Cisco XDR · OAuth Scopes

Cisco XDR OAuth Scopes

OAuth 2.0 searched

Cisco XDR publishes 41 OAuth 2.0 scopes via the authorizationCode and clientCredentials flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Cisco XDR API on a user’s behalf.

Tokens are issued from https://visibility.amp.cisco.com/iroh/oauth2/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

SecurityXDRThreat DetectionIncident ResponseSOCThreat IntelligenceExtended Detection and ResponseAuthenticationWebhookAutomationMCP

Scopes: 41 Flows: authorizationCode, clientCredentials Method: searched

OAuth endpoints

Authorization URL
https://visibility.amp.cisco.com/iroh/oauth2/authorize

Token URL
https://visibility.amp.cisco.com/iroh/oauth2/token

Flows
authorizationCodeclientCredentials

Scopes (41)

Scope	Description	Flows
admin	Provide admin privileges	authorizationCode, clientCredentials
ao	AO Integration.	authorizationCode
ao:read	AO Integration.	clientCredentials
asset	Access and modify your assets	authorizationCode, clientCredentials
casebook	Casebook Full Access	authorizationCode, clientCredentials
casebook:read	Casebook Read Access	authorizationCode
casebook:write	Casebook Write Access	authorizationCode
cognitive	Cognitive Integration	authorizationCode, clientCredentials
enrich	Query your configured modules for threat intelligence	authorizationCode
enrich:read	Query your configured modules for threat intelligence	authorizationCode, clientCredentials
event	Read IROH Events	authorizationCode, clientCredentials
event:read	Get event information for an org. Needed to get full report information.	authorizationCode
feedback	Submit Customer Feedback	authorizationCode, clientCredentials
global-intel:read	Access AMP Global Intelligence	authorizationCode, clientCredentials
inspect	Extract Observables and data from text	authorizationCode
inspect:read	Extract Observables and data from text	clientCredentials
integration	Manage your modules	authorizationCode
integration:read	Manage your modules	authorizationCode, clientCredentials
investigation	Perform threat analysis investigation	authorizationCode, clientCredentials
invite	Invite users into your organization	authorizationCode
invite:read	Invite users into your organization	clientCredentials
notification	Receive notifications from integrations	authorizationCode, clientCredentials
oauth	Manage OAuth2 Clients	authorizationCode
oauth:read	Manage OAuth2 Clients	clientCredentials
orbital	Orbital Integration.	authorizationCode, clientCredentials
playbook	Access and modify your playbooks	clientCredentials
playbook:read	Get playbook state. Needed to get full report information.	authorizationCode
private-intel	Private Intelligence Full Access	authorizationCode
private-intel:read	Private Intelligence Read Access	authorizationCode, clientCredentials
private-intel:write	Private Intelligence Write Access	authorizationCode
profile	Get your profile information	authorizationCode
profile:read	Get your profile information	clientCredentials
registry	Manage registry entries	authorizationCode, clientCredentials
response	List and execute response actions using configured modules	authorizationCode
response:read	List and execute response actions using configured modules	clientCredentials
sse	SSE Integration. Manage your Devices.	authorizationCode, clientCredentials
telemetry	Collect application data for analytics	authorizationCode, clientCredentials
users	Manage users of your organisation	authorizationCode
users:read	Manage users of your organization	clientCredentials
vault	Grants access to Module Vaults	authorizationCode, clientCredentials
webhook	Manage your Webhooks	authorizationCode, clientCredentials

📄 Provider scope reference: https://visibility.amp.cisco.com/iroh/doc/iroh-auth/index.html#scopes

