-verdict-api-openapi.yml
- openapi/cisco-xdr-version-api-openapi.yml
- openapi/cisco-xdr-vulnerability-api-openapi.yml
- scope: casebook:write
description: Casebook Write Access
flows:
- authorizationCode
sources:
- openapi/cisco-xdr-actor-api-openapi.yml
- openapi/cisco-xdr-asset-api-openapi.yml
- openapi/cisco-xdr-asset-mapping-api-openapi.yml
- openapi/cisco-xdr-asset-properties-api-openapi.yml
- openapi/cisco-xdr-attack-pattern-api-openapi.yml
- openapi/cisco-xdr-bulk-api-openapi.yml
- openapi/cisco-xdr-bundle-api-openapi.yml
- openapi/cisco-xdr-campaign-api-openapi.yml
- openapi/cisco-xdr-casebook-api-openapi.yml
- openapi/cisco-xdr-coa-api-openapi.yml
- openapi/cisco-xdr-event-api-openapi.yml
- openapi/cisco-xdr-feed-api-openapi.yml
- openapi/cisco-xdr-graphql-api-openapi.yml
- openapi/cisco-xdr-incident-api-openapi.yml
- openapi/cisco-xdr-indicator-api-openapi.yml
- openapi/cisco-xdr-investigation-api-openapi.yml
- openapi/cisco-xdr-judgement-api-openapi.yml
- openapi/cisco-xdr-malware-api-openapi.yml
- openapi/cisco-xdr-metrics-api-openapi.yml
- openapi/cisco-xdr-note-api-openapi.yml
- openapi/cisco-xdr-properties-api-openapi.yml
- openapi/cisco-xdr-relationship-api-openapi.yml
- openapi/cisco-xdr-sighting-api-openapi.yml
- openapi/cisco-xdr-status-api-openapi.yml
- openapi/cisco-xdr-target-record-api-openapi.yml
- openapi/cisco-xdr-tool-api-openapi.yml
- openapi/cisco-xdr-verdict-api-openapi.yml
- openapi/cisco-xdr-version-api-openapi.yml
- openapi/cisco-xdr-vulnerability-api-openapi.yml
- scope: cognitive
description: Cognitive Integration
flows:
- authorizationCode
- clientCredentials
sources:
- openapi/cisco-xdr-automation-openapi.json
- openapi/cisco-xdr-deliberate-api-openapi.yml
- openapi/cisco-xdr-event-api-openapi.yml
- openapi/cisco-xdr-feedback-api-openapi.yml
- openapi/cisco-xdr-health-api-openapi.yml
- openapi/cisco-xdr-inspect-api-openapi.yml
- openapi/cisco-xdr-invite-api-openapi.yml
- openapi/cisco-xdr-iroh-api-openapi.yml
- openapi/cisco-xdr-login-api-openapi.yml
- openapi/cisco-xdr-moduleinstance-api-openapi.yml
- openapi/cisco-xdr-moduletype-api-openapi.yml
- openapi/cisco-xdr-moduletypepatch-api-openapi.yml
- openapi/cisco-xdr-observe-api-openapi.yml
- openapi/cisco-xdr-one-click-api-openapi.yml
- openapi/cisco-xdr-private-intel-api-openapi.yml
- openapi/cisco-xdr-query-api-openapi.yml
- openapi/cisco-xdr-refer-api-openapi.yml
- openapi/cisco-xdr-reputation-api-openapi.yml
- openapi/cisco-xdr-response-api-openapi.yml
- openapi/cisco-xdr-session-cookie-api-openapi.yml
- openapi/cisco-xdr-webhook-api-openapi.yml
- openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: enrich
description: Query your configured modules for threat intelligence
flows:
- authorizationCode
sources:
- openapi/cisco-xdr-deliberate-api-openapi.yml
- openapi/cisco-xdr-event-api-openapi.yml
- openapi/cisco-xdr-feedback-api-openapi.yml
- openapi/cisco-xdr-health-api-openapi.yml
- openapi/cisco-xdr-inspect-api-openapi.yml
- openapi/cisco-xdr-invite-api-openapi.yml
- openapi/cisco-xdr-iroh-api-openapi.yml
- openapi/cisco-xdr-login-api-openapi.yml
- openapi/cisco-xdr-moduleinstance-api-openapi.yml
- openapi/cisco-xdr-moduletype-api-openapi.yml
- openapi/cisco-xdr-moduletypepatch-api-openapi.yml
- openapi/cisco-xdr-observe-api-openapi.yml
- openapi/cisco-xdr-one-click-api-openapi.yml
- openapi/cisco-xdr-private-intel-api-openapi.yml
- openapi/cisco-xdr-query-api-openapi.yml
- openapi/cisco-xdr-refer-api-openapi.yml
- openapi/cisco-xdr-reputation-api-openapi.yml
- openapi/cisco-xdr-response-api-openapi.yml
- openapi/cisco-xdr-session-cookie-api-openapi.yml
- openapi/cisco-xdr-webhook-api-openapi.yml
- openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: enrich:read
description: Query your configured modules for threat intelligence
flows:
- authorizationCode
- clientCredentials
sources:
- openapi/cisco-xdr-automation-openapi.json
- openapi/cisco-xdr-incidents-investigations-openapi.json
- scope: event
description: Read IROH Events
flows:
- authorizationCode
- clientCredentials
sources:
- openapi/cisco-xdr-automation-openapi.json
- openapi/cisco-xdr-deliberate-api-openapi.yml
- openapi/cisco-xdr-event-api-openapi.yml
- openapi/cisco-xdr-feedback-api-openapi.yml
- openapi/cisco-xdr-health-api-openapi.yml
- openapi/cisco-xdr-inspect-api-openapi.yml
- openapi/cisco-xdr-invite-api-openapi.yml
- openapi/cisco-xdr-iroh-api-openapi.yml
- openapi/cisco-xdr-login-api-openapi.yml
- openapi/cisco-xdr-moduleinstance-api-openapi.yml
- openapi/cisco-xdr-moduletype-api-openapi.yml
- openapi/cisco-xdr-moduletypepatch-api-openapi.yml
- openapi/cisco-xdr-observe-api-openapi.yml
- openapi/cisco-xdr-one-click-api-openapi.yml
- openapi/cisco-xdr-private-intel-api-openapi.yml
- openapi/cisco-xdr-query-api-openapi.yml
- openapi/cisco-xdr-refer-api-openapi.yml
- openapi/cisco-xdr-reputation-api-openapi.yml
- openapi/cisco-xdr-response-api-openapi.yml
- openapi/cisco-xdr-session-cookie-api-openapi.yml
- openapi/cisco-xdr-webhook-api-openapi.yml
- openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: event:read
description: Get event information for an org. Needed to get full report information.