Source

OAuth Scopes

generated: '2026-08-19'
method: searched
source: openapi/cisco-xdr-actor-api-openapi.yml, openapi/cisco-xdr-asset-api-openapi.yml, openapi/cisco-xdr-asset-mapping-api-openapi.yml,
  openapi/cisco-xdr-asset-properties-api-openapi.yml, openapi/cisco-xdr-attack-pattern-api-openapi.yml, openapi/cisco-xdr-automation-openapi.json,
  openapi/cisco-xdr-bulk-api-openapi.yml, openapi/cisco-xdr-bundle-api-openapi.yml, openapi/cisco-xdr-campaign-api-openapi.yml,
  openapi/cisco-xdr-casebook-api-openapi.yml, openapi/cisco-xdr-coa-api-openapi.yml, openapi/cisco-xdr-deliberate-api-openapi.yml,
  openapi/cisco-xdr-event-api-openapi.yml, openapi/cisco-xdr-feed-api-openapi.yml, openapi/cisco-xdr-feedback-api-openapi.yml,
  openapi/cisco-xdr-graphql-api-openapi.yml, openapi/cisco-xdr-health-api-openapi.yml, openapi/cisco-xdr-incident-api-openapi.yml,
  openapi/cisco-xdr-incidents-investigations-openapi.json, openapi/cisco-xdr-indicator-api-openapi.yml, openapi/cisco-xdr-inspect-api-openapi.yml,
  openapi/cisco-xdr-investigation-api-openapi.yml, openapi/cisco-xdr-invite-api-openapi.yml, openapi/cisco-xdr-iroh-api-openapi.yml,
  openapi/cisco-xdr-judgement-api-openapi.yml, openapi/cisco-xdr-login-api-openapi.yml, openapi/cisco-xdr-malware-api-openapi.yml,
  openapi/cisco-xdr-metrics-api-openapi.yml, openapi/cisco-xdr-moduleinstance-api-openapi.yml, openapi/cisco-xdr-moduletype-api-openapi.yml,
  openapi/cisco-xdr-moduletypepatch-api-openapi.yml, openapi/cisco-xdr-note-api-openapi.yml, openapi/cisco-xdr-observe-api-openapi.yml,
  openapi/cisco-xdr-one-click-api-openapi.yml, openapi/cisco-xdr-private-intel-api-openapi.yml, openapi/cisco-xdr-properties-api-openapi.yml,
  openapi/cisco-xdr-query-api-openapi.yml, openapi/cisco-xdr-refer-api-openapi.yml, openapi/cisco-xdr-relationship-api-openapi.yml,
  openapi/cisco-xdr-reputation-api-openapi.yml, openapi/cisco-xdr-response-api-openapi.yml, openapi/cisco-xdr-session-cookie-api-openapi.yml,
  openapi/cisco-xdr-sighting-api-openapi.yml, openapi/cisco-xdr-status-api-openapi.yml, openapi/cisco-xdr-target-record-api-openapi.yml,
  openapi/cisco-xdr-tool-api-openapi.yml, openapi/cisco-xdr-verdict-api-openapi.yml, openapi/cisco-xdr-version-api-openapi.yml,
  openapi/cisco-xdr-vulnerability-api-openapi.yml, openapi/cisco-xdr-webhook-api-openapi.yml, openapi/cisco-xdr-webhookresult-api-openapi.yml
docs: https://visibility.amp.cisco.com/iroh/doc/iroh-auth/index.html#scopes
docs_alt:
- https://developer.cisco.com/docs/cisco-xdr/authentication/
- https://docs.xdr.security.cisco.com/Content/Administration/api-clients.htm
note: Three different views of the same authorization surface, and they do not agree. The specs declare 41 oauth2
  scopes. The RFC 8414 authorization-server metadata at visibility.amp.cisco.com/.well-known/oauth-authorization-server
  advertises 32. And the operation descriptions inside the IROH specs require 36 finer-grained scope strings that
  appear in NEITHER list - things like response/trigger:write, webhook/management:read and private-intel/incident:write.
  Those hierarchical scopes are what actually gates an operation, so they are captured separately below. An API
  Client created from the coarse list alone will get 403s.
authorization_server:
  issuer: IROH Auth
  authorization_endpoint: https://visibility.amp.cisco.com/iroh/oauth2/authorize
  token_endpoint: https://visibility.amp.cisco.com/iroh/oauth2/token
  device_authorization_endpoint: https://visibility.amp.cisco.com/iroh/oauth2/device_authorization
  refresh_endpoint: https://visibility.amp.cisco.com/iroh/oauth2/refresh
  jwks_uri: https://visibility.amp.cisco.com/.well-known/jwks
  grant_types_supported:
  - authorization_code
  - client_credential
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:ietf:params:oauth:grant-type:token-exchange
  code_challenge_methods_supported:
  - S256
  - plain
  scopes_supported:
  - forensics_analyst
  - insights
  - telemetry
  - security-events
  - integration
  - private-intel
  - base-telemetry
  - admin
  - cognitive
  - profile
  - inspect
  - asset
  - event
  - feedback
  - sse
  - forensics_admin
  - registry
  - users
  - investigation
  - invite
  - playbook
  - casebook
  - forensics_responder
  - detection
  - orbital
  - enrich
  - oauth
  - global-intel
  - response
  - notification
  - webhook
  - ao
schemes:
- name: oauth2
  source: openapi/cisco-xdr-actor-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-asset-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-asset-mapping-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-asset-properties-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-attack-pattern-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oAuth2
  source: openapi/cisco-xdr-automation-openapi.json
  flows:
  - flow: clientCredentials
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-bulk-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-bundle-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-campaign-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-casebook-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-coa-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-deliberate-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-event-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-feed-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-feedback-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-graphql-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-health-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-incident-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-incidents-investigations-openapi.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-indicator-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-inspect-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-investigation-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-invite-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-iroh-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-judgement-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-login-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-malware-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-metrics-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-moduleinstance-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-moduletype-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-moduletypepatch-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-note-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-observe-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-one-click-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-private-intel-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-properties-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-query-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-refer-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-relationship-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-reputation-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-response-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-session-cookie-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-sighting-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-status-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-target-record-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-tool-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-verdict-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-version-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-vulnerability-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-webhook-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
- name: oauth2
  source: openapi/cisco-xdr-webhookresult-api-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
    tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
scopes:
- scope: admin
  description: Provide admin privileges