flows:
- authorizationCode
sources:
- openapi/cisco-xdr-incidents-investigations-openapi.json
- scope: feedback
description: Submit Customer Feedback
flows:
- authorizationCode
- clientCredentials
sources:
- openapi/cisco-xdr-automation-openapi.json
- openapi/cisco-xdr-deliberate-api-openapi.yml
- openapi/cisco-xdr-event-api-openapi.yml
- openapi/cisco-xdr-feedback-api-openapi.yml
- openapi/cisco-xdr-health-api-openapi.yml
- openapi/cisco-xdr-inspect-api-openapi.yml
- openapi/cisco-xdr-invite-api-openapi.yml
- openapi/cisco-xdr-iroh-api-openapi.yml
- openapi/cisco-xdr-login-api-openapi.yml
- openapi/cisco-xdr-moduleinstance-api-openapi.yml
- openapi/cisco-xdr-moduletype-api-openapi.yml
- openapi/cisco-xdr-moduletypepatch-api-openapi.yml
- openapi/cisco-xdr-observe-api-openapi.yml
- openapi/cisco-xdr-one-click-api-openapi.yml
- openapi/cisco-xdr-private-intel-api-openapi.yml
- openapi/cisco-xdr-query-api-openapi.yml
- openapi/cisco-xdr-refer-api-openapi.yml
- openapi/cisco-xdr-reputation-api-openapi.yml
- openapi/cisco-xdr-response-api-openapi.yml
- openapi/cisco-xdr-session-cookie-api-openapi.yml
- openapi/cisco-xdr-webhook-api-openapi.yml
- openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: global-intel:read
description: Access AMP Global Intelligence
flows:
- authorizationCode
- clientCredentials
sources:
- openapi/cisco-xdr-automation-openapi.json
- openapi/cisco-xdr-deliberate-api-openapi.yml
- openapi/cisco-xdr-event-api-openapi.yml
- openapi/cisco-xdr-feedback-api-openapi.yml
- openapi/cisco-xdr-health-api-openapi.yml
- openapi/cisco-xdr-incidents-investigations-openapi.json
- openapi/cisco-xdr-inspect-api-openapi.yml
- openapi/cisco-xdr-invite-api-openapi.yml
- openapi/cisco-xdr-iroh-api-openapi.yml
- openapi/cisco-xdr-login-api-openapi.yml
- openapi/cisco-xdr-moduleinstance-api-openapi.yml
- openapi/cisco-xdr-moduletype-api-openapi.yml
- openapi/cisco-xdr-moduletypepatch-api-openapi.yml
- openapi/cisco-xdr-observe-api-openapi.yml
- openapi/cisco-xdr-one-click-api-openapi.yml
- openapi/cisco-xdr-private-intel-api-openapi.yml
- openapi/cisco-xdr-query-api-openapi.yml
- openapi/cisco-xdr-refer-api-openapi.yml
- openapi/cisco-xdr-reputation-api-openapi.yml
- openapi/cisco-xdr-response-api-openapi.yml
- openapi/cisco-xdr-session-cookie-api-openapi.yml
- openapi/cisco-xdr-webhook-api-openapi.yml
- openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: inspect
description: Extract Observables and data from text
flows:
- authorizationCode
sources:
- openapi/cisco-xdr-deliberate-api-openapi.yml
- openapi/cisco-xdr-event-api-openapi.yml
- openapi/cisco-xdr-feedback-api-openapi.yml
- openapi/cisco-xdr-health-api-openapi.yml
- openapi/cisc
# --- truncated at 32 KB (58 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-xdr/refs/heads/main/scopes/cisco-xdr-scopes.yml
Work with this as data
Every scope set here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for oauth scopes
4 MCP tools reach this
find_scopesBrowse and filter every scope set in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This scope set
curl "https://apis.io/api/v1/scopes/cisco-xdr-scopes"
All oauth scopes
curl "https://apis.io/api/v1/scopes?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.