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - openapi/cisco-xdr-automation-openapi.json
  - openapi/cisco-xdr-deliberate-api-openapi.yml
  - openapi/cisco-xdr-event-api-openapi.yml
  - openapi/cisco-xdr-feedback-api-openapi.yml
  - openapi/cisco-xdr-health-api-openapi.yml
  - openapi/cisco-xdr-inspect-api-openapi.yml
  - openapi/cisco-xdr-invite-api-openapi.yml
  - openapi/cisco-xdr-iroh-api-openapi.yml
  - openapi/cisco-xdr-login-api-openapi.yml
  - openapi/cisco-xdr-moduleinstance-api-openapi.yml
  - openapi/cisco-xdr-moduletype-api-openapi.yml
  - openapi/cisco-xdr-moduletypepatch-api-openapi.yml
  - openapi/cisco-xdr-observe-api-openapi.yml
  - openapi/cisco-xdr-one-click-api-openapi.yml
  - openapi/cisco-xdr-private-intel-api-openapi.yml
  - openapi/cisco-xdr-query-api-openapi.yml
  - openapi/cisco-xdr-refer-api-openapi.yml
  - openapi/cisco-xdr-reputation-api-openapi.yml
  - openapi/cisco-xdr-response-api-openapi.yml
  - openapi/cisco-xdr-session-cookie-api-openapi.yml
  - openapi/cisco-xdr-webhook-api-openapi.yml
  - openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: ao
  description: AO Integration.
  flows:
  - authorizationCode
  sources:
  - openapi/cisco-xdr-deliberate-api-openapi.yml
  - openapi/cisco-xdr-event-api-openapi.yml
  - openapi/cisco-xdr-feedback-api-openapi.yml
  - openapi/cisco-xdr-health-api-openapi.yml
  - openapi/cisco-xdr-incidents-investigations-openapi.json
  - openapi/cisco-xdr-inspect-api-openapi.yml
  - openapi/cisco-xdr-invite-api-openapi.yml
  - openapi/cisco-xdr-iroh-api-openapi.yml
  - openapi/cisco-xdr-login-api-openapi.yml
  - openapi/cisco-xdr-moduleinstance-api-openapi.yml
  - openapi/cisco-xdr-moduletype-api-openapi.yml
  - openapi/cisco-xdr-moduletypepatch-api-openapi.yml
  - openapi/cisco-xdr-observe-api-openapi.yml
  - openapi/cisco-xdr-one-click-api-openapi.yml
  - openapi/cisco-xdr-private-intel-api-openapi.yml
  - openapi/cisco-xdr-query-api-openapi.yml
  - openapi/cisco-xdr-refer-api-openapi.yml
  - openapi/cisco-xdr-reputation-api-openapi.yml
  - openapi/cisco-xdr-response-api-openapi.yml
  - openapi/cisco-xdr-session-cookie-api-openapi.yml
  - openapi/cisco-xdr-webhook-api-openapi.yml
  - openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: ao:read
  description: AO Integration.
  flows:
  - clientCredentials
  sources:
  - openapi/cisco-xdr-automation-openapi.json
- scope: asset
  description: Access and modify your assets
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - openapi/cisco-xdr-automation-openapi.json
  - openapi/cisco-xdr-deliberate-api-openapi.yml
  - openapi/cisco-xdr-event-api-openapi.yml
  - openapi/cisco-xdr-feedback-api-openapi.yml
  - openapi/cisco-xdr-health-api-openapi.yml
  - openapi/cisco-xdr-incidents-investigations-openapi.json
  - openapi/cisco-xdr-inspect-api-openapi.yml
  - openapi/cisco-xdr-invite-api-openapi.yml
  - openapi/cisco-xdr-iroh-api-openapi.yml
  - openapi/cisco-xdr-login-api-openapi.yml
  - openapi/cisco-xdr-moduleinstance-api-openapi.yml
  - openapi/cisco-xdr-moduletype-api-openapi.yml
  - openapi/cisco-xdr-moduletypepatch-api-openapi.yml
  - openapi/cisco-xdr-observe-api-openapi.yml
  - openapi/cisco-xdr-one-click-api-openapi.yml
  - openapi/cisco-xdr-private-intel-api-openapi.yml
  - openapi/cisco-xdr-query-api-openapi.yml
  - openapi/cisco-xdr-refer-api-openapi.yml
  - openapi/cisco-xdr-reputation-api-openapi.yml
  - openapi/cisco-xdr-response-api-openapi.yml
  - openapi/cisco-xdr-session-cookie-api-openapi.yml
  - openapi/cisco-xdr-webhook-api-openapi.yml
  - openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: casebook
  description: Casebook Full Access
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - openapi/cisco-xdr-actor-api-openapi.yml
  - openapi/cisco-xdr-asset-api-openapi.yml
  - openapi/cisco-xdr-asset-mapping-api-openapi.yml
  - openapi/cisco-xdr-asset-properties-api-openapi.yml
  - openapi/cisco-xdr-attack-pattern-api-openapi.yml
  - openapi/cisco-xdr-automation-openapi.json
  - openapi/cisco-xdr-bulk-api-openapi.yml
  - openapi/cisco-xdr-bundle-api-openapi.yml
  - openapi/cisco-xdr-campaign-api-openapi.yml
  - openapi/cisco-xdr-casebook-api-openapi.yml
  - openapi/cisco-xdr-coa-api-openapi.yml
  - openapi/cisco-xdr-deliberate-api-openapi.yml
  - openapi/cisco-xdr-event-api-openapi.yml
  - openapi/cisco-xdr-feed-api-openapi.yml
  - openapi/cisco-xdr-feedback-api-openapi.yml
  - openapi/cisco-xdr-graphql-api-openapi.yml
  - openapi/cisco-xdr-health-api-openapi.yml
  - openapi/cisco-xdr-incident-api-openapi.yml
  - openapi/cisco-xdr-incidents-investigations-openapi.json
  - openapi/cisco-xdr-indicator-api-openapi.yml
  - openapi/cisco-xdr-inspect-api-openapi.yml
  - openapi/cisco-xdr-investigation-api-openapi.yml
  - openapi/cisco-xdr-invite-api-openapi.yml
  - openapi/cisco-xdr-iroh-api-openapi.yml
  - openapi/cisco-xdr-judgement-api-openapi.yml
  - openapi/cisco-xdr-login-api-openapi.yml
  - openapi/cisco-xdr-malware-api-openapi.yml
  - openapi/cisco-xdr-metrics-api-openapi.yml
  - openapi/cisco-xdr-moduleinstance-api-openapi.yml
  - openapi/cisco-xdr-moduletype-api-openapi.yml
  - openapi/cisco-xdr-moduletypepatch-api-openapi.yml
  - openapi/cisco-xdr-note-api-openapi.yml
  - openapi/cisco-xdr-observe-api-openapi.yml
  - openapi/cisco-xdr-one-click-api-openapi.yml
  - openapi/cisco-xdr-private-intel-api-openapi.yml
  - openapi/cisco-xdr-properties-api-openapi.yml
  - openapi/cisco-xdr-query-api-openapi.yml
  - openapi/cisco-xdr-refer-api-openapi.yml
  - openapi/cisco-xdr-relationship-api-openapi.yml
  - openapi/cisco-xdr-reputation-api-openapi.yml
  - openapi/cisco-xdr-response-api-openapi.yml
  - openapi/cisco-xdr-session-cookie-api-openapi.yml
  - openapi/cisco-xdr-sighting-api-openapi.yml
  - openapi/cisco-xdr-status-api-openapi.yml
  - openapi/cisco-xdr-target-record-api-openapi.yml
  - openapi/cisco-xdr-tool-api-openapi.yml
  - openapi/cisco-xdr-verdict-api-openapi.yml
  - openapi/cisco-xdr-version-api-openapi.yml
  - openapi/cisco-xdr-vulnerability-api-openapi.yml
  - openapi/cisco-xdr-webhook-api-openapi.yml
  - openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: casebook:read
  description: Casebook Read Access
  flows:
  - authorizationCode
  sources:
  - openapi/cisco-xdr-actor-api-openapi.yml
  - openapi/cisco-xdr-asset-api-openapi.yml
  - openapi/cisco-xdr-asset-mapping-api-openapi.yml
  - openapi/cisco-xdr-asset-properties-api-openapi.yml
  - openapi/cisco-xdr-attack-pattern-api-openapi.yml
  - openapi/cisco-xdr-bulk-api-openapi.yml
  - openapi/cisco-xdr-bundle-api-openapi.yml
  - openapi/cisco-xdr-campaign-api-openapi.yml
  - openapi/cisco-xdr-casebook-api-openapi.yml
  - openapi/cisco-xdr-coa-api-openapi.yml
  - openapi/cisco-xdr-event-api-openapi.yml
  - openapi/cisco-xdr-feed-api-openapi.yml
  - openapi/cisco-xdr-graphql-api-openapi.yml
  - openapi/cisco-xdr-incident-api-openapi.yml
  - openapi/cisco-xdr-incidents-investigations-openapi.json
  - openapi/cisco-xdr-indicator-api-openapi.yml
  - openapi/cisco-xdr-investigation-api-openapi.yml
  - openapi/cisco-xdr-judgement-api-openapi.yml
  - openapi/cisco-xdr-malware-api-openapi.yml
  - openapi/cisco-xdr-metrics-api-openapi.yml
  - openapi/cisco-xdr-note-api-openapi.yml
  - openapi/cisco-xdr-properties-api-openapi.yml
  - openapi/cisco-xdr-relationship-api-openapi.yml
  - openapi/cisco-xdr-sighting-api-openapi.yml
  - openapi/cisco-xdr-status-api-openapi.yml
  - openapi/cisco-xdr-target-record-api-openapi.yml
  - openapi/cisco-xdr-tool-api-openapi.yml
  - openapi/cisco-xdr-verdict-api-openapi.yml
  - openapi/cisco-xdr-version-api-openapi.yml
  - openapi/cisco-xdr-vulnerability-api-openapi.yml
- scope: casebook:write
  description: Casebook Write Access
  flows:
  - authorizationCode
  sources:
  - openapi/cisco-xdr-actor-api-openapi.yml
  - openapi/cisco-xdr-asset-api-openapi.yml
  - openapi/cisco-xdr-asset-mapping-api-openapi.yml
  - openapi/cisco-xdr-asset-properties-api-openapi.yml
  - openapi/cisco-xdr-attack-pattern-api-openapi.yml
  - openapi/cisco-xdr-bulk-api-openapi.yml
  - openapi/cisco-xdr-bundle-api-openapi.yml
  - openapi/cisco-xdr-campaign-api-openapi.yml
  - openapi/cisco-xdr-casebook-api-openapi.yml
  - openapi/cisco-xdr-coa-api-openapi.yml
  - openapi/cisco-xdr-event-api-openapi.yml
  - openapi/cisco-xdr-feed-api-openapi.yml
  - openapi/cisco-xdr-graphql-api-openapi.yml
  - openapi/cisco-xdr-incident-api-openapi.yml
  - openapi/cisco-xdr-indicator-api-openapi.yml
  - openapi/cisco-xdr-investigation-api-openapi.yml
  - openapi/cisco-xdr-judgement-api-openapi.yml
  - openapi/cisco-xdr-malware-api-openapi.yml
  - openapi/cisco-xdr-metrics-api-openapi.yml
  - openapi/cisco-xdr-note-api-openapi.yml
  - openapi/cisco-xdr-properties-api-openapi.yml
  - openapi/cisco-xdr-relationship-api-openapi.yml
  - openapi/cisco-xdr-sighting-api-openapi.yml
  - openapi/cisco-xdr-status-api-openapi.yml
  - openapi/cisco-xdr-target-record-api-openapi.yml
  - openapi/cisco-xdr-tool-api-openapi.yml
  - openapi/cisco-xdr-verdict-api-openapi.yml
  - openapi/cisco-xdr-version-api-openapi.yml
  - openapi/cisco-xdr-vulnerability-api-openapi.yml
- scope: cognitive
  description: Cognitive Integration
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - openapi/cisco-xdr-automation-openapi.json
  - openapi/cisco-xdr-deliberate-api-openapi.yml
  - openapi/cisco-xdr-event-api-openapi.yml
  - openapi/cisco-xdr-feedback-api-openapi.yml
  - openapi/cisco-xdr-health-api-openapi.yml
  - openapi/cisco-xdr-inspect-api-openapi.yml
  - openapi/cisco-xdr-invite-api-openapi.yml
  - openapi/cisco-xdr-iroh-api-openapi.yml
  - openapi/cisco-xdr-login-api-openapi.yml
  - openapi/cisco-xdr-moduleinstance-api-openapi.yml
  - openapi/cisco-xdr-moduletype-api-openapi.yml
  - openapi/cisco-xdr-moduletypepatch-api-openapi.yml
  - openapi/cisco-xdr-observe-api-openapi.yml
  - openapi/cisco-xdr-one-click-api-openapi.yml
  - openapi/cisco-xdr-private-intel-api-openapi.yml
  - openapi/cisco-xdr-query-api-openapi.yml
  - openapi/cisco-xdr-refer-api-openapi.yml
  - openapi/cisco-xdr-reputation-api-openapi.yml
  - openapi/cisco-xdr-response-api-openapi.yml
  - openapi/cisco-xdr-session-cookie-api-openapi.yml
  - openapi/cisco-xdr-webhook-api-openapi.yml
  - openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: enrich
  description: Query your configured modules for threat intelligence
  flows:
  - authorizationCode
  sources:
  - openapi/cisco-xdr-deliberate-api-openapi.yml
  - openapi/cisco-xdr-event-api-openapi.yml
  - openapi/cisco-xdr-feedback-api-openapi.yml
  - openapi/cisco-xdr-health-api-openapi.yml
  - openapi/cisco-xdr-inspect-api-openapi.yml
  - openapi/cisco-xdr-invite-api-openapi.yml
  - openapi/cisco-xdr-iroh-api-openapi.yml
  - openapi/cisco-xdr-login-api-openapi.yml
  - openapi/cisco-xdr-moduleinstance-api-openapi.yml
  - openapi/cisco-xdr-moduletype-api-openapi.yml
  - openapi/cisco-xdr-moduletypepatch-api-openapi.yml
  - openapi/cisco-xdr-observe-api-openapi.yml
  - openapi/cisco-xdr-one-click-api-openapi.yml
  - openapi/cisco-xdr-private-intel-api-openapi.yml
  - openapi/cisco-xdr-query-api-openapi.yml
  - openapi/cisco-xdr-refer-api-openapi.yml
  - openapi/cisco-xdr-reputation-api-openapi.yml
  - openapi/cisco-xdr-response-api-openapi.yml
  - openapi/cisco-xdr-session-cookie-api-openapi.yml
  - openapi/cisco-xdr-webhook-api-openapi.yml
  - openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: enrich:read
  description: Query your configured modules for threat intelligence
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - openapi/cisco-xdr-automation-openapi.json
  - openapi/cisco-xdr-incidents-investigations-openapi.json
- scope: event
  description: Read IROH Events
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - openapi/cisco-xdr-automation-openapi.json
  - openapi/cisco-xdr-deliberate-api-openapi.yml
  - openapi/cisco-xdr-event-api-openapi.yml
  - openapi/cisco-xdr-feedback-api-openapi.yml
  - openapi/cisco-xdr-health-api-openapi.yml
  - openapi/cisco-xdr-inspect-api-openapi.yml
  - openapi/cisco-xdr-invite-api-openapi.yml
  - openapi/cisco-xdr-iroh-api-openapi.yml
  - openapi/cisco-xdr-login-api-openapi.yml
  - openapi/cisco-xdr-moduleinstance-api-openapi.yml
  - openapi/cisco-xdr-moduletype-api-openapi.yml
  - openapi/cisco-xdr-moduletypepatch-api-openapi.yml
  - openapi/cisco-xdr-observe-api-openapi.yml
  - openapi/cisco-xdr-one-click-api-openapi.yml
  - openapi/cisco-xdr-private-intel-api-openapi.yml
  - openapi/cisco-xdr-query-api-openapi.yml
  - openapi/cisco-xdr-refer-api-openapi.yml
  - openapi/cisco-xdr-reputation-api-openapi.yml
  - openapi/cisco-xdr-response-api-openapi.yml
  - openapi/cisco-xdr-session-cookie-api-openapi.yml
  - openapi/cisco-xdr-webhook-api-openapi.yml
  - openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: event:read
  description: Get event information for an org. Needed to get full report information.
  flows:
  - authorizationCode
  sources:
  - openapi/cisco-xdr-incidents-investigations-openapi.json
- scope: feedback
  description: Submit Customer Feedback
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - openapi/cisco-xdr-automation-openapi.json
  - openapi/cisco-xdr-deliberate-api-openapi.yml
  - openapi/cisco-xdr-event-api-openapi.yml
  - openapi/cisco-xdr-feedback-api-openapi.yml
  - openapi/cisco-xdr-health-api-openapi.yml
  - openapi/cisco-xdr-inspect-api-openapi.yml
  - openapi/cisco-xdr-invite-api-openapi.yml
  - openapi/cisco-xdr-iroh-api-openapi.yml
  - openapi/cisco-xdr-login-api-openapi.yml
  - openapi/cisco-xdr-moduleinstance-api-openapi.yml
  - openapi/cisco-xdr-moduletype-api-openapi.yml
  - openapi/cisco-xdr-moduletypepatch-api-openapi.yml
  - openapi/cisco-xdr-observe-api-openapi.yml
  - openapi/cisco-xdr-one-click-api-openapi.yml
  - openapi/cisco-xdr-private-intel-api-openapi.yml
  - openapi/cisco-xdr-query-api-openapi.yml
  - openapi/cisco-xdr-refer-api-openapi.yml
  - openapi/cisco-xdr-reputation-api-openapi.yml
  - openapi/cisco-xdr-response-api-openapi.yml
  - openapi/cisco-xdr-session-cookie-api-openapi.yml
  - openapi/cisco-xdr-webhook-api-openapi.yml
  - openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: global-intel:read
  description: Access AMP Global Intelligence
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - openapi/cisco-xdr-automation-openapi.json
  - openapi/cisco-xdr-deliberate-api-openapi.yml
  - openapi/cisco-xdr-event-api-openapi.yml
  - openapi/cisco-xdr-feedback-api-openapi.yml
  - openapi/cisco-xdr-health-api-openapi.yml
  - openapi/cisco-xdr-incidents-investigations-openapi.json
  - openapi/cisco-xdr-inspect-api-openapi.yml
  - openapi/cisco-xdr-invite-api-openapi.yml
  - openapi/cisco-xdr-iroh-api-openapi.yml
  - openapi/cisco-xdr-login-api-openapi.yml
  - openapi/cisco-xdr-moduleinstance-api-openapi.yml
  - openapi/cisco-xdr-moduletype-api-openapi.yml
  - openapi/cisco-xdr-moduletypepatch-api-openapi.yml
  - openapi/cisco-xdr-observe-api-openapi.yml
  - openapi/cisco-xdr-one-click-api-openapi.yml
  - openapi/cisco-xdr-private-intel-api-openapi.yml
  - openapi/cisco-xdr-query-api-openapi.yml
  - openapi/cisco-xdr-refer-api-openapi.yml
  - openapi/cisco-xdr-reputation-api-openapi.yml
  - openapi/cisco-xdr-response-api-openapi.yml
  - openapi/cisco-xdr-session-cookie-api-openapi.yml
  - openapi/cisco-xdr-webhook-api-openapi.yml
  - openapi/cisco-xdr-webhookresult-api-openapi.yml
- scope: inspect
  description: Extract Observables and data from text
  flows:
  - authorizationCode
  sources:
  - openapi/cisco-xdr-deliberate-api-openapi.yml
  - openapi/cisco-xdr-event-api-openapi.yml
  - openapi/cisco-xdr-feedback-api-openapi.yml
  - openapi/cisco-xdr-health-api-openapi.yml
  - openapi/cisc

# --- truncated at 32 KB (58 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-xdr/refs/heads/main/scopes/cisco-xdr-scopes.yml